Automobile Dealerships Need Strong Wireless and Physical Network Security

Posted on by

Automobile dealerships have problems when it comes to information security. One of these problems is that, being relatively small organizations, they have limited resources to expend on information security. Exacerbating this problem is the fact that dealerships are difficult to secure and are juicy targets for cyber-criminals and identity thieves.

What do I mean by “juicy targets?” Dealerships of necessity must collect a great deal of personal private information about their customers in order to do business. This not only includes names, addresses, phone numbers and email addresses, but also potentially includes information such as Social Security Numbers, credit ratings and other financial information. Criminals can exploit this level of information to cause all sorts of mischief and make lots of money.

What do I mean by difficult to secure? Dealerships typically have various sales departments (i.e. new, used, fleet), service departments, finance departments and body shops. All of these departments employ computers and most of these departments are also accessible to customers. In addition, dealership personnel are often called upon to leave customers and computers unattended while they perform various tasks away from their areas. This means that there are lots of “attack surfaces,” both physical and cyber, for cyber-criminals to try to exploit.

One  inexpensive and effective way for dealerships to fight these problems is to ensure that access to your computer networks is well secured. There are basically two ways for attackers to access your computer networks: through a physical connection or a wireless connection. If your dealership still uses wired connections for workstations (many don’t), you should ensure that these connections are secure from tampering. You don’t want unattended customers to be able to successfully plug their devices into an open port and get access to your network. Access via these ports should be limited to approved MAC addresses, or should employ some other access controls to prevent casual network access.

Even more important than this, though, is ensuring that your dealership wireless networks are properly configured and secured. On top of having the same vulnerabilities as wired networks, wireless networks have the added weakness of working via electromagnetic signals that can be accessed by anybody in range. To secure your wireless networks, you should follow best practices advice including:

  • Use strong access controls to limit access to wireless networks to only authorized users. Multi-part authentication is strongly recommended for this.
  • Ensure that your wireless network employs strong protocols like WPA2 and is fully encrypted.
  • Ensure that wireless access points and other networking equipment are fully secured. It is preferable to have this equipment secured in locked rooms or cabinets. It’s even better if access to this equipment is logged to individuals.
  • Ensure that your wireless systems are securely configured. Change all vendor default passwords, and ensure other device settings conform to best practices recommendations.
  • Ensure that your wireless devices and software applications receive proper security maintenance, and are well updated and patched.
  • Separate your wireless networks into segments and ensure that only those with a business need to know can access each segment.
  • Ensure that guest networks are available and properly secured. Each user of the guest network should have separate access control to prevent other guest network users from illicitly spying and compromising others on the network.
  • If you are allowing your employees to use their own devices to access the production wireless networks, ensure that these devices are secured according to best practices recommendations. Also ensure that users are fully educated in their responsibilities for maintaining wireless security.
  • Monitor your wireless networks with an eye for anomalies and misconfigurations.

Following these and other good network security recommendations can greatly increase information security at your dealership without having to expend inordinate amounts of money and employee time.

 

3 Steps To Increase Cyber Security At Your Dealership

Posted on by
Reply

Car dealerships and automotive groups are juicy targets for cybercriminals with their wealth of identity and financial information. Cyber security in many dealerships is lax, and many don’t even have full time IT teams, with even fewer having cybersecurity risk management skills in house. While this is changing, for the better, as dealerships become more data-centric and more automated, many are moving to become more proactive against cybersecurity threats. 

In addition to organized criminals seeking to capture and sell personal information,  global threats stemming from phishing, malware, ransomware and social engineering also plague dealerships. Phishing and ransomware are among the leading causes of financial losses tied to cybersecurity in the dealership space. Even as the federal regulators refine their focus on dealerships as financial institutions, more and more attackers have shifted some of their attention in the automotive sales direction.

Additionally, a short walk through social media doesn’t require much effort to identify dealerships as a common target for consumer anger, frustration and threats. Some of the anger shown toward car dealerships has proven to turn into physical security concerns, while it is almost assured that some of the industry’s network breaches and data breaches can also be tied back to this form of “hacktivism”. In fact, spend some time on Twitter or chat rooms, and you can find conversations and a variety of information of hacking dealership wireless networks and WiFi cameras. These types of cybersecurity incidents are proving to be more and more popular. 

With all of this cybersecurity attention to dealerships, are there any quick wins to be had? We asked our MSI team and the folks we work with at the SecureDrive Alliance that very question. Here’s the best 3 tips they could put forth:

1) Perform a yearly cybersecurity risk assessment – this should be a comprehensive view of your network architecture, security posture, defenses, detection tools, incident response plans and disaster recovery/business continuity plan capabilities. It should include a complete inventory of all PII and threats that your dealership faces. Usually this is combined with penetration testing and vulnerability assessment of your information systems to measure network security and computer security, as well as address issues with applications and social engineering. 

2) Ensure that all customer wireless networks and physical security systems are logically and physically segmented from operations networks – all networks should be hardened in accordance with information security best practices and separated from the networks used for normal operations, especially finance and other PII related processes. Network traffic from the customer wireless networks should only be allowed to traverse the firewall to the Internet, and may even have its own Internet connection such as a cable modem or the like. Cameras and physical security systems should be hardened against attacks and all common credentials and default passwords should be changed. Software updates for all systems should be applied on a regular basis.

3) Train your staff to recognize phishing, eliminate password re-use among systems and applications and reportcybersecurity attacks to the proper team members – your staff is your single best means of detecting cyber threats. The more you train them to identify and resist dangerous behaviors, the stronger your cybersecurity maturity will be. Training staff members to recognize, handle, report and resist cyber risks is one of the strongest value propositions in information security today. The more your team members know about your dealership’s security protocols, service providers and threats, the more effective they can be at protecting the company and themselves. Buidling a training resource center, and setting up a single point of contact for reporting issues, along with sending out email blasts about the latest threats are all great ways to keep your team on top of the issues.

There you have it, three quick and easy wins to help your dealership do the due diligence of keeping things cyber secure. These three basic steps will go a long way to protecting the business, meeting the requirements of your regulatory authority and reduce the chances of substantial harm from cyber attacks. As always, remaining vigilant and attentive can turn the tide. 

If you need any assistance with cybersecurity, risk management, penetration testing or training, MicroSolved and the SecureDrive Alliance are here to help. No matter if you’re a small business or a large auto group, our risk management and information security processes based on the cybersecurity framework from the National Institute of Standards and Technology (NIST) will get you on the road to effective data security. Simply contact MSI via this web form, or the SecureDrive Alliance via our site, and we will be happy to have a no cost, no hassle discussion to see how we can assist you.  

Credit Unions – Protect Private Member Info from Ransomware Attacks

Posted on by

Ransomware has been a sad fact of business life for some time now. It has proven to be an effective money maker for cyber-attackers, and so is constantly being developed and improved by the bad guys. We think of the typical ransomware attack as someone compromising your network, encrypting your data and demanding ransom payment for the key to decrypt it again. But credit unions are one of those businesses that are regulated; they must protect private Member information according to FFIEC and NCUA 748 recommendations and requirements. That makes them especially sensitive to another, enhanced type of ransomware attack in which the attackers also threaten to release private information to the public unless paid off. This type of coercion bypasses incident response and business continuity measures. It doesn’t matter if you can restore your systems from backup if you already have a public data breach.

Even if a compromised credit union has kept an average information security program in place and therefore is not heavily trod upon by the regulators, the business will still be damned by the court of public opinion if data breach occurs. This loss of reputation could seriously affect the credit union and could also lead to large expenditures in credit monitoring and spin doctoring efforts. So, for credit unions, the best answer is to protect your network and private information from being compromised in the first place.

First, strong encryption and key management are a must with this type of regulated information. Private member information should be well encrypted not only when being transmitted, but also when at rest on all systems. Over years of security testing, we have noticed many businesses that do a pretty good job of encryption, but then miss something crucial like databases or backups. This is like building a safe with a screen door in it! Another encryption problem we have noticed is poor key management practices. We have seen keys stored on production systems and not properly protected in other ways. An encryption system is only as good as its key management system. If you do the encryption and key management part correctly, the attackers won’t be able to read Member data even if they manage to get their hands on it.

Next is network security mechanisms and monitoring practices. It’s not good enough to simply build a series of walls to keep the bad guys out; you need to post guards to keep an eye on things as well. It’s the same with network security; you not only need to have effective security mechanisms in place, you need to have humans in the loop to add that detection ability that no machine can truly equal. That is why we recommend that credit unions don’t spend all of their infosec dollars on extravagant machines or software, and ensures adequate resources are set aside to properly staff the information security department. A decent, well configured firewall, full logging and log aggregation, an adequate AV package and egress filtering and monitoring can go a long way when properly employed and monitored by competent staff.

Configuration and privileged access control are also key. In most ransomware attacks, cyber-criminals employ phishing techniques or exploit network vulnerabilities to gain a foothold on businesses’ internal networks. But to mount a successful ransomware attack, they must also be able to maneuver around the network and to elevate their network privileges. On most networks, unfortunately, this is not a daunting task. Attackers can crack password hashes on user machines looking for admin passwords that they can then use to access other hosts and repeat the exercise. They can do this because most networks use common admin passwords on multiple machines. They also have generally “flat” networks that are not properly segmented according to the principles of least privilege and need to know. These practices can allow attackers to gain domain admin-level access to the system, and that is game over. In addition, many businesses are lax when it comes to privileged access control. Many sys-admins use the same password for simple network access as well as for admin access to the system. Plus, when a new admin user is added to the system, or privileges have been highly elevated for a normal user, no alerts are made and nobody is monitoring the access control list. All of these practices should be curtailed if you want to get serious about network protection.

The final control I’ll mention in this blog is user education and buy-in to the information security program at your credit union. Employees and partners can be your worst security enemy or your greatest security asset. To be truly effective, personnel not only should receive infosec training and awareness reminders regularly, they should also be actively enlisted by the credit union as troops in the fight against network compromise. Their worth to the company in this effort should be extolled, and good performance should get praise and recognition. Even little perks like a good parking spot or small bonus can really motivate personnel.

Implementing these kinds of effective controls can seriously increase your resistance to all type of network attacks including ransomware. However, I don’t mean to say that these controls can replace the need for decent incident response and business continuity programs; you need those too. This is because, as we all should know by now, no information security program is or can be perfect!

All About Credit Union Credential Stuffing Attacks

Posted on by
Reply

Credential stuffing attacks continue to be a grave concern for all organizations worldwide. However, for many Credit Unions and other financial institutions, they represent one of the most significant threats. They are a common cause of data breaches and are involved in some 76% of all security incidents. On average, our honey nets pretending to be Credit Union and other financial services experience targeted credential stuffing attacks several times per week. 

What Is Credential Stuffing?

“Credential stuffing occurs when hackers use stolen information, such as usernames and passwords from database breaches or phishing software from one account, and attempt to gain access to another. The hackers prey on people’s habit of using the same usernames and passwords for multiple sites. Using automated tools, they run large amounts of stolen information across multiple sites looking to find the same usernames and passwords being used elsewhere. Once they find a match, they can monetize the personal and financial information they gather.” (ardentcu.org)

How Common is Credential Stuffing?

Beyond our honey nets, which are completely fake environments used to study attackers, credential stuffing and the damage it causes is quite starteling. Here are some quick facts:

  • It is estimated that automated credential-stuffing attempts makes up 90% of enterprise login traffic in the US. (securityboulevard.com)

  • It’s estimated that credential stuffing costs companies more than $5 billion a year and creates havoc with consumers. (ardentcu.org)

  • According to Akamai’s latest State of the Internet report on credential stuffing, its customers alone were deluged by 30 billion malicious login attempts between November 2017 and June this year, an average of 3.75 billion per month. (theregister.com)

  • Significant credential stuffing attacks are a favorite of professional hacking groups from Russia, India, Asia and Africa. They often gather extensive lists of stolen and leaked credentials through advanced Google hacking techniques, by combing social media for password dumps (so called “credential spills”) and by purchasing lists of exposed credentials from other criminals on the dark web. Lists of member information from compromised online banking, online retailers and business association sites are common. This information often includes names, addresses, bank account numbers/credit card numbers, social security numbers, phone numbers and other sensitive data – enabling credential stuffing and social engineering attacks against victims around the world.

What Can Credit Unions Do About Credential Stuffing?

The key to handling this threat is to be able to prevent, or at the very least, identify illicit login attempts and automate actions in response to failed logins. Cybercriminals use a variety of tools, rented botnets (including specifically built credential stuffing bots) and brute force attacks to pick off less than strong passwords all around the Internet. Then, as we discussed above, they use that stolen information to probe your credit union for the same login credentials. 

The first, and easiest step, in reducing these cybercriminals’ success rate is to teach all of your legitimate users not to use the same password across multiple systems, and NEVER use passwords from public sites like Facebook, LinkedIn, Instagram, Pinterest or Twitter for example, as account credentials at work or on other important sites. Instead, suggest that they use a password manager application to make it simple to have different passwords for every site. Not only does this help make their passwords stronger, but it can even reduce support costs by reducing password reset requests. Ongoing security awareness is the key to helping them understand this issue and the significance their password choices have on the security of their own personal information and that of the company.

Next, the Credit Union should have a complete inventory of every remote login service, across their Internet presence. Every web application, email service, VPN or remote access portal and every single place that a cybercriminal could try or use their stolen credentials to gain an account takeover. Once, the Credit Union knows where login credentials can be used, they should go about preventing abuse and cyberattacks against those attack surfaces. 

The key to prevention should start with eliminating any Internet login capability that is not required. It should then progress to reducing the scope of each login surface by restricting the source IP addresses that can access that service, if possible. Often Credit Unions are able to restrict this access down to specific countries or geographic areas. While this is not an absolute defense, it does help to reduce the impacts of brute force attacks and botnet scans on the login surfaces. 

The single best control for any authentication mechanism, however, is multi factor authentication (MFA) (basically a form of secure access code provided to the user). Wheverever possible, this control should be used. While multi factor authentication can be difficult to implement on some services, it is widely available and a variety of products exist to support nearly every application and platform. Financial services should already be aware of MFA, since it has been widely regulated by FFIEC, NCUA and FDIC guidance for some time.

More and more, however, credential stuffing is being used against web mail, Office 365 and other email systems. This has become so common, that a subset of data breaches called Business Email Compromise now exists and is tracked separately by law enforcement. This form of unauthorized access has been wildly popular across the world and especially against the financial services of the United States. Compromised email addresses and the resulting wire transfer fraud and ACH fraud that stems from this form of credential theft/identity theft are among some of the highest financial impacts today. Additionally, they commonly lead to malware spread and ransomware infections, if the attacker can’t find a way to steal money or has already managed to do so.

No matter what login mechanism is being abused, even when MFA is in place, logging of both legitimate access and unauthorized access attempts is needed. In the event that a security breach does occur, this data is nearly invaluable to the forensics and investigation processes. Do keep in mind, that many default configurations of web services and cloud-based environments (like Office 365) have much of this logging disabled by default. 

While Credit Unions remain prime targets, having good prevention and detection are a key part of strong risk management against credential stuffing. Practicing incident response skills and business recovery via tabletop exercises and the like also go a long way to stengthening your security team’s capabilities.

How Can MicroSolved Help?

Our team (the oldest security firm in the midwest) has extensive experience with a variety of risk management and security controls, including helping Credit Unions inventory their attack surfaces, identify the best multi factor authentication system for their environment, create policies and processes for ensuring safe operations and performing assessments, configuration audits of devices/applications/cloud environments. 

We also scope and run custom tabletop exercises and help Credit Unions build better information security programs. Our team has extensive experience with business email compromise, wire/ACH/credit card fraud prevention, cybercriminal tactics and incident response, in the event that you discover that credential theft has occurred. 

Lastly, our ClawBack data leak detection platform, can help you watch for leaked credentials, find source code and scripts that might contain reuseable account credentials and even hunt down device configurations that can expose the entire network to easy compromise. 

You can learn more about all of our services, and our 28 years of information security thought leadership here.

Lastly, just reach out to us and get in touch here. We’d love to talk with your Credit Union and help you with any and all of these controls for protecting against credential stuffing attacks or any other cybersecurity issue.

3 Quick Thoughts for Small Utilities and Co-Ops

Posted on by
Reply

Recently I was asked to help some very small utilities and co-ops come up with some low cost/free ideas around detection. The group was very nice about explaining their issues, and here is a quick summary of some of the ideas we discussed.

1) Dump external router, firewall, AD and any remote access logs weekly to text and use simple parsers in python/perl or shell script to identify any high risk issues. Sure, this isn’t the same as having robust log monitoring tools (which none of these folks had), but even if you detect something really awful a week after it happens, you will still be ahead of the average curve of attackers having access for a month or more. You can build your scripts using some basis analytics, they will get better over time, and here are some ideas to get you started. You don’t need a lot of money to quickly handle dumped logs. Do the basics and improve.

2) Take advantage of cheap hardware, like the Raspberry Pi for easy to learn/use Linux boxes for scripting, log parsing or setting up cron jobs to automate tasks. For less than 50 bucks, you can have a powerful machine to do a lot of work for you and serve as a monitoring platform for a variety of tools. The group was all tied up in getting budget to buy server and workstation hardware – but had never taken the Pi seriously as a work platform. It’s mature enough to do a lot of non-mission critical (and some very important) work. It’s fantastic if you’re looking for a quick and dirty way to gain some Linux capabilities in confined Windows world.

3) One of the best bang for the buck services we have at MSI is device configuration reviews. For significantly less money than a penetration test, we can review your external routers, firewall and VPN for configuration issues, improper rules/ACLs and insecure settings. If you combine this with an exercise like attack surface mapping and threat modeling, you can get a significant amount of insight without resorting to (and paying for) vulnerability assessments and penetration testing. Sure, the data might not be as granular, and we still have to do some level of port scanning and service ID, but we have a variety of safe ways to do that work – and you get some great information. You can then make risk-based decisions about the data and decide what you want to act on and pay attention to. If your budget is tight – get in touch and discuss this approach with us.

I love to talk with utilities and especially smaller organizations that want to do the right thing, but might face budget constraints. If they’re willing to have an open, honest conversation, I am more than willing to get creative and engage to help them solve problems within their needs. We’d rather get creative and solve an issue to protect the infrastructure than have them get compromised by threat actors looking to do harm.

If you want to discuss this or any security or risk management issue, get in touch here.  

Utility Tabletop Cybersecurity Exercises

Posted on by
Reply

Recently, a group of federal partners, comprised of the Federal Energy Regulatory Commission (FERC), North American Reliability Corporation (NERC) and it’s regional entities released their Cyber Planning for Response and Recovery Study (CYPRES). The report was based on a review and analysis of the incident response and recovery capabilities of a set of their member’s cyber security units, and is a great example of some of the information sharing that is increasing in the industry. The report included reviews of eight utility companies’ incident response plans for critical infrastructure environments, and the programs reviewed varied in their size, complexity and maturity, though all were public utilities.

Though the specific tactics suggested in the report’s findings have come under fire and criticism, a few items emerged that were of broad agreement. The first is that most successful programs are based on NIST 800-61, which is a fantastic framework for incident response plans. Secondly, the report discusses how useful tabletop exercises are for practicing responses to cybersecurity threats and re-enforcing the lessons learned feedback loop to improve capabilities. As a result, each public utility should strongly consider implementing periodic tabletop exercises as a part of their cyber security and risk management programs.

Tabletop Exercises from MSI

At MicroSolved, we have been running cyber security tabletop exercises for our clients for more than a decade. We have a proprietary methodology for building out the role playing scenarios and using real-world threat intelligence and results from the client’s vulnerability management tools in the simulation. Our scenarios are developed into simulation modules, pre-approved by the client, and also include a variety of randomized events and nuances to more precisely simulate real life. During the tabletop exercise, we also leverage a custom written gaming management system to handle all event details, track game time and handle the randomization nuances.

Our tabletop exercise process is performed by two MSI team members. The first acts as the simulation moderator and “game master”, presenting the scenarios and tracking the various open threads as the simulation progresses. The second team member is an “observer” and they are skilled risk management team members who pre-review your incident response policies, procedures and documentation so that they can then prepare a gap analysis after the simulation. The gap analysis compares your performance during the game to the process and procedure requirements described and notes any differences, weaknesses or suggestions for improvement.

Target scenarios can be created to test any division of the organization, wide scale attacks or deeply nuanced compromises of specific lines of business. Various utility systems can be impacted in the simulation, including business networks, payment processing, EDI/supply chain, metering/AMI/smart grid, ICS/SCADA or other mission critical systems.Combination and cascading failures, disaster recovery and business continuity can also be modeled. In short, just about any cyber risks can be a part of the exercise.

Tabletop Exercise Outcomes and Deliverables

Our tabletop exercises result in a variety of detailed reports and a knowledge transfer session, if desired. The reports include the results of the policy/procedure review and gap analysis, a description of the simulated incident and an action plan for future improvements. If desired, a board level executive summary can also be included, suitable for presentation to boards, management teams, direct oversight groups, Public Utility Commission and Homeland Security auditors as well.

These reports will discuss the security measures tested, and provide advice on proactive controls that can be implemented, enhanced, matured or practiced in order to display capabilities in future incidents that reflect the ability to perform more rapid and efficient recovery.

The knowledge transfer session is your team’s chance to ask questions about the process, learn more about the gaps observed in their performance and discuss the lessons learned, suggestions and controls that call for improvement. Of course the session can include discussions of related initiatives and provide for contact information exchange with our team members, in the event that they can assist your team in the future. The knowledge transfer session can also be performed after your team has a chance to perform a major review of the reports and findings.

How to Get Started on Tabletop Exercises from MSI

Tabletop exercises are available from our team for cyber security incidents, disaster preparedness and response or business continuity functions. Exercises are available on an ad-hoc, 1 year, 2 year or 3 year subscription packages with frequencies ranging from quarterly to twice per year or yearly. Our team’s experience is applicable to all utility cyber programs and can include any required government partners, government agencies or regulators as appropriate.

Our team can help develop the scope of threats, cyber attacks or emergency events to be simulated. Common current examples include ransomware, phishing-based account compromises, cyber attacks that coincide with catastrophic events or service disruptions, physical attacks against substations or natural gas pipelines, data breach and compromise of various parts of the ICS/SCADA infrastructure. Our team will work with you to ensure that the scenario meets all of your important points and concerns.

Once the scenario is approved, we will schedule the simulation (which can be easily performed via web-conference to reduce travel costs and facilitate easy team attendance) and build the nuances to create the effects of a real event. Once completed, the reporting and knowledge transfer sessions can follow each instance.

Tabletop exercises can go a long way to increasing cybersecurity preparedness and re-enforcing the cybersecurity mindset of your team. It can also be a great opportunity for increasing IT/OT cooperation and strengthening relationships between those team members.

To get started, simply contact us via this web form or give us a call at (614) 351-1237. We would love to discuss tabletop exercises with you and help you leverage them to increase your security posture.

 

OCIE Cites Current Risks Facing Wealth Management Firms

Posted on by

As I discussed in my last blog concerning wealth management firms, the Securities and Exchange Commission (SEC) and their Office of Compliance Inspections and Examinations (OCIE) has placed a strong emphasis on information security and privacy practices. As 2020 began, the focus of OCIE examinations seemed to be concentrating on cyber governance, cyber resilience, privacy and data security, and outsourcing risks. Although these considerations still exist, the advent of the COVID-19 crisis has prompted the SEC to augment their thinking on current risks for brokers/dealers and investment advisors. Pursuant to this effort, they released a Risk Alert entitled Select COVID-19 Compliance Risks and Considerations for Brokers-Dealers and Investment Advisers (https://www.sec.gov/files/Risk%20Alert%20-%20COVID-19%20Compliance.pdf). The OCIE’s observations and recommendations have been grouped into a number of categories. These are discussed below:

Protection of Investor Assets: The OCIE is encouraging firms to review their operating practices surrounding collecting and processing investor checks and transfer requests to ensure social distancing practices and remote working are not impacting the security of these practices. As well as updating policies to reflect these changes, the OCIE is recommending implementing additional steps to validate the identity of investors and the authenticity of their disbursement instructions.

Supervision of Personnel: The OCIE is recommending that firms should review and adjust their personnel supervision policies and procedures to ensure that the current situation does not seriously impact brokers/dealers’ ability to provide sound advice in a volatile market, and to communicate with their customers effectively.

Fees, Expenses and Financial Transactions: Recent market volatility has put pressure on both investors and wealth management firms. It is thought that this increased pressure may have increased the potential for misconduct among brokers/dealers. Because of this, OCIE recommends that firms should review and adjust their policies and procedures surrounding fees and expenses.

Investment Fraud: Volatile times and business situations can increase the risk of investment fraud through fraudulent offerings. The OCIE recommends that firms should be aware of these risks and take them into consideration when conducting due diligence reviews on investments to ensure that said investments are actually in the best interest of the investors. They solicit firms and investors that suspect fraud to contact the SEC.

Business Continuity: The OCIE is recommending that firms should consider their ability to operate critical business functions during the emergency situation and review their business continuity plans. They cite the fact that working from remote sites could raise compliance issues. They specifically state that compliance policies and procedures used under normal operating conditions may need to be modified to address risks and conflicts of interest present in remote operations. They also state that security and support for facilities and remote sites may need to be modified or enhanced.

Protection of Sensitive Information: The current emergency has forced firms to employ video conferencing and other electronic means to communicate while working remotely. Often personnel are using personal devices and web-based applications as a part of this process. The OCIE points out that employing these means increases the risk that investor PII or private company information may be compromised. These practices also increase email/phone phishing risks. To help fight this, the OCIE recommends that firms enhance their identity protection practices, provide additional training for users and investors, conduct heightened reviews of access rights and privileges, use encrypted communications, ensure patching and updating is well undertaken, consider enhancements such as multi-factor authentication, and address risk issues related to partners and third parties.

MSI points out that the best way to ensure that all your information security practices are effective and compliant with guidance such as that listed above is to conduct regular security reviews and testing. These include risk assessments, application security assessments, network vulnerability and penetration testing and other security testing such as Wi-Fi security testing and social engineering exercises.

All About FINRA Risk Assessments

Posted on by
Reply

FINRA (Financial Industry Regulatory Authority) requires an enterprise risk assessment once per year for all member firms. This risk assessment should be completed using the NIST Cyber-Security Framework, if appropriate for the size of the organization. At MSI, we fully embrace the NIST framework and use it routinely for our approach to information security and risk management.

Who Performs the FINRA Risk Assessment?

The FINRA requirements for risk assessment include that it be completed by independent third-party assessors, if possible, or otherwise by internal information security experts (if qualified and available). MSI’s approach is to work WITH our client’s internal team members, including them in the process, and leveraging their deep knowledge of the firm’s operations, while still maintaining our independence. In our experience, this provides the best return on investment for the risk assessment, and allows granular analysis without draining critical internal client resources.

What Analysis Does the FINRA Risk Assessment Require?

Each FINRA risk assessment should include an inventory of all critical data, PII and other sensitive information. Then, each asset should be reviewed for its impact on the business and identification of relevant controls, risks, mitigations and residual risks should occur. This process requires deeper knowledge of cyber security than most firms are comfortable with, and the experience and attention to detail of the assessor can make or break the value of the assessment.

Is the FINRA Risk Assessment Affordable?

Since the workload of a risk assessment varies greatly based on the size and complexity of the organization being assessed, smaller firms are naturally more affordable than larger firms. Risk assessments are affordable for nearly every firm today, and the work plans can be easily customized to fit even the tightest of budgets. In addition, when working with experienced and knowledgable assessors, the cost can be even lower and the results even more valuable. At MSI, our assessment team has more than 15 years of experience, across a wide variety of size, type and operational styles of client firms. You won’t find any “on the job training” here, our experts are among the best and most recognized in the world. We are excellent at what we do, and we can help your firm get the best ROI on a risk assessment in the industry.

How Do I Get Started on a FINRA Risk Assessment from MSI?

Simply drop us a line via this web form, or give us a call at (614) 351-1237 to arrange for a free, no hassle call with our team. We’ll explain how our process works, gather some basic information and provide you with a proposal. We’d love the chance to talk with you, and be of service to your firm. At MSI, we build long-term client relationships and we truly want to partner to help your firm be more successful, safer and manage the risks of the online world more easily. Give us a call today! 

Car Dealership Threat Scenario – Wireless Printer Hacking AP Fraud

Posted on by
Reply

Today, I wanted to talk about a threat scenario that we have modeled recently. In the scenario, the victim was a car dealership, and the target was to commit accounts payable fraud. The testing scenario is a penetration test against a large group of car dealerships, but our research shows the threat to be valid against any number of organizations. 

Here’s the basics of the scenario:

  • The team found a car dealership with an extensive wireless network. Though the network was encrypted and not available to the public, the team was able to compromise the wireless credentials using a wifi pineapple in a backpack, while pretending to shop for a new car.
  • The team used the credentials to return later, appearing to wait for a service visit and working from the customer lounge. (The coffee and snacks were great! )
  • The team logged into the wireless network and quickly identified many devices, workstations and such available. Rather than focus on the workstations or attempt an attack on the users – the team instead focused on the shared printers.
  • One printer was identified with the name “BackOffice”, and access to the print spool was easily obtained through known default passwords which hadn’t been changed on the device.
  • Our team made notes of attack their recon attack path, and left the dealership.
  • Once away from the dealership a couple of simple social engineering calls were made to the accounts payable folks, pretending to be a vendor that we had observed at work at the facility. Without any real information, the accounts payable team member explained when we could expect payment, because accounts payable checks were processed every Thursday morning. The social engineer thanked them and completed the call.
  • On Thursday morning, the team showed up at the dealership again, pretending to wait for a service appointment. While in the lounge, they accessed the compromised network and printer. This time, taking deeper control of the printer’s file buffer.
  • The team waited for the accounts payable staff to submit their weekly check printing to the printer. Indeed, around 10:45, the printer file showed up in the printer spool, where our penetration testing team intercepted it. 
  • The team quickly edited the file, changing one of the checks in amount (increasing the amount by several thousand dollars) and the payee (making the check payable to a fictional company of our choosing). They also edited the mailing address to come to our office instead of the original vendor. (PS – we alerted the manager to this issue, so that the bill could be paid later — never harm a client while doing testing!!!)
  • The file was then re-sent to the printer and released. The whole process occurred in under 3 minutes, so the AP person never even noticed the issue.
  • One expected control was that perhaps the AP staff would manually reconcile the checks against their expected checks, but this control was not in place and the fake check was mailed to us (we returned it, of course!).

This is a pretty simple attack, against a very commonly exploitable platform. Poor wireless network security and default installs of printer systems are common issues, and often not given much thought in most dealerships. Even when organizations have firewalls and ongoing vulnerability scanning, desktop controls, Anti-Virus, etc. – this type of attack is likely to work. Most organizations ignore their printers – and this is an example of how that can bite you.

These types of threat scenarios are great examples of our services and the threat modeling, fraud testing and penetration testing available. If you’d like to learn more about these kinds of activities, or discuss how to have them performed for your organization – get in touch. You can contact us via web form or give us a call at (614) 351-1237. You can also learn more about our role and services specific to car dealerships here.

Thanks for reading and let me know if you have any questions – @lbhuston on Twitter.

Business Email Compromise Attacks on Dealerships

Posted on by
Reply

Business email compromise attacks are a significant threat to car dealerships.

Among the car dealerships we work with, two large threats represent the most significant risks at the moment. The first is ransomware, which we have covered extensively on this blog. The second, business email compromise, we’ve also talked a lot about, but mostly in terms of traditional financial services firms. However, business email compromise is one of the most common cybersecurity attacks today and, according to the FBI’s Internet Crime Complaint Center, costs American firms $1.7 billion in 2019, while worldwide losses might well have reached over $5 billion!

How big is the risk of a business email compromise in a dealership?

Business email compromise attacks occur every single day across a variety of industries. Business email compromises typically occur via two specific attack vectors: phishing and stolen credential reuse. Most of our dealerships have significant controls around phishing, with those detection systems reporting tens to hundreds of attempts per day. While the phishing tools are good enough to stop the vast majority of common phishing attacks, there are some that make it through the network and computer-based defenses. When this happens, it is up to the humans in the dealership to be aware enough of the issue, be paying enough attention and have good enough training to prevent the phishing message from becoming a compromise.

In the second attack vector for business email compromise, attackers reuse stolen or leaked credentials (logins and passwords) that have become available on the Internet. There are several common forums and pastebin-type sites where these credentials are dumped, traded or sold (if you want to learn about a common tool to help monitor for these issues, check out ClawBack) and attackers monitor these sites with various tools. Once they see a leaked set of credentials, they try and use it on the web mail logins of their targets. If the user has the same login and password across many sites (many do), then the attacker may compromise the web mail account and be logged into the corporate email system as the user.

What happens in a typical business email compromise in a dealership?

Once the attacker has access to the email system, they will often spend a little time reading the emails and browsing through any files that the email server maintains. If the system includes chat capabilities, they often read those as well. They do this to learn about the user, their position and what the attacker may be able to use the compromised account to do. If any valuable information is in the email archive or on exposed files, they often steal that data right away for resale.

It’s not uncommon for attackers to set a forwarding address for compromised mail accounts, redirecting copies of emails to themselves so that they can monitor the email activity of the user without logging back into the server – thus reducing their chances of being discovered. If the compromised account doesn’t seem useful to the attacker, they will often use it to send phishing emails to other people in the address book, including other internal users, business partners, customers and the like. These phishing attacks are often highly successful, given that they come from a trusted contact and the attacker can tailor the language and tone of the email to match usual conversations.

Once the attacker gets access to an account that they feel is capable of either gaining them network access (think executives who can make requests of subordinates) or allow them to move money (think about accounts payable, wire, ACH and other banking fraud), they will use the email account to send messages, forms (if available) or other requests to get what they want. Again, these attacks are often highly successful, because the attacker comes from a known account, can tailor the language and tone of the messages, and can use social engineering techniques to apply pressure to the victims in order to get them to do things they might not ordinarily do.

What can dealerships do to prevent business email compromises?

Dealerships can combat business email comprise attacks by ensuring that their phishing and authentication defenses are up to par. They can train their team members to be on guard for messages that apply pressure, declare urgency or ask for unusual activities. The dealership can implement training and protocols for voice validation checks for unusual requests and perform ongoing testing of these types of scenarios to educate and keep their staff on guard.

Dealerships can also be vigilant about their email systems, configuring them to apply controls, ensure that logging and other security measures are in place. They can implement multi-factor authentication. They can have ongoing assessments and penetration testing – including business email comprise-based scenarios.

Reducing the risk is doable, but it does require work, investment and continued vigilance. Attackers only have to be right once, while the security controls and your team have to be right every single time to prevent losses. With incidents ranging from tens of thousands of dollars to hundreds of thousands of dollars in losses – paying attention to business email compromises is critical for dealerships of all sizes.

To learn more about tools, techniques and testing to help your organization prevent, detect and respond to business email compromise attacks, get in touch with our team at SecureDrive Alliance for more information and a free risk discussion today.