- News & Resources: Listings >
- Blog
- Brand and Network Considerations When Adopting AI Corporately
- Integrating XDR, SIEM, and SOAR
- 3-2-1 –Go? Not so quick, this time.
- 5 Things a CISO Shoud Know
- 10-Step Patch Management Checklist
- Penetration Testing vs. Breach Attack Simulation
- Current big cyber breaches and impact on businesses
- Smart Infrastructure Gets Lit Up!
- Securing Industrial IoT: The Missing Puzzle Piece
- 7 Common Cybersecurity Mistakes Made by SMBs
- The Future of Physical Security: Cloud-Based Systems
- Autonomous and Sensor Technology Use Surging
- 2024 Facilities Trends Will Require Facilities and IT Teams to Work in Tandem
- NGFW vs. WAF. What’s the Right Firewall for You?
- Chris Hadfield’s Words To Live By
- Industrial Revolution 4.0 + IIoT
- Digital Fluency Drives Innovation
- Your Cloud Needs Protecting, Too
- Your building alarm systems could become obsolete. In 2024!
- Zero Trust 2.0: Zero Trust Data Resilience (ZTDR)
- We just got, or got used to, Wi-Fi 6. What is Wi-Fi 7?
- What Does the Board Need to Know? Business Metrics that CISOs Should Share – 4th and Last in a Four-Part Series
- Why 2024 is the Year for AI Networking
- International Women’s Day is Tomorrow – Great Time to Think About…
- Data-Centric Security Step One: Classifying Your Data
- The Network – Unsung Hero of Super Bowl LVIII
- What Does the Board Need to Know? Business Metrics that CISOs Should Share – Third in a Four-Part Series
- Boosting IT Team Performance by Fostering Intuition, Curiosity and Creativity
- Breach Remediation Costs Can Wipeout Bottom Line and Business
- Hoodied Hackers Now Favour Hugo Boss
- What Do You Need to Tell the Board? Business Metrics that CISOs Should Share – Second in a Four-Part Series
- How to Get People to Re-Engage After the Holidays
- What Does the Board Need to Know? Business Metrics that CISOs Should Share – First in a Four-Part Series
- Android Devices MUST be Updated + IT Departments Being Cut as Privilege Escalation Escalates
- Today’s Common Cloud Migration and Management Concerns
- Protect Your Healthcare Network from Cyberattack – Lives are at Stake
- Happy Halloween: Black Cats Lead to Boo….Hoo.
- Insurance Underwriters are Protecting Their Flanks
- Insurance Companies Cracking Down as Cybercriminals Become Better Business Builders
- Scary Cyberattacks Stats
- Parents, Profs and IT Professionals Perceive Back-to-School Through Different Lens
- Zscaler’s new IDTR and other tools that leverage generative AI
- Vanquish Vaping, Vandalism and Villainy
- Fabric for Fast-Paced Environments
- Changes to Cyber Insurance Requirements – What you Need to Know
- Cybersecurity Readiness – Newly Released Report
- Passwords Leaked…Again
- 10-Step Patch Management Checklist
- Remote – Again – For Now… and Still Maintaining Engagement
- Protecting Pocketbooks, Passwords and Property from Pilfering
- Raspberry Robin: Highly Evasive Worm Spreads over External Disks
- Cisco Introduces Responsible AI – Enhancing Technology, Transparency and Customer Trust
- Managing Customer Trust in Uncertain Supply Chain Conditions
- Hope on the Horizon
- Toys of Tomorrow… What will spark your imagination? Fuel your imagination?
- Protecting Purses and Digital Wallets
- The Password that Felled the Kingdom + MFA vs 2FA
- The MOE’s RA 3.0 and Zscaler
- 7 Critical Reasons for MS Office 365 Backup
- Penetration Testing Important, but…
- Social Engineering and Poor Patching Responsible for Over 90% of Cybersecurity Problems
- Breach Incidence and Costs On the Rise Again + 5 Ways to Reduce Your Risk
- Cybersecurity Insurance Policies Require Security Audits and Pen Testing
- Wireless strategies for business continuity gain importance as enterprise expand IoT, cloud, and other technologies
- How Cybercrooks are Targeting YOU
- Enabling Digital Transformation with Cisco SD-WAN
- WFH Post Pandemic – What It Will Look Like. What You’ll Need.
- Leaders to looking to the IoT to improve efficiency and resiliency
- Cyber Security Vernacular – Well, some of it, for now
- Why You Need Disaster Recovery, NOT Just Back-Ups
- 10 Reasons Why Having an Expert Manage Your Cybersecurity Makes Sense and Saves Dollars
- Converting CapEx IT Investments into Manageable OpEx
- The Hybrid Workplace – Planning the Next Phase
- Cisco Cloud Calling: Empowering Customers to Thrive with Hybrid Work
- When You Can’t Access the Cloud
- How to Keep On Keeping On
- New Cisco Research Reveals Collaboration, Cloud and Security are IT’s Top Challenges
- Threats from Within on the Rise
- Cloud Covered? If Not, Take Cover!
- Zero Trust and Forrester Wave Report
- Password Based Cyber Attack: Like Leaving Keys Under Doormats
- So, What’s Up With Sensors?
- Sensors and Systems Create a Digital “Last Mile” and Help Skyrocketing Costs
- Scanners Provide Peace of Mind for Returning Students and Workers
- Sensors Improve Operations and Bottom Line… Easily and Cost-Affordably.
- Cisco Meraki Looks at 2021
- 2020 Holiday Shopping: Cybersecurity and Other Tips to Safeguard Wallets and Systems
- How to make the most of the technology you have
- Personnel, Planet and Business Progress: More Interdependent Than Ever Before
- Sure… you can get them all in the boat – but can you get them to work well together?
- Pushing the Zero Trust Envelope – Cisco is Named a Leader in the 2020 Forrester Zero Trust Wave
- Cloud Data Must be Protected, Too!
- Don’t Let Anyone Get the Dirt on You – Make It Instead!
- How IoT Devices Can Help You and Your business
- WebEx – A World of Possibility
- Creating Your Breach Response Plan Now Will Save You Thousands Down The Road
- Been hacked? Here’s what you must do next.
- The Need for Pen Testing is At an All-Time High
- 5 Ways an IT Reseller Improves Your Performance and Peace-of-Mind
- 5G and Wi-Fi 6: Faster, more flexible, and future ready. Are you?
- Network and Data Security for Returning and Remote Workers + Disaster Recovery Symposium
- Collaboration and Cisco WebEx: Protecting Your Data
- Thursday’s Virtual Conference Tackles Today’s Supply Chain Trials and Tribulations
- 10 Tips to Reduce Cloud Storage Risk
- COVID-19 Crisis Fuelling IT Spending
- Supply Chain/Logistics Experts Share Their Expertise
- Cisco Breach Defence Overview
- Announcing Our New Website and Blog
![Current big cyber breaches and impact on businesses](https://cloudmanaged.ca/wp-content/uploads/bfi_thumb/shutterstock_2348310713-Copy-3krcmg6hc52ijkn3ojr762.jpg)
Once again, headlines are filling with news about major breaches. From today’s Ticketmaster disclosure to stale telecommunications confessions, there’s no shortage of security breach stories. The real headline, however, is in the escalating costs, which we’ll discuss momentarily.
On Friday, nearly 2 years after the fact, AT&T finally revealed that 109 million cellular user customer accounts had been downloaded to a third-party platform between May 1, 2022 – October 31, 2022. Although personal information was not leaked, the fact that hackers had access to calls and texts of nearly all customers during this period – without AT&T signalling an alarm – is, well, alarming.
U.S. software giant Ivanti, an asset management software system used to remotely inventory and manage desktop computers, has come under scrutiny and censure from The Cybersecurity and Infrastructure Security Agency (CISA).
In 2023, Ivanti had to issue multiple patches to address zero-day vulnerabilities facing active attacks. A zero-day attack is one that gives the infected company network no time to remediate the bug before it is exploited.
One such attack enabled non-authenticated users to access the APIs used for configuring Ivanti Sentry via the administrator portal, make it possible for hackers to change configurations, system commands and/or write files onto the system.
Despite repeated patches, CISA issued an advisory at the end of February 2024, in conjunction with Canadian Centre for Cyber Security (Cyber Centre), and counterparts in Australia, New Zealand and the UK, stating that “the Ivanti ICT is not sufficient to detect compromise and that a cyber threat actor may be able to gain root-level persistence despite issuing factory resets.”
Ironically, Ivanti promotes itself by saying: “Ivanti finds, heals and protects every device, everywhere – automatically. Whether your team is down the hall or spread around the globe, Ivanti makes it easy and secure for them to do what they do best.”
CISA’s recommendations to Ivanti’s clients:
-
Limit outbound internet connections from SSL VPN appliances to restrict access to required services.
-
Keep all operating systems and firmware up to date.
-
Limit SSL VPN connections to unprivileged accounts.
Good advice for any firm facing similar challenges.
On April 24, 2024, Dropbox Sign (formerly HelloSign) announced that its automated system configuration tool had been hacked, enabling the intruder to gain privileges to its production environment. The hackers also accessed customer account information, API keys, OAuth tokens and its Multi-Factor Authentication.
Last month, it was announced that Canada’s privacy commissioner is teaming up with counterparts in the UK to investigate the 2023 data breach which compromised 7 million 23andMe accounts. The firm uses clients’ DNA to help them locate relatives and trace their family tree. This information could also be used for surveillance and discriminatory purposes.
Today, I received an email from Ticketmaster saying that between April 2 – May 18, 2024, “an unauthorized third party obtained information from a cloud database that may have included your [my] name, basic contact information, and payment card information such as encrypted credit or debit card numbers and expiration dates.”
These are but a few of the bigger headlines. Every day, new stories are pushed to my phone, including a recent one about cybercriminals coming after Apple products because of their widespread adoption. In this case, convincingly smishing SMS messages prompt recipients to click a link and sign into their iCloud accounts. From there, grief ensues.
The biggest story, however, is not the increasing number of successful cybersecurity attacks, but the escalating impact on organisations and individuals.
Although the money spent in detecting and remediating the problem is not insignificant, companies are more greatly impacted by the downtime and, in some cases, the hit to their brand reputation. As we have said in previous posts, unless you are able to respond quickly to customer concerns, get your business up and running again promptly, and can assist your customers in addressing problems created by the breach, you risk losing customers, and reduce your ability to attract new ones.
On average, breached Canadian firms lose 8 – 10% of their customers within three months and find that their client acquisition costs increase by as much as 50% in the year following a successful attack. A small percentage of firms are never able to fully restore their data and are forced to close their doors.
Do not let this happen to you. Remember to…
-
Protect your cloud, edge, network and endpoints.
-
Use MFA on all devices and adopt a least privilege approach to user access.
-
Have a breach readiness plan in place.
-
Backup your data, operating systems and network configurations – and practice restoring from bare metal, from time to time.
-
Ensure employees are trained on, and regularly reminded about, security protocols.
These are some of the key steps. For others, please feel free to reach out to us at : [email protected], or call 1.877.238.9944.