Endpoint
12/5/2012
03:07 PM
Dark Reading
Dark Reading
Products and Releases
50%
50%

Don't Bring Cybercrime Home For The Holidays

Here are a few strategies for keeping the cyber-grinches out

PORTLAND, Ore., Dec. 5, 2012 /PRNewswire/ -- Cybercrime is on the rise, the holidays being no exception. In fact, this holiday season may prove to be the biggest ever for cybertheft. Hackers observe no holidays, instead using them as yet another theme to entice and trick computer users into letting them into their networks. Compounding this, many retailers and other businesses conduct more transactions and process more credit cards during the holidays than at any other time of the year, which makes breaking into any company's networks all that more lucrative and enticing, regardless of size.

Here are a few strategies for keeping the cyber-grinches out:

Know what is happening on your network. With good security monitoring architecture in place, if a network incident occurs, you would be able to go back and trace when and how the breach happened and detect if any sensitive data was stolen. Network recording devices, such as full packet capture appliances, quickly establish the facts and timeline of any incidents and provide the forensic evidence necessary to pursue prosecution.

Beware of holiday e-cards, even if received from a trusted sender. Unbeknownst to the sender, holiday-themed screensavers, e-cards and other free digital content from the Internet may contain malicious spyware, malware and trojans. Downloading these digital "freebies" onto your office computers can open your network up to intrusion and exploitation by cybercriminals – who have no intent of spreading holiday cheer.

Encourage employees to keep their holiday internet shopping activities at home. Seemingly benign and legitimate retail sites may be fronts for disseminating malware, compromising both computers and networks. Hackers are fully aware that even a short-lived exploit on a busy website can bring high exposure. Hackers even go so far as to hide their malicious payloads in paid-for advertisements. Remember: a firewall cannot keep malicious programs out if an insider invites them in.

Review what your business liability insurance covers and what to expect from lapses in PCI and other regulatory compliance. Standard business insurance does not cover the costs and liabilities resulting from data theft and a breach of your credit card processing system can result in suspension of your merchant account.

The reality is that business losses from cybercrime overtook losses due to physical theft for the first time in 2010. 2012 stands as no exception, with a growing list of breach victims in all industries. Cybercrime is on an upward trend and the question now is not whether an intrusion will happen, but when you will need to respond to a cyber-event. Businesses cannot afford to put cybersecurity off until the new year.

IPCopper wishes you a happy and safe holiday season!

About IPCopper: IPCopper, Inc. manufactures off-the-shelf and custom solutions for network forensics, security monitoring and encrypted data storage. Its line of standalone packet capture appliances leads the market in performance, capacity and price. Headquartered in Portland, Oregon, IPCopper, Inc. designs and manufactures its products in the USA.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Tech Digest, Dec. 19, 2014
Software-defined networking can be a net plus for security. The key: Work with the network team to implement gradually, test as you go, and take the opportunity to overhaul your security strategy.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2015-1414
Published: 2015-02-27
Integer overflow in FreeBSD before 8.4 p24, 9.x before 9.3 p10. 10.0 before p18, and 10.1 before p6 allows remote attackers to cause a denial of service (crash) via a crafted IGMP packet, which triggers an incorrect size calculation and allocation of insufficient memory.

CVE-2015-2072
Published: 2015-02-27
Multiple cross-site scripting (XSS) vulnerabilities in SAP HANA 73 (1.00.73.00.389160) and HANA Developer Edition 80 (1.00.80.00.391861) allow remote attackers to inject arbitrary web script or HTML via unspecified vectors to (1) ide/core/plugins/editor/templates/trace/hanaTraceDetailService.xsjs or...

CVE-2015-2075
Published: 2015-02-27
SAP BussinessObjects Edge 4.0 allows remote attackers to delete audit events from the auditee queue via a clearData CORBA operation, aka SAP Note 2011396.

CVE-2015-2076
Published: 2015-02-27
The Auditing service in SAP BussinessObjects Edge 4.0 allows remote attackers to obtains sensitive information by reading an audit event, aka SAP Note 2011395.

CVE-2015-2101
Published: 2015-02-27
Cross-site scripting (XSS) vulnerability in the Navigate bar in the Navigate module before 6.x-1.1 and 7.x-1.x before 7.x-1.1 for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Dark Reading Radio
Archived Dark Reading Radio
How can security professionals better engage with their peers, both in person and online? In this Dark Reading Radio show, we will talk to leaders at some of the security industry’s professional organizations about how security pros can get more involved – with their colleagues in the same industry, with their peers in other industries, and with the IT security community as a whole.