Newsletters
Is Your Cybersecurity Infrastructure in Compliance?
In March of 2017, the New York State Department of Financial Services’ (DFS) issued its “Part 500” - Mandatory Cybersecurity Requirements for financial services entities. Thus, requiring banks, insurers, and other financial institutions to establish and maintain a “risk-based, holistic, and robust security program” that is ultimately designed to protect consumers’ private data. Partial exemptions are provided for covered entities based on their staffing level, annual revenue, or total assets.
The initial deadline for submitting an annual Certification of Compliance on February 15, 2018 is rapidly approaching, and all organizations are required to comply with DFS Part 500 Section 9, Risk Assessment by March 1, 2018.
Digital Edge is an expert in ISO standards, is certified by International Standard Organization on Information Security and Quality (ISO 27001). There is a clear crosswalk between DFS law and ISO standards. Digital Edge will help to implement policies, standards and practices to cover all DFS requirements based on International Standards Organization framework.
Contact us today to further explore how our team can provide your business with an unparalleled cybersecurity solution, with our continued focus on Stability, Security, Efficiency and Compliance.
For more information on this regulation and to ensure that your organization is following the critical compliance requirements, please read our most recent articles:
New Vulnerabilities - Meltdown and Spectre. What You Need to Know
The Digital Edge Security Team is aware of a set of security vulnerabilities—known as Meltdown and Spectre—that affect modern CPUs and virtual memory access. Exploitation of these vulnerabilities could allow an attacker to obtain access to sensitive information.
We analyzed our clients configurations and our own DE Cloud Infrastructure, and as of now, do not see any active exploitation of this vulnerability.
There has been much contradictory information. The Digital Edge Security Team explains the vulnerability in simple terms and provides suggestions on how to handle the situation here.
Digital Edge’s Managed Security – response to HIDDEN COBRA- North Korean Remote Administration Tool: FALLCHILL
The Digital Edge Security Team warns that HIDDEN COBRA actors have been using FALLCHILL malware to target IT infrastructures. DHS and FBI specified Internet Protocol (IP) addresses and other indicators of compromise (IOCs) associated with a remote administration tool (RAT) used by the North Korean government—commonly known as FALLCHILL. The U.S. Government refers to malicious cyber activity by North Korea as HIDDEN COBRA.
HIDDEN COBRA uses dual proxy technique allowing to change vector of the attack and keep the source of the attack hidden.
These types of activities can have severe impacts such as data loss and disruption of operation. The Digital Edge Security Team has updated its own core infrastructure to protect our clients from possible impacts of HIDDEN COBRA and advise other IT organization to use the same practice.
Imperative Concern: Your Wi-Fi Connection is Vulnerable
Wi-Fi vulnerability has been of recent speculation; indicating that a hacker can exploit Wi-Fi networks. Digital Edge wants to raise awareness by sharing an article written by our friend Henry Jiang (CISO, CISSP) that covers this topic extensively. In addition, you will find the results of our conversation with a security expert who witnessed a “Proof of a Concept” of the Wi-Fi exploitation using modern white hacking approach - THE RESULT IS SHOCKING.
Please get the full article here.
Digital Edge’s Contribution to the Verizon Security Breach Report 2017
Have you ever been or almost been hacked? The answer is most likely yes. Everyone knows of those sketchy emails that try to get you to do something but in reality just cause viruses on your computer. Exploiting someone’s computer has become such a big 21st century issue and it continues to grow.
Digital Edge served as a contributor to Verizon’s Security Breach Reports this year. Hacking is becoming an ever-growing issue so Verizon comes up with statistics of breaches that occurred throughout the year to keep people informed. Digital Edge aided Verizon in providing our own reports of client’s attacks. We analyzed the type of attack, the success rate and ultimately the amount of attacks our clients experienced. (Note: Client Confidentiality Was Not Compromised). There were interesting trends found when analyzing the reports, such as the main targets and the way industries are being exploited. To see these trends, read the full article!
Alerting for Fraudulent Rules Setup in Office 365
Friends and Colleagues,
It is critical that at this time, the Digital Edge Security Team sends an urgent warning about a wide-spread email phishing campaign aiming at Microsoft Office 365 users. The emails have subject similar to this: “View your Office 365 Business billing statement for…”.
The email looks very real and our Security Team is urging what users should pay attention to when analyzing such email for authenticity.
Multiple clients have notified us about receiving said emails and some people were getting trapped by this campaign.
Click here to read more about this incident of email phishing and possible remediation for this and further attack involving setting up spying rules in your Office 365 account.
Digital Edge Security Team Advises Not To Use Kaspersky
It was recently reported that the home computer of an NSA (National Security Agency) contractor was hacked using Kaspersky antivirus software. The incident happened back in 2015 but it had been brought to light about a month ago. It revealed that this vulnerability in the Kaspersky software could have been in massive scale. It was also suggested that not only was the Kaspersky Lab team aware of the hacks, but they assisted in them as well. Kaspersky Lab sent out an emailed statement refuting this and offering help to the U.S. in investigating the breach. However, with rising tensions between Russia and the U.S., there could be a connection between the Kaspersky Lab and Russian Intelligence Agencies; which can pose as threat to American consumers that have Kaspersky software.
The Digital Edge Security Team advises against using Kaspersky security products, which have deep access to system resources, may work as spying software as well as have possible ties to the Russian intelligence agencies.
To continue reading please click here!
Digital Edge’s security team provides top security to their servers. Working 24/7, we detect any type of faults in our systems instantly, before they even cause a potential threat to breaches. Digital Edge provides security checks, does penetration testing and supervises our client’s systems to ensure full security. We work hard to maintain our 100% Uptime.
If you are in need of immediate Security assistance, please contact the Digital Edge Security Team today!
Microsoft SPLA Price Increases
Good Afternoon Digital Edge Customers,
We are writing to you today to inform you of changes to monthly Microsoft licenses. (The Microsoft Service Provider Licensing Agreement, or SPLA, is designed to provide customers hosted software services including web services, database services and applications.)
We received communication from Microsoft regarding the expected price changes for January 2018 & January 2019. Please see the information below. Once we have official set dollar amounts we will communicate that information as well. Please let me know if you have any questions! We want to make sure you have this information as soon as possible to give you as much time as possible to plan for these changes.
Programs Impacted – Corporate & Academic
Effective January 1, 2018 monthly prices for the following products will increase:
- By 10% for Windows Remote Desktop Services SAL
- By 10% for Windows Server Standard (Processor license)*
- By 10% for Windows Server Datacenter (Processor license)*
- By 10% for SQL Server Standard Core
- By 10% for SQL Server Enterprise Core
- By 10% for SQL Server Web
- By 10% for SQL Server Standard SAL
- By 5% for Core Infrastructure Server Suite Standard (Processor license)
- By 7% for Core Infrastructure Server Suite Datacenter (Processor license)
(* Applicable to Agreements that still have the right to report these sku’s)
Giving customers 15+ months’ notice and effective January 1, 2019 prices for the following products will increase:
- By 10% for Windows Server Standard Core
- By 10% for Windows Server Datacenter Core
- By 5% for Core Infrastructure Server Suite Standard Core
- By 7% for Core Infrastructure Server Suite Datacenter Core
- By 15% for Windows Remote Desktop Services SAL
For more information regarding these changes, or to speak with the Digital Edge team, please contact us today!
Amazon Security Is Not Enough
Using cloud platforms does guarantee that customer deployments on those platforms will be automatically secured. Regardless of how advanced the security of the products is, if a customer leaves login as admin/admin - the entire deployment will be vulnerable. This admin/admin is only one very simple example, and is exactly why Equifax had its major security breach.
Digital Edge not only suggests, but implores companies to implement security frameworks such as ISO 27001, NIST Core or SOC2.
Recently, the resumes of potential, current, and previous employees of the US Department of Defense and the US intelligence community were exposed. The documents were found on an insecure Amazon S3 bucket that was not password protected. Amazon needs a stronger third-party cybersecurity to prevent these issues, especially since it is such a large company. This can become very disastrous, for clients and Amazon if the problem isn’t fixed. To find out more information, click here!