Business, Compliance, Cyber Security, Data Breach, Geopolitics, Information Security, Risk Management, Security, Social Media

2018 Year in Review

As 2018 comes to a close, we reflect on those moments throughout the year that defined the times yet to come. For Centry, 2018 was a year that brought us great joys like the opening of our new branch in Mexico City and establishment of the ASIS Ukraine chapter, but also times of mourning after our colleague, Mr. Rachid Boukhari, passed away in June. Above all, it has been a journey, and one we are grateful to undertake for the mark we make on this world.

From our Centry family to yours, we wish our readers love and joy over the holidays, and a happy new year!

In keeping with the tradition of our year’s end articles on Centry Blog, we put together a list of some of our most-read stories from 2018 below.

January

Centry’s GDPR Guide

Our GDPR guide breaks down exactly what the EU’s General Data Protection Regulation was all about. This article was highlighted on TWiT live in an interview with our CTO Dave Ehman!

February

The Next Gold Rush: Renewable Energy

The Renewable Energy industry just might be the next gold rush for businesses and investors alike. This time, we aren’t hiking into the Klondike for gold; individuals and organizations alike are turning their eyes toward the broader world, looking out for opportunities to make good on this booming initiative.

March

Hidden Sanctions Risk: North Korean ties to Africa

The connection between Namibia and North Korea stands as but one example among many similar stories. It began in the 1960s, when several African countries started the struggle for independence from colonialism. During this vulnerable time period, North Korea invested time and money in these revolutions, where the political ties eventually grew into commercial relationships.

April

Human Trafficking in the European Union

Over the course of the past two decades, the European Union has been making an increased effort to understand and address the heinous crime of human trafficking. The most recent publication of statistics from Eurostat concerning registered victims and suspected traffickers revealed that a number of non-EU nationals are trafficked into member states, primarily from Nigeria.

This week’s article on Centry Blog examines just a facet of this deep and complex issue through analyzing Nigerian campus cults, the international response, and global business reponses.

May

Fake Social Media Profiles and What To Do If You Are Being Impersonated Online

False accounts are prevalent across social media, mainly used for phishing purposes. Whether it’s a bot or malicious actor threatening your account, we put together an instructional guide for those moments that you notice you have a seemingly second profile, not of your own making.

June

Supply Chain Security Introductory Guide

Having a secure logistics supply chain can save your company millions in terms of assets and reputation, and here at Centry, we have the know-how to help you. This article serves as an introductory guide to security in the supply chain.

July

Typosquatters

Sometimes fat-finger errors can lead to more than just an autocorrect goof. Some scammers have figured out how to lay traps surrounding these common mistakes.

August

Common Security Dos and Don’ts

Our article on Common Security Dos and Don’ts covers what you and your business can do to prevent costly breaches of data and trust.

September

Golden Visa for sale! Now on special offer for the 1%

In some countries, you can buy your way to citizenship. European passports and Schengen visas are the most desired traveling documents in the world. Not only do they grant the most traveling freedom, they give access to a safe and stable living environment, with free speech, in a market that can fulfill all your needs. Many EU countries have taken advantage of this by offering entry in exchange for investment. This kind of activity is commonly referred to as a Golden Visa Program.

October

5 Basic Digital Privacy Tips for the Average Person

Digital privacy is for everyone. But it’s also a massive topic that can be very easy to get lost in, especially if you’re new to to it. However, you don’t need to be a security expert nor do you need any particular reason to want to bolster your privacy on the internet.

November

What is Social Engineering?

Social engineering is a growing threat to individuals and businesses alike. In this article, we look into what social engineering is, the ways it can manifest, and what you can do to protect yourself.

December

Cyber Security in the Supply Chain

Your company might have a rigorous Cyber Security policy, and thorough training on all its personnel. But what happens when the security vulnerability comes from a trusted source in the Supply Chain?

Security professionals must now consider not only the possible vulnerabilities of their own network, but their supplier’s network, and their supplier’s supplier network, and so on.

We hope you have enjoyed Centry Blog this year. For more content like this, be sure to subscribe and follow us on Twitter @CentryLTD! We will see you in 2019!

Business, Cyber Security, Risk Management, Security, Uncategorized

Cyber Security in the Supply Chain

Cyber Security is generally accepted to encompass the protection of our interconnected information systems and assets including hardware, software, applications and data.  In that range of topics, one of the most important areas of concern for Cyber Security professionals is Vulnerability and Patch Management within the realm of Security Operations.

Vulnerability and Patch Management is the ongoing practice of ensuring that your systems and applications are kept up to date, scanned for known and unknown vulnerabilities.  The conventional wisdom is simple – when a software vendor provides security updates for critical application, these should be installed as soon as possible. Right?

Microsoft issues security patches for Windows and Office applications on the second Tuesday of each month. Apple issues security updates a handful of times per year.  Other vendors have similar programs.

When a vendor issues security updates, they usually disclose the particular security vulnerabilities that it was intended to fix.  So, as soon as a security update is released, the vulnerability becomes “public”. Now that the vulnerability is available (to bad actors) it is even more crucial that the fixes be applied in a timely manner.

All of this assumes that the vendor (the “Supplier” of this particular “Supply Chain”) has not already been compromised.  Imagine if a hacker could get in to the systems of our software supplier, make changes to released software that add malware.  Diligent users would unknowingly, and quite reliably continue to install updates, that now include malware.

If this sounds like a nightmare scenario, it is.  And it has already happened.

Examine the case of the Not Petya worm.  This started at a small company in Ukraine that supplies a piece of software called M.E.Doc.   You probably don’t use M.E.Doc. so you are not worried, right? M.E.Doc. is accounting software, used in Ukraine (think Quicken/TurboTax) and is required for filing national taxes.  So a large number of Ukraine based companies use it. In the spring of 2017, outside forces (likely Russian) hijacked the company’s update servers, injecting malware that included a small, but critical backdoor into the software.  As users updated their systems, they were infected with a backdoor, which laid latent for a month or two.

Then, the attack was launched.  The attack leveraged other vulnerabilities in Windows known as Eternal Blue and Mimikatz. These vulnerabilities rely on being “inside” the network of a company, behind the firewall, and once there, were able to spread globally encrypting data and asking for ransom.  Large multinational companies were affected, including banks, large shipping interests, manufacturing and more. If your company had an office in Ukraine, you may have been affected. If one of your suppliers, to whom you connect has offices in Ukraine, or is connected to someone who does, you might have been affected.

The upshot is this: Supply Chain security in Cyber Security is a now multi level concern.  Security professionals must now consider not only who might get in to their own network, but who might get in to their supplier’s network and who might get in to their suppliers’ supplier’s networks, and so on.

As is the case in other areas of Supply Chain security, we must concern ourselves with not only preventing bad things from happening, but assuming that they can, and trying to limit what can be done when bad things happen anyway.

And there is no simple answer.  Keep systems up to date to protect from know vulnerabilities.  But know that these updates can themselves introduce other vulnerabilities.

This article was written by Dave Ehman and edited by Kristina Weber. For more content like this, be sure to subscribe to Centry Blog for new articles every other week on topics relevant to the security industry. Follow us on Twitter @CentryCyber and @CentryLTD!

Cyber Security, Information Security, Security, Social Media, Uncategorized

5 Basic Digital Privacy Tips for the Average Person

As interconnectedness and personalized browsing experiences have become the norm in today’s society, our lives – increasingly impacted by our digital footprint – have become less private.

The right to digital privacy has been a slow growing movement, and its biggest marker was the General Data Protection Regulation that affected the EU. It was a legislation that marked digital privacy as a right, not a privilege, and companies all over the world scrambled to make sure they met compliance requirements. Now, for users in the EU, the internet has become a more transparent place for how information can be used or accessed. But, of course, it is still a work in progress.

Digital privacy is a massive topic that can be very easy to get lost in, especially if you’re new to to it. However, you don’t need to be a security expert nor do you need any particular reason to bolster your privacy on the internet. So, here are some simple security pointers for the average web user:

1. Keep your OS updated

The first thing you will want to do on any device is to make sure that it’s updated. As annoying as the notifications can be, they’re there for a reason– updating is important, and not staying on top of them could mean your device has a critical security vulnerability. So whether it’s installing the new macOS update, iOS 12, or Windows update, etc. just make sure that you take the time to do it, or set up your device to update automatically (usually configurable in settings).

2. Be mindful of Public WiFi networks

Public WiFi and open networks are notorious for security vulnerabilities, and connecting to one could pose a risk to your information. While it’s better to avoid connecting to them at all, sometimes you need to, so if you do, here’s some steps you can take. First, you’ll want to make sure that you turn off network sharing (usually preferences can be found in wifi settings on your computer). On Windows devices, you can also make sure you have Windows Firewall enabled.

When browsing connected to a public network, it’s best to avoid anything sensitive, such as banking. You should check to make sure that what websites you navigate begin their web address with HTTPS, as well.

3. Use a secure web browser

Make sure that you are using a secure web browser. Mozilla Firefox and Google Chrome are some good choices depending on what you want. If your priority is maintaining as much privacy as possible online, Firefox is better as it has more options for privacy and security. It is also the more lightweight program of the two, which would run more smoothly on computers with less RAM.

Google Chrome is also a comparatively secure option in terms of protecting you from malicious websites, however it is less private as a lot of data about your internet usage goes to Google. That may be a positive or a drawback to you depending on your priorities – if you want privacy, it’s not so great, but if that’s not extremely important to you and your computer is equipped to handle Chrome’s resource demands, then it’s a solid choice as well for speed and reliability.

In either browser, make sure you take the time to navigate to the Privacy and Security settings and adjust them to your preference. Some of the settings you can choose are to clear your browsing data/history, unselect the option to send usage statistics to the company, enable Do Not Track requests, etc.

Additionally, you can install an ad blocker extension/addon, such as uBlock Origin, in both browsers that serve as an additional line of defense against unwanted scripts running on websites that you visit. This can be easily obtained for free through the Chrome Web Store or Firefox Addons.

4. Secure your social media profiles

One common mistake that people make on social media platforms like Facebook and Instagram is that they have their profiles set to public. This means that anyone, anywhere can view your profile and all the content on it. This is great for a business page, but maybe not so much for your personal profile.

Every big social platform has privacy and security options. These can usually be found in the settings menu, where you can navigate to the relevant sections to adjust what you want to be seen. On Facebook, you have full control over who can see your posts and friends lists, as well as whether you can be searched by your email address or phone number.

Location settings – especially in mobile apps – are important to adjust as well. Snapchat is a big one for this, as people on your friends list can observe your location in real time through the Discover function unless you have disabled this feature and turned on “Ghost Mode.”

5. Consider using a VPN

Finally, if you want to take your security one step further, you can look into getting a VPN — that is, a virtual private network. VPNs have significant privacy advantages by encrypting your connection and acting basically as an intermediary between your device and the internet. They mask your IP address, which is basically as telling in the digital world as your home address is otherwise. The VPN works by routing your traffic through its own servers, and gives you the option to appear to be from any location of your choosing.

But since you are relying on the VPN in this way, it’s important that you get a trustworthy one, such as F-Secure Freedome. Most free VPNs are unreliable at best or actively malicious at worst.

Overall, online security and privacy is what you make of it. But these simple steps will at least ensure that you’re going in the right direction. For more in-depth information on the topic, be sure to follow @CentryCyber on Twitter.

This article was written by Kristina Weber of Centry Global. If you would like help or have questions, feel free to contact us via email at info@centry.global! Be sure to subscribe to Centry Blog for original bi-weekly articles relevant to the security industry.

Business, Compliance, Cyber Security, Information Security, Risk Management, Security, Social Media, Uncategorized

Centry Opens New Office in Mexico City!

el-angel-de-independencia--mexican-landmark-552812595-59863bb2519de2001116a0d0

We are pleased to announce the expansion of Centry Global to Mexico!

Our new office is now open, located on the 17th Floor Torre Magenta, Paseo de la Reforma 284, Colonia Juarez, Distrito Federal, Mexico CP 06600.

new office.PNG

As an international security company, our work takes us across the world. With the opening of this office, we are now able to better serve our clients in the region.

At Centry, our focus is to develop long-term, communicative working relationships to provide you with the best resolutions to your security challenges. While our combined expertise primarily revolves around security and risk management, you will find among our ranks professionals in corporate and private investigations, fraud control, and experts in programming, software development, and more.

We look forward to meeting and working with more clients across Mexico. Please don’t hesitate to contact us!

📧 info@centry.global 📱 +52 55 4739 2665