Menu

Tag Archives:
#databreache

Home / Blog / Tag: #databreache

Physical & Cloud #DataProtection: Best Practices for your #Backup and #RecoveryProcess

Data, one of the most valuable assets of organisations. Massive data is the new currency. Thanks to advancements in technology and connectivity, data creation is skyrocketing. According to IDC, Global DataSphere Forecast, 2021-2025, the global data creation and replication will experience a compound annual growth rate (CAGR) of 23% over the forecast period, leaping to 181 zettabytes in 2025. That’s up from 64.2 zettabytes of data in 2020 which, in turn, is a tenfold increase from the 6.5 zettabytes in 2012. These data are stored in ever-increasing environments and connected devices, therefore backup and restoring the capability of an information system is a real challenge to ensure business continuity and the availability of associated data.

Volume of data created and replicated worldwide

What must IT departments do to fulfill the data security mission? Well, the data security policy is at the heart of each business concern and should be a fundamental part of their security strategy. Planned security measures can then create tactical and operational rules through the joint efforts of security and storage teams. To this end, storage must be an integral part of the company’s security strategy.

 

To achieve these objectives, a company must establish a cluster around the following five essential aspects:
• Allocation of responsibilities;
• Risk Assessment;
• Development of a data protection procedure;
• Communication of data protection procedure;
• Execution and testing of the data protection procedure.

 

  1. Allocation of responsibilities

The goal is to make storage security a fully-fledged feature of the IT security architecture. Even if the company decides that the responsibility for backup or storage security rests within the storage team, it must nevertheless integrate any safety measures in this area with task to secure the rest of the infrastructure. This integration will contribute to the establishment of in-depth protection. It is also advisable to share responsibility for extremely sensitive data. It’s, therefore, better to ensure that the person authorizing access is not the same as the person responsible for enforcement.

 

  1. Assessment of storage risks in the area of ​​IT security

#Managers must review each step of their backup methodology to identify security vulnerabilities. Can an administrator secretly make copies of backup tapes? Are they stored in boxes accessible to everyone? Is there a rigorous end-to-end monitoring chain for backup tapes? If critical data is backed up and transported, vulnerabilities of this nature could make it easy prey. If the risk analysis reveals many vulnerabilities, the company must seriously question the encryption of its data.

 

  1. Development of an information protection program that guarantees the security of company data, at all times, wherever they are

Multi-level protection should be adopted by taking existing best practices for the data network in order to apply to the storage network, while adding specific layers adapted to the characteristics of the archived data, for example:

  • Authentication: application of multi-level authentication techniques and anti-spoofing (anti-identity or address spoofing).
    • Authorizations: access rights according to roles and responsibilities (as opposed to total administrative access).

It is imperative to duplicate backup tapes because it is never good to depend on a single copy of the data. Despite the longevity of the bands, they are still exposed to environmental and physical damage. A common practice is to perform nightly backups and then store these off-site tapes without any verification. Recommended best practices include duplicating backup tapes and then storing offsite copies.

Magnetic tapes remain the preferred storage mode for backups because they are economical and offer sufficient capacity to back up an entire operating system on a single cartridge. When stored properly, archival tapes have a lifetime of more than 30 years, making them an exceptionally reliable storage medium.

 

  1. Communication of the procedure to be applied with regard to the protection and security of information

Once the procedure for protecting and manipulating sensitive data has been defined, it is important to ensure that those responsible for their safety are informed and trained. Safety rules are the most important aspect of assigning responsibilities. Functional managers need to be aware of risks, countermeasures, and costs.

Data loss and intellectual property theft affect the entire enterprise, not just the IT department. As such, the Director of Security must undertake a data security approach by training the different functional frameworks in the risks, threats and potential harms arising from security breaches, as well as the cost of the various possible countermeasures in this area. In this way, company executives can raise awareness about the cost/benefit of investments in data security.

 

  1. Implementation and testing of Data Protection and Security Plan

Securing data is not about technology but about the procedure. This is why it is essential to test the procedure. In addition, as the growth of the company is accompanied by an evolution in security and data protection needs, IT security practices must also evolve. Once the complete security plan has been developed, defined, and communicated to the concerned team, only then it’s the right time to implement it. IT team must ensure the implementation of the tools, technologies, and methodologies necessary for the classification of information. New technologies may be required to classify information or label it with metadata so that it is backed up according to appropriate rules and procedures.

Once in place, the procedure must be tested, both concerning backup and restore. The test is to introduce, into the process, any possible and imaginable danger, whether it is the loss of a tape or a server, network problems, equipment or filing of data or any other scenario which could affect the company’s performance.

It is advisable to carry out tests with personnel who are less familiar with the procedure, to ensure that it can nevertheless be applied without difficulty in the absence of the usual supervisor (due to illness, holidays or departure).

Credential Stuffing Attacks: How to Protect Yourself

GLOBAL INTERNET USERE 2020

 

As we look forward to the hopefully great year ahead, let’s rewind a year that seems to have more episodes than Game of Thrones. Companies all across the globe were put into a huge test followed by a rapid shift from office working to home-office prompted by the coronavirus pandemic. Nearly overnight, organizations worldwide had to enable remote workforces to support their business requirements. COVID-19 has in many ways unleashed a new set of challenges and/or accelerated existing challenges, such as ransomware, data breaches, API attacks, cyber-fraud and unemployment frauds, within global enterprises.

 

It’s clear-cut that technology and security teams struggled in 2020 to respond as quickly to the changing environment as did the cybercriminals, who took advantage of an environment of unexpected change, extraordinary shifts in employees’ working process, and technology used by governments and worldwide companies.

 

Akamai reports that global internet traffic has grown by as much as 30 percent in 2020, while Statista observed that only in October 2020, online traffic across 20 different industries increased by 1.5% compared to the reference period in January 2020. Online transactions increased by 26.7 % compared to 2019. Another report from Cisco predicted there will be 5.3 billion total Internet users (66 percent of the global population) by 2023, up from 3.9 billion (51 percent of the global population) in 2018. That’s nearly two-thirds of the global population with Internet access.

 

The internet has gained more popularity in 2020, internet users are currently growing at an annualized rate of more than 7%, equating to an average of more than 875,000 new users each day. With this massive increase in the global internet traffic, Akamai is seeing over a hundred million of these attacks every day, with a peak of nearly 300 million a day, only in its own customer base. On the one hand, the internet is serving humanity, on the other hand, it has become the best place of like phishing, fraud, identity theft, Email Spoofing, bullying, cyberstalking, Malware, computer viruses.

 

In the history of cybercrime, the global coronavirus pandemic has added the credential stuffing problem to it extend. For those who don’t know, in this attack method, a cybercriminal tries a large number of stolen credentials on multiple websites. In order to gain unauthorized access to as many user accounts as possible to carry out attacks or fraudulent activities.

 

Transactional bots are getting popularity among hackers, as they act as agents on behalf of hackers. Bots aren’t typically created to compromise just one individual computer, they’re designed to infect millions of devices. An attacker first identifies websites with valuable accounts such as credit institutions, online shops, etc. In the Darknet, he then acquires lists of stolen login data and rents a botnet to automatically check the account list on the advised website. If a credential stuffing attack is successful, the attacker either sells the new, validated access data in the darknet or uses it himself. With the stolen data, fraudsters can then, for example, log into third-party accounts and carry out financial transactions.

 

Attacks like these often have very unpleasant consequences for the concerned companies and institutions, Application failures due to impaired web performance (73%) and recovery costs (63%) are among the greatest burdens, but also lower customer satisfaction, lost sales and financial losses (all-around 40%) have a significant weight (Akamai).

 

Here below are the few possible ways to protect yourself against credential stuffing attacks.

Protecting yourself from credential stuffing is pretty simple if you use the same password security tips that security experts have been recommending for years. For effective protection against bot attacks, it is recommended in the first step not to reuse the passwords, use a password manager, enable two-factor authentication, and get your leaked password notifications.

 

By using a unique password for each online account, you can protect all of your accounts at once. Because even if one of your passwords gets leaked, it can’t be used to sign in to other websites. As remembering strong unique passwords, for each account you have, is a nearly impossible task, the use of a password manager is recommended. It can not only remember your passwords but also generate strong unique passwords. Additionally, don’t ignore the 2-factor authentication. It is much more difficult to hack your account if you’re using two-factor authentication on it. As it adds an additional layer of security to the authentication process, it harder for attackers to gain access to your devices or online accounts.

 

Sources

 

Tadalafil is a online cialis Learn More Here medication which has the same action as cialis. But to make it successful, you have cost of levitra to make a lot of efforts. Any man suffering from erection issue can get cialis tablets 20mg no prescription on the internet too. viagra online canada In any case at times men are simply not equipped to perform effectively.

Cheap Tents On Trucks Bird Watching Wildlife Photography Outdoor Hunting Camouflage 2 to 3 Person Hide Pop UP Tent Pop Up Play Dinosaur Tent for Kids Realistic Design Kids Tent Indoor Games House Toys House For Children