Category Archives: Cybercrime

The Deepfake Threat: Why it’s Time to Update Your Security Policies

by Ian Heritage

Could this be the year that deepfakes break through into popular culture? One ominous sign of things to come has been the scrambling of social media companies over the past few weeks to develop a coherent set of policies on faked content. Their actions should help raise awareness and limit the impact of malicious audio and video online.

But let’s not forget that deepfakes are already being used by cyber-criminals today, specifically in CEO fraud attacks. This will require CISOs to update their risk management and security strategies, as attacks become more widespread and convincing.

Keeping it real
AI-powered deepfakes are spoofed audio or video clips which are hard to distinguish from the original. They quite literally put words in the mouth of the subject; whether it’s a famous politician, a celebrity or a CEO. While it sounds like a lot of fun, there’s a serious side. Doctored video clips could be used ahead of elections to discredit candidates, for example. The bad news is that psychologists believe that once we’ve viewed something like this, it tends to have a lasting impact on our perception of a person, even if we subsequently find out the video is a fake.

Social media companies are understandably nervous about the potential for misinformation on a whole new scale spreading via their platforms. Earlier this week Twitter revealed its policy on deepfakes, promising to label any content that has been “significantly and deceptively altered or fabricated” and that has been shared deceptively. It said it would remove any such content also deemed capable of causing harm. The firm joins Facebook, which last month said it would ban deepfakes outright from its site, and YouTube, which has banned such content in the run up to the 2020 US Presidential election.

Firms under pressure
In this context, deepfakes represent a major threat to democratic countries like ours, especially following previous attempts by nation states to interfere in elections and referendums. But there’s another angle more relevant to businesses. Deepfake audio clips are already being used in quasi-BEC attacks, designed to impersonate CEOs and trick employees into wiring funds to hacker-controlled bank accounts.

A UK energy company lost €220,000 (£187,000) after its CEO was tricked into making a fund transfer by someone he thought to be his German boss. In reality, the ‘person’ on the other end of the phone was simply a deepfake audio clip. This is just the beginning. In our 2020 predictions report, we argue that the C-suite will increasingly find themselves targeted by this kind of hi-tech fraud, as their public profile will make it easier for cyber-criminals to record and mimic their voice.

Spotting the fakers
We’re just at the start of a very long road. In time, the technology will get better, making it harder to spot the fakes. We may even reach a point when organisations or individuals are held to ransom with fake clips of a CEO doing something outrageous, which could cause the company share price to tank.

CISOs must therefore act now to build this threat into their security strategies, by updating their employee awareness training, and tightening company policies on large fund transfers. Fortunately, the majority of CEO fraud today still occurs via email. And for these occasions Trend Micro has its own AI-powered solution, Writing Style DNA, which “blueprints” the writing style of senior executives so that it can raise the alarm when hackers try to impersonate them. We recommend its use as part of a layered approach to email security that focus on domain reputation and other elements.

Also, be reassured that cybersecurity remains an arms race. The deepfakers might appear to have the upper hand at the moment, but realistic fakes are few and far between, and we’re working all the time on ways to foil them.

Data Privacy Day: the 2020s can be the decade of privacy-by-design everywhere

By Ian Heritage

Internet trends come and go. But one concept that has steadily gathered momentum over the past decade is that of dataprotection and privacy. It’s now enshrined in EU law thanks to the GDPR, and today consumers and businesses are far more aware than they’ve ever been about their rights and responsibilities online. That’s why the coming decade offers a fantastic opportunity to embed privacy-by-design principles into every single organisation. But there’s still much to do, to raise awareness and change behaviours, especially among corporates.

That’s why Trend Micro is a proud sponsor and champion of the annual Data Privacy Day initiative, which is celebratedaround the world on 28 January.

Back to the beginning
It was on this day way back in 1981 that the Council of Europe opened for signature Convention 108, the first legally binding international treaty dealing with privacy and data protection. The first European Data Protection Day was held in January 2007 to drive greater engagement with online privacy issues, and the rest is history. 

Over the past 13 years, countless organisations have come unstuck in a very public manner. From a now-infamous HMRC blunder in 2007 to 2018’s Cambridge Analytica scandal, each incident has highlighted the potentially catastrophic impact of negligent data protection programmes. Yet these incidents have also raised public awareness and galvanised lawmakers. Thanks to the GDPR, European citizens are more in control of their personal data than they have ever been, while businesses must clear a high bar to prove they are responsible custodians of that data.  

Still work to do
But there’s still much to do. Highly sensitive personal browsing data is still shared across the adtech digital supply chain billions of times a day without any consent from consumers. Social media companies continue to harvest vast troves of customer data, IoT devices and smart assistants listen to our most intimate conversations, and the growing pervasiveness of digital technology continues to raise concerns among worried parents. 

There are also concerns for businesses. GDPR compliance is no easy thing: its vague references to “state of the art” technology and focus on broad principles rather than prescriptive controls, mean there’s no simple tick-box solution here. For many, there’ll be no 100% way of knowing whether they’re compliant until an incident occurs and the company waits for an official verdict.

There have already been over 160,000 breach notificationsacross Europe since the regulation landed nearly two years ago, leading to fines of €114m (£94m). These will certainly ramp up, as regulators across the region sharpen their knives. The ICO has already stated its intent to fine Marriott International and BA a combined £282m for serious breaches at the companies.

What happens next?
For now, this means that organisations must ensure their data protection policies are aligned with the GDPR, even in post-Brexit Britain. They must focus on best practice approaches and frameworks like those produced by NIST, Cyber Essentials and ISO. And they must look to partner with the right security experts: vendors that can offer multi-layered protection across all parts of the IT infrastructure, from endpoint to servers, networks to web and email gateways. The end goal is privacy-by-design: a commitment to embedding data protection into everything an organisation does.

At Trend Micro, we sit on both sides of the data privacy debate. Our Internet Safety for Kids and Families (ISKF) programme has offered vital resources for concerned parents for over a decade. But we also provide expert advice and support for organisations struggling to navigate a complex regulatory landscape while ensuring they do right by their customers. 

As a Data Privacy Day Champion, we’re working hard on both fronts — to ensure consumers know their rights, and have the tools and knowledge to stay safe online, and that businesses have the right controls and processes in place to meet their data protection responsibilities. As we travel through a new decade, there’s still plenty of work to do.

Our smart factory honeypot proves ICS attacks are rife

by Ian Heritage

The world is getting smarter, and that includes the factories and industrial facilities that do everything from generate power to manufacture the products we love. In practice, this means IoT systems that streamline business processes and enhance productivity. But this race for innovation comes at a cost. As operational technology (OT) converges with IT, threats are starting to emerge via outdated communications protocols, IT siloes and hardware not designed for regular patching.

Continue reading

Supply chain risk to dominate 2020: from the cloud all the way to the remote worker

by Bharat Mistry

We all know that the success or otherwise of most modern organisations depends to a large degree on their supply chains. From professional services partners to software providers and transportation contractors, an average enterprise could maintain hundreds of these partnerships. But these all threaten to introduce extra risk to the business, especially in the cyber domain.

Trend Micro’s newly released 2020 predictions report highlights some of the key areas where organisations may be exposed next year: from cloud and managed service providers (MSPs), new DevOps dependencies and even supply chain risks associated with their remote workers.

A new spin on an old risk
Supply chain risk is not a new phenomenon per se. The infamous NotPetya ransomware attacks of 2017 were introduced via the software supply chain, for example, while Operation Cloud Hopper was a major attack campaign targeting global organisations via their MSPs.

However, the scale of the threat coming down the line requires urgent attention. It stems to a large degree from the way organisations are changing the way they work. Digital transformation is viewed by many as an essential driver of business growth, enabling firms to respond with agility to changing market demands. In practice, this means cloud and DevOps increasingly taking centre stage in the IT departments of the coming decade.

More agility, more risk?
Unfortunately, this will introduce new cyber risk. First, organisations’ increasing reliance on third-party cloud providers will encourage attackers to go after data stored in these accounts, via code injection attacks exploiting deserialisation bugs, cross-site scripting and SQL injection. They’ll also capitalise on mistakes made when misconfiguration of these accounts leaks data to the public-facing internet.

Next, they’ll look to exploit the reliance of DevOps teams on third-party code in container components and libraries to compromise microservices and serverless environments. As these architectures become increasingly commonplace, so will attacks.

The risk posed by MSPs will also escalate, enabling a much higher ROI for attackers because they can access multiple customers via a single provider. Such threats will imperil corporate and customer data, and even pose a risk to smart factory and other environments.

Finally, supply chain risk may come from an unlikely source in 2020 and beyond. As remote and home working becomes the norm for many employees, hackers may come to view these as a handy stepping-stone into corporate networks. Whether they’re logging-on via unsecured public Wi-Fi hotspots or at home, where smart home flaws could provide an unlocked door to sneak through, these employees need to be considered as part of holistic enterprise risk management strategies.

What to do
I
t will be tough for CISOs to keep up with the rapid pace of technological change as we head through the next decade. But it’s vital that teams are equipped with the right tools and strategies to manage these third-party risks and other threats to the bottom line and corporate reputation. Here’s a snapshot of advice offered in the report:

  • Improve due diligence of cloud providers and MSPs
  • Conduct regular vulnerability and risk assessments on third parties
  • Invest in security tools to scan for vulnerabilities and malware in third-party components
  • Consider Cloud Security Posture Management (CSPM) tools to help minimise the risk of misconfigurations
  • Revisit security policies regarding home and remote workers

To find out more on our predictions for 2020 and advice on how best to manage risk in your business, check out the report here.