An SOC 2 Type 2 report is crucial when selecting a cloud service vendor

We are living in a cloud-first world; cloud services, including storage services and SaaS providers, are wildly popular. Unfortunately, third-party vendor breaches are at epidemic levels, and new regulations such as the EU GDPR are seeking to hold organizations accountable if third-party business associates that store or handle their sensitive data, including their cloud vendors, are hacked. One way for businesses to protect themselves is to look for an SOC 2 Type 2 report when evaluating cloud vendors.

While cloud vendors are embracing the SOC 2 Type 2 to demonstrate their commitment to data integrity and security, many client organizations are still unfamiliar with this important audit standard.

What is an SOC 2 Report?

The SOC 2 is part of the American Institute of Certified Public Accountants (AICPA) SOC reporting framework and utilizes the AT-101 professional standard. Unlike the SOC 1, which focuses on financial reporting controls, the SOC 2 documents service organizations’ non-financial reporting controls. It was specifically designed for to address the needs of service organizations that store customer data in the cloud, including SaaS providers.

SOC 2 attestations are based on AICPA’s Trust Service Principles of Security, Availability, Processing Integrity, Confidentiality, and Privacy. Reporting organizations are not required to address each one of the Trust Service Principles; SOC 2 reports can be limited to the principles that are relevant to the services being provided. AICPA’s principles of Security attest that the organization protects information and systems against unauthorized access, information disclosure, and damage; and Privacy, which attests that the service organization collects, uses, retains, discloses, and disposes of personal information properly.

Type 1 vs. Type 2

There are two types of SOC 2 reports, Type 1 and Type 2. When evaluating a cloud vendor, always look for a Type 2. While a Type 1 audit provides a snapshot of an organization’s controls at a point in time, a Type 2 audit examines them over a specified period. The Type 1 is, thus, only preliminary to the Type 2. An SOC 2 Type 1 demonstrates that the provider has controls in place but has not yet audited them. A Type 2 demonstrates that they have tested the controls over a period of time and proven that they work.

SOC 2 Type 2 reports benefit both cloud vendors and their clients. Client organizations can rest assured knowing that their cloud vendors’ controls meet the highest standards of data governance and security. Cloud vendors are able to differentiate themselves in a crowded marketplace and enjoy their own peace of mind, knowing that they have proactive data governance and cyber security controls in place to protect their systems and their clients’ data.

While SOC 2 audits are time-consuming and rigorous, GRC automation technologies such as Continuum GRC’s IT Audit Machine (ITAM) can make the process take far less time and go far more smoothly.

The cyber security experts at Continuum GRC have deep knowledge of the cyber security field, are continually monitoring the latest information security threats, and are committed to protecting your organization from security breaches. Continuum GRC offers full-service and in-house risk assessment and risk management subscriptions, and we help companies all around the world sustain proactive cyber security programs.

Continuum GRC is proactive cyber security®. Call 1-888-896-6207 to discuss your organization’s cyber security needs and find out how we can help your organization protect its systems and ensure compliance.

The biggest social media cyber security risks businesses face and how to avoid them

Businesses tend to gloss over social media cyber security, thinking that it’s more of an issue in their employees’ personal lives than a threat to workplace cyber security. However, one in eight enterprises have suffered a security breach that was traced back to a cyber attack on social media.

Here are the top social media cyber security threats to organizations and how to avoid them.

Social Media Cyber Security Threats to Enterprises

Human Error & Other Insider Threats

Company insiders are arguably the biggest social media cyber security threat, representing everything from posting inappropriate content (accidentally or purposefully) to sharing passwords to clicking on a phishing link posted by a follower or “friend.”

Unattended Accounts

It’s a good idea to reserve your brand’s name on all major social media channels, even if you don’t plan to use all of them, so that competitors and detractors do not get their hands on them. It’s not a good idea to leave these accounts completely unattended. Hackers often look to break into “zombie” corporate accounts that no one is monitoring, then use them to spread malware, launch social engineering schemes, or even post defamatory information about the company.

Uncontrolled User Access

Some organizations hand out their social media credentials like they’re candy, not only to multiple employees but also interns, temps, and third-party social media vendors.

Imposter Accounts

This is when hackers set up phony social accounts with handles that closely match your organization’s name, sometimes even using your graphics and copying your recent posts to make the account look genuine.  Although imposter accounts are sometimes seen as a reputation management problem, not a social media security issue, these accounts then follow/friend your customers or even your employees and engage in social engineering, sending them messages requesting login credentials and other sensitive information.

Vulnerabilities in Connected Apps

Many companies connect their social accounts with third-party apps, such as analytics apps. While these apps are useful or even necessary, they are not without cyber security risks. In 2017, hackers got into the Twitter accounts of numerous prominent organizations, including Forbes and Amnesty International, using a flaw in the popular Twitter Counter app.

Social Media Cyber Security Best Practices for Enterprises

There are numerous proactive steps your company can take to protect against social media cyber security threats:

• Establish a social media policy that includes social media cyber security protocols. Perform periodic audits of your policy to ensure it keeps up with the latest changes and threats.
• Strictly limit social media access. Avoid giving access to interns and other temporary staff. Don’t allow any employee to access your social media until they have been trained on social media cyber security.
• Use social media management platforms, such as Hootsuite or Buffer, that allow you to grant employees posting access without handing over actual account login credentials. These programs also allow you to set up a system of approvals for social media posts.
• Immediately suspend the login credentials of any staff members who leave the company or any vendors you are no longer using.
• Prohibit employees or vendors from connecting your social media accounts to any third-party apps until they have been vetted by your security and governance team.
• Monitor all of your company’s social media accounts, including placeholder accounts that you are not using.
• Engage in “social listening” and monitor social media networks for imposter accounts, negative content about your brand, and other actionable items.
• Be careful about who your company accounts “follow back.” Following everyone who follows you may seem harmless, but once you follow an account back, it can start sending you private messages, which may contain phishing links.

The cyber security experts at Continuum GRC have deep knowledge of the cyber security field, are continually monitoring the latest information security threats, and are committed to protecting your organization from security breaches. Continuum GRC offers full-service and in-house risk assessment and risk management subscriptions, and we help companies all around the world sustain proactive cyber security programs.

Continuum GRC is proactive cyber security®. Call 1-888-896-6207 to discuss your organization’s cyber security needs and find out how we can help your organization protect its systems and ensure compliance.

How to Protect Yourself on Public WiFi Networks

Once a luxury item, free public WiFi has morphed into a standard service that consumers expect when patronizing everything from restaurants and retail stores to airports and hotels. Free WiFi users aren’t just checking Facebook or posting vacation photos to Instagram, either; all of us have sat down on a train or in a coffee shop and seen business people tapping away on their laptops, taking advantage of public WiFi to work on the go.

However, public WiFi networks open users up to numerous cyber attacks, especially if the network is unsecured. These include:

• Phony rogue networks set up specifically by cyber criminals. These networks often have innocent-sounding names such as “Customer Public WiFi” and are unsecured.
• Man-in-the-middle attacks where hackers commandeer a public WiFi network and redirect users, often to a phony login site where their credentials are stolen.
• Wireless sniffer tools that locate unsecured public WiFi networks, analyze their packets, and steal data, monitor network activity, or gather intel for use in a future attack against the enterprise’s network.
• Having your device infected by a worm on another user’s device that travels through the public WiFi network.

Hacking public WiFi networks is so easy and lucrative that cyber criminals step up their game during major events where they know large crowds will gather and connect to public networks. In February, US-CERT issued a press release warning travelers about expected cyber attacks at the 2018 Olympic Games in Pyeongchang.

Staying Safe on Public WiFi

The best way to prevent an attack on a public WiFi network is to never connect to one in the first place, even if it is “secured.” The WPA/WPA2 WiFi standard currently in use has multiple security flaws, and the new, far more secure WPA3 won’t start rolling out until later this year, when devices supporting it are scheduled to be released. Instead of using a public WiFi network, tether your laptop to your mobile phone or use one of your mobile carrier’s hotspots. If you travel a lot, it may be worth investing in an unlimited mobile data plan.

What if using mobile tethering or hotspot is not an option, your work just won’t wait, and public WiFi is the only realistic option? Protect yourself using these best practices:

Use a Virtual Private Network (VPN)

VPNs allow users to connect to servers through secure connections. While many free or ultra-low-cost VPN services are available, they may not be trustworthy; it’s better to pay for the peace of mind. Employers should provide their employees with VPN access to protect their company’s data when their employees are working in the field.

Use Secure Connections

Configure your browser to default to the “always use HTTPS” option on websites you use frequently, especially those that require login credentials.

Don’t Access Anything Sensitive

Do not check your bank account or credit cards, go shopping, or access any other sites that would expose sensitive personal information.

Turn Off Automatic Connectivity

Change the settings on your devices so that they do not automatically connect when they sense an open WiFi network; you could end up connected to a phony rogue network.

Even if you’re not stuck using a public WiFi network, never leave your electronic devices unattended while in a public place, and make sure to turn off Bluetooth and file sharing capabilities. It is highly unlikely you’ll need to use them; all they’ll do is open you up to an attack.

The cyber security experts at Continuum GRC have deep knowledge of the cyber security field, are continually monitoring the latest information security threats, and are committed to protecting your organization from security breaches. Continuum GRC offers full-service and in-house risk assessment and risk management subscriptions, and we help companies all around the world sustain proactive cyber security programs.

Continuum GRC is proactive cyber security®. Call 1-888-896-6207 to discuss your organization’s cyber security needs and find out how we can help your organization protect its systems and ensure compliance.