Chase Breach: 5 Lessons for Europe

Key Security Takeaways for European Financial Institutions

By Mathew J. Schwartz, October 13, 2014. Follow Mathew J. @euroinfosec  

 

The breach of financial giant JPMorgan Chase in the United States poses difficult questions for the financial services industry. Namely, if hackers can infiltrate Chase, is any financial institution safe?
JPMorgan Chase has confirmed that the breach affected personal information, such as e-mail addresses, tied to 76 million U.S. households as well as 7 million businesses.

Related Content

• Mass. AG Probes Breach Tied to Experian
• Report: Russians Hack JPMorgan Chase
• Helping Retailers Fight Malware
• Michael Daniel's Path to the White House
• Apple Attackers Hack Webcams Too

Related Whitepapers

• Protecting Your Mid-Size Business from Today's Security Threats
• The Importance of Reputation
• 2014 Report: State of Security Operations
• Threat Intelligence and Incident Response: A Study of U.S. and EMEA Organizations
• Information Security Buyer's Guide: Rapid Detection and Resolution Model

Beyond that, however, getting solid details about the breach continues to be difficult. The incident appears to have begun in early June, but reportedly wasn't detected by the bank until late July. Various, anonymous sources have discussed the possibility that Russian attackers were involved, and also suggested the same gang probed or exploited a total of 10 financial services firms, including Chase.
With news of the breach still trickling in, information security experts weigh in on the Chase breach implications for financial services firms located in Europe:

1. Everyone is a Target

One breach fact - for any financial institution, anywhere in the world - is that they're a potential target, says Alan Woodward, a professor in the Department of Computing at the U.K.'s University of Surrey, as well as a cybersecurity adviser to Europol. "The U.K. banks have recognized for some time that this is the case - the Bank of England has been running simulations with the banks to test out defenses. But sadly, as we all know, the bad guys only need to get through once to cause a problem."
Dublin-based cybersecurity consultant Brian Honan, who heads Ireland's computer security incident response team, notes: "No matter how effective your security program is, there will always be risks."
So information security experts recommend businesses focus resources on preventing hacks as well as quickly detecting intrusions, rapidly remediating breaches, and always staying abreast of the latest changes - both offensive and defensive. "Banks, and all organizations, should conduct regular risk assessments taking into account the latest developments in threats and cybercrime capabilities," Honan says.
That's especially important for financial institutions around the world, given the preponderance of legacy systems in their IT environments, says London-based Gavin Millard, the European, Middle East and Africa technical director at Tenable Network Security. "It is also critical that organizations continuously monitor their infrastructure for vulnerable and weakly configured systems to identify any springboard into the network that could be utilized to gain further access and exfiltrate sensitive data," he says. "If a legacy system - of which there are many at banks and financial institutes - can't be upgraded, appropriate compensating controls have to be in place to protect them."

2. Remediate Phishing Vulnerabilities

Unconfirmed details of the JPMorgan Chase investigation suggest the financial institution got hacked after the PC of an employee who was working remotely was exploited (see: Alleged Bank Hack Tied to Phishing). One takeaway from that scenario is that businesses should make sure that employees are not reusing their work username and password on third-party sites. That's because those sites could get hacked, with the credentials obtained and then put to use by attackers to break into corporate environments.
"Organizations need to do more in understanding their extended attack surface and never assume that 'user@CorporateEmail' and 'CorporatePassword' haven't been used elsewhere to create accounts on third-party systems or spear-phished," Millard says. "Pro-actively banning the use of corporate e-mail addresses to sign up to any third party Web services and enforcing good password best practices should be standard for all organizations."

3. Breach Regulations Will Change Awareness

To date, the majority of breaches - and especially massive data breaches - have involved U.S. organizations, leading some commentators to assume that European organizations are simply more secure. Currently, however, European financial services firms are under no obligation to publicly disclose when their networks get breached. But the EU is considering a new data breach notification law, which would require any business that suffers a breach involving customer data to notify regulators and consumers "without undue delay" (see EU Prepares Tough Breach Notification Law).
But if the law does pass, expect it to reshape notions of how secure - or insecure - financial firms are in Europe, says Jeremy King, international director of the PCI Security Standards Council. "For too long, we've sort of swept the problem under the carpet. It's very interesting - and maybe it's no coincidence - that because of the breach notification rules in the U.S., we hear about these big breaches, and people have this strange thought that it's not happening over here, and that's really because the breaches are happening, but they're not being reported, because we can hide them," he says.

4. Beware of the Blame Game

Who hacked JPMorgan Chase? Numerous "sources" - all speaking anonymously - have been cropping up in U.S. media coverage of the Chase breach.
Ignore it, says Jeffrey Carr, CEO of threat-intelligence firm Taia Global. "Public attribution by cybersecurity vendors is usually nothing more than a marketing play where the vendor is hoping to get his company's name mentioned by The New York Times or another major paper by claiming that China or Russia is behind the attack," he says. "Public attribution by U.S. government officials may be done to push their political agenda. Regardless of who is doing it, ill-informed guesswork at who's responsible is always a bad idea because it serves no constructive purpose and provides cover for attackers from other parts of the world who want investigators to look East while they're attacking from the West."

5. Market-Crashing Attacks Remain Unlikely

To date, no JPMorgan Chase breach commentators have been able to answer this crucial question: What were the Chase hackers seeking? President Obama repeatedly asked this question of his briefing team, and no one could provide him with a solid answer, The Times reports.
But Carr says the hackers likely were not trying to crash financial markets. "JPMorgan and other international banks are vulnerable to attack in countless ways much more serious than this one - attacks by insiders, by trusted vendors, by finding zero-days in hardware, firmware, and software, etc. - and many of those ways would be invisible to their respective security teams," he says. "The fact that the world's biggest banks have avoided any major financial disruption is not because they aren't vulnerable. It's because it's in no one's interest to conduct a breach big enough to start a global panic, which a successful attack against JPMorgan would have done."


http://www.bankinfosecurity.co.uk/chase-breach-5-lessons-for-europe-a-7429

Read more »

Why cyber criminals are winning: The secret weapon of the black hats

October 4, 2014 4:30 PM
Shlomi Boutnaru, CyActive

Another day. Another hack. One day it’s black hats making headlines with a massive hack on Home Depot. The next, it’s the theft of 4.5 million U.S. hospital records or 1.2 billion web credentials. The connected world is under siege and the current cyber security approach is falling woefully short — as evidenced by the headlines.
Why are cyber criminals winning?
Today’s cyber security paradigm is a reactive cycle: when a threat is exposed, it is analyzed and a counter-solution is designed with response times varying from weeks to years. The trouble is that attackers can easily reuse pieces of previous malware, modify them, and create a brand new threat, bypassing the newly updated security measures.
Attackers can simply copy pieces of code from previous malware, such as exploits, decryptors or modules (keyloggers, backdoors etc.), and incorporate them into the new malware they are developing. Alternatively, attackers can imitate the operational methods performed by other malware, needed for the success of the operation (persistence methods for example).
By reusing code and methods, hackers gain the upper hand. New malware is cheaper and easier to develop, while the tools needed to locate and disable it are only becoming more expensive. All the while, defenders need to cover a growing array of potential targets, each with their own set of weaknesses. For every dollar spent by cyber attackers, hundreds of dollars are being spent by the IT security industry. This economic imbalance is the springboard from which cyber-crime, cyber-terrorism and cyber-warfare are launched. Thus, code and method reuse has become an intrinsic part of the DNA structuring of malware development today.
A number of malware used in prominent cyber attacks over the past year, both in espionage program Advanced Persistent Threats (APTs) and in cybercrime, serve as prime examples of reuse of both code and methods – BlackPOS, Mask, Snake,and Zberp to name a few.

Notorious, but not original cyber attacks

BlackPOS is the malware responsible for stealing credit card information from the Target and Neiman-Marcus department stores in December 2013. The attackers reused the entire code of an earlier variant of the BlackPOS malware, modifying it slightly to deal with the specific PoS software used in Target. Yet another variant of the BlackPoS model returned in April-May 2014, stealing an even bigger number of credit cards from the Home Depot retail chain.
Mask, revealed in February 2014, is a large (and possibly state-sponsored) malware operation that attacked 31 countries, covering more than 380 unique victims. The malware uses a complex implant that performs a large number of surveillance functions on the target. Mask reuses known vulnerabilities in the Java Runtime Environment and Adobe Flash Player.
The Snake (AKA Turla, Uroburos) APT was revealed in March 2014 to have been targeting government and military organizations in countries of the Former Soviet Union, the European Union, U.S.and U.K.  Based on several similarities, the malware is assumed to be the work of the creator of Agent.BTZ, that infiltrated the US Department of Defense network in 2008.
A very recent example of the reuse phenomenon is Zberp, which attacked some 450 financial institutions around the world during the first half of 2014. Zberp enables attackers to steal information such as SSL certificates and FTP account credentials, and allows attackers remote access to the infected target. It reuses code and methods from Zeus, the infamous banking malware, and Carberp, another major banking malware discovered in 2010. The reused methods include Steganography, which hides malicious code in pictures, and API Hooking, whose code was copied from Carberp with only slight modifications.
The bottom line is that as long as we give cyber criminals the opportunity to reuse and recycle code, hacking makes financial sense. Until hackers are forced to create attack chains from scratch they will continue to win. And therein lies the challenge.
Shlomi Boutnaru is CTO of CyActive and has a decade of cyber security experience. Formerly manager of COE (Center of Excellence) Cyber & Security at Matrix, he managed Matrix’s entire cyber security operation, including development and integration of security products, analysis of malicious code, and penetration-testing. Prior to that, he served in elite Israeli military units (Intelligence and IAF). He is a lecturer on information security in leading institutes in Israel and abroad.

Read more »

New York’s Financial Regulator Pledges Increased Focus on Cybersecurity

The financial regulator for the state of New York announced on Monday a plan to increase focus on cybersecurity over the next year. In a speech at the Bloomberg Markets Most Influential Summit, Benjamin Lawsky, superintendent of New York’s Department of Financial Services, said that the possibility of a cyberattack targeting the financial system keeps him awake at night, adding that “it is impossible to take it seriously enough.”
The state’s Department of Financial Services is only three years old, but the agency has already worked to increase fines and executive accountability for banks. In fact, DFS fined French bank BNP Paribas a record $8.9 billion for doing business with countries that have been blacklisted by American authorities.
In his speech, Lawsky went on to say that cyberterrorism is the most important issue his agency will work on in the coming year, warning that a large-scale event could come if protective measures aren’t taken soon.
“I worry that we’re going to have some sort of major cyberevent in the financial system that’s going to cause us all to shudder, an Armageddon-type cyberevent,” Lawsky said at the Summit. “The failures to detect the 9/11 plot were sort of a failure of imagination, some would say … I worry about the same thing here: that an event will happen and we’ll all look back at it and say, ‘How did we not do more?’”
Lawsky went on to say that there are only two types of people: those who have been hacked and are aware of it, and those who have been hacked and haven’t found out yet. A series of prominent data breaches targeting major companies and compromising the credit card information of millions of customers have occurred recently, causing alarm within the financial sector.

Financial Sector Experiencing Increased Cyberattacks

Banks have also come under attack, with a variety of high-profile financial institutions suffering breaches last month. In all of the security incidents, not only were the attacks large-scale occurrences, but they also persisted for several months, making them more harmful.
A report on cybersecurity in the financial sector by New York’s DFS released earlier this year found that most institutions surveyed had been the victim of a cyberattack at least once over the last three years, and the breaches occurred irrespective of the institutions’ sizes. Due to the increased threat facing financial service providers, Lawsky urged the use of protective security measures.
“It’s a bargain if we harden our systems now and protect against something more catastrophic,” Lawsky said. “It is a great deal in my view. Once there is major event, everyone suffers. We’re going to pay for it either now or then.”
For organizations looking to increase enterprise security and improve data loss prevention, either financial or otherwise, data encryption is a proven way to protect sensitive information. Another option is the use of a public key infrastructure, or PKI, to ensure malicious actors are not able to access privileged information. PKI is one of the safest encryption methods available, offering companies increase data security and peace of mind when transmitting sensitive information.

   Department of Financial Services, DFS, Financial Regulator, New York, Terrorism

Read more »

European firms far from ready for new data rules, study shows

Warwick Ashford Wednesday 01 October 2014

As European authorities aim to ratify revised data protection legislation by the end of 2015, many firms will have a lot of work to do to comply, a study has revealed.
If all goes according to plan without any more deadline slips, European firms will have to comply with the reviewed laws some time in 2017, following a two-year implementation phase.

However, despite 84% of 1,500 office workers polled in the UK, France and Germany saying Europe needs stronger data protection laws, 77% are not confident their organisations comply with current rules.
This means only 23% were completely confident their organisations complied with current legislation, according to the survey commissioned by security firm Sophos.
While 91% of respondents had at least one safeguard in place when it came to protecting personal data, only 59% had antivirus protection.
Almost half said their organisation either did not have a data protection policy in place, or had not told employees about one.
The survey, aimed at gauging professionals’ understanding of data protection ahead of the proposed EU reforms, showed knowledge and awareness of data encryption is low.
A fifth said their organisations are not encrypting personal data, while a quarter said they did not know if their organisation was using data encryption, and 7% admitted not knowing what encryption was.

More on EU data protection reform

• EU data protection reform threatens NHS record-sharing plans
• Revised EU data protection in effect already, says lawyer
• Only one in 100 cloud providers meet latest EU data protection requirements
• EU data law changes are a security channel opportunity
• Where next for the new EU data protection regulation?
• Infosec 2014: Act now, but no new EU data protection law before 2017, says ICO
  EU Data Protection Regulation: fines up to €100m proposed
• Half UK IT decision makers unaware of coming EU data laws, study shows

Again, only 23% could confirm their organisations encrypted employee and customer data.
The report also examined user attitudes to mobile device security, with 98% agreeing the data is to an extent more important than the device itself.
However, a quarter confessed to storing corporate information on their personal laptops and mobile phones, with 19% revealing they had lost a personal or mobile device.
When it came to securing mobile devices, the majority (64%) said their organisations implemented passwords to secure mobile devices.
However, only 31% of those with company phones were able to confirm they were encrypted, compared with 51% confirming their company laptops were encrypted.
The UK had the highest percentage of encrypted company laptops – 62%, compared with 36% in France and 56% in Germany.
The UK also had the highest percentage of encrypted company mobiles – 41%, compared with 21% in France and 32% in Germany.
This disparity between encryption on mobile phones and laptops highlights the continued willingness to accept mobile phones as a risk, according to the study report.
The majority of respondents agreed information was the most valuable asset, with 95% saying they need to share, send and access corporate data from any device or location in order to work effectively.
But the survey showed two thirds of respondents do not always check whether the data is safe to share, and little more than two thirds said to share data easily, they were willing to use personal cloud services to circumvent company IT restrictions and policies.
Attitudes to cloud storage differed in each country. Overall, 31% said their organisation allowed them to use cloud storage solutions – like Dropbox – in the workplace.
However in the UK this increased to 44%, with only 27% allowed in France and 23% in Germany.
A further 11% were not allowed to use cloud storage solutions, but said they did so anyway.
The survey showed UK respondents are also more likely to share data in the cloud – 52%, compared with 40% in France and 34% in Germany.
Overall, 61% of respondents said it was important to have stronger laws on data protection governing all European countries. This broke down to 54% in the UK, 68% in France and 62% in Germany.
There were also differences in opinion between the three countries with regard to the security of personal data, with France (86%) more concerned than the UK (78%) and Germany (74%).
Only 29% of respondents in Germany were concerned about cyber criminals getting hold of data, compared with 49% in France and 45% in the UK. Additionally, 76% of respondents in France were more concerned about the security of corporate data, compared with 62% in the UK and 59% in Germany.
Interestingly, 60% of employees in the UK – compared with 43% in France and 50% in Germany – said their organisation had a data protection policy and it had been clearly communicated, with employees in larger organisations more likely to be aware of data protection policies.

Data protection reform a step in the right direction

“Although there is still some fine-tuning to be done to the proposals for reformed data legislation in the EU before they can become law, the core principles are unlikely to change,” said Anthony Merry, director of data protection at Sophos.

The proposed legislation allows for more help and support for organisations hit by data breaches than the current legislation in the UK
James Lyne, Sophos

“All in all, we see this as a positive step in the right direction to bringing all member states under a single set of rules appropriate for the modern, digital world,” he said.
The current data protection directive dates from 1995, but there have been many changes since then, such as widespread use of smartphones and enterprise adoption of cloud-based services.
At the very least, Merry believes the new legislation will achieve the goal of raising awareness about the importance of data protection.
“Many of the companies I talk to still do not understand what data protection is, why businesses need to do it and why it is important, and that needs to change,” he said.
With the proposed fines of up to 5% of global turnover, or €100m, he believes the planned data protection laws will help focus the attention of business executives on the issue.
Mandatory breach notifications will force companies of all sizes to think more carefully about data access, according to James Lyne, global head of research at Sophos.
In particular, he said it will force small-and-medium enterprises (SMEs) to limit access to the data employees need to do their work, instead of full access to everything by anyone on the company network.
“The new laws should result in greater data segmentation, more use of encryption and more groups of data with policy around them,” said Lyne.

SME-friendly data protection legislation

But while it will force SMEs to report all data breaches, it will also be more SME-friendly by requiring data protection authorities to help companies hit by breaches to deal with the impact.
“The proposed legislation allows for more help and support for organisations hit by data breaches than the current legislation in the UK,” said Lyne.
“The new laws are aimed at encouraging organisations to report breaches as quickly as possible by offering reduced liability and support in mitigating the effects of a breach,” he said.
Lyne hopes the new laws will encourage SMEs to choose a security standard to implement and seek professional advice to ensure they are following best practices.
“This approach means that if they are hit by a breech, they are more likely to be supported as a victim, rather than being fined for being negligent though failing to take appropriate measures,” he said.
The proposed legislation, he said, will go a long way to ensure businesses are not failing to take basic security measures to ensure data is protected.

Encouraging data encryption

The reviewed legislation is also likely to help drive encryption of data, said Merry. “If data is encrypted, even it if IT systems are breached, companies will not be liable under the law,” he said.
Encrypting data will also mean even though organisations will have to report a data breach, they will not have to notify individuals that their data has been compromised.
While continual data breach notifications may result in notification fatigue, Merry said the overall effect is likely to be an increase in awareness of the issue by companies and consumers.
“This means consumers are more likely to transact with businesses they feel they can trust with their personal and financial information,” he said.
Another positive effect of the proposed legislation is that it will force all companies that hold the data of EU citizens to offer better protection, even US-based companies.
Lyne said cyber crime is transnational, but laws still tend to be national. However, the proposed EU data protection laws will go some way to changing this by bringing the law more in line with real-world practice.

Related Topics: Privacy and data protection, Regulatory compliance and standard requirements, IT legislation and regulation, IT for consulting and business services, IT risk management, IT for manufacturing, IT for small and medium-sized enterprises (SME), IT suppliers, IT for retail and logistics, Hackers and cybercrime prevention, VIEW ALL TOPICS

Read more »

Nearly Half Of U.S. Companies Had Data Breaches In The Past Year

Despite an increase in preparedness, confidence in security measures is low.

By Peter Wade

While more companies are taking action to prevent and respond to a security breach like the recent Home Depot hack, the number of attacks is also on the rise. In the past year alone, an astounding 43% of companies in the United States were hit by a data breach, according to a new study by Experian and Ponemon--a 10% increase from the previous year.
According to the survey, which asked 567 executives of U.S. companies about their preparedness and response plan for a data breach, 73% said their company has plans and teams in place to respond to a data breach (compared to 61% in last year’s survey). However, only 30% of respondents said that plan was effective, and a vast majority (78%) don’t update their plan regularly.

RELATED

• Why Do Companies Keep Getting Hacked?
• Survey: 35% Of Americans Took Security Actions After iCloud Breach
• Who Is Liable When Cloud Services Are Hacked?
• Home Depot's Customer Security Nightmare Continues

"While more organizations have data breach preparedness on their radar and have developed a response plan, a majority of companies are not putting the support and resources behind having it truly be effective," said Michael Bruemmer, vice president of Experian Data Breach Resolution. For example, fewer than half of companies train customer service representatives and employees who handle sensitive data on security measures, which the study calls a company’s “weakest link” when it comes to vulnerability to hackers.
Increasing data security isn’t only good for customers, it’s good for a company’s bottom line. According to Ponemon and IBM’s 2014 Cost of Data Breach Study, each stolen record costs a company $201, unless it has implemented a formal response plan. Having a plan in place reduced the cost per lost record to as little as $17. But implementing security measures on old software can be difficult.
"Security really needs to come in from the beginning," Patrick Thomas, a security consultant at Neohapsis, told Fast Company in February. "For larger companies with huge established portfolios of applications, many of these go back five, 15, 20 years to before many modern security practices existed. Overhauling them is a tremendous mountain to climb."
[h/t USA Today]

Read more »

Ashley Carman, Editorial Assistant                     

September 24, 2014

DDoS attacks target enterprises and ISPs, ignore financial institution

Distributed denial-of-service attack volume and targets shift in 2014.

The traffic volume of distributed denial-of-service (DDoS) attacks has increased this year with one-third peaking at more than 500Mbps, and more than five percent reaching 4Gbps. Only .9 percent of attacks reached 4Gpbs during the second half of 2013.
The high frequency attacks have become increasingly difficult to detect and defend against, according to NSFOCUS's “Mid-year 2014 DDoS Threat Report,” and they can do considerable damage by effectively shutting down an enterprise's online business and services. In addition, they can diminish a company's reputation and can have political impact, Xuhua Bao, senior researcher, said in an email to SCMagazine.com.
One of the most notable findings, however, was the complete shift in targets, the report said. Last year, banks accounted for the majority of attacks. This year, financial institutions barely made the report's list of targets. Instead, NSFOCUS found that enterprises and internet service providers (ISPs) in particular are being targeted this year with 20.8 percent of the attacks aimed at enterprise websites and 14.6 percent aimed at ISPs.
Bao attributed this refocus to financial institutions employing stronger security defense solutions, which makes it both more difficult to penetrate their defenses and lessens the impact of the attacks.
He also noted that "most enterprises are inclined to take a low-profile when dealing with or reporting security issues when being attacked as compared to attacks that occur in the financial and banking industry.” Small attacks are rarely reported, he said, so without large-scale attacks, the general perceived impact is small.
The report explored attack methods, as well, and found that DNS floods remain the most popular of attack methods, followed by TCP floods and HTTP floods. For Bao, this finding represents the biggest issue plaguing IT security professionals and the field.
“Attacks methods and tactics have become more diversified,” he said. “In particular, some distinguished types of attacks, such as the Wordpress reflector and amplification attacks, are very clever…How to mitigate these types of multi-vectors hybrid DDoS attacks will be a big challenge in the future.”

Read more »

Data Classification: As Easy As 01 10 11

Data Classification: As Easy As 01 10 11

Mandy Huth

Sep 24, 2014

Forrester analyst John Kindervag recently presented an interesting webcast, outlining the top recommendations to enhance data security. One of his main points that stuck with me involved the concept of simplifying data classification into binary’s most basic premise: the value of either one or zero.
Using this method, Kindervag states two types of data exist in our network:

1 = Data someone wants to steal, and
0 = Everything else

(In binary, 1 = true and 0 = false)

In the first step of our classification efforts, we should realize what our data is and where it’s located—after all, you can’t protect what you don’t know about, or can’t see. This should be the main focus of our efforts, with the ultimate goal of gathering a complete inventory of what assets are targeted and where they are hosted.
In order to seek out data, Kindervag suggests we follow the four Ps:

• PCI – Payment Card Industry

• PHI – Protected Health Information

• PII – Personally Identifiable Information

• IP – Intellectual Property

This data has imminent value to black-hats, as they sell information in exchange at profitable rates, resulting in higher threat vectors for us. All of this data should be tagged as a “1″ and therefore, protected as such.
Then, our efforts should include a classification of all remaining data, in which we ask ourselves:
How important are financials to our business? What about our policies? Do our product roadmaps provide value to someone? And lastly, is it worth stealing? If we are led to believe this data is targeted for its value, the data can be classified as a “1,” if not, we can classify it as a “0″.
With this information in hand, the security teams can begin segregating and protecting the data in a secured network, using the right user access controls based on what they need to know—also referred to as the “principle of least privilege.” With this design, hackers cannot access the critical data in a segregated network, even when the outer perimeter is breached.
Additionally, there is great value in going back and further classifying all the “0″ values identified in this exercise. There are many classification frameworks that break data into several tiers and will help the business identify what level of risk they are willing to accept for each type.
The intent of the binary exercise is to get ahead of the complexities and begin to make progress rather than getting caught up in a more complex framework that requires extensive “pre-work.”
No one wants to have their data at risk. It is our responsibility in protecting our company’s most important assets, including data, to classify and protect them accordingly. By making it a binary exercise of 1s and 0s, you may be able to kick start this effort and greatly increase your security posture. We can all be a “bit” more secure this way.
 

Read more »