TECHNOLOGY

Next generation of phishing attacks uses unexpected delivery methods to steal data

Published

1 year ago

November 3, 2022

Netskope, a specialist in secure access service edge (SASE), has unveiled new research that shows how the prevalence of cloud applications is changing the way threat actors are using phishing attack delivery methods to steal data.

The Netskope Cloud and Threat Report: Phishing details trends in phishing delivery methods such as fake login pages and fake third-party cloud applications designed to mimic legitimate apps, the targets of phishing attacks, where the fraudulent content is hosted, and more.

Although email is still a primary mechanism for delivering phishing links to fake login pages to capture usernames, passwords, MFA codes and more, the report reveals that users are more frequently clicking phishing links arriving through other channels, including personal websites and blogs, social media, and search engine results. The report also details the rise in fake third-party cloud apps designed to trick users into authorizing access to their cloud data and resources.

Phishing Comes From All Directions

Traditionally considered the top phishing threat, 11% of the phishing alerts were referred from webmail services, such as Gmail, Microsoft Live, and Yahoo. Personal websites and blogs, particularly those hosted on free hosting services, were the most common referrers to phishing content, claiming the top spot at 26%. The report identified two primary phishing referral methods: the use of malicious links through spam on legitimate websites and blogs, and the use of websites and blogs created specifically to promote phishing content.

Search engine referrals to phishing pages have also become common, as attackers are weaponising data voids by creating pages centred around uncommon search terms where they can readily establish themselves as one of the top results for those terms. Examples identified by Netskope Threat Labs include how to use specific features in popular software, quiz answers for online courses, user manuals for a variety of business and personal products, and more.

Ray Canzanese, threat research director, Netskope Threat Labs, said: “Business employees have been trained to spot phishing messages in email and text messages, so threat actors have adjusted their methods and are luring users into clicking on phishing links in other, less expected places.

“While we might not be thinking about the possibility of a phishing attack while surfing the internet or favourite search engine, we all must use the same level of vigilance and skepticism as we do with inbound email, and never enter credentials or sensitive information into any page after clicking a link. Always browse directly to login pages.”

The Rise of Fake Third-Party Cloud Apps

Netskope’s report discloses another key phishing method: tricking users into granting access to their cloud data and resources through fake third-party cloud applications. This early trend is particularly concerning because access to third-party applications is ubiquitous and poses a large attack surface. On average, end-users in organisations granted more than 440 third-party applications access to their Google data and applications, with one organisation having as many as 12,300 different plugins accessing data – an average of 16 plugins per user. Equally as alarming, over 44% of all third-party applications accessing Google Drive have access to either sensitive data or all data on a user’s Google Drive – further incentivising criminals to create fake third-party cloud apps.

“The next generation of phishing attacks is upon us. With the prevalence of cloud applications and the changing nature of how they are used, from Chrome extensions or app add-ons, users are being asked to authorise access in what has become an overlooked attack vector,” added Canzanese. “This new trend of fake third-party apps is something we’re closely monitoring and tracking for our customers. We expect these types of attacks to increase over time, so organisations need to ensure that new attack paths such as OAuth authorisations are restricted or locked down. Employees should also be aware of these attacks and scrutinise authorisation requests the same way they scrutinise emails and text messages.”

Within the report, Netskope Threat Labs includes actionable steps organisations can take to identify and control access to phishing sites or applications, such as deploying a security service edge (SSE) cloud platform with a secure web gateway (SWG), enabling zero trust principles for least privilege access to data and continuous monitoring, and using Remote Browser Isolation (RBI) to reduce browsing risk for newly-registered domains.

Additional key findings from the report include:

Employees continue to click, fall victim to malicious links. It is widely understood that it takes just one click to severely compromise an organisation. While enterprise phishing awareness and training continues to be more prevalent, the report reveals that an average of eight out of every 1,000 end-users in the enterprise clicked on a phishing link or otherwise attempted to access phishing content.
Users are being lured by fake websites designed to mimic legitimate login pages. Attackers primarily host these websites on content servers (22%) followed by newly registered domains (17%). Once users put personal information into a fake site, or grant it access to their data, attackers are able to capture usernames, passwords, and multi-factor authentication (MFA) codes.
Geographic location plays a role in the access rate of phishing. Africa and the Middle East were the two regions with the highest percentages of users accessing phishing content. In Africa, the percentage of users accessing phishing content is more than 33% above average, and in the Middle East, it is more than twice the average. Attackers frequently use fear, uncertainty, and doubt (FUD) to design phishing lures and also try to capitalise on major news items. Especially in the Middle East, attackers appear to be having success designing lures that capitalise on political, social, and economic issues affecting the region.

Tags: apps, data, Privacy, Security

Source link

Up Next

86% of cloud attacks in healthcare sector lead to financial losses or other damage

Don't Miss

Cyber Security Awareness & Beyond with 11:11 Systems

Click to comment

You must be logged in to post a comment Login

TECHNOLOGY

HCLTech and Cisco create collaborative hybrid workplaces

Published

14 hours ago

November 29, 2023

Max

Digital comms specialist Cisco and global tech firm HCLTech have teamed up to launch Meeting-Rooms-as-a-Service (MRaaS).

Available on a subscription model, this solution modernises legacy meeting rooms and enables users to join meetings from any meeting solution provider using Webex devices.

The MRaaS solution helps enterprises simplify the design, implementation and maintenance of integrated meeting rooms, enabling seamless collaboration for their globally distributed hybrid workforces.

Rakshit Ghura, senior VP and Global head of digital workplace services, HCLTech, said: “MRaaS combines our consulting and managed services expertise with Cisco’s proficiency in Webex devices to change the way employees conceptualise, organise and interact in a collaborative environment for a modern hybrid work model.

“The common vision of our partnership is to elevate the collaboration experience at work and drive productivity through modern meeting rooms.”

Alexandra Zagury, VP of partner managed and as-a-Service Sales at Cisco, said: “Our partnership with HCLTech helps our clients transform their offices through cost-effective managed services that support the ongoing evolution of workspaces.

“As we reimagine the modern office, we are making it easier to support collaboration and productivity among workers, whether they are in the office or elsewhere.”

Cisco’s Webex collaboration devices harness the power of artificial intelligence to offer intuitive, seamless collaboration experiences, enabling meeting rooms with smart features such as meeting zones, intelligent people framing, optimised attendee audio and background noise removal, among others.

Want to learn more about cybersecurity and the cloud from industry leaders? Check out Cyber Security & Cloud Expo taking place in Amsterdam, California, and London. Explore other upcoming enterprise technology events and webinars powered by TechForge here.

Tags: Cisco, collaboration, HCLTech, Hybrid, meetings

Source link

TECHNOLOGY

Canonical releases low-touch private cloud MicroCloud

Published

1 day ago

November 28, 2023

Max

Canonical has announced the general availability of MicroCloud, a low-touch, open source cloud solution. MicroCloud is part of Canonical’s growing cloud infrastructure portfolio.

It is purpose-built for scalable clusters and edge deployments for all types of enterprises. It is designed with simplicity, security and automation in mind, minimising the time and effort to both deploy and maintain it. Conveniently, enterprise support for MicroCloud is offered as part of Canonical’s Ubuntu Pro subscription, with several support tiers available, and priced per node.

MicroClouds are optimised for repeatable and reliable remote deployments. A single command initiates the orchestration and clustering of various components with minimal involvement by the user, resulting in a fully functional cloud within minutes. This simplified deployment process significantly reduces the barrier to entry, putting a production-grade cloud at everyone’s fingertips.

Juan Manuel Ventura, head of architectures & technologies at Spindox, said: “Cloud computing is not only about technology, it’s the beating heart of any modern industrial transformation, driving agility and innovation. Our mission is to provide our customers with the most effective ways to innovate and bring value; having a complexity-free cloud infrastructure is one important piece of that puzzle. With MicroCloud, the focus shifts away from struggling with cloud operations to solving real business challenges” says

In addition to seamless deployment, MicroCloud prioritises security and ease of maintenance. All MicroCloud components are built with strict confinement for increased security, with over-the-air transactional updates that preserve data and roll back on errors automatically. Upgrades to newer versions are handled automatically and without downtime, with the mechanisms to hold or schedule them as needed.

With this approach, MicroCloud caters to both on-premise clouds but also edge deployments at remote locations, allowing organisations to use the same infrastructure primitives and services wherever they are needed. It is suitable for business-in-branch office locations or industrial use inside a factory, as well as distributed locations where the focus is on replicability and unattended operations.

Cedric Gegout, VP of product at Canonical, said: “As data becomes more distributed, the infrastructure has to follow. Cloud computing is now distributed, spanning across data centres, far and near edge computing appliances. MicroCloud is our answer to that.

“By packaging known infrastructure primitives in a portable and unattended way, we are delivering a simpler, more prescriptive cloud experience that makes zero-ops a reality for many Industries.“

MicroCloud’s lightweight architecture makes it usable on both commodity and high-end hardware, with several ways to further reduce its footprint depending on your workload needs. In addition to the standard Ubuntu Server or Desktop, MicroClouds can be run on Ubuntu Core – a lightweight OS optimised for the edge. With Ubuntu Core, MicroClouds are a perfect solution for far-edge locations with limited computing capabilities. Users can choose to run their workloads using Kubernetes or via system containers. System containers based on LXD behave similarly to traditional VMs but consume fewer resources while providing bare-metal performance.

Coupled with Canonical’s Ubuntu Pro + Support subscription, MicroCloud users can benefit from an enterprise-grade open source cloud solution that is fully supported and with better economics. An Ubuntu Pro subscription offers security maintenance for the broadest collection of open-source software available from a single vendor today. It covers over 30k packages with a consistent security maintenance commitment, and additional features such as kernel livepatch, systems management at scale, certified compliance and hardening profiles enabling easy adoption for enterprises. With per-node pricing and no hidden fees, customers can rest assured that their environment is secure and supported without the expensive price tag typically associated with cloud solutions.

Tags: automation, Canonical, MicroCloud, private cloud

Source link

TECHNOLOGY

AWS and SoftwareOne collaborate on RISE with SAP

Published

1 week ago

November 22, 2023

Max

Amazon Web Services (AWS) and SoftwareOne Holding AG, a global provider of end-to-end software and cloud technology solutions, have partnered to help customers transition to RISE with SAP on an AWS cloud environment.

Called the Ready for RISE on AWS bundle, it combines SoftwareOne’s deep SAP advisory and implementation knowledge with AWS technologies to expedite a client’s SAP transformation journey.

The collaboration comes at a time when there is growing pressure on organisations to decide how to modernise their SAP environments driven in part by the end of mainstream support for SAP ERP Central Component (SAP ECC) in 2027. Despite the imminent deadline, many organisations are still confused as to which path to take, including when to adopt RISE with SAP, SAP’s bundled offering of cloud solutions, infrastructure, and services that helps migrate SAP ERP to the cloud.

Ireneusz Hołowacz, Director of Application Development Center at GAVDI Polska, said: “A stable, efficient, and cost-effective environment for consultants and programmers is one of the most important priorities of our daily work. Thanks to the migration of our SAP systems to the AWS cloud with the help of SoftwareOne, GAVDI Polska has achieved all the goals set for this process.

In a survey recently conducted by SoftwareOne with Americas’ SAP Users’ Group (ASUG) – the full details of which will be revealed in January 2024 – showed that while 42% of respondents were familiar with RISE with SAP, 40% had heard of it but weren’t familiar with the details and 18% had never heard of it. Over half (52%) said they were still unsure how RISE with SAP would impact their existing relationship with cloud service providers.

“SAP customers have implemented some of the most comprehensive and complex enterprise systems in the industry and moving them to cloud services like AWS requires many important decisions to be made to optimise these investments,” says Joshua Greenbaum, Principal at EAC. “SoftwareOne’s extensive experience in the SAP ecosystem, combined with its unique capabilities around system rationalisation, cost containment, contracts and licenses, and cloud service management, among others, will provide customers deploying on AWS with the ability to make the most of RISE on SAP and other SAP offerings. Ready for RISE on AWS is an important offering for SAP customers at this critical moment in their business transformations.”

The Ready for RISE on AWS bundle will help clients understand their SAP transformation options and offer a comprehensive solution to organisations who consider RISE with SAP. It includes advisory data preparation, conversion services, data and AI, cloud innovation platform, supporting the entire journey to RISE on AWS. Clients will benefit from accelerated Return on Investment (ROI), optimal data management, and cost-saving strategies while laying the foundation for ongoing innovation and long-term business success.

Matt Schwartz, worldwide director, SAP Alliance & Partner Network at AWS, said: “As a valued AWS Premier Consulting Partner, AWS is working closely with SoftwareOne to offer SAP customers comprehensive assistance through each step of their journey to RISE with SAP on AWS. SoftwareOne’s ability to bundle Advisory, Data & AI, Cloud Platform, and Operations considerations can be of high interest to customers who are seeking to understand RISE with SAP as well as the cloud native and operation considerations that surround and support the RISE with SAP construct.”

PF Grillet, SAP Business Lead at SoftwareOne, said: “There are many choices available to SAP clients who know they need to modernise but aren’t sure of the best option, particularly given the business-critical nature of the applications.

“All of our services are centered around our customers and what is right for them. This includes supporting and optimising RISE with SAP in scenarios when it’s the right decision based on their requirements. Our extensive knowledge of and relationship with AWS means we can help them better prepare and achieve a seamless transition to S/4HANA using RISE with SAP on AWS with reduced costs and risks. This collaboration goes beyond preparing businesses for change; it’s making transformation and becoming innovation-ready a reality using AWS technologies.”

The offering includes SNP tooling to reduce a customer’s data footprint and accelerate migration. SoftwareOne will migrate selected data to an AWS data lake, accelerate innovation readiness and ensure SAP data is suitable for broader data analytics and AI use cases. Clients gain access to innovative tools like AWS’ Sagemaker for Machine Learning, continuous data management and optimisation within the AWS environment. The AWS innovation platform also includes Amazon Bedrock that helps organisations accelerate adapting Large Language Models and deploying GenAI use cases that leverage the extended data set.

“While the future innovation opportunities are exciting, clients need to balance these with a pragmatic approach to costs,” explained Marilyn Moodley, Country Leader for South Africa and WECA at SoftwareOne, “We integrate ‘Cost-Out’ recommendations into the core of our services, providing a more cost-effective solution for customers, like reducing the data footprint size and optimising storage and archiving.

“Our expertise in the complexities of SAP licensing further drives cost savings while our FinOps capabilities enable customers to optimise their AWS cloud spend and effectively manage their AWS cloud environment, ensuring full transparency in their budgets. The overall result is a significantly reduced time for RISE migration, which translates into a quicker time to value.”

Tags: AWS, partnership, SAP, SoftwareOne, transition

Source link