• Babak D. Beheshti, Associate Dean of the School of Engineering and Computing Sciences at NYIT. • Clyde Bennett, Chief Healthcare Technology Strategist at Aldridge Health. • Ross Brewer, VP and MD of EMEA at LogRhythm. • Ben Desjardins, Director of Security Solutions at Radware. • Eric O'Neill, National Security Strategist at Carbon Black. • Jeff Schilling, Chief of Operations and Security at Armor. • Karl Sigler, Threat Intelligence Manager at Trustwave. • Sigurdur Stefnisson, VP of Threat Research at CYREN. • Amos Stern, CEO at Siemplify. • Ronen Yehoshua, CEO at Morphisec. ! Visit the magazine website at www.insecuremag.com Feedback and contributions: Mirko Zorz, Editor in Chief - [email protected] News: Zeljka Zorz, Managing Editor - [email protected] Marketing: Berislav Kucan, Director of Operations - [email protected] (IN)SECURE Magazine can be freely distributed in the form of the original, non-modified PDF document. Distribution of modified versions of (IN)SECURE Magazine content is prohibited without permission. ! Copyright (IN)SECURE Magazine 2016. www.insecuremag.com Are all IoT vulnerabilities easily 5. Insecure or no network pairing control op- avoidable? tions (device to device or device to net- works). Every vulnerability or privacy issue reported 6. Not testing for common code injection ex- for consumer connected home and wearable ploits. technology products since November 2015 7. The lack of transport security and encrypt- could have been easily avoided, according to ed storage including unencrypted data the Online Trust Alliance (OTA). transmission of personal and sensitive in- formation including but not limited to user OTA researchers analyzed publicly reported ID and passwords. device vulnerabilities from November 2015 8. Lacking a sustainable and supportable through July 2016, and found the most glaring plan to address vulnerabilities through the failures were attributed to: product lifecycle including the lack of soft- ware/firmware update capabilities and/or insecure and untested security patches/ 1. Insecure credential management including making administrative controls open and updates. discoverable. “In this rush to bring connected devices to 2. Not adequately and accurately disclosing consumer data collection and sharing poli- market, security and privacy is often being cies and practices. overlooked,” said Craig Spiezle, OTA Execu- tive Director and President. “If businesses do 3. The omission or lack of rigorous security testing throughout the development not make a systemic change we risk seeing process including but not limited to pene- the weaponization of these devices and an tration testing and threat modeling. erosion of consumer confidence impacting the IoT industry on a whole due to their security 4. The lack of a discoverable process or ca- pability to responsibly report observed vul- and privacy shortcomings.” nerabilities. ! www.insecuremag.com !5 PCI Council wants more robust se- terminals and mobile devices used for pay- curity controls for payment devices ment transactions. Payment devices that di- rectly consume magnetic stripe information The PCI Council has updated its payment de- from customers remain a top target for data vice standard to enable stronger protections theft, according to the 2016 Data Breach In- for cardholder data, which includes the PIN vestigation Report from Verizon. and the cardholder data (on magnetic stripe or the chip of an EMV card) stored on the card or “Criminals constantly attempt to break security on a mobile device. controls to find ways to exploit data. We con- tinue to see innovative skimming devices and Specifically, version 5.0 of the PCI PIN Trans- new attack methods that put cardholder data action Security (PTS) Point-of-Interaction at risk for fraud,” said PCI Security Standards (POI) Modular Security Requirements empha- Council CTO Troy Leach. “Security must con- sizes more robust security controls for pay- tinue to evolve to defend against these ment devices to prevent physical tampering threats. The newest PCI standard for payment and the insertion of malware that can com- devices recognizes this challenge by requiring promise card data during payment transac- protections against advancements in attack tions. techniques.” The updates are designed to stay one step Vendors can begin using PCI PTS POI Modu- ahead of criminals who continue to develop lar Security Requirements version 5.0 now for new ways to steal credit and debit card data payment device evaluations. Version 4.1 will from cash machines, in-store and unattended retire in September 2017 for evaluations of new payment devices. ! Public cloud services market to cloud services. Not only are public cloud ser- grow to $208.6 billion in 2016 vices being used to recognize the tactical benefits of cost savings and innovation, but The worldwide public cloud services market is they are also being used to establish a more projected to grow 17.2 percent in 2016 to total modern IT environment — an environment $208.6 billion, up from $178 billion in 2015, that can serve as a strategic foundation for according to Gartner, Inc. The highest growth future applications and digital business pro- will come from IaaS, which is projected to cesses. grow 42.8 percent in 2016. SaaS is expected to grow 21.7 percent in 2016 to reach $38.9 Security and/or privacy concerns continue to billion. be the top inhibitors to public cloud adoption, despite the strong security track record and “The aspiration for using cloud services out- increased transparency of leading cloud paces actual adoption. There’s no question providers. there is great appetite within organizations to use cloud services, but there are still chal- Most organizations are already using a com- lenges for organizations as they make the bination of cloud services from different cloud move to the cloud. Even with the high rate of providers. While public cloud usage will con- predicted growth, a large number of organiza- tinue to increase, the use of private cloud and tions still have no current plans to use cloud hosted private cloud services is also expected services," said Sid Nag, research director at to increase at least through 2017. Gartner. The increased use of multiple public cloud IT modernization is currently the top driver of providers, plus growth in various types of pri- public cloud adoption, followed by cost sav- vate cloud services, will create a multi-cloud ings, innovation, agility and other benefits. environment in most enterprises and a need The focus on IT modernization indicates a to coordinate cloud usage using hybrid sce- more sophisticated and strategic use of public narios. ! www.insecuremag.com !6 Compromised electronic health get compromised just once, and sold repeat- records may haunt you forever edly all over the Dark Web, we’ll likely have problems for the rest of our lives. Information A recent report on the Deep Web black market that is contained in those records can be used for electronic health records (EHRs) by re- for many different types of fraud and attacks, searchers affiliated with the Institute for Criti- such as medical identity theft, submission of cal Infrastructure Technology has pointed out false claims, acquisition of controlled and pre- that healthcare systems are relentlessly and scription substances, and obtainment of med- incessantly attacked. ical devices. But the list of dangers doesn’t stop there – criminals can also create fake “Vulnerable legacy systems and devices that identities, perpetrate tax fraud, access gov- lack the ability to update and patch are ernment benefits, or try to extort patients. An- Frankensteined into networks possessing other problem is that there are still no legal newer technologies that can be updated and protections for medical identity theft victims. patched. As a result, the organization’s IoT microcosm becomes collectively vulnerable as “Stopping the damage, disputing the charges, effective layers of security cannot be properly and correcting the record can consume all of implemented,” the analysts noted. “Without a victim’s time and energy,” the researchers the input of cyber risk management profes- noted, adding that “even if the victim learns of sionals and without comprehensive oversight, the compromise before the information is ex- they will continue to make socially negligent ploited, remediation can still cost over $1,500 decisions that gamble the electronic health in fees and consume their free time for up to information of US citizens between antiquated five years.” security, insufficient fiscal and regulatory penalties, and the fingertips of tantalized insa- “Due to the longevity of the record, adver- tiable adversaries.” saries may continue to exchange and exploit the compromised information for the rest of By now, we also realized that the risk and im- the victim’s life. For some, such as children, pact of compromise of EHRs is usually and this can drastically hinder their future financial mostly shifted to us (the patients). But what stability and limit the potential lives that they most still don’t recognize is that if our EHRs could lead,” the researchers concluded. ! www.insecuremag.com !7 Chrome will start labeling some Internet towards the default use of HTTPS. HTTP sites as non-secure Changes in Chrome are one way to do it. Slowly but relentlessly, Google is pushing Previously employed tactics include prioritis- website owners to deploy HTTPS – or get left ing websites using HTTPS in Google Search behind. rankings and adding a new section to the company’s Transparency Report that allows The latest announced push is scheduled for users to keep an eye on Google’s use of January 2017, when Chrome 56 is set to be HTTPS, and HTTPS use of the top 100 non- released and will start showing in the address Google sites on the Internet. bar a warning that labels sites that transmit passwords or credit cards over HTTP as non- “A substantial portion of web traffic has transi- secure. tioned to HTTPS so far, and HTTPS usage is consistently increasing,” noted Emily In due time, all HTTP pages will be labeled by Schechter, of the Chrome Security Team.