Endpoint
12/5/2012
03:07 PM
Dark Reading
Dark Reading
Products and Releases
Connect Directly
RSS
E-Mail
50%
50%
Repost This

Don't Bring Cybercrime Home For The Holidays

Here are a few strategies for keeping the cyber-grinches out

PORTLAND, Ore., Dec. 5, 2012 /PRNewswire/ -- Cybercrime is on the rise, the holidays being no exception. In fact, this holiday season may prove to be the biggest ever for cybertheft. Hackers observe no holidays, instead using them as yet another theme to entice and trick computer users into letting them into their networks. Compounding this, many retailers and other businesses conduct more transactions and process more credit cards during the holidays than at any other time of the year, which makes breaking into any company's networks all that more lucrative and enticing, regardless of size.

Here are a few strategies for keeping the cyber-grinches out:

Know what is happening on your network. With good security monitoring architecture in place, if a network incident occurs, you would be able to go back and trace when and how the breach happened and detect if any sensitive data was stolen. Network recording devices, such as full packet capture appliances, quickly establish the facts and timeline of any incidents and provide the forensic evidence necessary to pursue prosecution.

Beware of holiday e-cards, even if received from a trusted sender. Unbeknownst to the sender, holiday-themed screensavers, e-cards and other free digital content from the Internet may contain malicious spyware, malware and trojans. Downloading these digital "freebies" onto your office computers can open your network up to intrusion and exploitation by cybercriminals – who have no intent of spreading holiday cheer.

Encourage employees to keep their holiday internet shopping activities at home. Seemingly benign and legitimate retail sites may be fronts for disseminating malware, compromising both computers and networks. Hackers are fully aware that even a short-lived exploit on a busy website can bring high exposure. Hackers even go so far as to hide their malicious payloads in paid-for advertisements. Remember: a firewall cannot keep malicious programs out if an insider invites them in.

Review what your business liability insurance covers and what to expect from lapses in PCI and other regulatory compliance. Standard business insurance does not cover the costs and liabilities resulting from data theft and a breach of your credit card processing system can result in suspension of your merchant account.

The reality is that business losses from cybercrime overtook losses due to physical theft for the first time in 2010. 2012 stands as no exception, with a growing list of breach victims in all industries. Cybercrime is on an upward trend and the question now is not whether an intrusion will happen, but when you will need to respond to a cyber-event. Businesses cannot afford to put cybersecurity off until the new year.

IPCopper wishes you a happy and safe holiday season!

About IPCopper: IPCopper, Inc. manufactures off-the-shelf and custom solutions for network forensics, security monitoring and encrypted data storage. Its line of standalone packet capture appliances leads the market in performance, capacity and price. Headquartered in Portland, Oregon, IPCopper, Inc. designs and manufactures its products in the USA.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-2391
Published: 2014-04-24
The password recovery service in Open-Xchange AppSuite before 7.2.2-rev20, 7.4.1 before 7.4.1-rev11, and 7.4.2 before 7.4.2-rev13 makes an improper decision about the sensitivity of a string representing a previously used but currently invalid password, which allows remote attackers to obtain potent...

CVE-2014-2392
Published: 2014-04-24
The E-Mail autoconfiguration feature in Open-Xchange AppSuite before 7.2.2-rev20, 7.4.1 before 7.4.1-rev11, and 7.4.2 before 7.4.2-rev13 places a password in a GET request, which allows remote attackers to obtain sensitive information by reading (1) web-server access logs, (2) web-server Referer log...

CVE-2014-2393
Published: 2014-04-24
Cross-site scripting (XSS) vulnerability in Open-Xchange AppSuite 7.4.1 before 7.4.1-rev11 and 7.4.2 before 7.4.2-rev13 allows remote attackers to inject arbitrary web script or HTML via a Drive filename that is not properly handled during use of the composer to add an e-mail attachment.

CVE-2011-5279
Published: 2014-04-23
CRLF injection vulnerability in the CGI implementation in Microsoft Internet Information Services (IIS) 4.x and 5.x on Windows NT and Windows 2000 allows remote attackers to modify arbitrary uppercase environment variables via a \n (newline) character in an HTTP header.

CVE-2012-0360
Published: 2014-04-23
Memory leak in Cisco IOS before 15.1(1)SY, when IKEv2 debugging is enabled, allows remote attackers to cause a denial of service (memory consumption) via crafted packets, aka Bug ID CSCtn22376.

Best of the Web