As we approach the November general U.S. elections, things are heating up, with both candidates now making actual campaign appearances. We have also seen an increase in cyberattacks and other threats to our elections. This includes efforts to hack into campaign staff’s accounts by foreign governments, physical threats during these campaign stops, and changes to how votes will be recorded.

You can read my full post on Avast’s blog here,where I review the latest in election interference news.

As college students try to return to campus, some are being asked to allow the college unprecedented access to their whereabouts and health information, as we posted last week. Many are learning about the personal implications of their data security for the first time, let alone dealing with being quarantined. I’ve previously explored the wide ranging methods colleges are using to try to bring students back to campus safely and how they are planning to track their students (and staff). In this post, I talk about some of the infosec issues with tracking the college crowd. It all comes down to having solid IT leadership and necessary skills on staff to do proper security vetting.

You can read more on my blog for Avast today.

IT security has evolved from being a completely binary operation to taking a more nuanced approach. Back in the days when R, S, and A first got together, it was sufficient to do security on this pass/fail basis – meaning a large part of security was letting someone in or not to your network. Or allowing them to use a particular application or not or allowing them access to a particular network resource (printer, server) or not. In some of my other blog posts, I have mentioned this nonbinary approach in passing, particularly when I have talked about adaptive authentication. This is the core reason that the authentication “adapts” to particular conditions – for example, if someone is attempting a second login with “impossible travel” conditions. Or if you are trying to authenticate not just the user but their device as well.

But the nonbinary issue is bigger than authentications. And it is a product of our times: First, because of the pandemic and more remote working conditions, IT shops have had to make drastic changes in their infosec policies, procedures, and products. But more importantly, a nuanced approach is needed more than ever because everyone has somewhat different security circumstances. “It isn’t just one size doesn’t fit everyone; it is that one size doesn’t fit many circumstances,” said Erik Jost, the Chief Technologist for NTT Data in a recent conference session.  Everyone’s network infrastructure is different and has changed greatly since the beginning of the pandemic. Let me give you a few examples:

— Figuring out attribution to the source of an attack. Sometimes there are shades of grey that could indicate a variety of outcomes, or even that an attack wasn’t from an adversary but just from a badly configured laptop of an employee. Or an attacker may deliberately confuse things by planting false flags in their code so that they could slip inside your network undetected, such as by disguising their malware as a normal piece of code that is part and parcel to the underlying operating system. The ability to block these sneakier methods calls for a nuanced approach, so you can link the various steps in a malware’s kill chain and make it harder for an attacker to move around your network before more damage is done.

—Password rules that are too complex. Many IT shops put in place requirements for password construction that are too onerous: 20-character passwords that must be changed every month, for example. This makes employees more motivated to come up with more predictable passwords that they can remember and manage, which defeats the whole purpose of having complex passwords to begin with.

–Over-protective endpoint security. While it is great to plug as many holes as possible across your endpoint collection, if you lock down your endpoints too much, employees will shift their work to the cloud and their personal devices that aren’t locked down. That is also self-defeating.

— Finding “missing” network segments. It is just human nature: we can be forgetful, and in some cases as a result of misconfiguration, we can forget about an entire network segment or collection of servers. Your endpoint/intrusion detection tools tend to be more pass/fail on this and can give you false results. If these tools offered a more nuanced approach, you might recognize that the forgotten equipment is legitimate and you need to modify your system asset tables to properly account for them, rather than collect a bunch of false warning messages.

— URL shorteners. Remember how they were all the thing not too long ago? Now they are less favored, because they can hide malware or take you to places that will compromise your endpoint’s browsing session. Again, nuance please. This is what happened at the email provider SendGrid, which is now owned by Twilio. Many of their customers give the shortened URLs generated by their software an automatic pass.  That turned out to be one way that attackers could compromise their customers’ accounts.

–Dealing with detecting impossible travel. The impossible travel situation once was absolute: after all, no one can travel across the globe very quickly, especially these days. But as more of us work remotely and make use of VPNs, that means calculating what is possible is a lot harder to do just by computing the raw distance between the implied geolocations. If I change my VPN endpoint from one continent to another, does that mean my account has been compromised or is it because I am trying to obtain a better or faster Internet connection? Nuance once again.

— Sloppy outboarding of former staff. Did your recently fired employee access your network? We don’t always outboard former staff completely and can sometimes leave residue of access rights scattered around the network. Detecting these mistakes will require a finer – and more thorough — touch.

As one article written back in 2017 stated, “Cybersecurity requires a more nuanced approach than rushing headlong into the cyber-security marketplace to snap up the shiniest solutions, sanctioning wholesale Internet separation, or locking out USB devices entirely. Senior management of large organizations should also be wary of blanket cybersecurity policies that conflict with local operational needs.” I couldn’t agree more.

Passwords are known as the bane of every IT security manager, but often it’s the way they’re used that creates the most problems. Passwords are shared and reused across numerous logins and can frequently be easily guessed by using pet and children’s names. In other cases, passwords are compromised by users who stick with the default manufacturer settings years after their hardware is installed. This has given rise to a number of solutions that are labeled ‘passwordless,’ even though they technically still use some form of authentication.

You can read more with my post for Network Solutions blog here.

The news is filled regularly with attacks on misconfigured cloud servers and the leaked data that criminals obtain from them. The errors happen because we are all human. We might set up a cloud server with loose (or no) credentials and forget to tighten them when the server is placed into production. Or we fail to keep software up to date when exploits are discovered or get IT involved to audit the finished production app to ensure that it is as secure as possible.

You can read my post for CSOonline here on the 10 most common cloud configuration mistakes.

As more remote work from home happens, your collaboration tools need more scrutiny. A popular choice for instant messaging and video conferencing is Microsoft’s Teams, and securing this application will be a challenge. There have been Teams-specific exploits observed, for example. And even if Teams isn’t targeted, it could fall victim to general DDoS or ransomware attacks, which would be an issue if you depend on Teams for internal communications post-attack. And while Microsoft has published numerous suggestions on how to better secure Teams, the process is vexing and error-prone.

You can read my published analysis for CSOonline here. I also compare how Teams security stacks up with Slack. Avanan, pictured above, has versions for both.

Last month, a massive data leak exposed more than 300 million different accounts from social media platforms. The collection included 192 million records scraped from two different Instagram collections, along with 42 million records scraped from TikTok and an additional 4 million records scraped from YouTube.

The records include usernames, profile photos, emails, phone numbers, age and gender along with specifics about followers and other engagement for each account. The leak involved a set of three open data shares from the company Social Data: a few hours after being notified, the shares were properly secured.

There are several things that are interesting about this leak: its source, how the data was obtained, and what this means for your own social media consumption. You can read more on the Avast blog.