Monthly Archives: October 2022

October Security Breach Round Up

October was Cyber Security Awareness Month, and yet, another month, another breach. In a month that is geared towards helping organizations protect themselves, large companies have yet again fallen victim to these heinous attacks. One after the other, many companies and their consumers are now wondering when these breaches will stop. 

 

Here are our top October 2022 know-worthy incidents:

 

Toyota:

    • Toyota is no stranger to data breaches. And by the looks of it, it seems as though the company hasn’t learned from past mistakes (remember the 2019 breach that affected over 3 million of Toyota’s customers?). On October 7, 2022, Toyota issued an apology after nearly 300,000 people who used T-Connect, a telematics service that connects vehicles via a network, were exposed. The Japanese car giant explained that personal data was leaked when an access key was publicly made available on GitHub for almost five years. Email addresses and customer control numbers may have been exposed since 2017.


Microsoft:

    • Another tech giant hit yet again. On October 19, 2022, Microsoft addressed the public after security researchers at SOCRadar informed Microsoft of a misconfigured Microsoft endpoint. After the discovery, Microsoft explained that the researchers exaggerated the entire situation. This misconfiguration resulted in the potential for unauthenticated access to some business transaction data corresponding to interactions between Microsoft and prospective customers. Information about planning or potential implementation and provisioning of Microsoft services was involved. In addition, the data that was potentially compromised includes names, email addresses, email content, company name, and phone numbers, and may have included attached files relating to business between a customer and Microsoft or an authorized Microsoft partner. 


Verizon:

    • In a notice, the company confirms, “we determined that between October 6 and October 10, 2022, a third party actor accessed the last four digits of the credit card used to make automatic payments on your account. Using the last four digits of that credit card, the third party was able to gain access to your Verizon account and may have processed an unauthorized SIM card change on the prepaid line that received the SMS linking to this notice.” 


Carousell:

    • On October 14, Carousell Singapore disclosed that it experienced a breach. And this wasn’t a small breach either – almost 2 million accounts were compromised. The company explains, “it is unlikely that this incident will result in an identity theft as it does not include information like your NRIC number,” but it is believed that emails were compromised. 


Medibank:

    • Bad news for Medibank, one of the largest Australian private health insurance providers. On October 12, 2022 the company discovered that customer information may have been compromised after a hack on their systems. It was thought that the original hack only affected certain customers, but after this week, the company is assuming that all 3.9 million customers were affected. The company said it had received a series of files from the alleged hacker, and they found the files included 100 ahm policy records, which include personal and health claims data, plus another 1,000 policy records from ahm, and files which contain some Medibank, ahm and international student customer data. The records provided to the company include names, addresses, dates of birth, Medicare numbers, phone numbers and medical claims data, including information about diagnosis, procedures and location of medical services.


Twilio:

    • Sometimes companies just can’t catch a break. Cloud communications company, Twilio, disclosed a new data breach stemming from a June 2022 security incident. After a lengthy investigation, the company concluded that 209 customers and 93 Authy end users had accounts that were impacted by the incident. 

 

Don’t let your company end up on this list. See how findings can help you here.

Supply Chain Risk Management: Your Black Friday Weakest Link

Supply Chain Risk Management: Your Black Friday Weakest Link

Black Friday is the time of year that is bound to put stress on many businesses’ supply chains. With demand soaring for items across the board, supply chains have already come under pressure from the effects of the past two years, and these delays are becoming more evident every day. So what does this mean for your risk management?

 

Unfortunately, not all risks originate internally. As you know, risks can also arise from within your supply chain. With increased strain (American consumers spent $8.9 billion online during Black Friday 2021), comes increased focus on your business’s reputation and possible fast tracking vetting of alternative vendors in your supply chain to keep up with demand. But thorough vetting should not be sidestepped. 

 

The Consequences Of Poor Supply Chain Risk Management On Black Friday Sales

 

Supply Chain Risk Management strategies that focus only on internal threats and ignore the supply chain fall short for 2 main reasons:

More threat opportunities

The threats that impact internal systems represent only a subset of all threats. But within your supply chain, attack vectors are far broader and numerous. You can’t always control the types of security exposures that your vendors or suppliers introduce to their products. And the last thing you want is this impacting your Black Friday sales. 


Lack of efficiency

If supply chain risk management isn’t part and parcel of your broader risk management strategy, it’s hard to manage supply chain risks efficiently. If you protect against supply chain threats at all, it ends up being through one-off audits or action against isolated threats.


At one of the busiest times of year, time and efficiency take center stage and It’s much more efficient to monitor for and address all types of risks – internal and external – through centralized tools and processes.

Read here: All you’ve ever wanted to know about Vulnerability Disclosure Programs (VDPs)

 

Major Holidays Leave The Door Open For Major Attacks

Retailers are particularly vulnerable to client-side attacks. Many online retail sites are built on CMS frameworks with a plethora of third-party plug-ins, from blog posting to popups to SEO maintenance. On average, 31 JavaScript resources are used per site, making retailers vulnerable to many forms of supply chain fraud such as formjacking, data-skimming and Magecart attacks.


Kaseya Attack Affecting the Supply Chain

Though initially thought to only affect 40 of its clients, it was further discovered that over 1,000 downstream companies were affected by this 4th July attack by Russian group, REvil. With over 40,000 organizations worldwide using at least one Kaseya software solution, the potential impact of this supply chain attack was massive. By exploiting zero day vulnerabilities in Kaseya’s software, it caused a major Swedish grocery store to completely shut for 24 hours as well as 11 schools in New Zealand. 


Magento Magecart Attack Prevented in 2021

With millions of transactions being carried out over the Black Friday period, it’s no surprise that this is a key target for threat actor’s to leverage vulnerabilities in the supply chain. In fact the UK’s National Cyber Security Centre (NCSC) notified small businesses about the risk of magecart attacks on and around Black Friday last year. They’re unique because they exploit third party scripts on companies’ websites. Because highly critical services, like Adobe’s Magento, are trusted and there are not many services like them, these attacks can impact 1000s of sites simultaneously. When the NCSC notified these businesses over 4000 were at risk.


A Better Approach To Supply Chain Risk Management And Intelligence

How do businesses avoid those shortcomings this Black Friday? How can they implement risk management that addresses both internal and external threats?

The answer is to deploy risk management processes and tools that provide the following features:

  • Continuous, real-time intelligence: Businesses need to know – immediately, before performance and security is affected – whenever a risk emerges within any internal or external asset.
  • Complete supply chain risk management: It’s crucial to identify risks that exist at any point in the supply chain. This includes risks introduced not just by third-party vendors with whom you do business directly, but also “fourth-party” vendors, meaning those who supply your direct vendors. Risks can arise from these vendors, too.
  • Automated, scalabile compliance: Checking for risks manually doesn’t scale (and takes away precious time, when time is a short commodity). Whether you have one vendor or one thousand, you need automation to ensure that you can detect all potential risks across all internal and external assets – and that nothing falls through the cracks.
  • Centralized compliance: Risk management is inherently fragmented because risks come in many forms and affect many types of systems. Nonetheless, businesses should be able to manage all risks comprehensively using a platform that works across the enterprise. When you centralize risk management, you save time and maximize risk coverage.


The Findings Difference

With Findings, you are provided with an automated, comprehensive supply chain risk management solution that empowers businesses to manage supply chain risks proactively by getting ahead of issues before they happen. Instead of treating the supply chain as a black box from the perspective of compliance, leverage Findings to implement centralized, enterprise-wide supply chain risk management for both internal and external threats. 

Don’t get caught out this Black Friday (or any day!). Get started at Findings.co.

5 Critical Steps In Maintaining A Vulnerability Disclosure Policy

5 critical steps vulnerability disclosure policy

Once upon a time, the vendors that your company chose to work with were your own business. There was little pressure to disclose supply chain vendors to the world at large.

 

Those days are gone. Today, businesses face pressure from a variety of sources to establish a vendor and vulnerability disclosure policy in order to maintain a transparent supply chain.

 

Government regulators are demanding vulnerability disclosure policies in the wake of initiatives like the White House’s call for more stringent supply chain cybersecurity protections. Partners expect transparency, too – which is why companies like Palo Alto Networks and Nestlé detail their suppliers on their websites.

 

 

From the perspective of consumers as well, vulnerability disclosure policies have become a priority. Alexis Bateman and Leonardo Bonanni note in the Harvard Business Review, “researchers at the MIT Sloan School of Management found that consumers may be willing to pay 2% to 10% more for products from companies that provide greater supply chain transparency.”

 

 

For all of these reasons, now is the time for company shareholders and security teams to establish strong vulnerability disclosure policies and supply chain transparency, if they have not already. While it’s important to avoid giving away too much information – because doing so could harm your competitive advantage – CISOs also don’t want to be left playing catchup when a vulnerability arises within their supply chain. They don’t want regulators, partners, customers and shareholders asking questions about why there wasn’t more transparency and disclosure before an incident, especially in situations where proactive disclosure could have helped to mitigate the impact of a rapidly spreading attack or threat.

 

 

Of course, establishing and managing a vulnerability disclosure policy is easier said than done. To help with this mission, we are unpacking the five critical steps they should be taking to establish supply chain transparency and ensure effective disclosure of vulnerabilities (Also known as VDP).

 

 

Step 1: Set vendor disclosure goals

Supply chain transparency doesn’t mean disclosing every detail of your supply chain to the world. Instead, CISOs should set goals about how much information to disclose. Their policies should reflect the level of risk that each supply chain component or vendor poses to stakeholders.

 

For example, a vendor that supplies software that your business uses internally poses less of a risk than one who helps to provide customer-facing systems., A security issue in the latter is likely to be harder to contain and to have a bigger impact on your users and business. For that reason, a vulnerability disclosure policy might treat suppliers for line-of-business apps and customer-facing apps differently.

 

Keep in mind, too, that risks constantly change, so you should revisit your vendor disclosure goals at least yearly.

 

 

Step 2: Map suppliers and flow

Supply chain transparency is about more than just listing who your vendors are. It’s equally critical to understand how information flows between vendors, and how a vulnerability in one part of the supply chain impacts the rest of the chain.

CISOs can unpack this information by mapping suppliers to the ‘flow of information’. From there, look for gaps where failure to contain a vulnerability or disclose it quickly could impact other vendors or customers.

 

Read here: All you’ve ever wanted to know about Vulnerability Disclosure Programs (VDPs)

 

 

Step 3: Optimize reporting systems

A strong vulnerability disclosure policy requires effective reporting about where vulnerabilities like to hide and which vendors they involve. Since it’s not practical to generate this information manually at any kind of scale, CISOs should leverage automatic vendor disclosure reporting systems that can generate disclosure information automatically.

 

Baking vendor disclosure into existing business processes, can also help to make reporting more systematic and automated. Supply chain transparency is an important component of corporate responsibility. Many businesses are also considering ESG as an integrated part of their cybersecurity risk management, so including it in your vendor disclosure policy just makes sense.

 

 

Step 4: Gather information continuously

Again, risks change constantly. So do the vendors within your supply chain and the role they play in it. That’s why security teams must continuously gather and update information about vendors and vulnerabilities, then adjust vulnerability disclosure policies accordingly.

They should also make sure that information is available to all stakeholders. Every person in the organization should be able to see whether there is a supply chain risk and report it to the security team.

 

Step 5: Report findings and engage vendors

Vulnerability disclosure shouldn’t be a passive affair. You can’t just list vendors or report vulnerabilities periodically on your website.

Instead, you should engage actively with your vendors to report findings, make collaborative decisions about vulnerabilities and address specific risks as quickly as possible.

 

The point of vulnerability disclosure policies, after all, is to lower risk for everyone. You can do that only by acting on the information you discover.

 

 

Continuous monitoring for vendor disclosure is essential

You may have noticed a theme running throughout the vulnerability disclosure steps described above: The importance of continuous monitoring and disclosure.

 

Continuous monitoring and disclosure means the ability to detect, report on and react to supply chain risks in real time. They’re critical because, once again, risks and vendors constantly change, so continuous monitoring is the only way to ensure you never miss a threat. Periodic audits or one-off reports are not enough to stay on top of risks or demonstrate a genuine commitment to your supply chain security.

 

Keep in mind, too, that continuous monitoring and reporting will support the image of your business as one that takes supply chain security seriously. In turn, it helps you to gain a competitive advantage, since partners and customers will see continuous transparency and reporting as a positive quality.

 

 

While continuously monitoring risk across your supply chain may seem daunting, Findings makes it easy with automated supply chain security, and our innovative continuous and cloud monitoring apps to support and scale your entire supply chain. 

 

See for yourself by signing up for a free trial.

September Security Breach Round Up

September Security Breach Round Up. An iPhone with a broken lock - signifying a breach.

Cybersecurity threats have become an integrated part of every company’s lifecycle. They are occurring now more than ever, and hackers are not selective – ultimately putting any company at risk for an attack. 

 

To keep your company safe and your cybersecurity team up to date with the latest trends, it’s important to learn from recent incidents to avoid the same mistakes that left even the world’s largest corporations exposed. 

 

Here are our top 5 September 2022 read-worthy incidents:

 

Uber:

Sneaking out of the house isn’t the only thing teens are getting good at and a recent breach proves this. On September 15, 2022, Uber fell victim to an attack. In this case, a suspected teen hacker, who Uber believes is a part of Lapsus$, was able to access Uber’s systems. In a company notice, Uber explains that the hacker likely purchased an Uber EXT contractor’s password off the dark web, and after many attempts, was successfully able to access this worker’s account. Several internal systems, internal slack messages, information from an internal tool the company uses to manage invoices, and their dashboard at HackerOne were all accessed. 


Samsung:

Most would think that one of the world’s biggest tech companies is heavily secure, right? Well… On September 2, 2022, Samsung confirmed a cybersecurity incident that affected customer data. Information such as name, contact and demographic information, date of birth, and product registration information may have been compromised. After further investigation, Samsung discovered that this incident stemmed from an unauthorized third party acquiring information from some of Samsung’s U.S. systems. 


Optus:

Optus, one of Australia’s largest telecommunication companies, suffered a cyberattack and confirmed it on September 22, 2022, through a company announcement. Customer names, dates of birth, phone numbers, email addresses, street addresses, medicare cards, and ID document numbers such as driver’s license and passport numbers of over 9 million people were potentially exposed.


American Airlines (Again?! Really?!):

On September 16, 2022, American Airlines informed customers that they experienced a security incident in July 2022. The notice explains the discovery of an unauthorized actor who compromised the email accounts of a limited number of American Airlines employees. Upon further investigation, they found that personal information such as name, date of birth, mailing address, phone number, email address, driver’s license number, passport number, and/or certain medical information were accessible through  the email accounts. 


Tap Air Portugal:

As aviation becomes a hot target, TAP Air Portugal released an important notice to customers on September 21, 2022, regarding a cyber attack discovered back in August. The notice reads, “Regretfully, we want to inform that the following categories of personal data from some customers of TAP have been disclosed: name, nationality, gender, date of birth, address, email, telephone contact, customer registration date and frequent flyer number. The information for each affected customer may vary. We are releasing this notice to make customers aware of this matter. There is no indication that payment data was exfiltrated from TAP’s network.” While the company did not disclose how many people were affected, it is believed that over 1.5 million TAP customers had their data stolen. 


While we’ve only listed 5 of the many incidents that occurred in September, it’s important to mention that breaches occur all the time, and hackers are getting more and more creative and sophisticated. 


As businesses, it’s even more important for you to find ways to prevent, detect, and respond to these attacks in a quick and effective manner. 


Keeping your supply chain secure is vital to keeping it functioning properly and that’s why we’ve put together a supply chain security enhancement checklist for companies to reference. 

 

 

                                                                      At Findings, we help secure your digital supply chain. Discover how we can benefit your business here.

Supply Chain Risk Monitoring as a Service
Join us today
Supply Chain Risk Monitoring as a Service
Join us today
Waitlist signup

Welcome to Findings

Let's go over some details to setup your tailor-made account


Please fill your details below and click "Next" to create your account:

Payment

Feature
Startup
Business
Enterprise
Price
$10 / Month
$10 / Month
$25 / Month
VDPaaS
Alerts
Assessments
Integrated Apps
API
Join today and scan ALL YOUR VENDORS for FREE*
* FREE VENDOR SCAN for all of your vendors during your first month.
Feature
Startup
Business
Enterprise
Price
$25 / Month
$200 / Month*
Contact Us
Free vendors scan for 1 month
Findings search engine
Rapid security and compliance profile
Profile/showcase engagements per year
5
40
Unlimited
Multi/unlimited showcase use cases
Showcase compliance badge for your website
Best practice self-assessment
1 Findings or 1 BYOC
Assessment response automation
Personalizable, branded security & compliance showcase page
File/evidence repository
OKTA
DKIM
Out-of-the-box TPRM
20 vendors +
20 rating scans
50 vendors +
50 rating scans
Support
Email
Priority via Phone / Email
Internal Workflows (SO/BO)
Onboarding and customization account setup
*Price for every 40 engagements
Automate assessment response and showcase your cybersecurity posture
Supply Chain Risk Monitoring as a Service
Join us today
.
.
.
.

Thank you for signing up!

Supply Chain Risk Monitoring as a Service
Join us today
.
.
.
.

Thank you for signing up!