ReportWire

Tag: Cyber Criminals

  • Deepfakes Are on the Rise — Will They Change How Businesses Verify Their Users? | Entrepreneur

    Deepfakes Are on the Rise — Will They Change How Businesses Verify Their Users? | Entrepreneur

    [ad_1]

    Opinions expressed by Entrepreneur contributors are their own.

    You know how you can’t do anything these days without proving who you are? Whether opening a bank account or just hopping onto a car-sharing service. With online identity verification becoming more integrated into daily life, fraudsters have become more interested in outsmarting the system.

    Criminals are investing more money and effort to overcome security solutions. Their ultimate weapon is deepfakes — impersonating real people using artificial intelligence (AI) techniques. Now, the multi-million question is: Can organizations effectively employ AI to combat fraudsters with their tools?

    According to a Regula identity verification report, a whopping one-third of global businesses have already fallen victim to deepfake fraud, with fraudulent activities involving deepfake voice and video posing significant threats to the Banking sector.

    For instance, fraudsters can easily pretend to be you to get access to your bank account. Stateside, almost half of the companies surveyed confessed to being targeted with the voice deepfakes last year, beating the global average of 29%. It’s like a blockbuster heist but in the digital realm.

    And as AI technology for creating deepfakes becomes more accessible, the risk of businesses being affected only increases. That poses a question: Should the identity verification process be adjusted?

    Related: Deepfake Scams Are Becoming So Sophisticated, They Could Start Impersonating Your Boss And Coworkers

    Endless race

    Luckily, we’re not at the “Terminator” stage yet. Right now, most deepfakes are still detectable — either by eagle-eyed humans or AI technologies that have already been integrated into ID verification solutions for quite some time. But don’t let your guard down. Deepfake threats are evolving quickly — we are already on the edge of witnessing persuasive samples that can scarcely arouse any suspicion, even upon deliberate scrutiny.

    The good news is that the AI, the superhero we’ve enlisted to fight against good old “handmade” identity fraud, is now being trained to spot fake stuff created by its fellow AI buddies. How does it manage this magic? First of all, AI models don’t work in a vacuum; human-fed data and clever algorithms shape them. Researchers can develop AI-powered tools to remove the bad guys of synthetic fraud and deepfakes.

    The core idea of this protective technology is to be on the lookout for anything fishy or inconsistent while doing those ID liveness checks and “selfie” sessions (where you snap a live pic or video with your ID). An AI-powered identity verification solution becomes the digital Sherlock Holmes. It can detect both changes that occur over time, like shifts in lighting or movement, and sneaky changes within the image itself – like tricky copy-pasting or image stitching.

    Fortunately, AI-generated fraud still has some blind spots, and organizations should leverage those weak points. Deepfakes, for instance, often fail to capture shadows correctly and have odd backgrounds. Fake documents typically lack optically variable security elements and would fail to project-specific images at certain angles.

    Another key challenge criminals face is that many AI models are primarily trained using static face images, mainly because those are more readily available online. These models struggle to deliver realism in liveness “3D” video sessions, where individuals must turn their heads.

    One more vulnerability organizations can use is the difficulty in manipulating documents for authentication compared to attempting to use a fake face (or to “swap a face”) during a liveness session. This is because criminals typically have access only to one-dimensional ID scans. Moreover, modern IDs often incorporate dynamic security features that are visible only when the documents are in motion. The industry is constantly innovating in this area, making it nearly impossible to create convincing fake documents that can pass a capture session with liveness validation, where the documents must be rotated at different angles. Hence, requiring physical IDs for a liveness check can significantly boost an organization’s security.

    While the AI training for ID verification solutions keeps evolving, it’s essentially a constant cat-and-mouse game with fraudsters, and the results are often unpredictable. It is even more intriguing that criminals are also training AI to outsmart enhanced AI detection, creating a continuous cycle of detection and evasion.

    Take age verification, for example. Fraudsters can employ masks and filters that make people appear older during a liveness test. In response to such tactics, researchers are pushed to identify fresh cues or signs of manipulated media and train their systems to spot them. It’s a back-and-forth battle that keeps going, with each side trying to outsmart the other.

    Related: The Deepfake Threat is Real. Here Are 3 Ways to Protect Your Business

    Maximum level of security

    In light of all we’ve explored thus far, the question looms: What steps should we take?

    First, to achieve the highest level of security in ID verification, toss out the old playbook and embrace a liveness-centric approach for identity checks. What’s the essence of it?

    While most AI-generated forgeries still lack the naturalness needed for convincing liveness sessions, organizations seeking maximum security should work exclusively with physical objects — no scans, no photos — just real documents and real people.

    In the ID verification process, the solution must validate both the liveness and authenticity of the document and the individual presenting it.

    This should also be supported by an AI verification model trained to detect even the most subtle video or image manipulations, which might be invisible to the human eye. It can also help detect other parameters that could flag abnormal user behavior. This involves checking the device used to access a service, its location, interaction history, image stability and other factors that can help verify the authenticity of the identity in question. It’s like piecing together a puzzle to determine if everything adds up.

    And one final tip – requesting that customers use their mobile phones during liveness sessions instead of a computer’s webcam would be helpful. This is because it is generally much more difficult for fraudsters to swap images or videos when using a mobile phone’s camera.

    To wrap it up, AI is the ultimate sidekick for the good guys, ensuring the bad guys can’t sneak past those defenses. Still, AI models need guidance from us humans to stay on the right track. But when together, we are superb at spotting fraud.

    [ad_2]

    Ihar Kliashchou

    Source link

  • A Cybersecurity Expert Reveals Why You’re a Cybercriminal’s Next Target — and 5 Things You Can Do to Beef Up Your Defense. | Entrepreneur

    A Cybersecurity Expert Reveals Why You’re a Cybercriminal’s Next Target — and 5 Things You Can Do to Beef Up Your Defense. | Entrepreneur

    [ad_1]

    Opinions expressed by Entrepreneur contributors are their own.

    If your company was hit by ransomware today, who would you call? Or perhaps a better question: How would you call them? It sounds absurd, but as a cybersecurity expert, I’ve seen organizations paralyzed in the first hours after an incident simply because nobody knows anyone’s cell number anymore. Without access to email or messaging systems, communication grinds to a halt and workers, customers and suppliers are all left wondering what is going on. Panic rapidly escalates into a crisis.

    There’s a tendency to think about cybersecurity as being the responsibility of the IT or security department. But protecting your company comes down to two things: organizational culture and planning. That’s why some of the most important people on cyber defense aren’t in the IT team — they’re in human resources.

    The HR team is uniquely placed to embed cybersecurity preparedness into the everyday working of an organization. It’s responsible for building the policies and processes to mitigate risks and ensure the business has the competencies to be resilient to foreseeable challenges — and those include cyberattacks. And as the custodians of employees’ sensitive personal information, HR teams are themselves prime targets for hackers.

    Unfortunately, this vital role is often overlooked. So here are five ways HR can help make your business a tough target for cybercriminals.

    Related: 78% of Employers Are Using Remote Work Tools to Spy on You. Here’s a More Effective (and Ethical) Approach to Tracking Employee Productivity.

    Build a cybersecurity culture

    Eternal vigilance is the price of our liberty to roam the internet. The number of threats is mind-blowing — a recent report found the average education institution faces more than 2,300 attempts to breach its systems in a week, while healthcare organizations fend off more than 1,600 attacks. With so many digital grenades being lobbed, it’s incredibly hard to catch them all. However, a strong cybersecurity culture helps an organization defend against attacks and limits the blast radius when one does get through. The tough part: Everyone has to be on the same page when it comes to online behaviors.

    Step one is to ensure you have the training tools so that employees know what they should and should not be doing. Most organizations are reasonably good at this. Whereas, many fall short by not putting that information into practice every day.

    The best way to ensure that everyone considers cybersecurity a fundamental part of their responsibilities is to build it into performance reviews. This should not take the form of calling out workers for every dodgy link they click on. Instead, it should be a constructive conversation about how they’re keeping up with their cyber literacy training. There are cyber health-check tools that workers can use to analyze their online behavior and address weaknesses (like reusing Pa$$w0rd across half the internet or not using two-factor authentication) and often these can be used to track progress toward cybersecurity goals at an organizational level.

    When safety precautions are regularly discussed, they just become part of how you do business.

    Protect your crown jewels

    HR has custody of some of the most sensitive information in an organization — and hackers know this. In the past five years or so, many companies have adopted platforms that enable employees to self-serve routine tasks like vacation requests. However, third-party platforms come with risks. Hackers target them in so-called supply chain attacks, knowing that if they get lucky, they can access troves of information from multiple companies. In 2021, more than 300 organizations were breached in a hack of a widely used file transfer system. One of these was the University of California, which said the information exposed included employees’ social security numbers, driver’s licenses and passport details (the UC system offered its staff free ID monitoring services).

    Job one for HR professionals is to ensure employee data remains confidential. Perform extensive due diligence before your organization signs up for any third-party HR service. Only consider companies that comply with international standards (SOC 2 and ISO 27001 are the main ones to look out for) and check online for reports of security incidents at the site in the past few years. Also, look into where your data is being stored and how it is being backed up. Depending on your location and industry, you may have to comply with data residency laws.

    Stop hoarding data

    Updating the data retention policy should be on the to-do list of every HR department. I say updating because every company has a data retention policy whether they know it or not. If yours isn’t written down, then your policy is simply to keep everything forever. And that exposes you to considerable risk. The more data you have, the worse a breach can be — it’s especially bad if you’re hoarding data you no longer need. Many jurisdictions have limits on how long companies should retain sensitive information — it’s often around seven years for records on former employees.

    Figure out who will call the shots when a breach happens

    Cybersecurity may be everyone’s day-to-day responsibility, but when an attack gets through there should be one person in charge of the response. In cybersecurity lingo, we call this the incident commander. While everyone can have an opinion on the best course of action, decision-making power rests with them.

    The job spec for incident commander only has one line: It’s whoever best understands cybersecurity issues in your organization. Depending on the size of your business, that might be a cybersecurity leader, the head of IT or it could be Joanne in accounting who took a few courses on this stuff. Whoever it is, make sure you’ve identified them before an incident happens and have clearly communicated that to your team. Once a cybersecurity incident happens, events move quickly — in one case I was involved in, the hackers gave a 45-minute warning before starting to post sensitive information — so you don’t want to waste time figuring out who’s in charge.

    Run some drills

    Planning is only one half of the equation. Practice is the other. Plenty of research has shown that people don’t think clearly in stressful situations. We perform drills for fires and earthquakes to give us a framework to fall back on in an emergency. The same idea works for cybersecurity incidents. Set aside two hours once a year to run a tabletop exercise with key staff that simulates what you’ll do if the company is hacked. In these exercises, someone takes the role of a moderator to explain the nature of the attack and what’s been affected, while everyone else plays out how they’d respond.

    The first time you conduct the exercise, it’ll likely be a mess — but that’s the point. The scramble to figure things out will reveal the gaps in your plans. Over time, the drills will become second nature.

    Related: So, You’ve Been Hacked. These are the Best Practices for Business Leaders Post-Hack

    And write contact information down — on paper

    Put the incident team’s phone numbers down on paper and update the list regularly. Yes, it’s old school. Yes, it’s annoying. And yes, one day you’ll be thankful you did.

    [ad_2]

    Claudette McGowan

    Source link

  • This Type of Cyber Attack Preys on Your Weakness. Here’s How to Avoid Being a Victim.

    This Type of Cyber Attack Preys on Your Weakness. Here’s How to Avoid Being a Victim.

    [ad_1]

    Opinions expressed by Entrepreneur contributors are their own.

    You may not realize it, but social engineering attacks are the most common form of cyber attack out there. And, do you know why they are so popular?

    For starters, to carry out a cyber attack, social engineering is incredibly effective. You can gain access to systems and data simply by tricking the owner into giving up their login credentials or other sensitive information. Social engineering attacks are difficult to detect because they rely on human interaction. Yes, there have been so many successful attacks using this method, but it’s interesting to know that it can be controlled. In this article, I’ll be exposing you to different forms of social engineering attacks and how you can protect yourself from them.

    Related: How Small Businesses Can Shield Themselves Against Cyberattack

    What is social engineering?

    Social engineering is the art of gaining unauthorized access to a network or sensitive information by exploiting human behavior or psychology. Social engineering is a popular component used as an initial access vector to gain access to a network.

    Social engineering is carried out mostly via email — phishing. One example of such an attack is the 2016 FACC hit. According to this report, the CEO and CFO of FACC got fired as a result of the whaling incident that cost the company $47 million. An email, claiming to be from the CEO, asked an employee to transfer funds to support an acquisition. After the cybercriminal was long gone with the funds, it was discovered that both the email and the deal were fake. This describes how dangerous social engineering is — as it relies on human error and not some sort of software or operating systems.

    In recent years, there has been an increase in sophisticated social engineering attacks plaguing organizations. Examples of sophisticated social engineering attacks are reverse tunneling and URL shorteners, which are used by cybercriminals to launch virtually undetectable phishing campaigns.

    While cyber attackers often use social engineering tactics to try and get their targets to reveal sensitive information such as passwords and financial data, it is very important you know that this method of attack is so effective and has a high success rate because people are often the weakest link in an organization’s security. Hackers can use social engineering to bypass technical security measures, such as firewalls and antivirus software, by exploiting the trust and willingness of individuals to help others or follow instructions. More so, social engineering attacks are often relatively low cost, as they don’t require the attacker to invest in expensive tools or infrastructure.

    Additionally, social engineers are very calculative, clever and manipulative. Most cybercriminals employ social engineering to gain initial access to a network because it’s easier to manipulate and fool people than break into a secure system. Here are the four major types of social engineering to watch out for:

    Phishing: Phishing attacks are the most widely used form of social engineering you need to watch out for. It involves acquiring personal and sensitive information about an individual or an organization via email by disguising itself as a trustworthy entity in electronic communication.

    Pretexting: Pretexting is also another type of tricky social engineering technique to watch out for. In this kind of attack, the threat actor creates a false scenario where the victim feels compelled to comply. The attacker typically acts as someone in executive rank to intimidate and persuade the victim to follow their order.

    Vishing: Vishing is another type of social engineering attack technique that has a high rate of success. It is important to watch out for this kind of attack that is done over voice communication. Typically, the visher pretends to be from a legitimate company and tries to urge you to share your sensitive information, like the example highlighted earlier.

    Baiting: Baiting is another form of social engineering that exploits human weakness. The attacker puts up something enticing or compelling to lure the victim into a social engineering trap. For example, you might get “Congratulations, you are a lucky winner of an iPhone 14. Click on this link to claim it.” “Download this premium Adobe Photoshop software for $69. Offer expires in two hours.”

    As an active internet user, you might have come across this or not; well, it’s advisable to pass without clicking because it’s most likely a trap!

    Related: Hackers Aren’t The Only Unseen Enemy Behind Cyber Attacks — Your Board’s Ignorance Could Be To Blame, Too. Here’s What You Can Do About It.

    Social engineering attacks are successful because they exploit human vulnerabilities

    In this digital age where so much of our personal information is out there for the taking, it is easy for cyber attackers to gain our trust and get what they want. Moreover, it is not just clicking on phishing emails that can leave you open to an attack. It can be as simple as answering a phone call from someone who is pretending to be from your bank or tech support.

    Social engineering attacks are incredibly easy to execute. All it takes is a little bit of knowledge about how people work and some basic hacking skills. Then with it, a skilled hacker can easily get information from innocent victims, information that can be used to gain access to networks or steal identities.

    However, that does not mean you are powerless against them. Well, here are key tips that can help you recognize and prevent social engineering attacks from happening to you.

    Common telltale signs that indicate you’re under the web of social engineering attackers:

    1. When you keep receiving unusual emails and phone calls from unknown sources especially when they contain attachments and links to click on.
    2. When an unknown person keeps requesting your sensitive and personal information such as name, address, DOB, credit card numbers and so on.
    3. When an unknown person creates a sense of urgency and pressure just to get you to act swiftly without proper thoughts or analysis on matters related to work or personal accounts. And many more.

    How can you protect yourself from social engineering attacks?

    • Firstly, be aware of the dangers of social engineering attacks. These attacks are becoming more and more common, so it is crucial to be vigilant.
    • Be suspicious of unsolicited emails, calls or texts and never give out your personal information unless you are sure who you are dealing with. For example, if you receive an email from someone you do not know asking for sensitive information, do not respond. If you are not sure whether an email is legitimate or not, do not hesitate to reach out to the sender to verify its authenticity.
    • Only enter your information on trusted websites and make sure the URL starts with “HTTPS.”
    • Make sure the security software of your computer is up-to-date.
    • Use two-factor authentication, which is an extra layer of security that requires something you know (like a password) and something you have (like a physical security key or mobile app).
    • Make sure your passwords are strong and unique. Do not use the same password for multiple accounts, and ensure that your passwords are a mix of letters, numbers, and symbols.
    • Keep your personal information private. Do not share your passwords or login credentials with anyone, and be careful about the information you post online. Keep your personal information private!

    Social engineering attacks thrive in exploiting the human factor. People are often the weakest link in cybersecurity, and attackers know how to take advantage of that using social engineering.

    Remember that this is one of the most common ways cyber attackers gain access to your systems. That means they use deception to gain your trust and then extract information from you, like your passwords or login credentials.

    Now you have learned what you can do to keep yourself safe, remember that cyber attackers are experts at getting people to click on links and open attachments. Therefore, be vigilant when you are browsing the web and emailing.

    To fortify yourself against social engineering attacks, you have to stay up-to-date on the latest security threats. How do you do that? Do that by subscribing to a cybersecurity newsletter and reading blog posts on cybersecurity, such as this one, to stay informed.

    [ad_2]

    Ejiofor Francis

    Source link