How to Protect Yourself on Public WiFi Networks

Once a luxury item, free public WiFi has morphed into a standard service that consumers expect when patronizing everything from restaurants and retail stores to airports and hotels. Free WiFi users aren’t just checking Facebook or posting vacation photos to Instagram, either; all of us have sat down on a train or in a coffee shop and seen business people tapping away on their laptops, taking advantage of public WiFi to work on the go.

However, public WiFi networks open users up to numerous cyber attacks, especially if the network is unsecured. These include:

• Phony rogue networks set up specifically by cyber criminals. These networks often have innocent-sounding names such as “Customer Public WiFi” and are unsecured.
• Man-in-the-middle attacks where hackers commandeer a public WiFi network and redirect users, often to a phony login site where their credentials are stolen.
• Wireless sniffer tools that locate unsecured public WiFi networks, analyze their packets, and steal data, monitor network activity, or gather intel for use in a future attack against the enterprise’s network.
• Having your device infected by a worm on another user’s device that travels through the public WiFi network.

Hacking public WiFi networks is so easy and lucrative that cyber criminals step up their game during major events where they know large crowds will gather and connect to public networks. In February, US-CERT issued a press release warning travelers about expected cyber attacks at the 2018 Olympic Games in Pyeongchang.

Staying Safe on Public WiFi

The best way to prevent an attack on a public WiFi network is to never connect to one in the first place, even if it is “secured.” The WPA/WPA2 WiFi standard currently in use has multiple security flaws, and the new, far more secure WPA3 won’t start rolling out until later this year, when devices supporting it are scheduled to be released. Instead of using a public WiFi network, tether your laptop to your mobile phone or use one of your mobile carrier’s hotspots. If you travel a lot, it may be worth investing in an unlimited mobile data plan.

What if using mobile tethering or hotspot is not an option, your work just won’t wait, and public WiFi is the only realistic option? Protect yourself using these best practices:

Use a Virtual Private Network (VPN)

VPNs allow users to connect to servers through secure connections. While many free or ultra-low-cost VPN services are available, they may not be trustworthy; it’s better to pay for the peace of mind. Employers should provide their employees with VPN access to protect their company’s data when their employees are working in the field.

Use Secure Connections

Configure your browser to default to the “always use HTTPS” option on websites you use frequently, especially those that require login credentials.

Don’t Access Anything Sensitive

Do not check your bank account or credit cards, go shopping, or access any other sites that would expose sensitive personal information.

Turn Off Automatic Connectivity

Change the settings on your devices so that they do not automatically connect when they sense an open WiFi network; you could end up connected to a phony rogue network.

Even if you’re not stuck using a public WiFi network, never leave your electronic devices unattended while in a public place, and make sure to turn off Bluetooth and file sharing capabilities. It is highly unlikely you’ll need to use them; all they’ll do is open you up to an attack.

The cyber security experts at Continuum GRC have deep knowledge of the cyber security field, are continually monitoring the latest information security threats, and are committed to protecting your organization from security breaches. Continuum GRC offers full-service and in-house risk assessment and risk management subscriptions, and we help companies all around the world sustain proactive cyber security programs.

Continuum GRC is proactive cyber security®. Call 1-888-896-6207 to discuss your organization’s cyber security needs and find out how we can help your organization protect its systems and ensure compliance.

Passwords are no longer enough; your business needs multi-factor authentication

 Organizations can no longer depend on passwords alone to protect their systems and data, especially since 25% of employees admit to using the same password for all of their accounts, at home and at work, and stolen account credentials are hackers’ preferred way to break into enterprise systems. Passwords, even strong ones, are no longer enough to ensure enterprise cyber security. This is why cyber security experts urge both enterprises and individuals to employ multi-factor authentication (MFA) whenever possible.

Despite the growing consensus as to the importance of multi-factor authentication, 61% of small and medium-sized businesses think that MFA is only for large businesses. SMBs often cite the affordability of MFA as a major stumbling block. Yet with the average cost of a data breach at $3.86 million and rising, no business, large or small, can afford not to use multi-factor authentication.

What Is Multi-Factor Authentication?

Multi-factor authentication is a security protocol that requires users to use more than one authentication mechanism (known as “authentication factors”) to verify their identity at login. The three basic authentication factors used in MFA are:

• Something the user knows, such as a password, pass phrase, or PIN.
• Something the user has; this can be a physical or logical security token, including a one-time password (OTP) token, a key fob, an employee access card, or a phone’s SIM card.
• Something the user is; this refers to biometric identification such as retina scans, fingerprints, or voice authentication.

A multi-factor authentication protocol includes at least two of these factors. For example, ATMs employ MFA because users must swipe their ATM card, then enter a PIN. The user’s location and the time of the login are sometimes included in the authentication process, but these are used in addition to, not in place of, at least two of the knows/has/is factors.

It is important that multi-factor authentication factors be independent of each other. Access to one factor should not be a gateway to any other, and the compromise of one factor should not compromise the integrity or security of any other. Using our ATM example, if your ATM card goes missing, it is useless without your PIN; conversely, a PIN number is worthless without an ATM card.

Additionally, multi-factor authentication factors themselves must be protected. Passwords, PINs, pass phrases, etc. should be difficult to guess, and users should not share them. Physical security tokens and other “have” data should not be shared and should be protected against duplication or theft. Even biometrics must be protected against replication. All factors must be protected against misuse by negligent or malicious insiders.

Benefits of Multi-Factor Authentication

Some organizations are hesitant to use multi-factor authentication because they fear it will complicate the login process, confusing their employees and slowing down workflow. However, because MFA hardens cyber security, it enables enterprises to safely use advanced login options such as single sign-on.

Depending on what compliance standards your organization is subject to, you may not have a choice but to use multi-factor authentication. PCI DSS, DFARS, NIST 800-171, and other compliance standards mandate the use of MFA. Even when a standard does not specifically require it, MFA is still a good idea. Compliance standards are continually evolving as technology and the threat environment evolve, and with the tide turning against passwords and towards multi-factor authentication, it is likely that more standards will ultimately require it. Additionally, compliance should be about ensuring the security and integrity of your systems and data, not just doing the minimum to get by.

The cyber security experts at Continuum GRC have deep knowledge of the cyber security field, are continually monitoring the latest information security threats, and are committed to protecting your organization from security breaches. Continuum GRC offers full-service and in-house risk assessment and risk management subscriptions, and we help companies all around the world sustain proactive cyber security programs.

Continuum GRC is proactive cyber security®. Call 1-888-896-6207 to discuss your organization’s cyber security needs and find out how we can help your organization protect its systems and ensure compliance.

Business email compromise scams have been reported in all 50 states and in 150 countries

Global losses from business email compromise scams, a highly sophisticated form of phishing, grew by 136% between December 2016 and May 2018 and now exceed $12 billion, according to a public service announcement released by the FBI.

What Is a Business Email Compromise Scam?

A business email compromise (BEC) – also known as an email account compromise (EAC) or “CEO fraud” – is a form of spear phishing that primarily targets businesses or individuals who perform wire transfer payments. Some BEC variations seek employee tax data or other personal identifying information, such as a very large business email compromise scheme that targeted HR and payroll professionals in 2016.

Business email compromise schemes are far more sophisticated than regular phishing due to their highly targeted nature and the reconnaissance involved. BEC scammers don’t blindly send out emails; they do their homework, scouring company websites and social media profiles to gather information on specific targets.

A business email compromise scam generally unfolds as follows:

1. A victim receives an email that appears to be from a high-level company executive, company attorney, or business partner. However, the email address has been spoofed – or the sender got hold of a high-ranking user’s email login credentials, usually through a separate phishing scheme.
2. The email includes an urgent request for a wire transfer or, alternatively, employee payroll information or other personal data. The victim is implored to act immediately; for example, an email may claim that the money is for a seriously past-due invoice.
3. The email may even be followed by a phone call to further bolster legitimacy.
4. Thinking the request is legitimate, the victim sends the wire transfer/information.

While business email compromise scams can hit any industry sector, the FBI reports that the real estate industry, including real estate agents, title companies, law firms, and even buyers and sellers, has been heavily targeted in recent years. From 2015 to 2017, the real estate industry saw a 1,100% rise in the number of reported BEC incidents and a 2,200% increase in BEC losses. These BEC scams are a bit different than the scenario described above in that they don’t involve fraudulent requests for payment and instead seek to redirect legitimately owed funds to fraudulent accounts. The FBI elaborates:

Victims most often report a spoofed e-mail being sent or received on behalf of one of these real estate transaction participants with instructions directing the recipient to change the payment type and/or payment location to a fraudulent account. The funds are usually directed to a fraudulent domestic account which quickly disperse through cash or check withdrawals. The funds may also be transferred to a secondary fraudulent domestic or international account. Funds sent to domestic accounts are often depleted rapidly making recovery difficult.

Defending Against Business Email Compromise

Employees must be trained on how to spot BEC and other phishing scams. Additionally, because business email compromise scammers perform reconnaissance on company websites and social media networks prior to launching attacks, both company executives and rank-and-file employees must be taught about the dangers of sharing personal information on social media sites.

Because many business email compromise scams in the real estate industry involve fraudulent phone calls in addition to emails, the FBI suggests that parties to real estate transactions establish “code phrases” to verify callers’ identity.

Technical defenses against BEC schemes include:

• Secure company email systems with multi-factor authentication and the DMARC email security protocol.
• Require that all employees use official company email addresses – not free, web-based email clients – for official company business.
• In most cases, businesses probably shouldn’t use a private email server, as they are very difficult and time-consuming to secure.

However, the best defense is to bake redundancy into sensitive operational procedures such as releasing wire transfers or employee tax data or changing payment type or location; mandate that all such requests be verified and authorized by more than one person.

The cyber security experts at Continuum GRC have deep knowledge of the cyber security field, are continually monitoring the latest information security threats, and are committed to protecting your organization from security breaches. Continuum GRC offers full-service and in-house risk assessment and risk management subscriptions, and we help companies all around the world sustain proactive cyber security programs.

Continuum GRC is proactive cyber security®. Call 1-888-896-6207 to discuss your organization’s cyber security needs and find out how we can help your organization protect its systems and ensure compliance.