DocuSign, the world’s leader in electronic signatures for official documents, played an unwitting role in a particularly nasty phishing attack.

If you’re not familiar with the company, DocuSign is used by 12 of the top 15 US insurance companies, 12 of the top 15 US financial services companies and by most real estate agents, nationwide.

It is an electronic platform that allows agents to send official documents to their clients for digital signatures, and as such, it’s used for everything from signing loan documents to establishing insurance policies. In short, the documents housed on DocuSign’s servers run the gamut of sensitive information for hundreds of millions of users around the world.
Knowing this, the hackers breached one of the company’s subsystems and managed to get their hands on the company’s email list.

Armed with this list, they copied DocuSign’s branding, logo and layout, and proceeded to send out emails that appeared to legitimately come from the company. But instead of official documents in need of signing, these emails contained poisoned Word documents containing macro-enabled malware.

The company took swift, decisive action when the breach was discovered, and the phishing attack has been derailed, but if you make use of the company’s services, you may have already received a bogus email.

Having completed their detailed forensic investigation, the company assured its users that none of the stored files were accessed. The hackers were only able to gain access to email addresses, which definitely limits the amount of damage that could be done.

Even so, if a user clicks on the poisoned attachment, there’s no way of knowing what sort of malware could be unleashed. All DocuSign users are urged to take extra care when opening emails that appear to be from the company and ensure that anything they click on is a link to a legitimate file that needs to be signed, and not a Word document.

Used with permission from Article Aggregator

Phishing attacks are a fact of life on the internet these days, but recently, a Google Doc was used in a wide-spread, wildly successful attack that security researchers are calling one of the most advanced attacks of its class seen to date.

In fact, the attack was so successful, that in its aftermath, Google is rolling out additional protections to help ensure that the inevitable next attack doesn’t find the same level of success as this one did, which ultimately impacted several million users.

The recent combined a generic spam mail attack with an embedded Google Doc to try and trick Gmail users into giving up control of their email account. The company warns that any users who receive an email containing a Google Doc from a source they don’t know and trust should immediately revoke access to the document in their Google Account Settings and change their password, just to be safe.

In addition to making this recommendation, the company has announced that they’ll be rolling out a new security feature in their Android Gmail app that will mirror the action you already see when you surf to an unsafe website using the Chrome web browser. The new warning will read:

“Warning – Phishing (Web Forgery) Suspected
The site you are trying to visit has been identified as a forgery, intended to trick you into disclosing financial, personal, or other sensitive information.

You can continue to (URL) at your own risk. If you believe that this site is not actually a phishing site, you can (link)Report An Incorrect Warning(/link)”

It’s a good move, and should make a real difference in terms of limiting the next attack’s impacts. Hopefully, Apple will follow suit and implement a similar system for iPhone users. Note that the company has not released a firm ETA on when the change will be in place, but it should be regarded as “pending.”

Used with permission from Article Aggregator

The recent WannaCry campaign took over news cycles, hindering an evaluation of Trump’s recent cybersecurity Executive Order (EO) — but I’ll admit, upon closer scrutiny, it’s a good start. This is particularly true if the goal is to kickstart a national cybersecurity strategy from scratch.

As a whole, there are no glaring errors despite some notable omissions, which I will touch on in this post. The EO identifies stakeholders, empowers them, asks for a plan and subsequently holds those stakeholders accountable. It’s much like any reasonable organizational policy. What is interesting, though, is the operational processes the EO demands.

Operationally, each department is asked to submit a security audit upstream — all the way to the President — that details current status, major identified risks and a plan to address them. The stickler here is that each sub-order only provides 90 days or less to submit. Given the respective IT scope of each agency, this could be quite an ambitious goal unless they have already done most of these framework audits — which is entirely possible. Additionally, the President, the Department of Homeland Security and the Office of Management and Budget are all going to receive a metric ton of audit reports to sift through as they attempt to develop Stage Two of the plan — i.e. now that we know what’s broken, let’s figure out a plan for how to fix it and how to pay for it.

At this stage, budgeting will be another huge item. We probably should expect HUGE budget increases, if even just requests, and a large fight over what agency gets what and how much. Again, it’s a good place to start. But we’re jumping ahead of the gun, what’s the actual process going to be like and what will it take to pull off?

1. The transmission, access and storage of all these audits will be paramount. If the agencies are forthcoming and accurate with their audits, the amount of sensitive data about the current security of their IT environments and major risk areas will be an attractive target for state actors. And successful pilfering of the information could lead to some worse case scenarios.
2. The audit function, assessing the current security status of each agency, cannot just be a one-time thing like the order implies. Audits should be scheduled at least annually, or even better — automated. IT environments change often, as does the threat landscape. If the time distance between when the audits are submitted with recommendations and when the budget is approved is too long, priorities could be off.
3. There is zero purchasing guidance for agencies in regards to sector IT purchases (e.g. hardware, software, and services). One of the strongest levers the federal government has to improve cybersecurity for everyone is their budgetary power. They need to leverage it smartly while maximizing its benefit instead of blind “best-of-breed” purchases that end up wasting resources on trying to operationally secure them. Moreover, as an accountability accompaniment, if agency heads will be accountable for the security of their environments, so too should their IT and IT security vendors who supply products and services. Yes, I’m talking about financial liability for private organizations that sell to the government. For example, there are now a number of security vendors are now offering warranties that guarantee the effectiveness of their products, and hopefully more will continue to do so.
4. Finally, the order assumes, dangerously so, that every agency isn’t already hacked. It feels like they think they’re starting with clean environments, which is pretty likely not the case. As agencies conduct the framework audits, they should absolutely look for indications of compromise, as those instances should be triaged and dealt with immediately. It doesn’t make much sense to try and secure a system that is already fundamentally compromised.

Ultimately, the EO on its own is pointing the government and its agencies to a higher level of accountability. This could lead to great success, even possibly affecting private sector companies that deal with government entities. All that’s left to see is if everyone executes on this effectively. We’re certainly rooting for it.

The post The Executive Order on Cybersecurity: Can We Finally Get on the Right Path? appeared first on SentinelOne.