Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Physical Security

01:15 PM
Sylvain Cortes, Security Evangelist and cybersecurity expert
Sylvain Cortes, Security Evangelist and cybersecurity expert

Keeping Cyber Secure at Christmas

Sylvain Cortes, Security Evangelist and cybersecurity expert at Alsid, highlights the need for security departments to raise awareness through their organizations over cyber threats this Christmas.

Why Are Hackers Feeling Festive?
Reduced staff — December is the month of cookies, chocolate, and half your workforce going on vacation. That means thicker waistlines and thinner lines of defense as you juggle interim employees and reduced staff across the board.

Email avalanche — December and January result in a chaotic inbox cocktail: Christmas promotions, New Year wishes, (virtual) party invitations, online purchase receipts… Phishers know the situation well and will cloak themselves in the email avalanche. Even if staff are aware of phishing and other scam tactics, attention inevitably wanders. Remember that 80% of attacks start with a phishing tactic – an unending migraine for organisations.

Remote work — This has never been more relevant than this year, with so many employees still working from home due to the pandemic. As staff check emails, print invoices, or follow prospect activity, you'll be relying on your corporate VPN. As VPN activity increases, your SOC team gets flooded with traffic to inspect, and that translates to more false positives. The attacker can duck into this traffic jam to hide intrusion and other malicious activity.

Staff might also be tempted to use that free Wi-Fi offered by hotels, train stations, and airports when travelling, which tends to fall on the poor end of the security spectrum. Public Wi-Fi spots are an excellent entry point for attackers, so make sure employees are aware of the risks.

Bad Santa Is Coming for Your Data
All hackers want for Christmas is to encrypt data and pocket other's well-earned cash. Ransomware attacks are skyrocketing, and we anticipate a record-setting number of encryptions for December 2019 and January 2020.

The classic attack scenario looks like this:

Hackers will use Active Directory domain dominance to mask their presence and dramatically increase encryption efficiency. The attack path will use OS vulnerabilities or Active Directory misconfigurations to perform lateral movement and privilege escalation.

Cybersecurity Strategies for Christmas
You can implement a specific Christmas security plan to reduce the effectiveness of attacks. This is not complex, but it is important to guard against any Scrooges eyeing your organisation:

Provide a best practice checklist for salaried and interim employees alike: phishing, IT security procedures, Internet usage, etc., must be crystal clear.

Evaluate resilience by checking your workstation patches and your Active Directory configuration. Monitor your workstation status. To ensure your OS is updated, you may use a mix of GPOs and WSUS configuration.

Have backups. It is not enough to check the "success" status of your backup jobs — you must confirm that your backup files are resilient by testing a restore plan on specific systems.

Weather the Christmas Storm
Holiday cyberattacks won't be going away any time soon. They will grow and adapt to take advantage of increasing traffic and decreased resources inside businesses. A simple umbrella won’t cut it. You're going to need to build an IT shelter to monitor your employees' behavior, your Active Directory's security, and your backups' resilience. After all, no one wants to wake up to coal in their SOC.

Sylvain Cortes is the Security Evangelist and cybersecurity expert at Alsid.

This story first appeared on IFSEC Global, part of the Informa Network, and a leading provider of news, features, videos, and white papers for the security and fire industry. IFSEC Global covers developments in long-established physical technologies — like video surveillance, access control, intruder/fire alarms, and guarding — and emerging innovations in cybersecurity, drones, smart buildings, home automation, the Internet of Things, and more.

IFSEC Global, part of the Informa Network, is a leading provider of news, features, videos and white papers for the security and fire industry. IFSEC Global covers developments in long-established physical technologies – like video surveillance, access control, ... View Full Bio

Recommended Reading:

Comment  | 
Print  | 
More Insights
Oldest First  |  Newest First  |  Threaded View
Visit the Web's Most Authoritative Resource on Physical Security

To get the latest news and analysis on threats, vulnerabilities, and best practices for enterprise physical security, please visit IFSEC Global. IFSEC Global offers expert insight on critical issues and challenges in physical security, and hosts one of the world's most widely-attended conferences for physical security professionals.

7 Old IT Things Every New InfoSec Pro Should Know
Joan Goodchild, Staff Editor,  4/20/2021
Cloud-Native Businesses Struggle With Security
Robert Lemos, Contributing Writer,  5/6/2021
Defending Against Web Scraping Attacks
Rob Simon, Principal Security Consultant at TrustedSec,  5/7/2021
Register for Dark Reading Newsletters
White Papers
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2021-05-13
The HTMLSanitizer class in html-sanitizer.ts in all released versions of the Aurelia framework 1.x repository is vulnerable to XSS. The sanitizer only attempts to filter SCRIPT elements, which makes it feasible for remote attackers to conduct XSS attacks via (for example) JavaScript code in an attri...
PUBLISHED: 2021-05-13
An information disclosure vulnerability in ILIAS before 5.3.19, 5.4.12 and 6.0 allows remote authenticated attackers to get the upload data path via a workspace upload.
PUBLISHED: 2021-05-13
A local file inclusion vulnerability in ILIAS before 5.3.19, 5.4.10 and 6.0 allows remote authenticated attackers to execute arbitrary code via the import of personal data.
PUBLISHED: 2021-05-13
Pydantic is a data validation and settings management using Python type hinting. In affected versions passing either `'infinity'`, `'inf'` or `float('inf')` (or their negatives) to `datetime` or `date` fields causes validation to run forever with 100% CPU usage (on one CPU). Pydantic has been patche...
PUBLISHED: 2021-05-13
An issue was discovered in the Headunit NTG6 in the MBUX Infotainment System on Mercedes-Benz vehicles through 2021. A Message Length is not checked in the HiQnet Protocol, leading to remote code execution.