Libby Bevin

Cyber attacks and data breaches made big news in 2020 and 2021:

• In 2020, 37 percent of organizations were affected by ransomware attacks, according to a survey from cybersecurity firm Sophos.
• In September 2020 alone, cybercriminals stole or compromised 9.7 million medical records.
• 74 percent of organizations experienced malware attacks in 2021, up from 61 percent in 2020.

Today’s organizations are vulnerable to all kinds of cyberattacks, which NIST (the National Institute of Standards & Technology) defines as an event that disrupts, disables, destroys, or maliciously controls a computing environment, destroys data integrity, or steals controlled information.

Expert security teams know that attackers might compromise the enterprise network, systems, or applications; or steal data at any time through any number of means. To protect themselves, organizations invest in cybersecurity measures and tools, such as:

• Firewalls
• Anti-virus and anti-malware software
• Endpoint Detection and Response (EDR)
• Vulnerability scanners
• Penetration testing tools
• Intrusion Prevention Systems
• Security Information and Event Management (SIEM) platforms

These tools help to keep intruders out of the enterprise network. Many also alert security teams and security operations centers (SOCs) to the presence of cybercriminals or hackers so the team can move to prevent — or at least mitigate — a security incident or cyber attack.

Such security alerts are critical to active, ongoing cybersecurity. They also, however, can pose problems for security analysts and managers — thanks to those maddening things otherwise known as false positives.

What Are Cybersecurity False Positives?

False positives are incorrect alerts about cybersecurity; they warn teams that some issue is an infection or attack, when in reality it is not. The positive result (“this is an attack”) is false. That’s in contrast to true positives, which correctly note that some incident is an attack.

More simply — a false positive is the same as a false alarm. It indicates a vulnerability, threat, or risk where none actually exists.

Examples of common false positives include:

• Software bugs or poorly written software;
• Unrecognized network traffic;
• Legitimate cleanup utilities that delete old shadow copies, triggering a malware or ransomware alert;
• Legitimate files with missing security certificates may be flagged as “malicious.”

Security tools are often configured in such a way, or placed in such a location, that they raise alerts on everything that might indicate an infection or security threat.

Such tools aim to avoid missing any indicator that could lead to a real infection or cyber attack, and that’s a worthy objective. This approach, however, becomes problematic for security teams (as well as the organization) when too many false positives arise.

The Challenges of Security False Positives

According to 2021 research by Fastly:

• About 45 percent of all alerts are cybersecurity false positives.
• 75 percent of organizations spend the same amount (or more) time on false positives as they do on actual attacks.
• False positives cause the same amount of downtime as real cyber attacks.

A false positive is a false, non-malicious alert raised by a security platform. To assure that no threat results in an actual attack, security teams must review each alert and verify whether the threat is real.

False positives, however, increase the “noise” in the organization’s cybersecurity infrastructure. At large organizations, they can overwhelm security teams with hundreds or even thousands of alerts every day.

Many alerts don’t contextualize potential cybersecurity threats or provide enough information to support solid investigation and threat mitigation. As a result, analysts have to deal with the problem of alert fatigue and burnout.

Alert fatigue is believed to be one of the root causes of the 2013 Target security breach in which the credit card and private data of about 40 million customers were stolen.

To deal with alert fatigue, security personnel may ignore or miss important alerts that indicate a real or malicious cyber threat. This weakens the organization’s security posture and increases the risk of an actual cyber-attack or data breach.

How to Better Identify False Positives

False positives are an issue for every organization. Until a security tool is invented that can perfectly alert only on real threats or genuine security risks, security teams will have to deal with false positives. They can, however, reduce the burden of investigation, analysis, and action.

To achieve this, it’s essential to deploy tools that are robust enough to identify real threats and also are intelligent enough not to raise unnecessary false positives.

Such tools must collect, gather, analyze and contextualize threat evidence, build an evidence-based case for an infection or exploitation, and present it to the security team for further attention. This approach will consume less time since personnel won’t have to verify each alert, while also assuring that real threats are appropriately investigated and addressed.

Many existing security information and event management (SIEM) or endpoint detection and response (EDR) solutions raise too many false positives. They can be strengthened with extended detection and response (XDR) tools that provide better visibility into threat data and correlate and prioritize alerts for improved threat detection and remediation with minimal false positives.

How to Reduce and Manage False Positives

Optimize the Cybersecurity Tech Stack

Many organizations use multiple cybersecurity tools to strengthen their security posture. While there’s nothing wrong with this approach, optimizing the tech stack is essential to assure that your tools are not contributing to the false positive problem.

A global IBM survey found that using more than 50 tools in the security tech stack leads to less effective security response. Many such tools are not interoperable, so companies also find it more difficult to detect and respond to threats effectively.

This means organizations must select and implement the right security tools. Security teams must conduct an inventory of the security tech stack and, where necessary, replace some tools with more comprehensive solutions that are interoperable and (ideally) offer end-to-end security.

Further, these tools must be appropriately integrated to minimize false positives and alert fatigue.

Reduce the Size of the Threat Surface

The threat surface incorporates every device, application, or endpoint that an attacker could leverage to gain unauthorized access for any organization. This includes:

• Mobile and desktop devices
• Operating systems
• Unsupported, unpatched, or shadow IT software
• Network devices such as servers, routers, and switches
• Misconfigured cloud services
• Any Internet-connected service or device, such as IoT devices

Security teams must assess all these potential threat access points and take action to secure them. Doing this can reduce the threat surface size and reduce the number of alerts that need to be analyzed, managed, and investigated.

Adjust Alert Thresholds and Prioritize Alerts

Many false positives are the result of over-stringent or narrow alert thresholds. To reduce the number of false positives, security teams must rethink the rules that trigger alerts. For example, a single incorrect password entry may not trigger an alert, but multiple and rapid incorrect password attempts may indicate a brute force attack and therefore should raise an alert.

It’s also essential to prioritize the threats and alerts that are most relevant or most likely to have the most significant impact on the organization. While this approach cannot eliminate cyber risks entirely, it can help teams triage alerts and focus on mitigating genuine threats.

Enrich Alerts with Context

Some security tools simply raise alerts on potential threats without providing the proper context or additional information to help with the investigation. In such cases, actionable threat intelligence solutions provide highly contextual and real-time data about threats, so security teams can more easily identify, prioritize and mitigate real risks without drowning in a sea of false positives.

Improve Enterprise-wide Cybersecurity Hygiene

Good cybersecurity hygiene goes a long way towards strengthening the organization’s security posture and preventing security tools from raising too many false positives. This is why it’s critical for organizations to:

• Regularly patch all software, including operating systems
• Minimize the prevalence of shadow IT software, devices, and other resources
• Use strong passwords
• Implement multi-factor authentication (MFA)
• Deploy robust firewalls, anti-malware, and anti-virus solutions
• Educate employees on safe cybersecurity practices, such as how to recognize phishing emails, why they must not click on malicious links, and how to avoid social engineering attempts

Take Your Cybersecurity to the Next Level with ZenGRC

As the cyberthreat landscape expands, organizations need a robust security program and security tools to detect advanced threats while minimizing the noise of cybersecurity false positives and notifications.

ZenGRC provides a holistic, integrated platform that can empower your organization to meet those objectives. ZenGRC provides guidance from the most trusted cybersecurity frameworks to help you implement a program that will expose existing and new threats, so security teams can proactively strengthen enterprise security in the least burdensome way possible.

Contact Reciprocity for more information on how to efficiently monitor your enterprise IT infrastructure with minimal false positives.

Sign up for a free demo of ZenGRC.

Compliance is an essential part of any business. From a corporate perspective, it can be defined as ensuring your company and employees follow all laws, regulations, standards, policies and ethical practices that apply to your organization. In the context of information security, it means ensuring your organization meets the standards for data privacy and security that apply to your specific industry. And with the growing number of breaches and cyber attacks, this infosec compliance has become more critical to your business compliance program than ever before.

While infosec compliance might feel like a hassle, it will save — and avoid — costs for your organization in the long run, while also providing a solid foundation for a successful cyber risk management program. However, staying on top of your compliance obligations can be a challenge. So, a good place to start is to understand the key types of compliance for your business:

1. Regulatory Compliance means conforming to a rule, such as a specification, standard, or law. It is the responsibility of every organization to be aware of and take steps to comply with these mandatory regulations, many of which are created by government bodies. For example, the Health Insurance Portability and Accountability Act (HIPAA) was enacted by the U.S. government to protect sensitive patient health information from being disclosed without the patient’s consent or knowledge, and the General Data Protection Regulation (GDPR) is a European Union (EU) law that addresses the transfer of personal data both within and outside the European Union. Some regulations can also be created by private bodies, e.g. the Payment Card Industry (PCI) International Security Standard Council, which is made up of AMEX, VISA, MasterCard, Discover, and the Japan Credit Bureau, to ensure that an organization maintains a secure environment to accept, process, store or transmit credit card information.
2. Contractual Compliance focuses on an organization’s conformance and performance of obligations within an agreement. This includes customer and supplier contracts, employment agreements, and other internal company policies, e.g., travel expense reimbursements. Essentially, it ensures that all individuals and organizations involved in a contract follow through in the basic spirit of “good business”.
3. Best Practices aren’t regulations that you and your organization must comply with by law, but doing so will show others (e.g., customers, partners, and end-users) that you’re doing things the “right” way. This can be particularly useful for business-to-business (B2B) companies, as it can help convince prospective customers that their sensitive data and functions will be protected. A great example is Service Organization Control 2 (SOC 2) certification, which is an attestation procedure that ensures service providers securely manage data to protect the interests of an organization and the privacy of its clients. For security-conscious businesses, SOC 2 compliance is a minimal requirement when considering a SaaS provider. International Organization for Standardization (ISO) 27001 is similar to SOC 2, but accepted on an international level.

Now that you have a better understanding of the different types of compliance your organization needs to monitor, you’re ready to create your information security compliance management program. To learn more about how to build a strong compliance management program that enables you to achieve business-critical infosec compliance and cyber risk management for your organization, check out our recent webinar: Strategies to Connect Cyber Risk and InfoSec Compliance.

People travel through a world of risk every day, and we constantly calculate the level of risk we’re willing to tolerate at any particular moment. Should we race through the yellow light or stop? Should we keep investing in that promising stock or get out now? And on we go through the day — sometimes taking steps to reduce risk, other times just living with a risk we deem acceptable at the moment.

Risk management for organizations works in much the same manner. Businesses assess the inherent risk in some particular situation; take whatever precautions management might deem necessary; and then live with the residual risk that remains.

And as the potential harms of miscalculating a risk (financial or otherwise) increase, the importance of understanding the difference between inherent and residual risk goes up too.

What is Inherent Risk and What is Residual Risk?

Inherent risk is the innate risk in a business process or transaction without any controls in place. Imagine IT systems without any passwords, vulnerability scanning, penetration tests, security audits, or other measures to keep confidential data safe and operations running smoothly: that is an example of the inherent risk of modern technology.

Clearly the inherent risk of modern IT systems is quite high; your organization would almost be guaranteed to suffer a data breach, violate regulatory compliance obligations, and lose money. So businesses implement all the controls we mentioned above, and more: password policies, cybersecurity training, audits, pen tests, locks on the data center door, and so forth.

Residual risk is the risk that remains after you’ve applied all the controls you intend to use — because no matter how good your current controls are, you will never be able to eradicate every single risk.

What are Examples of Inherent Risk?

In the financial world, inherent risk is often defined as a misstatement that may lead to mismanagement when decisions are based on that misleading statement. This happens not for lack of internal controls but because the statement is simply wrong.

For instance, those statements may have been put together depending on a large amount of estimation (“Things are beginning to look up! So let’s build a new plant”), or perhaps a complicated calculation was performed incorrectly and led to erroneous conclusions (say, recording $100 million in revenue when you only had $10 million).

Another example is the inherent risk of cash, which is higher than the inherent risk of physical infrastructure such as a bank branch. Why? Because cash can easily be stolen or misappropriated; a building, not so much.

The financial service sector is vulnerable to inherent risk because of the often complicated relationships among financial institutions, their many vendors, contractors and customers. Frequent regulatory changes in the financial sector can make it difficult for financial firms to assure that their business processes and relationships are in full compliance with the law.

What are Examples of Residual Risk?

Residual risk is what’s left after you’ve mitigated all the risks you can identify and treat; it’s the risk that remains after your internal controls have done their work.

For instance, a company could implement a password policy requiring employees to use complex passwords that must be changed every week. The residual risk of hackers guessing the password would be low; but the resident risk of employees using new passwords that vary only slightly from the old (and jotting them down on a Post-It note) would be high. Which password policy should the company use? That depends on the amount and type of residual risk that management is willing to accept.

Another example: your company could require three executives to approve onboarding of new SaaS providers. The residual risk of hiring a fraudulent provider might be low (lots of executives are reviewing the contract), but it also means a longer, less agile onboarding process. Or the company could require only one executive approval: the residual risk of onboarding an unreliable provider is higher, but the company’s ability to embrace new technology runs faster. Which policy is better? Again, it depends on the residual risks management is willing to accept.

Key Differences Between Inherent and Residual Risk

A good risk assessment program analyzes the risk landscape in which you operate, determines the likelihood of specific types of risks actually turning into threats, and puts internal controls in place to filter out the highest risk threats.

Inherent risk is the risk level where your business is right now, as you are doing risk assessment, perhaps focused on the amount of risk stemming from your vendors. Once you have determined the risk level you can accept and have applied all controls that you want, what’s left is residual risk.

Manage Inherent and Residual Risk in One System

As you develop your business, you may find that your risk appetite changes. After all, running a business is what you do and you may be bolder in some areas today than you were a year ago.

We are here to support your risk management and analysis, every step of the way. Using artificial intelligence and sophisticated data analytics, ZenGRC will stay on top of compliance changes and new risk factors, and quickly identify blindspots in your processes.

ZenGRC’s compliance, risk, and workflow management software is an intuitive platform that not only keeps track of your workflow, but also lets you find areas of high risk before that risk has turned into a real threat.

Worry-free compliance management is the Zen way. For more information on how ZenGRC can enable your CMS, contact us for a demo.

Learn about the methods cybercriminals use to exploit passive and active attack vectors so you can better protect your business or organization from cyberattacks.

Cybercriminals will use any means they can to penetrate your corporate IT assets and exploit any vulnerabilities they find. Your ability to predict and prepare for these incidents could mean the difference between preventing a data breach and recovering from one.

The pathways cybercriminals use to enter an IT system and execute advanced cyberattacks are called attack vectors. Attack vectors allow cybercriminals to exploit your system vulnerabilities and gain access to confidential data, personally identifiable information (PII), or other sensitive information you wouldn’t want disclosed to the public.

The total number of attack vectors available to a cybercriminal is called your attack surface. As a general rule, you should keep your attack surface as small as possible to safeguard your business from hackers. In practice, that means closing off possible attack vectors before outsiders use them.

A data breach is a security incident where your sensitive, protected, or confidential data is either accessed or stolen by an unauthorized party. Data breaches are expensive — the average cost of a data breach in the U.S. was $8.64 million in 2020 — and they can ruin your organization’s reputation.

The high cost of a data breach also demonstrates why reducing potential attack vectors and preventing data breaches is a valuable practice: your organization can end up spending a fortune if it doesn’t. Preventing a data breach is much easier and less expensive than recovering from one.

Before cybercriminals can breach your data, however, they need to locate and exploit the attack vectors that will allow them to execute a successful cyberattack. So the best way to prevent attacks is to identify your attack vectors before cybercriminals do, and then take action to remediate or mitigate those vulnerabilities.

Cybercriminals never stop looking for your attack vectors; neither should you. As the cyber threats to your business continue to proliferate, it’s more important than ever that you know the most common attack vectors that cybercriminals exploit to gain access to your data.

In this article, we will closely examine some of the most common attack vectors, and how cybercriminals exploit them. First we’ll distinguish between the two main types of attack vectors: passive or active.

Passive Attack Vectors

A passive attack vector is a pathway a cybercriminal exploits to gain access to, or use information from, your IT system without affecting your system resources.

Passive attack vector exploits typically involve an attacker monitoring your system for open ports or vulnerabilities. The goal is to gain or gather information about your business and employees. Most times, passive attack vector exploits are difficult to detect because they don’t involve altering data or system resources.

Passive attack vectors allow attackers to threaten the confidentiality of your data, rather than causing damage to your organization’s systems.

To gain access to your data via a passive attack vector, cybercriminals may use passive reconnaissance tools such as session capture to monitor your systems for vulnerabilities without interacting with them. They might also use active reconnaissance methods such as port scanning to engage with their target systems.

Other examples of passive attack vectors include sniffing or traffic analysis, eavesdropping, and supervision.

Active Attack Vectors

An active attack vector is a pathway that a cybercriminal exploits which does alter a system or affect its operation.

Active attack vector exploits try to disrupt your organization’s system resources or affect regular operations. Cybercriminals might launch attacks against system vulnerabilities, such as DDoS attacks and targeting weak credentials. Other examples of active attack vectors include malware, unpatched vulnerabilities, phishing, and ransomware.

Active attack vectors allow cybercriminals not only to gain access to your sensitive data, but also to cause damage to your organization’s systems.

How Do Hackers Exploit Attack Vectors?

As the number of cyber threats increase, so too does the number of ways that cybercriminals attempt to expose, alter, destroy, disable, steal, or gain unauthorized access to computer systems, infrastructure, networks, operating systems, and IoT devices.

While all attack vectors, active and passive alike, provide different pathways for cybercriminals to reach your data, most attack vector exploits share similarities in the way they are executed.

Here are the general steps cybercriminals take when exploiting an attack vector:

• The attacker identifies a potential target.
• The attacker gathers information about the target using various methods that might include social engineering, malware, phishing, or vulnerability scanning.
• The attacker uses the information gathered to identify any possible attack vectors, and then creates or uses tools to exploit those vectors.
• The attacker gains unauthorized access to the system and steals sensitive data or installs malicious code.
• The attacker monitors the computer or network, steals information, or uses computing resources.

Most cybercriminals will use both active and passive attack vectors when they infiltrate their victims’ systems, and the end goal is usually the same: to exploit targeted devices or pilfer sensitive information. The best way to prevent cybercriminals from exploiting your attack vectors is to become familiar with the most common types and methods used to exploit them, as well as the counter-measures you can take to keep your data safe.

Common Attack Vectors

Between passive and active attack vector exploits, the number of methods cybercriminals will use to launch cyberattacks can seem endless. Several attack vectors, however, are common among businesses in all industries, and therefore deserve special attention.

Weak or Compromised Credentials

Weak or compromised credentials are the most common attack vector that cybercriminals exploit.

As long as people continue to use — and repeatedly use — weak passwords to protect their online accounts and profiles, this attack vector will be a high risk. Weak passwords give cybercriminals the opportunity to bypass other attack vectors that might be less successful, especially if users employ the same weak password for multiple accounts.

Compromised credentials are often the result of a successful phishing attempt, where a user accidentally reveals his or her login information to an attacker by entering those details on a spoofed website. When information such as usernames or passwords is exposed to cybercriminals, they can then use that information to access user accounts and corporate systems — and potentially escalate their access within the network to reach your most sensitive data.

Here are some things you can do to prevent cybercriminals from exploiting weak or compromised credentials:

• Enforce a stringent password policy that requires users to create and use strong passwords that are different for each account.
• Encourage employees to use a password manager.
• Don’t rely on passwords alone. Deploy multi-factor authentication to verify your users’ identities.
• Educate your employees to assure that they understand the security risks they face and the signs of a potential cyberattack.

Insider Threats

Some security attacks originate from inside an organization. Insider threats are attack vectors that cybercriminals can exploit when employees knowingly or unknowingly expose confidential information.

Although insider threats are sometimes accidental, at other times malicious insiders intentionally expose your corporate data or vulnerabilities to cybercriminals. Most often, these insiders are unhappy or disgruntled employees who have access to your sensitive information and networks.

It can be difficult for organizations to spot malicious insiders and insider threats, largely because they are authorized users that have legitimate access to your corporate networks and systems.

To prevent cybercriminals from exploiting insider threats, do the following:

• Continuously monitor your network for unusual activity, including users accessing files or systems they would not normally access.
• Employ the principle of least privilege to assure that employees only have access to information that’s essential to carrying out their duties.
• Tag sensitive data so that you can be alerted whenever it’s transmitted.

Missing or Weak Encryption

Encryption is a technique used to hide the true meaning of a message and protect its digital data by converting it into a code or ciphertext. This assures that data within messages can’t be read by anyone without a decryption key.

Missing, poor, or weak encryption has the potential to lead to the transmission of sensitive data in plaintext, which risks exposure to unauthorized parties if the data is intercepted or obtained through a brute-force attack.

Here are some countermeasures you can take to prevent cybercriminals from exploiting any missing or weak encryption:

• Use strong encryption methods.
• Always assure your sensitive information is encrypted at rest, in processing, and in transit.
• Make sure only the users with the most privilege have access to your decryption keys.

Unpatched Software

Cybercriminals always look for vulnerabilities in software and servers. Attackers can locate and exploit your vulnerabilities in several ways, including vulnerability scanning, or checking lists of CVEs on the dark web for any known software vulnerabilities they could exploit.

To prevent cybercriminals from exploiting any unpatched software, do the following:

• Assure that your software, operating system, and servers are always patched as soon as possible.
• Apply software updates or fix the code to a program or server to remove the vulnerability.
• Regularly patch your software.
• Assure automatic software updates are enabled.

Malware

Short for malicious software, the term “malware” refers to any intrusive program — script or code — that’s designed to exploit your devices. Because malware is easy to use and highly effective, it’s a favorite tool cybercriminals use to exploit attack vectors.

Cybercriminals can use a variety of methods to exploit vulnerabilities and insert malware into your system, but most methods typically involve a user clicking on a malicious link to open an attachment or download software.

Once inside your system, malware can wreak all sorts of havoc, such as monitoring your keystrokes, blocking access to essential files and components, altering confidential data on your computer, transmitting sensitive data, or even rendering your system completely inoperable.

Malware can be broadly categorized as ransomware, trojan horses, or spyware.

Ransomware is a specialized type of malware that encrypts your files or limits access to your data unless you pay the attackers a ransom. Ransomware attacks are becoming increasingly popular among cybercriminals, since these attacks are one of the most profitable that criminals can launch against you.

Trojan horses are ostensibly harmless programs that are hidden in email or file attachments that execute an assigned task once they get into your system. Trojan horses are primarily used to launch immediate attacks, but they can also create backdoors for future attacks.

Spyware consists of programs that monitor internet activity without the user’s knowledge. Using spyware, cybercriminals can spy on sensitive information and track your login credentials to gain access into your system. This type of malware is primarily used to obtain account passwords, credit card numbers, or banking information.

To prevent cybercriminals from using malware attacks to exploit your attack vectors, here are some things you can do:

• Always keep your operating systems up-to-date.
• Never open suspicious URLs or email attachments from unknown senders.
• Don’t download plug-is or files from suspicious websites.

Phishing

Phishing is a type of social engineering attack (including malicious emails, calls, or text messages) that tricks users into giving up their account credentials. Usually the sender poses as a reputable entity to dupe users into providing their sensitive information, such as credit card details, intellectual property, or passwords.

According to Verizon research, 30 percent of phishing emails are opened by users, and 12 percent of those users even click on the malicious attachment.

Spear-phishing attacks are more specific than phishing attacks; they target a particular individual or organization for financial gains, trade secrets, or intelligence. These types of phishing attacks are usually carried out by attackers who already have extensive knowledge about their victim.

Whale-phishing attacks target high-profile individuals within your organization such as CEOs and CFOs. These attacks are usually aimed at stealing sensitive data from individuals who have unlimited access to vital information.

Here are some ways you can prevent cybercriminals from using phishing to exploit your attack vectors:

• Enforce two-factor authentication for all of your accounts.
• Pay close attention to the details in an email, including spelling, syntax, and logos.
• Never click on a link within an email that asks for login credentials.
• Verify the email sender by calling the organization directly or using its website.
• Train your employees to spot phishing emails before they open them.

Distributed Denial of Service (DDoS) Attacks

The aim of a DDoS attack is to flood a server or website with bogus messages and traffic requests to exhaust its resources. Usually these attacks either crash or cripple the target’s website for a period of time (which means that legitimate messages and traffic requests can’t reach your servers).

To prevent cybercriminals from exploiting your attack vectors using DDoS attacks, here are some things you can do:

• Never accept third-party cookies.
• Be wary of user input on web pages.

Brute-Force Attacks

A brute-force attack is a cryptographic hack wherein cybercriminals use a trial-and-error method to guess your login information. In this type of attack, hackers try to guess the possible combinations of passwords or use words from the dictionary until they can log in successfully.

Most often, these attacks are launched using automated tools and botnets that enter thousands of password combinations within seconds.

Here are some countermeasures you can take to prevent cybercriminals from exploiting your attack vectors using brute-force attacks:

• Use strong passwords.
• Implement account lockout after multiple failed login attempts.
• Use a reCAPTCHA to block automated submission.

Man-in-the-Middle Attacks

“MitM” attacks occur when malicious actors place themselves in the middle of a two-party communication. Once the attacker intercepts the communication, they filter and steal sensitive information and return different responses to the user.

Sometimes cybercriminals will set up wake wi-fi networks or use public wi-fi networks to install malware on users’ computers or networks. These kinds of attacks are also called eavesdropping attacks, and their ultimate goal is to gain access to your data.

To prevent cybercriminals from exploiting your attack vectors with man-in-the-middle attacks, do the following:

• Make sure your lines of communication are secure.
• Only use secured networks and avoid using public wifi networks.
• Tag sensitive data so you can track its transmission.
• Encrypt your data so that even if it is intercepted, it’s indecipherable.

Protect Your Organization from Security Vulnerabilities

Unfortunately no single solution exists that can prevent every attack vector from being exploited. As cybercriminals continue to become more sophisticated, it’s no longer enough to rely on antivirus software or firewalls as your primary (or only) security system.

To stay ahead of cybercriminals, you need to understand your attack vectors and how cybercriminals can exploit them to breach your security. The surest way you’ll survive this never-ending battle against cyberattacks is with sound knowledge of the most common attack vectors and the ways you can combat them.

And, if you haven’t already, you should also consider using governance, risk management, and compliance (GRC) tools to help.

ZenGRC from Reciprocity is designed to combat today’s — and tomorrow’s — threats, with GRC capabilities that offer a variety of solutions to fit your organization’s needs.

Zen helps automate and facilitate the documentation and workflows involved in the assessment, mitigation, and documentation of cybersecurity controls. It can also trace your compliance stance across multiple frameworks, including HIPAA, CMMC, FedRAMP, and more.

ZenGRC provides real-time views into your cybersecurity gaps and vulnerabilities, and it even tells you how to resolve them. This enables a stronger and more efficient cybersecurity risk management posture, and helps compliance officers feel more effective at their jobs while keeping stakeholders informed.

Let us help answer today’s challenges with monitoring tools and risk assessment templates to address various elements from an information security perspective.

With clear, easy-to-use and effective frameworks to keep your company protected from threats to your IT systems and with integrated support from subject matter specialists, ZenGRC is the GRC solution your company needs.

To learn more about how ZenGRC can help protect your organization from security vulnerabilities, schedule a free demo today.

As the COVID pandemic swept the world in 2020 and changed the way we travel and do business, other disruptions happened too: large wildfires driven by climate change, and a volatile domestic political scene pressured corporate policies over diversity and other social issues — and that’s just what happened in the United States.

The long simmering trade and political tensions between the United States and China; Brexit; chronic instability in the Middle East; even looming bankruptcy of Chinese real estate Evergrande with its $300 billion in off-balance sheet debt — the list of geopolitical risks is endless.

Globalization means that the decisions made by business leaders and policy makers in one country can hugely affect financial markets in another country; everything is connected. This is especially true for large countries such as the United States and China, which are home to a majority of the world’s largest companies.

If global business affairs seem far removed from your own boardroom, you may want to spend time researching how your business is connected to the rest of the world, and just how economic uncertainty in, say, Brazil might affect your bottom line.

Whether your business is a Fortune 500 company or a flexible upstart, it pays dividends to keep one eye on geopolitics and gain a better understanding of how events far away can hit your company today.

Seven Top Geopolitical Risk Factors

Geopolitical risks are beyond our control: wildfire smoke might shut down the airport or a political uprising will suddenly blossom into a full blown revolution. These things happen, and can feel overwhelming.

The one thing a company can do is be better prepared. Yes, risk assessment can be difficult during these volatile times, but the good news is that you don’t have to be an expert on global risk management and political risk identification to limit your level of risk exposure.

Domestic Political Events in Other Countries

Latin America is primed to be a source of unrest because of upcoming elections in Argentina, Mexico, Chile, Brazil and other countries. Combined with the COVID crisis there, that can create a volatile climate that may hurt local financial markets and cross border trading.

Volatility in oil prices is another sore point. The Middle East is facing many challenges, including falling prices on oil and other petroleum products in 2020 thanks to the pandemic driving down consumption. (The price is back up in 2021.) This leaves oil producing nations such as Iraq facing some potential huge financial problems.

Cyberattacks and Lack of Cybercrime Enforcement

An attack on multinational IAAS (Internet as a service or cloud computing companies) may implicate clients on many continents. A hack in India may slow all your receivables in Chicago by days or weeks, presenting a high level of economic risk.

Cybersecurity is also hampered by a lack of international rules, regulations and agreements, making it easy for hackers to exploit the volatility of the cybersecurity world.

Tradewars and Political Events That Change Tariffs and Import/Export Rules

When Britain left the European Union, cross-border trade, customs and tariffs were thrown into a whirlwind that remains unsorted.

Tensions between the United States and China continue to grow and create a high level of enterprise risk and political instability. Human rights issues continue to surface in China, which is showing few signs of political change. Trade sanctions by the United States may have short-term effects, but do little to stabilize the business environment.

Climate Change

This has the potential to become a huge geopolitical risk factor, not just because the oceans are rising and extreme weather is becoming more common, but also because younger generations especially refuse to support industries and products that have the potential to accelerate climate change.

There is also a slow shift in ownership of resources (such as rainforest patches in Brazil) that may have a huge potential effect on exports to the western world.

How Can Global Companies Best Respond to Geopolitical Risks?

It’s a good idea to break geopolitical risk management into several parts before you make investment decisions or attempt mitigation of the outfall from a geopolitical event that impacts your business. McKinsey & Company outlines a great approach:

If a geopolitical event has already impacted your business, start by determining:

• How did we get here?
• Where are we now and what do we know?
• Where are we headed?
• And what can we do about it?

Then break the company response into three different kind of actions:

• Short-term. Invest in strategy and different materials so you can complete your business goals and meet deliverables and cut your financial loss.

• Mid-term. Should any business operations be changed? Any cybersecurity issues that can be strengthened? Look for case studies from other businesses and study their methodology.

• Long-term. Compile key takeaways from your research and involve all stakeholders in future decision-making processes, to be as certain as possible that any long-term changes are solid and well-researched.

  Let this research guide your future geopolitical risk analysis and establish solid long-term planning systems that take geopolitical events into consideration.

Carefully consider your corporate narrative. Assure that you make ethical business decisions. For example, perhaps now is a good time to stop using parts manufactured in a country with many human rights issues.

Discover the power of ZenGRC!

Automation can greatly simplify the task of geopolitical risk management and help you keep a competitive edge in today’s global business world. Let ZenGRC help you keep an eye on the global landscape and alert you to risks before they become disasters. Schedule a demo today.