Endpoint
12/5/2012
03:07 PM
Dark Reading
Dark Reading
Products and Releases
50%
50%

Don't Bring Cybercrime Home For The Holidays

Here are a few strategies for keeping the cyber-grinches out

PORTLAND, Ore., Dec. 5, 2012 /PRNewswire/ -- Cybercrime is on the rise, the holidays being no exception. In fact, this holiday season may prove to be the biggest ever for cybertheft. Hackers observe no holidays, instead using them as yet another theme to entice and trick computer users into letting them into their networks. Compounding this, many retailers and other businesses conduct more transactions and process more credit cards during the holidays than at any other time of the year, which makes breaking into any company's networks all that more lucrative and enticing, regardless of size.

Here are a few strategies for keeping the cyber-grinches out:

Know what is happening on your network. With good security monitoring architecture in place, if a network incident occurs, you would be able to go back and trace when and how the breach happened and detect if any sensitive data was stolen. Network recording devices, such as full packet capture appliances, quickly establish the facts and timeline of any incidents and provide the forensic evidence necessary to pursue prosecution.

Beware of holiday e-cards, even if received from a trusted sender. Unbeknownst to the sender, holiday-themed screensavers, e-cards and other free digital content from the Internet may contain malicious spyware, malware and trojans. Downloading these digital "freebies" onto your office computers can open your network up to intrusion and exploitation by cybercriminals – who have no intent of spreading holiday cheer.

Encourage employees to keep their holiday internet shopping activities at home. Seemingly benign and legitimate retail sites may be fronts for disseminating malware, compromising both computers and networks. Hackers are fully aware that even a short-lived exploit on a busy website can bring high exposure. Hackers even go so far as to hide their malicious payloads in paid-for advertisements. Remember: a firewall cannot keep malicious programs out if an insider invites them in.

Review what your business liability insurance covers and what to expect from lapses in PCI and other regulatory compliance. Standard business insurance does not cover the costs and liabilities resulting from data theft and a breach of your credit card processing system can result in suspension of your merchant account.

The reality is that business losses from cybercrime overtook losses due to physical theft for the first time in 2010. 2012 stands as no exception, with a growing list of breach victims in all industries. Cybercrime is on an upward trend and the question now is not whether an intrusion will happen, but when you will need to respond to a cyber-event. Businesses cannot afford to put cybersecurity off until the new year.

IPCopper wishes you a happy and safe holiday season!

About IPCopper: IPCopper, Inc. manufactures off-the-shelf and custom solutions for network forensics, security monitoring and encrypted data storage. Its line of standalone packet capture appliances leads the market in performance, capacity and price. Headquartered in Portland, Oregon, IPCopper, Inc. designs and manufactures its products in the USA.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading December Tech Digest
Experts weigh in on the pros and cons of end-user security training.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-2037
Published: 2014-11-26
Openswan 2.6.40 allows remote attackers to cause a denial of service (NULL pointer dereference and IKE daemon restart) via IKEv2 packets that lack expected payloads. NOTE: this vulnerability exists because of an incomplete fix for CVE 2013-6466.

CVE-2014-6609
Published: 2014-11-26
The res_pjsip_pubsub module in Asterisk Open Source 12.x before 12.5.1 allows remote authenticated users to cause a denial of service (crash) via crafted headers in a SIP SUBSCRIBE request for an event package.

CVE-2014-6610
Published: 2014-11-26
Asterisk Open Source 11.x before 11.12.1 and 12.x before 12.5.1 and Certified Asterisk 11.6 before 11.6-cert6, when using the res_fax_spandsp module, allows remote authenticated users to cause a denial of service (crash) via an out of call message, which is not properly handled in the ReceiveFax dia...

CVE-2014-7141
Published: 2014-11-26
The pinger in Squid 3.x before 3.4.8 allows remote attackers to obtain sensitive information or cause a denial of service (out-of-bounds read and crash) via a crafted type in an (1) ICMP or (2) ICMP6 packet.

CVE-2014-7142
Published: 2014-11-26
The pinger in Squid 3.x before 3.4.8 allows remote attackers to obtain sensitive information or cause a denial of service (crash) via a crafted (1) ICMP or (2) ICMP6 packet size.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Now that the holiday season is about to begin both online and in stores, will this be yet another season of nonstop gifting to cybercriminals?