Welcome to Cyber Insights! In this edition we share a scam relating to Microsoft Teams, provide an update on a recent breach and elaborate on a password stealing technique know as ‘Password Spraying’.
LATEST SCAM
Collaboration tools such as Microsoft Teams are prevalent in many businesses, and the criminals know this. Current phishing scams appear to be a notification from one of your collaboration tools asking you to click on a link. This could be to accept being added to a new project team or read a new message.
Another sneaky tactic is to label the email as internal or trusted. This seems to be an attempt to override the appearance of this email being external to your organisation.
Follow the tips below to help you stay safe from similar, simple scams:
- Never click on a link in an email that you were not expecting, even if it appears to come from a program or application that you use.
- When you receive an alert email, ask yourself questions: Did I sign up for email notifications? Have I received alerts like this in the past?
- If you think the notification could be genuine, log in to the program or application directly instead of clicking the link in the email.
BREACH UPDATE
There are legal ramifications for financial services businesses and possibly all Australian companies if they experience a breach. This month in Cyber Insights, we follow up on the legal outcome of a breach. In Australia, businesses are bound by several policies such as the Privacy Policies, Notifiable Data Breach Policy, APRA and others based on your industry. So far, we have not seen fines or many repercussions for businesses failing to meet their obligations to maintain proper cyber hygiene practices until last week. The federal court has ordered RI Advice to undertake cybersecurity training and pay $750,000 towards ASIC’s legal costs. This was because the lack of cyber security risk management at RI Advice breached its license obligations.
Federal Court Justice Helen Rofe stated:
“It is not possible to reduce cyber security risk to zero, but it is possible to materially reduce cyber security risk through adequate cyber security documentation and controls to an acceptable level.”
CYBERSECURITY TIPS
Passwords have become an integral part of our daily lives. We use passwords to check our social media feeds, access our bank accounts, and log in to our work computers. In fact, studies have shown that the average person can have up to 100 different online accounts. That’s a lot of passwords to remember! With so many login credentials to remember, you may be tempted to develop short and simple passwords. For example, using a password such as “password1234” or “QWERTY” may not seem like a big deal, but a weak password can put you at risk of a cyberattack called “password spraying.” What Is Password Spraying? Password spraying is a cyberattack that tests common weak passwords across multiple user accounts. Cybercriminals can avoid being locked out of a single account by cycling through numerous accounts due to failed login attempts. The process is usually automated and often goes undetected for a long time. Once cybercriminals gain access to a user’s account, they can steal sensitive information and plant malware. The password spray attack isn’t new, but it remains an effective hacking method that allows cybercriminals to access organisations’ networks. Recently, cybercriminals have modified the password spraying technique, attacking single sign-on (SSO) services and other cloud platforms. Due to these attacks, you may need more than just a password to keep your sensitive information secure. How Can I Keep My Account Safe? Follow the tips below to help protect your accounts and your organisation’s network from password spraying attacks:
|
Find out more about cybersecurity for your business here or book a complimentary consultation with our Chief Information Security Officer, Chris Haigh here
