Aug 03 2021

BazarCaller – the malware gang that talks you into infecting yourself

Category: Malware,Security Awareness,SpywareDISC @ 10:29 am

You’re almost certainly familiar with vishing, a phone-based scam in which cybercriminals leave messages on your voicemail in the hope that you’ll call them back later to find out what’s going on.

In fact, if you have a long-standing phone number, like we do, you may well get more of these scam calls (perhaps even many more of them) than genuine calls, so you’ll know the sort of angle they take, which often goes along these lines:

[Synthetic voice] Your Amazon Prime subscription will auto-renew. Your card will be billed for [several tens of dollars]. To cancel your subscription or to discuss this renewal, press 1 now.

Sometimes, they’ll read out the number to call them back on, to re-iterate not only that it matches the number that shows up in your call history, but also that it’s a local number, right there in your own town or country.

The crooks do this to “prove” that caller is local too, rather than sitting overseas in some scammy boiler-room call centre, far from the reach of law enforcement and the regulators in your part of the world.

BazarCaller – the malware gang that talks you into infecting yourself

Scam Me If You Can

Tags: BazarCaller, Scam Me If You Can, Spam


May 08 2021

Microsoft warns of a large-scale BEC campaign to make gift card scam

Category: Security AwarenessDISC @ 3:21 pm

Microsoft is warning of a large-scale BEC campaign that targeted hundreds of organizations leveraging typo-squatted domains registered days before the attacks.

Business email compromise (BEC) attacks represent a serious threat for organizations worldwide, according to the annual report released by FBI’s Internet Crime Complaint Center, the 2020 Internet Crime Report, in 2020, the IC3 received 19,369 Business Email Compromise (BEC)/Email Account Compromise (EAC) complaints. The reports states that BEC/EAC crimes caused $1.8 billion in losses.

Now Microsoft is warning of a large-scale BEC campaign that targeted more than 120 organizations with gift card scam.

The attackers targeted organizations in multiple industries, including the consumer goods, process manufacturing and agriculture, real estate, discrete manufacturing, and professional services sectors. The threat actors leverage typo-squatted domains to trick the recipients into believing that the emails were originating from valid senders.

Microsoft warns of a large-scale BEC campaign to make gift card scam

Tags: gift card scam


Apr 02 2021

How to Stop Your Remote Workforce from Being Hacked

Category: Hacking,Security AwarenessDISC @ 3:26 pm

More on: How to Stop Your Remote Workforce from Being Hacked

Tags: Remote Workforce


Mar 29 2021

Stop using your employees as scapegoats: Change their behavior

Category: Security AwarenessDISC @ 11:12 am

We’ve recently witnessed large companies that were hit with major data breaches and cybersecurity incidents point the finger of blame at the lowest hanging fruit – their employees. While it’s understood that employees have a certain level of accountability when it comes to their role in the organization’s broader security strategy, it’s up to company leadership to arm them with the resources and knowledge to effectively thwart cyber threats.

With 90% of security incidents stemming from human error, a culture strong in security awareness is no longer a nice-to-have, it is a top priority and an absolute must across all organizations, regardless of their size or industry. Businesses who change risky employee behavior methodically and effectively through personalized, timely, and relevant learning will see an improvement to their overall security posture and a reduction in the number of security incidents.

Personalization is key

Cyber threats today have become increasingly sophisticated and more personalized. Therefore, it stands to reason that the training and coaching offered to employees needs to meet the same level of personalization in order to effectively combat these threats and change risky habits and behaviors over time.

Transformational Security Awareness

Tags: Change their behavior


Mar 07 2021

Security awareness programs: The difference between window dressing and behavior change

Category: Security AwarenessDISC @ 11:59 pm


Mar 01 2021

5 Top Cybersecurity Career Paths & Certifications

Category: Security Awareness,Security trainingDISC @ 1:05 pm

We are living in a world of innovations. Now, imagine innovative technologies with zero security is such a big nightmare. Cybersecurity comes here for the rescue. Cybersecurity is an immense ocean of various fields. Many skillful fishes are living in this ocean with lots of expertise. Cybersecurity is what keeps all organizations sane and safe. For that reason, I will discuss the fields that outgrown currently and the certifications that help in those fields.

Before diving into the ocean of cybersecurity, let us understand why to choose cybersecurity. Imagine being the CEO of a digital children’s toy-making corporate, promising every parent that the information provided about children inside the toys will stay safe. And the organization faces a cyber-attack that leaks all information about the children. That is the big downfall of the organization’s reputation.

Cybersecurity promises to secure the organization system’s from cyberattacks yet to keep user information safe. Cybersecurity professionals put all their efforts to create a secure and protect the environment, not only for organizations as well for all the users connected to the network/internet.

The world is becoming digital day-by-day, the growth in cybersecurity is not coming slow. The rates of cybercrime are also increasing yet bringing many opportunities for jobs in cybersecurity.

According to New York Times,3.5 million cybersecurity jobs are available this year. United States Bureau of Labor Statistics (BLS) contemplate that in the next ten years, cybersecurity jobs will increase 30% compared to other computing jobs.

Job performance is another category where cybersecurity staff performs well. The (ISC)2 Cybersecurity Workforce Report in 2019 showed that 71% of cybersecurity professionals in the United States are happy with their employment.

Now, the question that arises is where to give a kick start in cybersecurity.

Breaking IN: A Practical Guide to Starting a Career in Information Security by [Ayman Elsawah]

Tags: Cybersecurity Career


Jan 23 2021

SANS Virtual Summits Will Be FREE for the Community in 2021


Nov 05 2020

Spotting a Common Scam

Spotting a Common Scam 

Image
These scams seek to collect personal information about you, often appearing to come from a real business or agency. Someone may pose as an official disaster aid worker, or send you a fraudulent COVID contact tracing email. If you receive a message with a link, you should not click it as it may download malware to your device to steal passwords and personal information. Government agencies like FEMA or the IRS will never contact you asking for a FEMA registration number, a Social Security number, or a bank account or credit card number to give you a COVID or FEMA payment—or ask you to pay anything up front to fill out an application or to access state or federal resources.
Image

 

 

 

Before sharing, check that what you are reading is from a trustworthy source. Disinformation can be life threatening in a global pandemic.

 

Image

No cures or vaccines have been approved for COVID-19 yet. Online offers claiming to provide a medicine or device to treat or prevent COVID should be ignored. When there is a new breakthrough in the treatment and prevention of COVID, it will be widely reported on by reputable news sources.

 

Image

 

 

Fake charities often emerge following a crisis, soliciting donations, but not using them for the described purpose. Before donating, check out www.ftc.gov/charity  to research the organization and make sure it’s legitimate.

 

Image

If you receive a robocall, you should hang up instead of pushing any buttons or giving away any personal information. If a call claims to be from the IRS or FEMA, but demands immediate payment through debit card or wire transfer, it is fraudulent. Federal agencies will never demand immediate payment over the phone, threaten immediate arrest, or ask you to make a payment to anyone other than the U.S. Treasury.

Warning Signs that a Loved One may be the Victim of a Scam 
Victims to a scam may be embarrassed or uncomfortable asking for help. It’s not always obvious when someone has been scammed, so check in with your loved ones frequently, especially if they are older, live alone, or are otherwise high risk.

Warning signs include large ATM withdrawals, charges, or checks; secretiveness and increased anxiety about finances; large quantities of goods being delivered that they do not need; an unusual number of phone calls or visits from strangers; and a sudden lack of money, unpaid bills, or a change in daily habits.

 

For more information, and to get help with a potential FEMA fraud, you can call the National Center for Disaster Fraud Hotline at 866-720-5721 or FEMA’s Public Inquiry Unit at 916-210-6276. For questions about pandemic scams, go to www.ftc.gov/coronavirus or www.cdc.goc/coronavirus/2019-ncov .





Tags: common scam, scam


Nov 02 2020

Cyber Security Training Courses

Category: cyber security,Security Awareness,Security trainingDISC @ 11:17 pm

Cyber Security Training Courses via Simpliv

[pdf-embedder url=”https://blog.deurainfosec.com/wp-content/uploads/2020/11/Simpliv-Links.pdf” title=”Simpliv Links”]

To review each course download a pdf of Cyber Security Training Courses




Tags: Cyber Security Training Courses


Oct 02 2020

How cyber security can protect your business

Christopher Wright is one of IT Governance Publishing’s most prolific writers, having released five books with us over the past six years.

His work covers many different topics, including advice on organizational cyber security, project management and risk management auditing.

In How Cyber Security Can Protect Your Business – A guide for all stakeholders, Wright provides an effective and efficient framework to help organizations manage cyber governance, risk and compliance.

How Cyber Security Can Protect Your Business

Businesses must protect themselves and their reputations, while reassuring stakeholders they take cyber security seriously. Wright’s pocket guide:

  • Explains in easy-to-understand terms what executives and senior managers need to know and do about the ever-changing cyber threat landscape;
  • Gives strategic, business-focused guidance and advice relevant to C-suite executives;
  • Provides an effective and efficient framework for managing cyber governance, risk and compliance; and
  • Makes clear what is required to implement an effective cyber security strategy.

Receive 15% off all of Christopher Wright’s books throughout October by entering the voucher code WRIGHT15 at the checkout.

How Cyber Security Can Protect Your Business - A guide for all stakeholders
 

            Buy now

 








Aug 18 2020

Privacy eLearning – Staff InfoSec & Compliance Awareness

Privacy eLearning & Staff Awareness

  • Access staff awareness e-learning programs and train staff on best practice processes
  • Ensure staff can spot and respond to cybersecurity and privacy risks
  • Comply with data protection and information security legislation and standards
  • Test learner knowledge to prove compliance for auditing purposes
  • Train staff under one, manageable contract with these cost-effective annual licenses
  • Developed by industry experts our programs are updated every three months to ensure the content remains relevant
  • Gain access to any new content ITG release throughout your year-long contract
  • Customize the courses by adding links to company documents, policies, and procedures
  • Fast deployment with instant access to all of the courses
  • Reinforce awareness with monthly security updates, which include the latest news and tips



1) Complete Staff Awareness E-learning Suite
Complete Staff Awareness E-learning Suite

2) GDPR Challenge E-learning Game
This short and punchy ten-minute game will test your employees’ knowledge on real-life GDPR-relevant scenarios across different industries.

3) GDPR Staff Awareness E-learning Course
GDPR Staff Awareness eLearning Course

4) GDPR: Email Misuse Staff Awareness E-Learning Course
GDPR: Email Misuse Staff Awareness E-Learning Course

5) Information Security & ISO 27001 Staff Awareness E-Learning Course
ITG eLearning Course: Information Security & ISO27001 Staff Awareness

6) PCI DSS Staff Awareness E-Learning Course
PCI DSS Online Staff Awareness eLearning Course

7) Information Security Staff Awareness E-Learning Course
Information Security | eLearning Course

8) Phishing Staff Awareness E-Learning Course
Phishing Staff Awareness E-Learning Course

9) Data Protection Awareness Posters
Data Protection Awareness Posters

10) Phishing Awareness Posters
Phishing Awareness Posters

11) The ISMS Card Game
The ISMS Card Game




Tags: GRC eLearning, information security awareness, InfoSec eLearning, security awareness training


Aug 17 2020

Google Chrome will warn users when submitting insecure forms

Category: Security Awareness,Security vulnerabilitiesDISC @ 11:24 am

Google Chrome will warn users when submitting insecure forms that deliver information via HTTP connections on HTTPS websites starting with version 86.

Source: Google Chrome will warn users when submitting insecure forms

 

Download a Security Risk Assessment Steps paper!

Security Risk assessment Quiz – Find Out How Your security risk assessment Stands Up!

DISC InfoSec 🔒 securing the business 🔒 via latest InfoSec titles

Subscribe to DISC InfoSec blog by Email

👉 Download a Virtual CISO (#vCISO) and Security Advisory Fact Sheet & Cybersecurity Cheat Sheet





Jun 16 2020

CyberSecurity Awareness Quiz

Category: cyber security,Security AwarenessDISC @ 2:16 pm

Take an InfoSec awareness quiz to test your basic cybersecurity knowledge







Would like to know more on InfoSec Awareness…

Download a Security Risk Assessment steps paper!

Download a vCISO template

Subscribe to DISC InfoSec blog by Email





Sep 26 2019

Live and let live InfoSec

User vs Security

secret password
Live and let live InfoSec

The average person’s take on security control: they have real jobs to do, and security isn’t one of them. so remember ‘usability vs bypass security control’ when designing a new control. Please feel free to share your opinion on this.



Funny business meeting illustrating how hard it is for an (infosec) engineer to fit into the corporate world!
httpv://www.youtube.com/watch?v=BKorP55Aqvg

parkour vs security chase
httpv://www.youtube.com/watch?v=Hnv5OOpr4ug


Subscribe to DISC InfoSec blog by Email





Sep 09 2019

What’s your Password?!

Category: Password Security,Security AwarenessDISC @ 12:36 am

Very funny 😂 security password reminder, not funny that this is real!
httpv://www.youtube.com/watch?v=_u8Rss3W4Wg

Most Hilarious 😹 WiFi Names
httpv://www.youtube.com/watch?v=YDkt0FMcGLs

Obama 😎 finds ways to make cybersecurity funny 😎
httpv://www.youtube.com/watch?v=NpNk-tEkW_Q




Subscribe to DISC InfoSec blog by Email





Aug 15 2019

Data Loss Prevention: Protect Yourself, Your Family, and Your Business

Category: data security,Security AwarenessDISC @ 2:30 pm

photo courtesy of Unsplash

By Jasmine Dyoco

Another day, another data breach. Lately, it seems like we can’t go more than a few days without hearing about another cyber attack. Data breaches have recently occurred at health insurance providers like Anthem, banks like Capital One, and even the Equifax credit bureau. If there’s anything these recent hacks have shown us, it’s that no industry is safe.
Social Security numbers, credit cards, and passwords are just some of the types of compromised data. Given the number of recent attacks, Bloomberg reports that some cybersecurity professionals now make millions of dollars per year.
Massive amounts of information have been stolen. According to The Week, “virtually everyone in the U.S. has been affected by a data breach in some way — even those who never go online.” If you’re worried a hacker might have your data, here’s how you can protect yourself and your family:

Malware and Viruses

Malware and computer viruses are common ways that scammers get sensitive information. Contrary to popular belief, Macs (and smartphones and tablets) can get viruses. Whether you use Mac, Windows, Linux, or an iPad, protecting your computer against viruses also protects your information.

According to Secure Data Recovery, proactive actions can help keep hackers and viruses from accessing your data. Use strong passwords that are hard to guess. A sentence or phrase is stronger than a single word, for example. You should also install a firewall and antivirus software. Save backups of your files to a device like an external hard drive. Alternatively, you could also save data to the cloud using Google Drive or similar.

Security and Compliance

Cyber threats are continually evolving. By having an information security (InfoSec) plan in place, you can protect data from falling into the wrong hands. InfoSec helps organizations maintain confidentiality while complying with industry regulations.  DISC help the organization to succeed in infosec and Privacy program by building and assessing Information Security Management System (ISMS) and Privacy Information Management System (PIMS) based on various standards and regulations.

For instance, Deura Information Security Consulting (DISC) can perform a risk assessment to identify the security risks. Based on those gaps, they’ll help you create a “safe, secure, and resilient cyber environment.” Additionally, they’ll help your organization comply with regional cyber laws. Those laws include Europe’s General Data Protection Regulation (GDPR) or the California Consumer Privacy Act (CCPA).

 

Protect Your Teens 

Nobody is safe from online attacks. Unfortunately, that includes children and teenagers. Some scams specifically target teens and young adults. One example is phishing, which tricks teens into revealing their social media passwords. Teens are also susceptible to phishing scams that include “urgent” subject lines. These scams often trick people into clicking a link to avoid missing a once-in-a-lifetime opportunity.

To protect your children, the InfoSec Institute advises telling them to keep their login information private and to never click on social media links via email. Teach them red flags, like email scams claiming they’ve won money or website URLs that have misspellings or extra letters. Your whole family can learn what to look for by practicing with a phishing simulator.

 

Credit Freezes and Monitoring

Many people believe cybercriminals only steal money. The reality is that many of them are interested in stealing data, identities, or intellectual property. In the event that you do experience data loss, whether due to a virus, malware, or online scam, it’s essential to take action.

According to the IRS, you should report identity theft to the FTC, your bank, and each of the credit bureaus. You might want to freeze your credit and place a one-year alert on your credit report. Credit monitoring companies can help you protect your credit score by alerting you of any fraudulent activity. If you follow the tips listed above, you can recover your data and protect yourself from future attacks.

How to report and protect yourself from credit card fraud

How to prevent credit card fraud amid coronavirus pandemic

The Secret to Cybersecurity: A Simple Plan to Protect Your Family and Business from Cybercrime







Apr 25 2019

Computer security training courses

Category: Security Awareness,Security Tools,Security trainingDISC @ 11:18 am

Computer security training courses – Online cyber security courses

Build your cyber security awareness and InfoSec career to keep your cyber security skills relevant. Learn how to protect your information assets against today’s cyber threats with best online cyber security training courses.

 

DISC InfoSec cyber security training curriculum includes specialized InfoSec training and general cyber security courses for all levels.

 

Security Penetration Testing (The Art of Hacking Series) LiveLessons

Security Penetration Testing (The Art of Hacking Series) LiveLessons

Linux Security and Hardening, The Practical Security Guide

Linux Security and Hardening, The Practical Security Guide

CISSP LiveLessons

CISSP LiveLessons

Red Hat Certified Engineer (RHCE) with Virtual Machines LiveLessons

Red Hat Certified Engineer (RHCE) with Virtual Machines LiveLessons, 2nd Edition

Fundamentals of nerc cip

Fundamentals of nerc cip

Cyber Security – Online Scams & How to Avoid Them

Cyber Security - Online Scams & How to Avoid Them

Disaster Recovery and Risk Management

Disaster Recovery and Risk Management

 

 

Penetration Testing

Kali Linux

ISO27001

Python

CISSP

GDPR

Linux

Identity Theft

Powershell Security

Programming Courses

Security Risk Management

Planning a Security Incident Respose

AWS Security

Azure Security

Network Security

Wireless Security

RedHat Security

InfoSec eLearning

Social Engineering

Essentials of CyberSecurity

Azure Security & Compliance

Cyber Security Training Courses

Security Disaster Recovery

Cloud Security Computing 

 

 


 Subscribe in a reader




Tags: Chief security officer, information security awareness, information security guide, security awareness training


Feb 19 2019

#TaxScam

Category: Security AwarenessDISC @ 6:16 pm

It’s tax season, and with it comes Tax Scams. Stay Cyber Aware and Cyber Safe.

“Thousands of people have lost millions of dollars and their personal information to tax scams. Scammers use the regular mail, telephone, or email to set up individuals, businesses, payroll and tax professionals.

The IRS doesn’t initiate contact with taxpayers by email, text messages or social media channels to request personal or financial information. Recognize the telltale signs of a scam.” See also: How to know it’s really the IRS calling or knocking on your door

[pdf-embedder url=”https://blog.deurainfosec.com/wp-content/uploads/2019/02/TaxScam-1.pdf” title=”TaxScam”]

 

 





Tags: tax fraud, tax scam


Jan 26 2019

Security Awareness Roadmap – Infographic via SANS Institute

Category: Security AwarenessDISC @ 3:46 pm
  • #InfoSecAwareness
  •  

    Full Size Image: Security Awareness Roadmap






    Mar 08 2017

    Security Awareness

    Category: Security AwarenessDISC @ 6:12 pm

    Security awareness is the knowledge and attitude members of an organization possess regarding the protection of the physical, and especially informational, assets of that organization. Many organizations require formal security awareness training for all workers when they join the organization and periodically thereafter, usually annually.

    Topics covered in security awareness training may include:

    Being security aware means you understand that there is the potential for some people to deliberately or accidentally steal, damage, or misuse the data that is stored within a company’s computer systems and throughout its organization. Therefore, it would be prudent to support the assets of the institution (information, physical, and personal) by trying to stop that from happening.

    According to the European Network and Information Security Agency, ‘Awareness of the risks and available safeguards is the first line of defence for the security of information systems and networks.’

    ‘The focus of Security Awareness consultancy should be to achieve a long term shift in the attitude of employees towards security, whilst promoting a cultural and behavioral change within an organisation. Security policies should be viewed as key enablers for the organisation, not as a series of rules restricting the efficient working of your business.’

    If you think technology can solve your security problems, then you don’t understand the problems and you don’t understand the technology.  – Bruce Schneier

    Top Rated Security Awareness Books




    Tags: information security awareness


    « Previous PageNext Page »