Security researchers just found a new Android malware that affects mostly banking apps, and it is called “BlackRock.”
According to ThreatFabric, BlackRock’s icon is always hidden when launched on a mobile device. After that, it acts as a Google update to access users’ Accessibility Service.
As soon as it gains access to the privileges, it grants more permission. This allows it to communicate with its C&C (command-and-control) server to make overlay attacks.
When it reaches this stage, Malware checks to determine the application that runs on that target’s foreground. BlackRock then has the chance to deploy one of its dual overlays.
The overlays include the one that particularly mimicked any of the applications of its target or a generic credit card snatcher.
The Modus Operandi Of BlackRock Malware
Interestingly, BlackRock malware targets apps related to banking operations in the United States, Europe, Canada, and Australia are its main target. Even with them as its primary target, this malware also went after lifestyle, communication, dating, and social applications.
According to ThreatFabric’s research, almost all trending dating and social applications are in the app. This choice of actor is likely due to this pandemic, which made people socialize more online. The actors have also likely tried to include dating applications, although it was rarely seen on the list.
The analysis of ThreatFabric revealed that the latest arrival of BlackRock is to revive LokiBot. The initial appearance of this threat was on the threat landscape between 2016 and 2017, with several attack campaigns.
It includes the one that deployed Ransomware anytime a user tried to remove it. The moment LokiBot’s source code was revealed online, it died down. Even at that, it still performed several attack operations as recently as May 2019.
How To Avoid BlackRock Malware
The emergence of this malware should give users more reason to download applications only from official marketplaces and trusted developers.
Smartphone users should be cautious of applications that require ‘excess’ permission. And you should also protect your bank accounts with some sort of two-factor authentication or something stronger.
Frequently Asked Questions
What is BlackRock malware?
BlackRock is a type of malware specifically designed to target Android smartphones. It falls under banking malware, which aims to steal your banking apps’ financial information and login credentials.
Android banking malware is malicious software created to target Android operating system users. These programs often disguise themselves as legitimate apps and lurk in the background, waiting to steal your banking login details and credit card information or even intercept SMS messages containing two-factor authentication codes.
How do I remove hidden malware from my phone?
If you suspect your phone is infected with BlackRock malware or any other type of malware, here are some steps you can take:
Run a security scan: Most antivirus apps offer scans to detect and remove malware. Run a full scan on your device and follow the app’s instructions to quarantine or remove any threats found.
Boot into Safe Mode: Booting into Safe Mode prevents third-party apps from running. This can help you identify if a downloaded app is the culprit. In Safe Mode, you can then uninstall any suspicious applications.
Factory Reset: A factory reset might be necessary if other methods fail. This will erase all your data and settings, so back up your phone beforehand. After the reset, only install apps from trusted sources like the Google Play Store.
Has BlackRock been hacked?
No, BlackRock itself is not a hacked program. It’s the malware itself that hackers use to try and steal information from your phone.
Is BlackRock a computer virus?
While the terms are sometimes interchangeable, BlackRock is more accurately classified as malware. A computer virus can replicate itself and spread from device to device, whereas BlackRock requires user interaction (downloading an infected app) to spread.
What is malware in banking?
Banking malware is a specific malware designed to target your financial information. These programs can steal login credentials for online banking apps, credit card details you enter while shopping online, or intercept SMS messages containing two-factor authentication codes for secure logins.
Hackers can steal your money or make unauthorized transactions by compromising your banking security.
Note: This was initially published in July 2020, but has been updated for freshness and accuracy.
Experts are afraid that users of the popular social media application WhatsApp will become easy victims of ongoing verification scam which targets sensitive data.
Since its launch in 2009, WhatsApp has grown to become one of the most used social media platforms in the World. After being acquired by Facebook in 2014, its numbers increased, and now, over two billion users make use of WhatsApp every month.
Hackers have introduced a new verification scam which put billions of WhatsApp users at risk. It is a clever hack, which is why experts fear that a lot of users will fall for it.
Usually, the hackers pose as friends and try to convince you to send them your login code. Other times, they pose as the WhatsApp Technical Team using the WhatsApp logo so they look legit enough. These hackers send messages to their targets, telling them that they need to verify their WhatsApp accounts.
Check out our review of OmniWatch, the solution that ensures your personal information stays off the dark web and data broker websites.
The WhatsApp verification scam not only puts users at risk of losing their details, but they can also lose their entire if they give out their login code. With the login code, the hackers will be able to send and read messages with the victims’ accounts.
Considering how frequently WhatsApp requires updating, most users will be unsuspicious of these messages. Users have been advised against falling victim to such scams as the WhatsApp Technical Team does not message users on the WhatsApp platform.
This was made known via a Whatsapp blog, WABetaInfo. They dismissed the messages as fake, and if WhatsApp were to message users, there would be a green verified indicator for authenticity. Furthermore, the blog made it clear that WhatsApp will never ask for user login codes or personal data.
How WhatsApp users can protect themselves against the verification scam
Users should note that the WhatsApp login code is private and shouldn’t be shared with any third party, no matter who requests for it. Furthermore, they can make use of the 2-factor authentication option featured in WhatsApp settings.
So, if they do give out their login code, the hackers would still need to bypass a second security protocol before getting access to their accounts.
Hackers Target WhatsApp with Verification Scam: Frequently Asked Questions
Is there a WhatsApp scam asking for verification code?
Yes, there is a circulating scam where attackers attempt to trick you into giving them your WhatsApp verification code.
Can my WhatsApp verification code be hacked?
Technically, the code itself cannot be hacked. However, if you reveal it to someone else, they can use it to verify their own device on your WhatsApp account, potentially locking you out.
Can a scammer hack my WhatsApp if I don’t give them the code?
No, simply not giving them the code prevents them from taking over your account.
WhatsApp typically only asks for a verification code when you:
Register a new device with your WhatsApp account.
Reinstall WhatsApp on your phone.
Request your account information report.
What can a scammer do with my verification code?
If you share your verification code, a scammer can use it to verify their device and gain access to your WhatsApp account. This allows them to:
Impersonate you and chat with your contacts.
See your private messages and media.
Make calls or send messages in your name.
How can I stay safe from this scam?
Never share your verification code with anyone, not even WhatsApp itself (WhatsApp will never ask for your code via call or message).
Be wary of suspicious messages, even if they appear to be from a friend or family member. If someone asks for your code, contact them directly through a trusted channel to confirm its legitimacy.
Enable two-factor authentication on your WhatsApp account. This adds an extra layer of security by requiring a PIN in addition to the verification code when registering a new device.
By understanding this scam and following these precautions, you can protect yourself from falling victim and keep your WhatsApp account secure.
Note: This was initially published in July 2020, but has been updated for freshness and accuracy.
This roundup post will reveal the most effective cybersecurity strategy for a small business.
Small business owners encounter a series of cyber threats, which might be deadly depending on their impact.
We asked top executives, small business owners, and cybersecurity experts: What Is the Most Effective Cybersecurity Strategy for a Small Business?
So, after several email requests, Skype interviews, and phone calls, we got valuable responses.
48 Effective Cybersecurity Strategy For A Small Business
Paul Lipman – CEO of BullGuard Cybersecurity Company
A multifaceted cybersecurity approach is the best cybersecurity strategy. Small businesses are more vulnerable to cyberattacks as these companies are typically not as well protected as their larger enterprise counterparts.
Small businesses must develop a cohesive cybersecurity plan that includes and communicates standards for security software to be run on every device on which work is done.
Security software must include anti-phishing capabilities to protect data and prevent security breaches.
Lev Barinksiy – CEO of SmartFinancial Insurance
Several insurance companies currently offer cyber insurance to small businesses. However, it is helpful for a small business to recruit a network defence specialist to improve their overall cybersecurity in their business environment.
Down the line, when cyber insurance becomes generally accepted, it will become a prerequisite for small business owners to provide the audit of the company’s defence processes.
Braden Perry – Cybersecurity Attorney at Kennyhertz Perry, LLC
I work with several companies on cyber intrusions. The most significant trend is the increase in outsider attacks on small and large companies.
For outsider attacks, these cyber threats target company websites to deliver malicious payloads, which can cause severe damage.
With a stringent cybersecurity implementation and policy, small business owners can mitigate outsider attacks significantly.
Logan Kipp – Director at SiteLock
Implement training & education: With the sudden shift to remote work, small businesses should educate their employees on security best practices when working online. From spotting phishing emails to utilizing two-factor authentication (2FA) and a strong password, companies can help ensure employees take all necessary steps internally to protect themselves.
By teaching employees to keep security top of mind at all times, companies can also establish a standard operating procedure, or “SOP,” on how documents should be handled and how potential vulnerabilities should be reported when working remotely.
Utilize VPN & website security tools: SMBs should use a virtual private network (VPN) when relying on external networks. In these even employees’ home networks, management of security controls is outside of the company’s scope. VPNs protect data by encrypting it as it’s transmitted across shared or public networks, keeping sensitive information, such as SSNs, passwords and credit card numbers, from being exposed.
Additionally, small businesses should routinely scan their websites for malware and vulnerabilities. By being proactive with their cybersecurity hygiene, organizations can help ensure that their customers and data remain safe and secure.
Be aware of the data you’re sharing: From inputting customer information into an online form to simply sending an email, businesses need to be mindful of the private information they share online. By being careful with sensitive information, companies can limit the risk of catastrophic data leaks if they fall victim to a hack or breach.
Kenny Trinh – Founder & CEO of NetbookNews
The perfect cybersecurity strategy for a small business is regular backups. Backups are essential, especially in a small business environment.
Likewise, relying on human intervention, such as plugging in a flash drive, is a recipe for cybersecurity failure.
Stacy Clements – Owner of Milepost 42 and Retired Air Force Cyber Operations Officer
An effective cybersecurity strategy for a small business requires identifying cyber risks and determining appropriate ways to mitigate those risks and respond to cyber events.
The NIST Cybersecurity Framework provides this strategy for small companies, with best practices based on input from government, academic, and private sector professionals.
The Framework was deliberately designed to be flexible so it can be used for different sizes and types of entities.
Because it’s a free resource, several sectors have already created customized resources, such as the National Restaurant Association Toolkit for Restaurant Operators. Using the Framework to define and mitigate risk is an excellent strategy for small business owners.
Vince Fishbone – Cybersecurity Expert at Kingpin Private Browser
I recommend that small businesses should secure themselves with antivirus software and firewalls in the first place. Even if it sounds basic, you would be surprised how many companies are not using up-to-date anti-malware solutions. That should be your first-level defence.
Both access control strategy and cybersecurity minimize human error. Determining who in the company structure will have access to different types of data is crucial. Every access should be recorded in the log file.
Many attacks or information leaks are dependent on the employees. Hackers often use social engineering for that purpose. Where possible, implement multi-factor authentication and reduce the chance of ransomware attacks by regular backups.
Marty Puranik – President & CEO of Atlantic.Net, a HIPAA-Compliant Web Host
Companies should seek a solution that mitigates current cybersecurity challenges, provides ongoing support, and helps offset risks from the evolving threats of the future.
Small businesses could utilize their resources in good faith and provide training to staff. Still, the challenges and threats are incredibly diverse and require a wide range of expertise.
So, the best practice is to focus on your business’s core function and let a vetted third-party provider take care of the rest. They have trained professionals who help deploy the best solutions, provide ongoing support, and are always available to help support your business.
Mike Shelah – Account Executive at Advantage Industries
The best Cybersecurity Strategy is: “Technology, Training, Insurance & Process Documentation.”
It all begins with the right technology — consistent updates, the proper firewall, the proper spam filtering and antivirus, as well as the use of multi-factor authentication.
Then, you train your people regularly with monthly, easy-to-digest lessons. This helps to create a culture of compliance.
You work closely with people who ignore the training or perform poorly on tests, as they are your greatest vulnerability. Work with your IT vendor and insurance agent to pick a policy that accurately reflects your company and needs.
Lastly, document all of your policies and procedures related to your industry and compliance regulations.
Carl Fransen – Founder & CEO of CTECH Consulting Group
There must be an acknowledgement that having a firewall, server passwords/permissions, and an antivirus does not constitute adequate protection today.
Moving away from the traditional systems, such as relying on an on-premise server whose security is based on a password and user permissions, to a modern system that contains identity management, threat analytics, document protection, and multi-factor authentication must be part of any company’s security planning.
For an effective cybersecurity strategy, there’s always a need to address the weakest link in any organization: the staff.
Staff needs to be trained on properly using the company’s systems, identifying potential threats, and having a working knowledge of the proper security procedures.
Centralizing and dashboarding multiple security systems to provide a ‘single pane of glass’ overview of what is happening within a business will help technical staff correlate relevant data and make the appropriate decisions.
Cameron Call – Technical Operations Manager at Network Security Associates
There are two simple things that every small business needs to implement. Once these are in place, they can begin building an effective strategy.
If you don’t have anything else, you should have backups. Anything in a network, or even an entire network, can be replaced. Data, however, cannot. Your client list, their files, accounts receivable entries, or anything else needed for the business to operate should be backed up.
After backups are MFA, with MFA, you don’t have to rely so much on your or your staff’s ability to detect a phishing email. It also helps if usernames and passwords are leaked online due to the fault of a service provider.
Sean Nguyen – Director of Internet Advisor
As small business owners, we’re aware that we’re the primary target for cybercriminals because we’re seen as easy hits. The statistics are brutal; this is the kind of thing that can wipe you out.
With remote work, I strongly emphasise employee security – full cybersecurity training, supplied security software, company devices with full facial recognition, etc.
The website is also fully locked down, from our domain to anti-spyware software, security patches, and everything else. We have security professionals checking everything regularly for suspicious activity. Our strategy is to “be over-prepared for every possible scenario”.
Dan Merino – CEO of Green Dot Security
Backups – Any good security person should say that the most locked down network is still open to attacks if the attacker is motivated enough; backups (especially with an offline and offsite copy) can get you out of many issues
Documentation – As much as possible, documents that spell out what to do in the case of a breach or cybersecurity incident can reduce downtime, speed up the isolation of issues and help the company to understand where they have shortcomings in security. Documentation should include a Cyber Incident Response Plan, Information Security Policy, Disaster Recovery / Business Continuity Plan and maybe more like a Security Framework Policy (which would outline the company’s various implemented security plans)
Layering – Adding as many different services and devices as can be afforded to help prevent attacks. For example, the firewall should have subscription security services so the gateway is more than just a traffic cop.
Security Awareness Training – At the end of the day, the weakest point in most networks is the users themselves. Many attacks exploit the fact that tech is complicated, and humans are easily tricked. Training should make users aware of the dangers that exist.
The best cybersecurity strategy I recommend for small businesses is cloud security. Even though the cloud is a bit risky, you are less likely to lose critical data by storing data in the cloud.
Utilizing the cloud for storing data is an economical choice for small to average-sized organizations.
Whenever smaller businesses develop due to expanded sales, cloud storage and security tools can scale with the company. As cloud security constantly improves, your business must opt for cloud storage security.
Calloway Cook – President of Illuminate Labs
Crafting a cybersecurity strategy for a small business is a cakewalk process. Web admins can set up reCAPTCHA on their forms for free using Google Developer Tools. This is a must for more prominent organisations because the more employees your company has, the more significant the attack vector.
reCAPTCHA is the best free tool available to ensure that forms are being completed by a human rather than a bot. It’s not perfect, and humans can still manually submit spam or phishing messages. However, this is a quick way to reduce risk, making it a cybersecurity significantly best practice.
Mark Soto – Founder of Cybericus Cybersecurity Company
Use network segmentation, a process where you split your computer network into multiple segments.
Using network segmentation can help prevent your entire system from getting compromised if hackers can access one of your networks. It also gives you time to react in the worst-case scenario where the other networks are also in danger of being hacked.
With network segmentation, you can specify which network resources your users can access. This might be the most significant benefit of network segmentation in a world where malicious internal users make up at least 30% of data breaches.
Jack Kudale – CEO of Cowbell Cyber
Cyber insurance is critical in protecting the assets of small businesses. Given their limited IT budgets and resources, small businesses are as susceptible to cyberattacks as large organizations and are heavily targeted by cybercriminals.
Small businesses can now benefit from tailored, standalone cyber coverage to help cover Security Breach Expenses, Security Breach Liability, Cyber Extortion and Ransomware Payment, and losses from Social Engineering incidents.
Cyberattacks are no longer an “if” scenario but rather a “when” scenario. Cyber insurance is a crucial step to mitigate the dreaded financial losses in the aftermath of a breach.
Zoran Naumoski – Awareness Expert at Li-Fi
As a small business owner working from home office for cyber-security, I strongly recommend using a Li-Fi internet connection in your office instead of the classic Wi-Fi connection, which can be easily hacked.
But with Li-Fi, it is the opposite and cannot be hacked by someone outside your office. Apart from that, small businesses should also focus on layered cybersecurity systems for their cybersecurity strategy.
Jay Ryerse – Vice President, Cybersecurity Initiatives atConnectWise
The biggest threat today is the unknown, so when it comes to cybersecurity, the best thing small businesses can do is educate themselves. They might have a lean team of IT people who know IT but don’t understand where cybersecurity fits.
There are free tools small businesses can put in place that are very effective in combating many common cyber threats, so they must understand what those are and how to implement them.
Johnny Santiago – Brand Partnerships Manager for Social Catfish
Ransomware is a typical phishing attack, an encrypting malware that encrypts essential company files and holds them for ransom. Ransoms typically range from hundreds to thousands of dollars. Cybercriminals made over $1 billion last year from businesses attacked by ransomware.
Never open an attachment in an email you did not expect to receive or recognize the sender. It would be best to use the same caution when presented with URLs that you do not know, or that came from an unknown sender.
With today’s advanced ransomware techniques, you only have to visit a website to become infected. You DO NOT have to click anything on the site to infect the company with data encrypting ransomware.
Please follow the best practices outlined above to ensure you do your part to keep ransomware off the company network. Failure to do so could result in significant downtime and monetary cost to the business, and we all need to be vigilant in stopping these attacks.
Ben Walker – Founder & CEO of Transcription Outsourcing, LLC
We work in the legal, law enforcement, medical, financial, and academic industries and have to abide by some stringent confidentiality agreements.
That’s why I would tell you to host everything in the cloud with a company with HIPAA and CJIS compliance certifications and run criminal background checks on all your employees with sensitive data access.
We also have general liability and a separate cyber liability policy in case something terrible happens.
Neil Kittleson – CEO of NKrypt
Cybersecurity strategies for small businesses must focus on protecting proprietary, employee, and customer data. In today’s world, that means that you must leverage outside providers to help manage all of the systems needed to preserve the full scope of your organization.
The first step is to invest in the right external providers for data storage, email services, video conferencing, and collaboration tools.
The last step is training your employees on the risks to the business presented by cyber adversaries and ensuring they understand your tools and policies and why they are essential.
Paul Kubler – Red Team Head at CYBRI
Small business owners’ most effective cybersecurity strategy to protect themselves against cyber attacks is to go after the low-hanging fruits, otherwise known as the 80-20 rule. A straightforward yet practical example is enabling multi-factor authentication on email accounts.
Another effective cybersecurity strategy for small businesses is to ensure that all passwords are longer than 14 characters and offer some complexity.
These give SMBs a considerable head start on cybersecurity cos it almost nothing and takes little time to set up. That way, a local business opportunity stands a chance against cyber threats.
Nir Kshetri – Professor at the University of North Carolina-Greensboro and a Research Fellow at Kobe University
It is essential to develop effective policy and cybersecurity-ready human capital, which includes improving cyber-defence capabilities and minimizing deviant behaviours in the workforce. This is because the human factor is the weakest link in cybersecurity.
According to Dell SecureWorks, 90% of all malware infections involve human elements, such as opening email attachments or clicking links on websites before they can infiltrate the targets. CybSafe’s analysis of the data from the U.K.’s ICO indicated that human errors accounted for 90% of data breaches in the U.K. in 2019.
SMEs can take advantage of cybersecurity training provided by companies in effectively identifying and screening phishing emails. It is also essential to develop clear policies regarding access to organizational data and networks, especially during COVID-19 and remote working.
Bryan Osima – CEO of Uvietech Software Solutions
A standard entryway for a malicious attack on your website is through the forms and web applications that allow visitors to interact dynamically with your business. Most visits to your website will be benign, but all it takes is one malicious user or automated bot that crawls the internet, looking for vulnerable websites, to bring down your entire system.
These attacks work when malicious codes and scripts are injected into your site through your contact forms, order forms or other types of user input like comments, etc.
These scripts could either execute malicious codes that can hijack and bring down your server or databases or take over your website and inject codes into your web pages that affect other site users (this is known as a Cross-site Scripting attack).
With such cross-site scripting attacks, users to your site could have all communications from your site redirected to other sites, where phishing or other scam activities can be carried out, or their computers could be infected with malware that turns their machines into spam bots that the malicious users control.
The solution to these attacks is to securely validate all input to your website through any exposed entry points, whether web forms, comment boxes, etc.
Never trust any input into your system, and thoroughly validate any submissions you receive to ensure that the types of content you expect are what you’re getting and that no malicious scripts are being introduced to your system from your website’s entry points.
Tomas Statkus – CEO of ReviewedbyPro
The cheapest and the most influential small business security strategy is to use a VPN with a dedicated IP address (Virtual Private Network).
It can add many security features for the business, including malware protection, data encryption, Wi-Fi network protection, and secure connection to the website management systems, banks, CRM systems, etc.
Brad Snow – Cloud Computing Specialist at Bridgepointe Technologies & Co-founder of Tech Exec Roundtable
All employees must take security seriously and understand the potential ramifications of a breach.
All employees must be trained in security; I suggest training be done not just when onboarding but periodically throughout employment, such as a monthly refresher that includes pass/fail requirements. Also, phishing test emails are not a bad idea as a training component.
Updates: be sure someone is not just clicking past these.
Multi-factor authentication, a minimum of 2FA.
Firewall, don’t go cheap, but you don’t need to break the bank.
Limit exposure generally; if they don’t NEED access, don’t grant it.
Interview local MSPs if they are trying to scare you…it’s a red flag! You need someone who understands your work environment/flow and can help optimize security. If they aren’t, at minimum, mentioning all the things above, move on as well.
Security has to be taken seriously, and due to the ever-changing environment, it must be an ongoing effort. These are a few relatively simple things you can do independently, but no matter your size, hiring someone to handle them is worth exploring.
Scott Croskey – Global Chief Security Officer at Cipher Security and part-time US Air Force Cyber Warfare Officer at US Cyber Command
Small businesses still operating are likely doing so from a “work from home” (WFH) model. The best return on investment today is to protect your employee’s laptops/workstations.
At the same time, they work remotely with robust endpoint protection software and outsource the 24/7 management of it to a Managed Security Service Provider (MSSP).
This will cost a fraction of what it would cost to hire staff to support 24/7 operations fully. Also, ensure the MSSP can protect your cloud-based environments, if applicable.
David Bell – Cybersecurity Editor at CountryVPNs
I believe a small business that can’t afford to hire an MSSP or install cybersecurity technology should use a top-notch VPN service and a quality antivirus program.
A top-notch VPN service will not only help them hide their location by swapping their actual IP with the IP of the country they are connected to, but it will also encrypt their online communication so no one can access what they are doing online.
A quality Antivirus will block any malware used by cybercriminals in cyberattacks. So, if these two things are in place, small businesses have ensured their cybersecurity strategy.
Osama Tahir – Cybersecurity Editor at VPNRanks
As a Cybersecurity expert, here’s my checklist of cybersecurity best practices for small business owners.
Small business owners must understand the risk factors and arrange digital assets for online safety.
They must protect their network access with Safe Wi-FI, Strong firewalls and more.
Limited access: This is an access control strategy, but one needs to find out or research which person needs access to which data.
Educate employees continually to use strong and secure passwords.
Ensure that your gadgets/equipment/devices are updated to the mark and secure from cyber-attacks.
Safest Cybersecurity Strategy: You must maintain the backup and recovery for the safe side.
Help from experts: Cybersecurity is quite complicated, especially for small businesses; you need to hire a consultant for help.
Mihai Corbuleac – Information Security Consultant at StratusPointIT
There are many different approaches to cybersecurity, but the most critical aspect is to take action. To protect your business against any malware, it’s crucial to implement a 360-degree cybersecurity plan, including well-configured firewalls, antivirus software, a backup policy, and network security solutions to protect all connected devices.
Firstly, your security strategy should focus on identifying critical digital assets. Secondly, implement a secure communication method and create an efficient password management protocol. Safeguard your backups, and most importantly, educate your employees.
Other vital aspects – include using robust authentication methods (MFA – token, smart card, mobile app), physically securing equipment and ports, defining strong security rules for administrators, using traffic monitoring tools, performing regular internal security audits, etc.
For email security (because the email service is the primary vector for malware infections), you can handle it in-house with the right software (such as Mimecast) and regular security training for all email users, as it can significantly mitigate human error.
Shagun Chauhan – Business Consultant at iFour Technolab
Every company is different, and their needs must be unique from those of competitors. It starts with building a cybersecurity strategy covering all threats, policy-making, access control, etc. As you build out your plan, here is one of the strong pillars you must focus on.
Many threats, such as phishing, ransomware, drive-by-downloads, etc., threaten businesses. Understand the threat and plan a successful attack to secure your company.
By understanding the critical assets from hubs of the network to the personal devices used by the employees and customers of your company and taking stock of digital landscapes, one can learn how to protect them.
This is because steps should be taken to protect the business from sudden cyber-attacks, which may affect the company’s continuity and cause a loss of data.
Nick Santora – CEO and Founder of Curricula, A Cybersecurity Awareness Training Company
It’s security awareness training to recognize warning signs from potential hackers.
Small business leaders are running a mile a minute. They don’t have an IT team but have tremendous risk because one security breach could end them.
Your employees are on the frontlines to help protect your organization. It’s essential to teach employees how to be aware of threats, such as phishing scams.
For example, send real-world simulated email tests to your employees’ inboxes every month. It’s interesting to see how many people fail these tests and show the risk of being victims of a phishing scam.
Dan L. Dodson – CEO of Fortified Health Security
With the economic environment the world was operating in changing overnight, small businesses need to remember the fundamentals of cybersecurity and ask themselves how the new work atmosphere could pose a more significant risk of attack, how to address those risks, and how to respond to an attack.
Vulnerabilities must be identified to understand how cybercriminals can access a network. The small business community must adapt to these new business models to protect their hard-earned reputation and preserve the confidence of the people with whom they do business.
Sanjay Patoliya – Founder and Director of Teclogiq
Your business cannot operate effectively without access to your data. If you don’t back it up, your data may not be there for you when you need it the most.
A busy office creates thousands of files each day, and the secure backup of these files needs to be a part of your company’s cybersecurity strategy.
Backups should be made daily and mirrored in the cloud or an offsite server. An IT support and IT security professional should oversee backups.
Stuart Cooke – Marketing Manager at Evalian
In my opinion, educating your staff so that they can recognise the danger signs of a possible cybersecurity breach is the most crucial strategy for a small business.
Adequate cybersecurity training will ensure that your staff are more likely to spot suspicious activity and report it before it worsens. This could be the difference between addressing a data breach and stopping it before the hacker can get into your systems.
By training your staff on the signs to look out for, they will be less likely to open suspicious emails from addresses they don’t recognise and know to flag anything they believe to be fraudulent. The best rule to implement across your team is ‘if in doubt, flag it with an appropriate team member just to be safe’.
Chris Noles – President of Beyond Computer Solutions
There is no silver bullet to prevent a cyberattack, but there are layers of protection that you can implement to reduce your risk significantly. Cybersecurity is like having a monitored alarm system in your home so that you can detect intrusions.
Here are some essential guidelines to follow:
Multifactor or Two Factor authentication: You should enable this for all websites that contain personal, financial or healthcare information. It would be best to allow this for your email to prevent business email compromise.
Train your staff – this is extremely important because attackers are not hacking their way in – companies are letting the attackers in because they are tricked by phishing emails!
Change passwords every 60 to 90 days, and don’t use the same password for multiple websites.
Have a computer use policy for your staff that defines how technology can, and more importantly, SHOULD NOT be used.
Update your computer systems with the latest updates
Partner with a Cybersecurity solutions provider like Experian or SpyCloud that focuses on detecting intrusions before they become breaches. Unfortunately, most companies are compromised months before being aware of an intrusion.
Erik Kangas – Founder of LuxSci, Former Senior Software Engineer at Akamai Technologies, and currently a Visiting Professor in Physics at MIT
The best general advice for a cybersecurity strategy would be to hire intelligent, experienced cybersecurity people and place them in positions of authority concerning product development, IT infrastructure, and vendor choice.
They can help guide your organization to a solid cybersecurity footprint that is customized and appropriate for your particular business.
Beyond that, outsource any IT services to vendors respected for their security programs. This lowers IT costs and your organization’s risk and liability concerning security.
Steven J.J. Weisman, Esq. – Lawyer, Author, College Professor at Bentley University, and Owner of Scamicide
Small and medium-size businesses are significant targets for cyberattacks. Often, small and medium-sized businesses don’t correctly establish security protocols and fail to monitor and update security procedures.
While steps such as establishing proper firewalls, using security software and updating it as soon as updates are available, encrypting data, using strong passwords, using dual-factor authentication and not permitting unauthorized devices to be plugged into office computers are all essential elements of a security plan, the best thing that any company can do is to train its employees to recognize and avoid phishing and spear phishing emails and text messages.
Spear phishing emails are the basis of almost all cyberattacks; training employees to recognize these phishing emails and having a policy of not clicking on links or downloading attachments unless verified to be legitimate is the best thing a company can do.
Alex Artamonov – Systems Engineer and Cybersecurity Specialist at Infinitely Virtual
Due to both limited budgets and limited personnel, small businesses need to focus on immediate threats. Given resource constraints, training end-users are typically Job #1. That means mitigating such intrusions as phishing and malware infections; the most cost-effective way to do so often involves turning to paid and free courses online.
Step #2 is creating an effective security policy consisting of strong passwords, regular password changes and two-factor authentication. That last item may prevent unauthorized access to confidential data, even if a user account is compromised.
Step #3: turn on the auto-update feature within the OS and any app. Step #4: Install anti-malware software from a reputable vendor. Finally, perform regular backups to local media and offsite storage (e.g., the cloud). Verify that backups were successful, and do regular test restores.
Alex Paretski – Knowledge Manager at Itransition
Regardless of their size, businesses must stick to the continuous security approach to guarantee the protection of their digital assets and data.
Unlike large enterprises, smaller companies can succeed in guarding their cybersecurity without investing in complex solutions. Instead, they can focus on more frequent employee security training, endpoint and device protection.
Small companies can also run comprehensive security tests more often than large companies.
For example, they can perform penetration testing and vulnerability assessments every six months or after any software and hardware modifications are made. These are some of the most effective activities to proactively detect and fix security defects promptly.
Mark Stamford – Founder of OccamSec
Determine your critical assets and how much risk you are willing to assume. Risks include fines for getting hacked and increased insurance premiums.
Securing Wi-Fi and strengthening passwords are crucial. Finally, small businesses have decided how to secure their assets with their budgets.
And the risks are real. We breached a company full of social media users by friending them on social media and ultimately having them send us passwords – most strategies around small businesses will not focus on social media security.
Still, in this case, they should have. Bad guys don’t follow a ‘book”; they find the easiest way in and exploit it.
Adi Donna – Founder of Cozy Down Home
The firewall is a set of programs that protects the internet from hackers and prevents them from accessing data through private networks. Users can enable firewall protection from their system settings or install free firewall software available online.
Since most businesses work from home and hackers are more active than before, it is best to protect the internet connections so your relevant documents are not cracked or hacked during transferring.
If using mobile devices to hold company credentials, protect the devices with strong passwords and encrypted data, and install security apps to prevent your files from stealing when the phone is using public networks.
Ken Jenkins – Principal and Founder of EmberSec
A threat-informed cybersecurity posture remains a robust approach. This includes understanding threats and the business’s risk tolerance.
Instead of protecting on-prem employee workstations, sensitive data, and critical infrastructure, companies must focus on the attack surface and cover cloud-hosted solutions, including email, collaboration capabilities, authentication systems, and file sharing.
Understanding the cybersecurity baseline and reestablishing how to defend against it will strengthen the cybersecurity posture and raise the cost to adversaries.
Other recommendations:
Enforce the use of multi-factor authentication
Prioritize email security and boost anti-phishing training and awareness
Continuously patch applications and operating systems
Apply the CIS Top 20 framework
Gintaras Steponkus – Marketing Manager at SolidGuides
Cloud backup service is no longer optional for small businesses as data backups have become necessary due to cyber attacks. However, there is a difference between the speed and reliability of the services available in the market.
Use services with high data transfer rates and strict security measures such as 2FA authentication, end-to-end encryption, etc.
Your data backup service should be on all the employees’ laptops dealing with company documents. Moreover, sometimes you need your data quickly, so choose the one that provides data delivery services on hard drives.
Steve Harrington – Vice President at Cygilant, a SMB-focused Cybersecurity Provider
Today’s small businesses face a trio of problems – fewer financial means, continued difficulty in hiring needed talent, and a continued onslaught of threats and breach attempts from cybercriminals who view their systems as easier to infiltrate. For many, this resource crunch has been exacerbated by the pandemic crisis.
Small businesses would be wise to seek managed services partners who can extend their team’s capabilities with automated technology and hands-on expertise, helping them overcome resource constraints while actively reducing threats and making compliance reporting easier.
Limiting the time small business IT staff need to spend managing daily alerts will maximize their time for situations more critical to the business.
Jeff Kuhn – Senior Solutions Architect and Senior Partner at New England IT Partners
Small businesses need to ensure they are protected from cyber criminals, as 1 in 5 small businesses fall victim to some cyber attack. While the company may be small, the target on them is much more significant from the eyes of the attackers.
Small businesses believe they won’t be targeted because of how small they are, so they spend less on protection. As most cyber-attacks are aimed at small businesses, they must implement as many security countermeasures as possible.
Tom Mowatt – Managing Director of Tools4ever
The best strategy you can use to protect your small business is a pre-emptive one. By implementing proper processes and instilling detailed access management, you can prevent most potential security threats before they even happen.
With an identity and access management solution, you can track which employees can access specific resources and enforce the Principle of Least Privilege (POLP) to ensure that no employee receives more access than needed to perform their job function or role.
Using these types of pre-emptive measures can significantly benefit the security of your business and can dramatically reduce any potential risks/breaches your organization could face.
Bottom Line
SMBs are open to cyber attacks as well as large enterprises. The alarming rate by which these cyber threats occur necessitates an effective cybersecurity strategy to counter such threats.
This roundup post has uncovered the most effective cybersecurity strategies that small businesses can adopt to protect their ventures.
Likewise, the interviewees have poured out their suggestions from practical experiences. They’ve overcome varying cybersecurity threats.
If you’re a small business owner yet to gear up your cybersecurity strategy, it might help to start implementing any of the abovementioned tips.
So, any time you encounter online security issues, you can apply any of the 48 tips in this post as a compass for your cybersecurity plan.
Web development is a very important part of the cyber world and also very lucrative. According to Bitdegree, web developers earn about $90,000 yearly salary.
As a web developer, you’re tasked with programming websites and web applications/software. There are two phases to this: front-end web development and back-end web development. One can either be a front-end or back-end web developer; you can as well be both.
In this post, we shall focus on front-end web development as we’ll be looking at how you can become a badass front-end developer.
Before getting to that, you must understand what front-end web development is all about.
What Is Front-end Development All About?
When we talk about the front end of a website or web application, we are talking about what the visitors see. This includes colours, texts, shapes, images, and extra perks.
It has to do with object-oriented programming, which involves creating interactive and responsive web elements, and that’s why you should definitely learn Java as well so you can understand the full process.
After a web designer or UI designer has sketched out the interface of what a website or web application should look like, the front-end developer then programs the website or application to look just like that.
This programming involves using development or coding languages which in this case are majorly HTML, CSS, and JavaScript.
What differentiates front-end from back-end web development is that the former has to do with the server side, the behind-the-scenes, which web visitors do not see.
How To Be A Badass Front-end Developer
Learn
This first step is the most important because it’s the basics of everything. If you want to be a badass front-end developer, you need to learn how to.
To start with, you need to learn the three major front-end developing coding languages. As mentioned before, these include HTML, CSS, and JavaScript – ideally, you learn them in this order.
HTML is the easiest of all three as it is just a coding language for e-documents or web pages. It has to do majorly with texts and their formatting.
With CSS, you get into web building and describing HTML pages. Think of it as an adjective and HTML as a noun. It has to do majorly with adding styles like fonts, colours, spacing, etc.
JavaScript is a high-level programming language and, thus, the most advanced. It has to do with object-oriented programming, which involves creating interactive and responsive web elements. On the other hand, you can hire JavaScript developers if you don’t have coding knowledge.
It takes quite a time to get a hang of all three languages. JavaScript alone takes about 6 – 9 months so if there’s anything you’ll need, it’s patience.
Practice
Practice might not make you perfect, but one thing it will certainly do is cause improvement. To be a badass front-end developer, you should practice as much as you can.
By practising with the coding languages, your focus is placed on track because practice maximizes training. Also, you can even discover some unique developing techniques on your own by just playing around.
You can purchase a domain & host for testing sake. Use it to try your hands on what you’ve learned so far and see how it goes. There are some code-writing applications you can also download and use, thereby saving money.
While you should practice, you should do it wisely so that you do not go overboard.
Study Other Works
Learning from others is crucial not just in the cyber industry but in every aspect of life. As you begin your journey to front-end development, keep in mind that others have been there, and more are still coming after you.
You can study and learn from others directly or indirectly. Direct involves reaching out to them. If you can reach these other developers, they might be kind enough to reveal their scripts which you can further study.
On the other hand, you can study others indirectly by simply observing and imitating their works. Look up the front end of websites and web applications that other developers have created and try to recreate them.
As you study others, look for their programming strengths and flaws – you learn from both.
It is important to know that the cyber world is always evolving. Take HTML, for example; there have been several HTML generations since its inception.
As of 1991, it was just HTML, but now developers utilize HTML 5 and soon enough, HTML 6 will arrive. The same goes for CSS, as we now use CSS 3 while expecting CSS 4.
If you’re going to be a badass front-end developer, you don’t want to stay behind while other developers are going in on the latest trend of these coding languages.
Staying updated is not difficult. You can follow web development blogs or join web development forums, groups, and communities on social media platforms. Likewise, you can follow web designer news as well for the latest information.
Understand Cybersecurity
The websites you develop should be secured which is why you should understand cyber-security. As a matter of fact, front-end security is a unique aspect of front-end web development.
The most common types of cyberattacks targeted at the front end include Cross-site scripting (XSS), Cross-Site Request Forgery (CSRF), and Denial of Service (DOS) attacks.
Ensuring that your front-end codes are well encrypted is one of the best web security implementations you can try.
Additionally, you can make use of web application firewalls like Sucuri WAF, Fortinet FortiWeb, Symantec WAF, Citrix NetScaler App Firewall, Barracuda WAF, Imperva WAF, and others to secure your website.
How To Be A Badass Front-end Developer: Frequently Asked Questions
The path to becoming a front-end master is paved with dedication, continuous learning, and a sprinkle of awesomeness. Here are some FAQs to guide you on your journey:
How can I be a strong front-end developer?
Master the Fundamentals: Get a solid grasp of HTML, CSS, and JavaScript (JS). These are the building blocks of the web, and proficiency in them is essential.
Deepen Your JS Expertise: Dive deeper into JavaScript, exploring frameworks like React, Angular, or Vue.js. These will help you build complex and dynamic web applications.
Embrace Responsive Design: Learn how to create websites that adapt seamlessly to different screen sizes and devices. Responsive design is crucial in today’s mobile-first world.
Sharpen Your UI/UX Skills: Understand user interface (UI) and user experience (UX) design principles to create interfaces that are not only visually appealing but also intuitive and user-friendly.
Practice, Practice, Practice: There’s no substitute for hands-on experience. Build projects, experiment with new technologies, and push your boundaries.
How can I improve myself as a front-end developer?
Never Stop Learning: The web development landscape is constantly evolving. Stay updated with the latest trends and technologies by reading blogs, attending workshops, and taking online courses.
Challenge Yourself: Step outside your comfort zone and tackle complex projects. Embrace the struggle; it’s how you learn and grow.
Contribute to Open Source: Contributing to open-source projects is a fantastic way to gain real-world experience, learn from others, and build your portfolio.
Network with Other Developers: Connect with other front-end developers through online communities, meetups, or conferences. Share your knowledge, learn from their experiences, and build a strong network.
How do I become a high-paid front-end developer?
Become Highly Skilled: The higher your skillset and expertise, the more valuable you become. Focus on mastering the fundamentals, expanding your knowledge, and staying ahead of the curve.
Build a Strong Portfolio: Showcase your best work in a well-curated portfolio that demonstrates your abilities, problem-solving skills, and design sense.
Negotiate Effectively: Learn how to negotiate your salary with confidence. Research average salaries for front-end developers with your experience level in your region.
Market Yourself: Build your online presence, network with potential employers, and actively market your skills and experience.
What is the hardest part of being a front-end developer?
Keeping Up with the Pace: The tech world moves fast, and it can be challenging to stay updated with the ever-evolving landscape of frameworks, tools, and best practices.
Browser Inconsistencies: Different browsers can render code slightly differently, which can lead to cross-browser compatibility issues that add complexity to development.
Balancing Creativity and Constraints: Front-end developers often need to strike a balance between their creative vision and technical limitations or project requirements.
Client Feedback: Effectively communicating with clients, managing expectations, and incorporating feedback while maintaining your vision can be a challenge.
Can I learn front-end development in 2 months?
While you can grasp the basics of HTML and CSS in a short period, becoming a proficient front-end developer typically takes longer. It requires dedication, consistent practice, and a willingness to learn new things throughout your career.
What do most front-end developers use?
Text Editors/IDEs: Most developers use code editors like Visual Studio Code or Sublime Text, or Integrated Development Environments (IDEs) like WebStorm for writing code.
Version Control Systems: Git is a popular version control system used to track code changes and collaborate with others.
Build Tools: Tools like Webpack or Gulp automate tasks like minifying code, compiling Sass/Less to CSS, and managing dependencies.
DevTools: Browser developer tools are essential for debugging code, inspecting elements, and analyzing website performance.
Final Thoughts
Becoming a badass front-end developer requires a lot on your part; there’s no easy route to it. The more you practice and take on front-end web-developing tasks and projects, the better you’ll get.
Most importantly, you have to learn and be conversant with the three front-end coding languages – HTML, CSS, and JavaScript. Know them like your alphabets – A B C – and like your numbers – 1 2 3.
This is just the beginning of your front-end developer journey. Embrace the challenges, celebrate your wins, and keep learning. Remember, the road to becoming a badass is paved with passion and perseverance!
Also, know that you cannot be a badass if you let hackers and other cybercriminals hijack your websites.
You will need to be dedicated and patient in your pursuit. Only then can you be taking home $90,000 salary or more at the end of every year like a badass.
Note: This was initially published in June 2020, but has been updated for freshness and accuracy.
In this exclusive interview, we spoke with Paul Lipman, the CEO of BullGuard, an award-winning cybersecurity company focused on the consumer and small business markets.
Due to the COVID-19 pandemic, cyber-attacks have been on the increase in the cyber sphere. In fact, both individuals and enterprises have been at the receiving end of the cybersecurity threats.
So, we spoke with Paul Lipman to learn more about the BullGuard company, their cybersecurity solutions, and how to combat these cyber-attacks.
1. The COVID-19 pandemic has caused a rise in the usage of VPNs and Antivirus products but cyber attacks have also been on the rise, do you think they correlate?
Paul Lipman:
They absolutely correlate. Natural disasters, pandemics and other major media events are a boon for cybercriminals.
We’ve seen a dramatic rise in cyber-attacks during this pandemic as a result of two main factors.
First, the massive disruption caused by the abrupt transition to working and studying from home has dramatically lowered cyber-defences across the board. Hundreds of millions of people are no longer protected by corporate networks and IT teams.
Second, the current uncertainty has left most of us more susceptible to social engineering and phishing attacks. We’ve seen everything from malicious COVID-19 tracking apps, to phishing emails purporting to come from HR departments, fake PPE sites scraping credit card details, PPP-related phishing and fake websites and much more.
2. Most of the cyber attacks point towards data exfiltration, how can VPN and Antivirus be used against such? Are there other security tools that should be used?
Data exfiltration is certainly a significant concern to both consumers and businesses. We see this kind of breach being typically executed through a phishing attack and/or malware.
Endpoint security products (the modern incarnation of AV) provide multi-layered protection against both phishing and malware, identifying malicious activity before sensitive data can get compromised.
Attacks have become significantly more sophisticated over time, making traditional signature-based AV insufficient. BullGuard utilizes machine learning models to enable us to detect and block attacks that have never been seen before (so-called “zero day” exploits).
3. How would you advise companies to respond when they fall victim to cyber attacks?
There are six key actions that you must take if your company has fallen victim to a cyber attack:
Take all systems offline. At this point, you don’t know what damage has been done, or whether your systems are exfiltrating data or being accessed by bad actors. This is a critical damage mitigation step.
Change credentials. According to the 2020 Verizon Data Breach Investigations Report, compromised credentials were involved in 80% of hack-related breaches. It’s imperative to change credentials for all systems, and ensure that you are using appropriate password policies, approaches and enforcement, e.g. 2FA (Two-Factor Authentication)
Engage your incident response team. If you have an internal security team, then they should immediately begin the forensic process of assessing what happened and the impact to your systems, business and customers. If you don’t have the internal expertise, then you should immediately engage a firm that specializes in cyber-response.
Inform authorities. Depending on the type of breach, you will need to inform the relevant law enforcement and/or regulatory authorities.
Internal and external communication. You’ll need to communicate honestly, directly and rapidly with your internal organization and affected customers and partners.
Overhaul protection and processes. Ensure that you understand how the attack happened, and re-visit your cyber-protection stance (policies, processes, systems) to step up your defense and preparedness for the future.
4. Not long ago, BullGuard launched a new 2020 security suite – BullGuard Internet Security 2020; are there any innovations customers should expect in future?
Cyber adversaries don’t sit still, and neither does BullGuard. A critical area in which we are devoting substantial resources is developing innovative new approaches to applying machine learning to the challenge of identifying and blocking cyber threats.
This is the leading edge of modern cybersecurity, and we have some exciting developments in this area we’ll be launching soon to help deliver the best possible protection to our customers.
We recently launched BullGuard Small Office Security, which provides highly effective, easy-to-use, centrally managed endpoint security for small businesses. We’re adding some exciting new capabilities to this product, and services to better support our partners in selling and servicing their corporate endpoint security customers.
5. With over 19 years of operation, what is the strength of your company against its competitors?
BullGuard’s promise to our customers — “We keep you safe, and we keep it simple.” — has remained constant throughout our history and is at the core of everything we do.
We’re singularly focused on providing industry-leading protection to our customers through products that are extremely powerful but delightfully easy to use. And we back this up with exceptional customer service, available in eight languages across all time zones.
The other central aspect of what makes BullGuard different is our dedication to our channel partners. We were honoured to have been named “Company of the Year” in the prestigious PCR awards.
This is a testament to the services, support and commitment to our network of channel partners around the world. BullGuard has paid over €20 million in revenue share to our partners, and we are committed to their success.
Thank you for your time, Paul Lipman.
Note: This was initially published in May 2020, but has been updated for freshness and accuracy.
Paul Lipman’s Bio: Paul Lipman is the CEO of BullGuard, an award-winning cybersecurity company focused on the consumer and small business markets. He has extensive experience building and leading security and consumer technology companies and is a recognized thought leader on cybersecurity, data privacy and IoT.
Before joining BullGuard, Paul was CEO at iSheriff, a recognized cloud security innovator acquired by Mimecast. Prior to this, he held the CEO role for Total Defense, a high growth consumer security business, which Untangle acquired. Paul has also held leadership positions at Webroot, Keynote Systems and Accenture.
Paul holds an MBA from Stanford and a Bachelors in Physics from Manchester University. Outside of work, Paul is an avid snowboarder and amateur astronomer and dabbles in quantum computing.
Aarogya Setu app, India’s contact tracing app for Covid-19, has become the latest government-backed app to be threatened by cybercriminals who have developed clones to steal data from users.
According to Sonic Wall Labs, a California-based cybersecurity firm, there have been several cloned malware apps masquerading as the legitimate Aarogya Setu app that maliciously infects user’s smartphones.
The cloned apps were designed to install monitoring malware on infected smartphones and to steal sensitive data, including banking and login details. With the legitimate Aarogya Setu having recorded about 10 million downloads since its launch in April, the clones are most likely to hit about two hundred thousand downloads.
How Does Aarogya Setu Contact Tracing App Clone Apps Work?
The Regional Sales VP – of Sonic Wall Labs, Asia Pacific, Debashish Mukherjee, in a statement, said that the malware, once downloaded on smartphones, can record audio, send SMS, and make calls, also, without granted permission. The malware app can be launched each time the infected device is rebooted.
He continued by saying, “The method of installing the Aarogya Setu app running in the background remains common, but threat actors exploit this method to deceive victims into thinking they are using the legitimate application while using the malicious app to execute functions in the background.”
The researchers explained that the attack on the contact tracing app is not peculiar to India alone, after identifying about 12 COVID-19 contact tracing apps around the world with cloned contact tracing apps. For instance, countries like Brazil, Indonesia, Iran, Russia and a host of others as contained in a release.
How To Identify A Real Contact Tracing App
The fake app is armed with the Aarogya Setu icon, which, on closer evaluation, appears stretched to deceive users into believing they are downloading the legitimate app.
The security research firm says that “Most fake apps have poorly written reviews and comments, which is one of the signs that you are on the wrong app.”
Downloads from unofficial sources should be deleted while running an antivirus scan to detect any hidden infections on your device. If you cannot delete the app after installation, perform a factory reset on your device to get rid of the threat.
Aarogya Setu is a mobile app developed by the Indian government to help slow the spread of COVID-19. It uses contact tracing technology to identify people who may have been exposed to the virus.
How Does Aarogya Setu Work?
The app uses Bluetooth technology to exchange anonymous digital tokens with nearby phones. If a user tests positive for COVID-19, they can choose to anonymously notify others who have been in close contact through the app. This allows those potentially exposed individuals to get tested and self-isolate, potentially preventing further spread of the virus.
What is the meaning of Arogya Setu?
“Aarogya” means “health” in Sanskrit and Hindi, and “Setu” means “bridge.” So, Aarogya Setu translates to “bridge to health.”
Contact tracing is the process of identifying people who may have been exposed to an infectious disease by coming into close contact with someone who is infected. Traditionally, this involves public health officials interviewing infected individuals to determine who they have been in contact with.
What are the Benefits of Contact Tracing?
Helps Slow the Spread: By identifying and notifying potentially exposed individuals, contact tracing can help break the chain of transmission and slow the spread of the virus.
Early Detection and Isolation: Early notification allows potentially exposed individuals to get tested and isolate themselves if necessary, preventing them from unknowingly spreading the virus to others.
Informs Public Health Efforts: Contact tracing data can be valuable for public health officials to understand transmission patterns and allocate resources effectively.
Hope you find this helpful?
Note: This was initially published in June 2020, but has been updated for freshness and accuracy.
Honda Global Operations just confirmed that their network has been a victim of a cyber attack. This was first confirmed via a tweet by the Honda Automobile Customer Service on June 8, 2020.
The tweet reads,” At this time, Honda Customer Service and Honda Financial Services are experiencing technical difficulties and are unavailable. We are working to resolve the issue as quickly as possible. We apologize for the inconvenience and thank you for your patience and understanding.”
In addition to this, a statement was released. This statement confirmed that the recent cyberattack on Honda’s global operations had a major effect on computer and email servers, so it is difficult to access internal systems.
Although the statement didn’t really dive into details, it confirmed that the attack was from an external source and was spreading throughout the Honda network.
Honda Production Systems Affected Globally
Notably, the attack on Honda’s global operations affected production systems, not just in Japan but in other operating countries as well. Honda is renowned for producing cars, motorcycles, lawnmowers, generators, and more. With production systems affected, the output is bound to be slow.
So far, there have been activities aimed at minimizing these effects in other for production to return to normal.
According to cyber-security professionals, the cause of the cyberattack has been linked to ransomware with the idea that the hackers locked out some of Honda’s IT systems with data encryption techniques.
Morgan Wright, Sentinel One’s security advisor implied that the attacks resemble one in which the Ekans ransomware was used. This is a type of ransomware that is used to target industrial control system networks and, as such, has disrupted Honda’s manufacturing systems.
However, Honda confirms that there have been no data stolen and the effect has been quite minimal business-wise.
In the buzz of these events, it was revealed that production in the UK factory in Swindon has been put on hold including that in other regions like Italy, North America, and Turkey.
Honda Hit by Cyberattack: Frequently Asked Questions
The recent cyberattack on Honda has raised concerns about cybersecurity and its impact on major corporations. Here are some FAQs to address what happened and clear up some misconceptions:
Has Honda been hacked?
Yes, Honda confirmed that they were the victim of a cyberattack in June 2020. This attack affected their computer and email servers, disrupting internal systems and impacting production across various countries.
Why are modern power systems prone to cyber threats?
This question is more relevant to cyberattacks on critical infrastructure, like power grids. Honda, in this case, is a manufacturer of vehicles and other equipment. However, modern systems in any industry, including manufacturing, are increasingly reliant on computer networks and control systems, making them vulnerable to cyberattacks.
What is the first step in the cyber attack cycle?
The first step in the cyber attack cycle can vary, but it often involves reconnaissance. In this stage, attackers gather information about their target, such as vulnerabilities in their systems or network configurations.
Let’s focus on the Honda incident. What is the suspected cause of the attack?
Cybersecurity professionals suspect the attack involved ransomware. Ransomware is a type of malware that encrypts a victim’s data, making it inaccessible. Attackers then demand a ransom payment in exchange for a decryption key.
What about the impact on Honda production?
The attack did disrupt production systems globally. Honda took steps to minimize the effects, but production in factories located in the UK, Italy, North America, and Turkey was reportedly put on hold.
Note: This was initially published in June 2020 but has been updated for freshness and accuracy.
What are CATI telephone investigations? What is the CATI method? Read on to find out…
Every company needs to perform various analyses to see if it is doing well. The considerations are made above all on the level of customer satisfaction if they return to buy, or if they prefer to turn to competitors.
The best market research is done through surveys or questionnaires that address the customer in person, asking them for an evaluation of a product or service, customer service, and much more.
In cybersecurity, market research is vital, and surveys are a valuable tool. This section explores the role of surveys in collecting data to assess customer satisfaction and preferences.
Surveys can be carried out in different ways; the most used are online surveys and telephone interviews recorded with CATI software, which involves entering the answers into an automated program.
The term “CATI” translates as: Computer-Assisted Telephone Interviewing and indicates a method that uses telephone interviews, in which the interviewer reads the interviewee’s questions and records the answers on specific software.
This survey method is considered very useful because it is not necessary to hire a specialized person; the employees of the marketing department can manage the questionnaires independently since the software is easy to use and there is no need to process the data.
CATI Method: A Cybersecurity Perspective
Surveys can be carried out in different ways, one of which is through telephone interviews recorded with CATI software. This involves entering the answers into an automated program. This section delves into the CATI method and its relevance in cybersecurity.
The term “CATI” translates as: Computer-Assisted Telephone Interviewing and indicates a method that uses telephone interviews, in which the interviewer reads the interviewee’s questions and records the answers on specific software. In this subsection, we break down what CATI stands for and how it works.
How The CATI Method Works
The CATI method was born during the seventies in the United States and then spread all over the world. Telephone interviews are especially suitable for B2B targets, as they can be planned based on the availability of the interviewees.
This method was promoted to eliminate all factors that reduce the quality of data collected through traditional telephone interviews. Thanks to the use of CATI software, operations can be facilitated processes more fluidly and faster without having to invest too many resources.
It is, therefore, a good investment for any company that wants to do market research and involve different targets.
Putting this method into practice is very simple: a sample is extracted from the list of names to be interviewed, setting parameters to be followed during the extraction.
If you also want to include those who are not on the list, you can rely on the random generation of numbers, which are divided according to geographical areas.
Not all people appreciate receiving telephone interviews, so it is always best to ask for their consent. During the interview, the questionnaire can be read from the computer monitor to the interviewer, who will enter the answers quickly.
Although the online mode is most appreciated today for doing online questionnaires, telephone interviews can still work if they are used in the right way. A company can obtain several advantages using the CATI method:
Optimization of the timing of telephone interviews and data collection thanks to the use of specific software;
direct contact between interviewer and interviewee, there are no misunderstandings or incorrect answers since any doubts can be clarified immediately;
more efficient work performed in real-time, without having to involve other figures within the company;
saving money because there are no large operating costs;
customer evaluation that is reliable and useful for the growth of the company;
better response rate, especially in the B2B sector.
The Use Of The CATI Method In Customer Satisfaction
Before choosing the CATI method to conduct investigations, it is necessary to understand in which sector to use it. In fact, in some cases, it is not recommended, especially when the target is very young, while it is appreciated more in customer satisfaction.
Thanks to this method, it is possible to measure the degree of satisfaction with the products, services, and user experience.
The data that is extracted is very important because it helps the company to focus on customer loyalty, allowing the marketing team to create targeted strategies. A company should use CATI surveys if it wants to have an in-depth assessment of:
customer satisfaction with a particular product or service;
customer support and shopping experience;
launch of a new product/service;
market research on a particular niche;
what customers think of competitors;
problems on the website, in the shop, or in the purchase of products or services.
Interviewing customers directly allows you to get honest and valid answers. In this way, changes can be made in the company and meet customer requests, so as to make them happier and more satisfied.
The analysis of competitors should always be taken into account to analyze what their strengths and shortcomings are in order to be able to offer a better product, a lower price, and a more attentive service.
The main advantages of the CATI method are: the possibility of interviewing people who are difficult to reach by other means, being able to use professional tools for quality control, but also efficiency, speed, and minimal costs.
Thanks to this method of telephone interviews, companies can collect a lot of data, avoid errors through the use of professional software, and optimize times. Usually, the CATI method is used in large numbers, especially to make surveys that are repeated over time.
Conclusion
In conclusion, I will say that CATI is a valuable tool for cybersecurity organizations to collect accurate data and gain insights into customer satisfaction, competitive analysis, and user experience.
Its global adoption and versatility make it a promising solution for fortifying cyber defences and improving customer relationships.
Exclusive interview with Dan Fusco, CEO of InnerPC
In this exclusive interview, we spoke with Dan Fusco, CEO of InnerPC to learn more about their managed IT services, cybersecurity tips for remote working, and more about their company.
InnerPC is a managed IT services company based in New York that helps individuals and small businesses with computer installations, upgrades & repairs, networking, data recovery & transfer, virus & malware issues, and computer tutoring.
Here are Dan Fusco’s responses to our questions:
1. Question: Your company has been operating for over ten years now; how has the journey been so far?
Dan Fusco: Starting a business is no easy feat. I remember when I first started. I had decided to fix laptops, but I had no idea how to get the word out that I was doing this. One day I was walking by the Saturday flea market on 79th street and saw that businesses had tents set up offering goods and services. The next week, I had a tent and was offering to fix laptops for $35.00. My schedule for fixing laptops got filled up fast!
As time went on, I would often look at the high-rise buildings, and I would ask myself, “How do I fix computers in those offices?”. Every day I would come up with different ideas about how to get in contact with the partners or C-level employees in order to show them how I could make their IT department run more efficiently. Today InnerPC is responsible for managing the IT departments for more than 30 businesses in those buildings.
I remember fixing a laptop for a very wealthy business owner when I first started out, and I asked him what his key to success was, and he asked, “Is making even one penny profit?”
2. Question: With the need to work from home due to the pandemic, has there been an increased need for managed IT services & support?
Dan Fusco: COVID-19 has had a huge impact on businesses. During the past 3 months, I have hosted webinar events for the Chamber of Commerce, NCCPAP, and LITS, on ideas of how to work remotely in a fast, secure way. Our clients are already set up to work remotely as we host their data in partnership with Microsoft and the Azure infrastructure. They have had zero downtime during this pandemic.
Conversely, there are a lot of businesses that are not set up to work remotely and did experience significant downtime. For these businesses, we are helping them create a roadmap for their IT department so they can work from anywhere in the world. There has been a huge amount of interest in working remotely and we are currently creating IT plans for many businesses.
3. Question: What is your advice to online businesses working remotely in terms of cybersecurity?
Dan Fusco: I often speak on Cyber Security at trade shows and for businesses. There are 5 key ingredients you need to work remotely securely:
1: Filter all emails before they get into your inbox.
2: Have an Anti-virus and firewall installed on your network
3: Back up your Data!!!! (Extremely important.)
4: Implement 2 Factor Authentication for logging into your network
5: Monitor and maintain patches and updates for desktops and servers
4. Question: Based on your experience in the industry, how important would you rate data backup & network documentation?
Dan Fusco: Wow, this is the question of the day. When I speak about backing up data, I often ask who in the group is backing up their data. Only about half the room raises their hands. I also have found that the people who are backing up data have no idea how it is being done. They don’t get reports on successful backups and they are not backing data up offsite.
Backing up data both onsite and offsite is crucial for protecting your company against lost data and ransomware. Ransomware is a virus that encrypts your data, this virus can put you out of business. If you back up your data, you can easily recover those encrypted files.
Documentation is a key point in resolving issues in a timely manner. We document everything from usernames to IP addresses for firewalls. It helps technicians get access to crucial data to be able to troubleshoot and fix issues right away.
5. Question: InnerPC offers efficient service delivery to clients; what measures do you take to ensure that you meet up with this?
Dan Fusco: Standard operation procedures are the key to creating an IT department that runs smoothly. We have a unique way of managing data in which there is 99.9% uptime.
To keep these systems running smoothly, we have a huddle meeting with all our technicians every morning to discuss any IT issues people are having and then come up with different ways of resolving those issues. We also are part of a network of 1000 other IT professionals, so we have access to a huge amount of knowledge.
Our clients are particularly happy that we answer the phone. This sounds simple, but how many times do you call a company and you are on hold for 2 hours? We respond to phone calls in 5 minutes and most resolutions are finished in 15 minutes.
6. Question: What have been your significant achievement(s) in 2020 so far?
Dan Fusco: I am happy to say that our partnership with Microsoft is our biggest achievement. We work with consultants from Microsoft every day.
Together, we discuss both the technical aspects of Office 365 and customer relations. This partnership is the key for us to be able to manage large companies with 500 employees.
Note: This was initially published in July 2020, but has been updated for freshness and accuracy.
