Access – Peace Sign Pics Could Give Hackers Your Fingerprints

AccessBiometric Access – Finger Prints

Researchers at Japan’s National Institute of Informatics have claimed they can accurately copy fingerprints from digital photographs, raising fears that the access security of biometric authentication systems could be undermined.

Isao Echizen from the Institute told the Sankei Shimbun that his team was able to copy firngerprints based on photos taken from as far away as three metres, as long as they’re in focus and with strong lighting, AFP reported.

“Just by casually making a peace sign in front of a camera, fingerprints can become widely available,” the researcher claimed.

He argued that anyone could do so—without the need for advanced technology.

Social media, especially in Asia, is filled with the images of individuals doing the two-fingered ‘peace’ sign, taken with the increasingly powerful digital cameras found on smartphones.

That could lead to fears over the security of fingerprint-based authentication systems, although it’s not clear how easy it would be to transfer a captured fingerprint into a form which could be used to authenticate.

Researchers famously ‘cracked’ Apple’s TouchID system in the iPhone 5 and 6 models, but the method required a laser-printed image of the fingerprint and then a convoluted process of creating a mould with pink latex milk or white wood glue.

The skill, patience and time needed to do so would deter most criminals.

However, some commentators said the research still serves a valuable purpose in highlighting the problem with static biometric identifiers.

Robert Capps, VP of business development at biometrics firm NuData Security, argued that humans leave fingerprint data behind on everything they touch, adding that researchers have also been able to use photographs to trick iris scanners.

“Once biometric data is stolen and resold on the Dark Web, the risk of inappropriate access to a user’s accounts and identity will persist for that person’s lifetime. As the most stringent of authentication verifications deploy physical biometrics, such as immigration and banking, physical biometric data will become very desirable to hackers,” he argued.

“We can expect more creative attempts by hackers to capture this information. The benefit of passive behavioural biometrics is that the information used to uniquely identify a user is passively collected and dynamically analyzed, and has an extremely limited shelf life of usefulness—making theft and successful reuse of raw behavioural signals nearly impossible.”

For consumers, another option would be to wait two years until the NII launches a new transparent film currently in development, which is designed to hide the wearer’s fingerprints.

Article Provded By: Info Security Magazine

If you would like liquidvideotechnologies.com to discuss developing your Home Security System, Networking, Access Control, Fire, IT consultant or PCI Compliance, please do not hesitate to call us at 864-859-9848 or you can email us at deveren@liquidvideotechnologies.com

Failing to Prepare is Preparing to Fail with Network Security

Network Security

Network SecurityNetwork security is now a more pressing concern for businesses than ever before. Indeed, the concern around security/compliance has been found to be business’ #1 barrier to deciding to adopt the cloud, and last year, a report from Cisco estimated that one million cybersecurity jobs would appear in 2016, highlighting a level of investment and dedication not yet witnessed.

What, though, can companies do to help ensure that they are protected against enormously damaging breaches? We take a look at how organizations can help ensure their networks, sensitive data and other critical infrastructure are safeguarded from the huge number of threats now in play.

Be sure to automate

How can IT security departments manually detect threats when users, devices and applications generate such an enormous number of network connections, data transactions and application requests? Indeed, it’s like finding a particular needle in a large stack of needles.

Here’s where security information and event management (SIEM) software comes in, allowing businesses to centralise syslogs and events from network devices, servers, applications, databases and users, while also helping to automate threat detection and offering corrective responses to mitigate risk.

Automation is just one of the vital tools in the fight against security threats, with firewalls, anti-malware, and threat intelligence all having a part to play.

Get your framework in place

A comprehensive security framework is an absolute must for helping to ensure the safety of your organization’s IT. With an audit of the available inventory, from the types of transactions to BYOD policies and account roles, your company can get the framework off on the right foot.

An IT security framework is only achievable with a significant degree of cooperation, with management, IT and many other business departments all playing a part. Indeed, it only ends with the technology used, and is comprised of the organization working together to evolve and help ensure better security standards 

Keep an eye on endpoint devices

A flexible workforce is becoming a more pressing need for the modern enterprise, with employers and employees keen to make use of the freedom this approach can offer. Yet such an approach represents a threat. Say an employee with malicious intent and access to confidential data on their laptop decided to share this, how could you stop it? 

By monitoring all endpoint devices, from laptops, to mobile devices to a USB drive, you can help ensure sensitive data is not leaving your environment. For example, if a USB device is ejected/blocked automatically as soon as any nefarious activities take place, and corrective action, such as account blocking, is implemented then you can minimize the impact of an attack.

Keep insider threats at bay

The example used in the previous entry on this list – of a malicious employee – highlights that the most damaging security compromise can sometimes happen from the inside. By monitoring which users attempt to access sensitive data, as well as network traffic, logs and credentials you can identify and combat any insider threats, with monitoring able to flag any user attempting to access something they shouldn’t. 

Analytics are a must

The importance of gaining insights from your data using analytics cannot be overstated. With access to real-time network data, a business can identify and act upon suspicious network activity, seeing whether there are seemingly threatening connection requests from outside sources, or an increase in web traffic activity on a critical router or firewall.

Data-driven analysis can also help investigate the cause of an attack after the fact. If you’re unlucky enough to have been breached, then analytics are vital in discovering how it happened through root-cause analysis, and will help you figure out how to prevent it in the future. 

Be PCI DSS compliant

By being compliant with regulatory standards, your business not only helps to ensure better data protection, but also helps avoid fines or even criminal charges. This is a particular concern in the payment card industry, for example, where data breaches can mean compromising data from millions of credit cards. 

Complying with standards such as PCI DSS can help ensure all of the above. However, being compliant does not mean you can rest on your laurels, so make sure to leverage this obligation to actually increase security, instead of just trying to tick the box for a regulator. There are many ways you can do this, for example, if you are required to produce a report of all admin activity, have your internal security team review it as well. Make sure you get the most out of being compliant. 

While there are a number of other steps businesses can take to help ensure IT security is in the right place, from enabling threat intelligence to practicing knowledge sharing, the above tips should stand your organization in good stead for the threats that lay ahead. 

With the right preparation, people, strategy and tools, your company can be confident that it is ready to overcome the new challenges it is likely to face.

Article Provided By: Info-Security Magazine

If you would like liquidvideotechnologies.com to discuss developing your Home Security System, Networking, Access Control, Fire, IT consultant or PCI Compliance, please do not hesitate to call us at 864-859-9848 or you can email us at deveren@liquidvideotechnologies.com

How to Quantify the Risk of an Insider Threat

Insider Risk

risk

Never before have there been so many platforms that let a growing number of people touch, manipulate, download, and share sensitive data.

But there’s a dark side to all that access: It exposes a company to malicious intent and theft of information worth thousands, sometimes millions, of dollars. More alarming is the fact that less than half (42 percent) of all organizations have the appropriate controls in place to prevent these attacks, according to the Insider Threat Spotlight Report.

How do you get a handle on this threat? Mitigation begins with assigning risk levels to employee roles. Who has access to sensitive information, intellectual property, trade secrets, customer lists, and any other proprietary data? That’s the foundation of your risk model. Many companies use a simple numerical scale of 1-10, with 10 as the highest risk. Others may prefer simpler categories like Low, Medium, and High or yellow, orange, and red alerts.

It turns out that nearly 80 percent of employee fraud takes place in accounting, operations, sales, senior management, customer service, and purchasing. But it’s critical to establish a risk profile for everyone in the company, no matter which department. Take into account employees’ current roles, levels of privilege, and required access to proprietary information. Senior IT people and C-Suite executives obviously have more privilege and access than mid-level managers and clerical workers. And, of course, the higher the risk in a potential disaster, the greater the need to monitor an employee’s activities.

Prepare to update the risk profile of an individual. Organizations are dynamic, and employees regularly make lateral moves or get promoted. Someone who doesn’t touch sensitive information in one role may very well have access and new privileges in a different assignment.

Employees’ personal lives change constantly, too. A traumatic event, like a death in the family or divorce, psychological problems, or a shift in financial circumstances for the worse—any of these can cause behavioral changes in people. And they all may require re-evaluation of an individual’s level of risk.

Once you’re committed to the process, we recommend taking the following steps:

  1. Create an insider-risk team. While IT and its security team may oversee the monitoring of user activity, the process really requires support from the most senior ranks, as well as other departments. Your legal department help can help decide how to monitor while complying with the law and act as a critical liaison between executives and the security group. Human resources can help support the need and processes for monitoring, as well document employee cases—and put a “human” face on the operation.
  2. Designate risk levels. This, of course, is what I’ve been discussing in this post all along: using job titles to assign a scale of risk, depending on levels of privilege and access.
  3. Pinpoint inappropriate conduct. Just because you’ve assigned someone a high-risk level doesn’t necessarily mean that he’s committing an offense. Conversely, an employee’s inappropriate behavior can sometimes be misread as performance of normal job-related tasks. That’s why it’s critical to develop ways to identify truly improper conduct through changes in an individual’s communication and behavior. You can do that through software that is known as user-behavior analytics and, less technically, by means of procedures your employees can follow to report troublesome behavior.
  4. Set up a system of insider monitoring. When you’re establishing a system to keep an eye on employee activity and behavior, it helps to decide what level of monitoring goes along with the different risks they may pose to your organization. For example, someone in a low-risk category probably can’t interact with sensitive information and therefore needs little more than the less-technical sort of monitoring suggested above. Medium-risk employees do have access to proprietary data and, so, may require monitoring additionally with user-behavior analytics. So, too, with those high-risk individuals who should probably be subject to the most active monitoring and review.

Quantifying risk is just the start of mitigating insider threats. But if you develop the initial baseline—starting with job title and access to privileged information—you can get a better handle on which employees you will have to monitor during such critical periods as hiring, job title and personal changes, and the high-risk exit period.

Article Provided By: Info-Security Magazine

If you would like liquidvideotechnologies.com to discuss developing your Home Security System, Networking, Access Control, Fire, IT consultant or PCI Compliance, please do not hesitate to call us at 864-859-9848 or you can email us at deveren@liquidvideotechnologies.com