October 5, 2023 - securitylinkindia

Cybercrime: 14 Arrests, Thousands of Illicit Cyber Networks Disrupted in Africa Operation

MassMediaLink India LLP SecurityLink IndiaOctober 5, 2023November 28, 202406 mins

Networks identified linked to financial losses of more than US$40 million INTERPOL and AFRIPOL have coordinated an operation across 25 African countries that enabled investigators to arrest 14 suspected cybercriminals and identify 20,674 suspicious cyber networks, highlighting the surge in digital insecurity and cyber threats in the region. The networks identified were linked to financial losses of more than USD 40 million. The four-month Africa Cyber Surge II operation was launched in April 2023 and focused on identifying cybercriminals and compromised infrastructure. It was coordinated by INTERPOL’s Cybercrime Directorate, under the auspices of the INTERPOL Africa Cybercrime Operations desk and INTERPOL’s Support Programme for the African Union in relation to AFRIPOL (ISPA). The operation sought to facilitate communication, provide analysis and share intelligence between countries, streamlining cooperation between African law enforcement agencies to prevent, mitigate, investigate, and disrupt cyber extorsion, phishing, business email compromise and online scams. By leveraging actionable private sector intelligence, it underlined how cybersecurity is most effective when international law enforcement, national authorities, and private sector partners cooperate to share best practices and pro-actively combat cybercrime. INTERPOL, AFRIPOL and private sector partners Group-IB and Uppsala Security provided on-theground operational support, sharing actionable intelligence leveraged throughout the operation. Operational highlights In Cameroon, acting on a tip-off from Côte d’Ivoire, three suspects were arrested in relation to an online scam involving the fraudulent sale of works of art worth USD 850,000. Authorities in Nigeria arrested a suspect accused of defrauding a Gambian victim. Police in Mauritius arrested two money mules linked to scams initiated through messaging platforms. In Gambia, proactive measures and strong partnerships led to the take down of 185 Internet Protocols (IP) connected to malicious activities. Two Darknet sites have been taken down following actions by Cameroonian authorities. In Kenya, authorities took down 615 malware hosters. Some 150 INTERPOL analytical reports providing intelligence and insight on cyber threats targeting specific countries were distributed to participating countries for investigative and disruptive actions during the operation. Developed by INTERPOL based on information shared by partners Group-IB, Trend Micro, Kaspersky, and Coinbase, the reports contained information on: 3,786 malicious command and control servers. 14,134 victim IPs linked to data stealer cases. 1,415 phishing links and domains. 939 scam IPs. More than 400 other malicious URLs, IPs and botnets. “The Africa Cyber Surge II operation has led to the strengthening of cybercrime departments in member countries as well as the solidification of partnerships with crucial stakeholders, such as computer emergency response teams and Internet Service Providers. This will further contribute to reducing the global impact of cybercrime and protecting communities in the region,” said Jürgen Stock, INTERPOL Secretary General. The initiative highlighted the strong correlation between financial crime and cybercrime, allowing participating countries to expand their law enforcement response by adopting a ‘follow the money’ approach. It was also preceded by a oneweek tabletop exercise in Tanzania on cybercrime and cryptocurrency investigations, equipping officials from 20 African countries with the knowledge and skills necessary for the successful execution of the operation. “As digital systems, Information Communication Technologies and Artificial Intelligence grow in prominence, it is urgent that public and private actors work hand in hand to prevent these technologies from being exploited by cybercriminals. Coordinated operations such as Cyber Surge are necessary to disrupt criminal networks and build individual, organizational and society-wide levels of protection,” said AFRIPOL’s Acting Executive Director, Ambassador Jalel Chelba. Africa Cyber Surge II was carried out with funding by the UK Foreign Commonwealth and Development Office, the German Federal Foreign Office and the Council of Europe.

Feature

Cybersecurity 911: How to Protect Healthcare’s Front Lines

MassMediaLink India LLP SecurityLink IndiaOctober 5, 2023November 14, 2024011 mins

Nikhil Karan Taneja, Vice President and Managing Director for India, SAARC and the Middle East, Radware As a result of recent shifts in global Distributed Denial-of-Service (DDoS) attack patterns, healthcare providers globally are facing a mounting number of cyber threats. Historically, healthcare providers have been the target of financially motivated ransomware attacks aimed at extracting monetary payments from their victims. More recently, however, they have found themselves in the crosshairs of state-actors and hacktivist groups that are waging global DDoS campaigns for political and religious reasons. For example, in March and April of this year, hospitals in India were targeted by pro-Russian groups and Islamist hacktivist groups that brought down the websites of several hospitals in the Hyderabad area as well as the Indian Ministry of Health. Regardless of the motivation behind the attacks, the end result is the same – the healthcare industry suffers. Patient care is disrupted. Availability of mission critical systems is threatened. And sensitive private data is exposed for the world to see. To defend against bad actors who are getting smarter and attacks that are ever more sophisticated, healthcare providers need to rethink their cyber security strategies. Investing in a comprehensive DDoS protection solution built to adapt to a shifting cyber landscape is now imperative for healthcare’s front lines. The risks to infrastructure, care, and reputation The seamless operation of healthcare applications and services has become mission critical as patient care increasingly relies on technology and data accessibility. Gone unchecked, the rise of DDoS attacks poses a variety of threats to this balance. Disruption of critical patient services: Healthcare institutions rely heavily on electronic health record systems, patient portals, and communication platforms for critical functions like patient care, scheduling appointments and accessing medical records. Any disruption to this digital infrastructure can hinder patient services. Risk to patient safety: In healthcare, timely access to medical information and services is crucial for patient safety. DDoS attacks that disrupt access to patient records or medical devices can delay vital treatments and procedures, potentially endangering patients’ lives. Data breaches: Some DDoS attacks serve as a smokescreen to divert attention while hackers attempt to breach an institution’s security and access sensitive patient data. These attacks can lead to data breaches and expose private patient information, resulting in legal and regulatory consequences, financial penalties, and damage to an institution’s reputation. Financial losses: The costs associated with mitigating a DDoS attack, restoring services, and implementing additional security measures can be substantial. Moreover, the loss of revenue due to service disruptions and potential patient churn can further impact an institution’s bottom line. Brand reputation damage: A successful DDoS attack on a healthcare institution can erode the trust and confidence of patients and partners. The negative publicity and perception of compromised data security may lead patients to seek care from competitors, impacting the institution’s reputation and market standing. Compliance violations: Healthcare institutions are bound by strict regulations such as the Health Insurance Portability and Accountability Act (HIPAA) and the General Data Protection Regulation (GDPR). A DDoS attack that results in data breaches can lead to compliance violations and severe penalties, including fines and legal actions. A get-well plan for healthcare Healthcare institutions face serious challenges when it comes to protecting their digital infrastructure. To ensure networks and services remain accessible and resilient, here are a few best practices for defending against DDoS attacks: Select DDoS protection with behavior-based detection: As network-layer and encrypted application-layer DDoS attacks get more sophisticated, it is getting increasingly difficult for security teams to discern between legitimate and attack traffic. Traditional DDoS defenses that typically rely on brute force mitigation mechanisms, such as volumetric detection, rate limiting and geo-blocking, are no longer sufficient protection as they are prone to high levels of false positives and will block legitimate users. Defending against emerging generations of DDoS threats requires automated solutions that can adapt in real time, scale by a magnitude higher than any on-prem solution, and surgically block the attacks without blocking legitimate traffic. This approach focuses not only on traffic volumes but also on the behavioral characteristics of the incoming requests so healthcare providers can more accurately distinguish between malicious and legitimate users and deliver better protection with lower false positives. As attackers increasingly leverage application-layer (L7) attack vectors, web DDoS protections, in particular, are important for healthcare providers because of the need to protect the availability of patient-facing web assets such as patient portals, information sharing, mobile applications, APIs, and other outbound-facing web assets. Deploy always-on cloud DDoS protection: Look for an always-on cloud DDoS protection solution that routes network and application traffic through a security provider’s scrubbing center or point of presence. This ensures that incoming connections are inspected to prevent malicious requests from reaching a protected network or application and that critical patient care systems are always available. Weigh the advantages of a hybrid solution: Healthcare providers handle patients’ protected health information (PHI), which is regulated by a variety of compliance requirements, including HIPAA, PHIPA, GDPR, and state and domestics laws. Because the stake in securing this data is so high, many healthcare organizations are very reluctant to share the SSL/ TLS encryption keys used to protect it with third-party vendors. An on-premises DDoS mitigation appliance can help address these concerns. When deployed within the healthcare organization’s network, an on-premises appliance can mitigate encrypted DDoS attacks while keeping the SSL/ TLS keys in-house and out of the hands of third-party cloud vendors. While cloud services are often recommended because of the scale their cloud scrubbing networks offer, combining them with an on-premises appliance is a good solution for larger organizations with specific needs. Use a managed security service: Often the size of internal security and IT teams that support healthcare organizations are small, with primary staff and resources being focused on patient care. As a result, many healthcare providers lack the experience and personnel to deal with massive DDoS attacks, particularly those targeted at complex application-layer vectors. Utilizing a managed security service as part of a…

National

Assists the G20 Summit India with Smart Electronic Surveillance Solution

MassMediaLink India LLP SecurityLink IndiaOctober 5, 2023November 14, 202404 mins

CP PLUS, a leading global provider of advanced security and surveillance solutions, is delighted to announce its successful participation in securing the prestigious G20 Summit Meetings held in New Delhi, India. As the trusted security partner for this high-profile event, CP PLUS demonstrated its unwavering commitment to safeguarding global leaders, delegates, and the host country. The G20 Summit, a gathering of the world’s most influential leaders and policymakers, is an event of immense significance, and security is of paramount importance. CP PLUS was chosen as the security solutions provider for this historic event due to its proven track record, leading-edge technology, and expertise in ensuring the safety and security of critical environments. CP PLUS deployed state-ofthe-art surveillance cameras, facial recognition technology, and access control systems at key venues across the city to provide comprehensive security coverage. These technologies play a crucial role in identifying and managing potential security threats. CP PLUS customized security solutions to meet the unique needs of the G20 Summit, ensuring that security measures were both effective and unobtrusive. This helped in integrating the brand’s security solutions seamlessly with the existing security infrastructure of New Delhi, enabling a unified and efficient security system for the duration of the summit. Aditya Khemka, Managing Director of CP PLUS (Aditya Group), expressed his pride in the company’s successful involvement in securing the G20 Summit Meetings. He stated, “We are honored to have been entrusted with the responsibility of securing this prestigious international event. CP PLUS has always been committed to innovation and excellence in security solutions, and our participation in the G20 Meet is a testament to our dedication to safeguarding global events of the highest significance.” CP PLUS’s involvement in securing the G20 Summit Meetings underscores its position as a global leader in the security industry. The company continues to provide leading-edge security solutions to protect critical infrastructure, public spaces, and events worldwide. CP PLUS is a global company in advanced security and surveillance solutions, providing state-of-the-art technology to safeguard people, property, and assets. With a commitment to innovation and excellence, CP PLUS has a strong presence in over 16 countries and has earned the trust of clients across various industries.

National

Navigating Security Gaps in SaaS Cloud

MassMediaLink India LLP SecurityLink IndiaOctober 5, 2023November 14, 202409 mins

Gaurav Ranade, CTO, RAH Infotech Software as a Service (SaaS) has transformed how businesses operate by providing scalable, cost-effective solutions for various functions, from customer relationship management to project management. SaaS has revolutionized the way businesses access and utilize software applications. With SaaS, companies can avoid the complexities of traditional software installation and maintenance, reducing the need for on-premises hardware and extensive IT resources. This streamlined approach allows organizations to focus on their core competencies while benefitting from frequent updates, scalability, and ease of use that SaaS provides. As organizations continue to embrace SaaS cloud solutions, it’s crucial to understand and address the security gaps that can arise within these environments. SaaS can save users time and money and offers rapid response to dynamic business demands. While SaaS offers numerous advantages, it also presents unique challenges that require proactive measures to ensure data privacy, integrity, and overall security. But SaaS customers require comprehensive security, often based on compliance mandates, for sensitive data stored in SaaS clouds. As organizations increasingly migrate their critical operations to cloud-based SaaS platforms, they must address a myriad of security concerns to ensure the confidentiality, integrity, and availability of their data. Organizations must be aware of these potential gaps to adequately protect sensitive data and maintain regulatory compliance. Let’s look at the key security gaps that have evolved into challenges: Data Breaches: SaaS applications store vast amounts of sensitive data, making them prime targets for cybercriminals. A single breach can expose confidential customer information, financial data, and proprietary business insights. The shared responsibility model between the SaaS provider and the client means that security measures must be a collaborative effort. Access Control: Misconfigured access controls can lead to unauthorized users gaining access to critical data and applications. Poorly managed permissions and user roles can result in data leaks and breaches. Data Loss: The risk of data loss is heightened when relying on a third-party SaaS provider. While providers typically implement disaster recovery mechanisms, organizations must still have robust backup strategies to safeguard against accidental data loss or provider outages. Compliance Challenges: Different industries are subject to various compliance regulations such as GDPR, HIPAA, or PCI DSS. Failure to properly configure and secure SaaS applications can lead to compliance violations and hefty fines. Vendor Lock-In: Organizations can become dependent on a particular SaaS vendor, making it challenging to migrate to another provider or revert to an on-premises solution if needed. This vendor lock-in can limit flexibility and bargaining power. Insider Threats and User Behavior: Not all security threats originate from external actors. Insider threats, whether intentional or accidental, pose a significant risk. Employees with excessive privileges, lax security practices, or insufficient training can compromise data integrity. Integration and Interoperability: Ensuring seamless integration while maintaining security can be complex. Misconfigured APIs, unauthorized data flows, and inadequate communication protocols can lead to vulnerabilities. High-performance encryption and key management solution provide ideal cloud security for SaaS Many organizations opt for full disk encryption (FDE) which involves encrypting the entire hard drive or storage device, ensuring that all data stored on it remains confidential and protected from unauthorized access. While FDE offers several benefits for data security, there are also some disadvantages, particularly when applied to Software as a Service (SaaS) cloud environments: Performance impact. Limited control. Key management complexity. Data portability and vendor lock-in. Backup and recovery challenges. Collaboration and sharing. Regulatory and compliance considerations. Usability and user experience. Data recovery and forensics. Thales is among the organizations providing robust SaaS cloud data security solutions. CipherTrust Transparent Encryption and Key Management as a Service or KMaaS help: Enables to provide customer-specific keys. Provides comprehensive access controls to give customers the highest assurance. Gives security intelligence you need to detect compromised credentials faster. SaaS providers integrate and deploy encryption, tokenization and key management to enhance their service offerings. Quickly overcome typical security and compliance end-customer objections. Accelerate SaaS revenue growth. SaaS cloud technology has reshaped the business landscape, offering unparalleled efficiency and flexibility. However, these benefits come with inherent security challenges that organizations must address to safeguard their valuable data and maintain their reputation. By understanding the security gaps in SaaS cloud and implementing robust security measures, companies can confidently embrace the advantages of SaaS while minimizing the risks associated with data breaches, unauthorized access, and compliance violations. The key lies in proactive risk management, continuous monitoring, and a commitment to staying informed about evolving security threats in the digital landscape. RAH Infotech is India’s leading value-added technology distributor and solutions provider. Headquartered in New Delhi, RAH Infotech has been providing world-class IT solutions since the year 2005 to a large number of channel partners and enterprises in the India & SAARC regions. The rich portfolio includes a wide range of best-of-breed solutions to address security, data, network, application, storage, and beyond requirements. As a top-tier technology enabler, we manage the entire value chain of data management requirements of enterprises and protect their digital assets. We partner with the finest global technology firms to develop customized IT solutions in the area of cybersecurity, networking, cloud computing, data management and application management for various industry verticals. *Views expressed in the article are solely of the Author