Author: Abi Bayley

We’re delighted to announce that we have teamed up with Electric Miles, B2B SaaS company providing EV charging software to charger manufacturers, offering a combined service for Electric Vehicle (EV) charger manufacturers and resellers to ensure compliance with the upcoming December 2022 cyber security regulations.

EV chargers are vulnerable to cyber and physical security threats just like any connected device and these risks have the potential to threaten the stability of the grid, the charger and the user’s personal data.

To ensure regulations compliance we offer:

• Physical Security Assessments of the EV charging points
• Assessment of logical interfaces presented by the EV charging point
• Assessment of WiFi and mobile network security posture
• Hardware Security Assessment including local storage and firmware

These regulations come into force from December 2022. Please reach out to us now on sales@razorthorn.com in order to guarantee compliance ahead of the deadline.

Securing your software development lifecycle

Digital innovation is key to the success of businesses across all sectors. Mounting competitive pressures and continuously evolving customer behaviour means that organisations are expected to adapt rapidly, more than they ever have before. This need for flexibility, change and faster innovation coupled with the complexity of today’s applications demand efficient reuse of code and, to this end, companies are utilising large volumes of open source libraries.

In order to keep up with the pace of transformation, dependence on both third party and OSS libraries is now an integral part of the development process when writing code. Why try and reinvent the wheel every time? Effective use of open source libraries can be an efficient tool in this age of ever evolving digital solutions in a competitive market place.

OSS components make up 90% of modern applications. When such a large proportion of the fundamental building blocks of code are being taken from open source libraries and then amalgamated inside complex system designs, it is easy to see that the chances of losing track of where each of those individual blocks came from is high. But what are the risks that come with this?

Visibility is paramount when defending an organisation against security and legal risks, and this visibility includes the origins of the components in our applications. Take one of the applications that your business uses on an everyday basis: do you know what OSS components are in use? Do you know in which part of the code they reside? Can you name the licenses associated with those components? I’m going to hedge my bets that the answer is probably “no” to at least one of those questions. This means that if a new vulnerability was announced and listed in the National Vulnerability database and applications that were using that package were now open to exploitation, you would have no idea if any of the thousands of applications in use in your business were running vulnerable versions.

Businesses need to have verifiable insight into their software and the third party software that is in use within their organisations.

Software Bill of Materials

As someone who suffers from a severe nut allergy, it would be completely irresponsible of me to eat a cake without knowing every ingredient that went in to making it. The benefits of eating the cake without reading the ingredients, getting to enjoy all that sugary goodness immediately rather than having to waste time checking the ingredients, is outweighed by the risk that comes with taking that shortcut, i.e. anaphylaxis. Suddenly, not taking time to research the ingredients just doesn’t seem worth it, right? This is the exact same attitude that businesses need to take regarding the components they use in their applications. It is irresponsible to use multiple OSS components in multiple systems without knowing everything about each one, doing so leaves your organisation and your customers at risk.

So, what can we do to overcome this? The benefits of using OSS and third party software are tangible and numerous, but we must negate the risk that comes hand in hand with this.

No silver bullet ever exists, we know this, but a good first step in this instance is a standardised Software Bill of Materials (SBOM). This is effectively a nested inventory of software components that describes which components have known security vulnerabilities and architectural or license risks. It enables businesses to make quick decisions, identify exposure and to take appropriate steps in response to any new vulnerabilities that arise. Knowing what open source and third party components have been used in and are flowing through your software supply chains is the first crucial step in mitigating the potential risks.

In response to the increasing number of application breaches that are occurring, standards bodies and governments are beginning to place a greater importance on SBOMs. They are also introducing laws, bills, guides and requirements to assist and hold development organisations accountable for the quality and security of the code they assemble and build.

In April 2020, The National Institute of Standards and Technology (NIST) released new standards for improving software security and in April 2021 they released a paper “Defending Against Software Supply Chain Attacks” which looks to be formalisation of software supply chain standard starting to take shape. Similarly, in January 2019, new PCI secure development standards advised organisations to generate an SBOM to track and trace the location of every single component of their software. The UK’s National Cyber Security Centre has recognised that software development practices are becoming increasingly automated and reliant on open source and third party components and, in an effort to help development teams evaluate their OSS components and reduce security risk, provided eight useful questions that organisations should consider in their resent guidance Produce clean & maintainable code – NCSC.GOV.UK.

Furthermore, Gartner states that by 2024 the provision of a detailed, regularly updated software bill of materials by software vendors will be a non-negotiable requirement for at least half of enterprise software buyers. From a security perspective, it is vital to have an inventory of every component used in your software, so that as a business you can act quickly to identify if any of the applications are vulnerable to known hacks or come from dubious sources, in order to stay ahead of adversaries and competitors.  Any time a vulnerability in OSS software components is announced, two questions need to be able to be answered rapidly: Did we ever use the vulnerable version(s) of the open source component? If so, in what applications do they reside?

Learning from Past Experiences

Many well known organisations have fallen into the trap of licence misuse and have subsequently found themselves subject to legal action. Below are just a couple of examples of organisations that know all too well the consequences of violating open source licenses:

• Versata and XimpleWare – Versata Case:  The Consequences of Violating Open Source Licenses
• Samsung and BusyBox – Best Buy, Samsung, other retails violated GNU General Public License version 2 (GPLv2)

Both of these used the GPL code mentioned above. Versata and Samsung all lost their court cases and were forced to release their code to the general public.

Handling an organisation’s open source security and dependencies can be a taxing and onerous job; staying compliant with OSS licenses, managing open source CVEs and keeping track of what dependency version is in use is time consuming. Often organisations leave security teams to manually manage the risk of vulnerable OSS code, or worse, sweep it under the rug with the classic ‘we don’t use open source so we don’t have a problem’…

Do not be one of those organisations!

Don’t risk eating the cake without checking the ingredients. Make sure that you are aware of every OSS component that has been used in your applications and where abouts they reside. Be informed and knowledgeable about the licenses and accompanying terms. It might take a little longer in the first instance, but then you can sit back, relax and enjoy your cake without risking putting you and your business into anaphylactic shock.

Sources list –

Mitigating the Risk of Software Vulnerabilities by Adopting a Secure Software Development Framework (SSDF) (nist.gov)

Produce clean & maintainable code – NCSC.GOV.UK

Hygiene for Open Source Software Is Now a PCI Requirement (sonatype.com)

SON_SSSC-Report-2020_final_aug11.pdf (sonatype.com)

Deliver Uncompromised: Securing Critical Software Supply Chains (mitre.org)

We’ve all had it happen. You receive an email telling you that you’ve won a prize draw you never entered or a foreign prince wants to transfer you a huge sum of money and needs your bank details. These obvious scams can be spotted from a mile away and are what we tend to think of when we think of phishing, but it’s not always that apparent.

Over the years, phishing scams have become harder to detect and many have fallen victim as a result. Research[1] has found that one in every 3,722 emails in the UK is a phishing attempt, and nearly 55% of the UK’s total email traffic is spam. In fact, around half of cyber attacks in the UK involve phishing, which is roughly 20% higher than the global average. In the Government’s 2021 Cyber Security Breaches Survey[2], this number was much higher with businesses who had experienced cyber attacks reporting that 83% of these attempts were phishing attempts.

If phishing has been around as long as we’ve had email, how is it that these stats are so high? How do we keep falling victim? Surely we should know better by now? The truth is, these scams aren’t always as easy to spot as we might assume and as we’ve wised up to these attempts, those behind the attacks have gotten smarter as well. Could you really outsmart a phishing scam if faced with one?

What to Do

Phishing scams have certainly become more realistic, but there are some very simple steps you can take to avoid them. These practices may seem a bit like common sense, but lack of attention to detail is exactly what these attackers prey on. Becoming a bit more tuned in can go a long way for protecting yourself and your organisation.

For starters, if you receive an email that claims to be from someone you know, work with, or have access to normally, it is always worth confirming that they were the true sender if they have asked you for information or to complete a task that seems a bit odd. It is also worth checking the email address of the sender when you receive emails. We tend to take the sender’s displayed name at face value without looking at the actual email address the message came from, thus letting these scams slip through the cracks. You would be surprised how many of these attackers spoof their sender name without doing anything to the email address itself.

You would also be surprised how many attackers make other simple mistakes that undermine the believability of their schemes. An email from Amazon, the NHS, or any other major organisation would never contain a typo or grammatical error, so it’s safe to assume that any mistakes like this are a red flag.

Of course, having the right security infrastructure can help make it harder for attackers to gain access. You need to have the right software in place if an attack should slip through your first line of defence. This is where Razorthorn can help. We offer various services to help build and protect your infrastructure including phishing education for staff, phishing solutions and managed phishing services. Get in touch to learn more.

---

[1] https://www.csoonline.com/article/3440069/uk-cybersecurity-statistics-you-need-to-know.html

[2] https://www.gov.uk/government/statistics/cyber-security-breaches-survey-2021/cyber-security-breaches-survey-2021

Since the introduction of Bitcoin in 2009, and as a result of the global recession during that period, cryptocurrency have been a much-discussed topic across technology, finance, and even global policy. The news is dominated by stories of its impact on our lives and businesses.

One of the most recent crypto controversies stems from China’s central bank, the People’s Bank of China (PBoC), with the publication of a memo that criminalises practically all cryptocurrency activity out of concerns about fraud, money laundering, and the facilitation of other criminal activities. This made huge waves, given that China is the highest contributor to the global GDP and the leader of the worldwide tech race. The ban came as a harsh blow, sending share prices plummeting and raising questions about the longevity of this currency form. If China, which has long been an early adopter of technological innovations, does not trust crypto, should we?

At the other end of the spectrum, we have nations and companies who are embracing these payments and building them into the future of their operations. In September 2021, El Salvador officially made bitcoin a legal tender in the country. Ukraine, Cuba and Panama are some of the most recent countries to announce their intention to introduce legislation to legalise crypto and encourage its use for payments. PayPal, one of the world’s biggest and most widely accepted payment platforms, now allows its UK users to buy, sell, and hold cryptocurrencies via the platform. If you are out shopping, dining, or travelling, then you may be able to pay using these digital currencies. Microsoft, Pavilion Hotels & Resorts, AXA Insurance, Starbucks, Tesla, Amazon, Visa, LOT Polish Airlines, Expedia, and Lush are among some of the biggest brands to allow their customers to use crypto as a form of payment in certain geographies.

It appears we are getting two very different sides of the story as one financial and technological juggernaut derides cryptocurrencies, while numerous others seem to be racing towards it. But will China’s decision shake the faith of other major players, as well as the everyday consumer? Was it all just a fad?

Is Crypto Safe?

The reason China cited for their ban was that cryptocurrencies facilitate criminal activities such as money laundering or fraud. For many naysayers, this ban comes as vindication of the popular critique that crypto is only for hackers, crackers, and criminals.’ For others, this ban has called into question whether or not crypto is safe.

The unique appeal of cryptocurrencies is that they are backed by blockchain technologies that operate via cryptography. This system is considered to be inherently more secure than other forms of encryption used in standard online banking, digital wallets, and other peer-to-peer payment services. These platforms are so secure that many have reported losing their passwords and never being able to get back into their digital wallet, unlike online banking which allows you to reset with a simple email or phone call. Cryptography adds an extra layer of protection by making these virtual currencies nearly impossible to counterfeit or double spend.

Therefore, whether or not crypto ‘safe’ depends on your definition of the term. The better word to describe these transactions is ‘secure’ for two main reasons. The first is the volatility of the crypto market itself. Much like the stock market, the value of cryptocurrency tends to fluctuate. Your bitcoin investment may be worth thousands one week and markedly less the next. We saw this in action after China’s announcement, with the value of bitcoin dropping much like a company’s stock would after a publicised scandal, for example. While many forms of crypto are valued much higher than your average stock would be, they are by no means a ‘safe’ investment due to their volatility. Traditional currency also fluctuates in value day-to-day thanks to inflation or deflation, but this is not nearly as extreme. The difference is usually pennies, if that. You are very unlikely to make or lose a vast amount of money overnight. For many, that risk is off-putting.

While the blockchain technology that powers crypto transactions does help to make these payments more secure, that does nothing to defend against nefarious intentions. Because it is still early days, there is insufficient regulation of these payments. Depending on who you talk to, this is either a blessing or a curse. On one hand, crypto payments can be processed faster and with less fees. That is one of the biggest draws for both businesses and individuals. On the other hand, the somewhat ‘Wild West’ nature of the crypto space has made it appealing for cyber criminals. The secure nature of these transactions makes them harder to trace, which is a double-edged sword in some ways. It is a draw for using these transactions, but also does make it easier to misuse this power.

However, it is fair to say that just as with traditional currency, those use cases can be considered the extreme. With traditional currency, we still see instances of fraud, money laundering, and counterfeiting, but only a small percent of the population are using it this way while the rest of us are making purchases, paying bills, dining out, and so on. Just because some forms of nefarious activity is a possibility, that doesn’t mean that that will be the default. The majority of us will use crypto without ill intentions.

Many countries are already taking steps to introduce legislation and appoint regulatory bodies at a national level. The UK has assigned the FCA to oversee it, and recent news from the US hints that the Biden administration will be ramping up their regulatory scrutiny in the coming months. We can also expect to see independent organisations begin to form dedicated to creating governance and ethical standards, as well as some related to crypto’s use in specific industries.

by David Smith, guest blogger for Razorthorn Security

Biometric technology, such as fingerprint sensors and voice recognition, has become widely popular in recent years with the boom in mobile applications. Organizations are now trying to make use of this technology and implement it to a wide range of areas. Particularly for the banking industry, biometrics can play a vital role in fraud prevention.

With the prevalence of phone and digital banking, banks require innovative ways to authenticate their customer’s identity. Moreover, though customers want their information to remain secured, they don’t like themselves to be scrutinized through an excessive authentication process for a simple transaction. Yet, it’s imperative for banks to verify their customers before they are given permission to access an account over a website, phone, or mobile application.

Conventional password and PIN codes have proven to not always be successful towards achieving security. Not only do customers forget them frequently, but the hackers also gather their personal information through various techniques such as phishing or social engineering. Thus, banks and account holders face losses worth millions every year as a result of identity theft.

When we talk about biometric in the banking industry, it simply brings together security and convenience. Biometric technology depends on a single action instead of other multi-factor authentication methods. For instance, in phone banking, a customer can be simply authenticated on the basis of their voice recognition instead of a sequence of security questions and password retrievals.

Unlike paper documents that can be forged, or passwords that can be cracked, an individual’s characteristics are unique. With voice verification software becoming more sophisticated, an industry like banking that prioritizes security can considerably benefit. Tools nowadays not only identify spoken words, but also the tone and pitch of voice.

For cash transactions, biometric technology replaces the need to enter traditional PIN code with identity verification such as facial recognition, fingerprints or iris scanning. This removes the concern of someone stealing your debit card and using it to take out your money from your account. With biometric enabled card procedure, customers will be required to verify their identity before they can cash out the money.

Benefits of Biometrics in Banking

To ascertain highest level of security, banks are now transitioning towards biometric technology. It offers numerous advantages to the financial institutions as well as consumers such as:

• no multi-factor authentication needed
• no PINs and passwords needed
• low operational costs
• inability of hackers to exploit information attained through a data breach

The last point is of utmost significance. This means that even if cyber criminals succeed in getting your credentials, they cannot use the information to their advantage. Customers also don’t have to recall multiple passwords and can authenticate themselves with only one biometric authenticator.

Behavioral Biometrics

This is a relatively new area which requires machine learning and big data for analyzing a mix of behavioral patterns of an individual to create unique profile for them. These patterns include anything from how a person uses their mouse to how the keystrokes are made on the keypad. The profile also includes location and IP addresses.

Handling Biometrics Data: Avoiding Potential Limitations

Biometrics data is personal to every individual’s identity. When we talk about security, there is absolutely no room for error in keeping the data secure, or protecting it from getting compromised. Passwords and PIN can be changed, but your personal characteristics cannot.

Another important aspect to consider is false negatives. If a system fails to recognize an actual biometric which the customer has no power to change, it will result in a mistrust in the technology and lead to disgruntled customers. Hence, once a bank’s system completely relies on biometrics, it must be sophisticated enough to correctly recognize an identifier every time.

Similarly, false positives are also a possibility. This can be avoided by including “liveness” factor. It’s better if the system sees your face through a live camera or authenticates your voice with different sentences instead of scripted lines.

Conclusion

Biometrics is an innovative technology that is rapidly changing the way we manage banking. Over the next few years, it will be interesting to find out how it develops and adapts to the expectations of customers so that it is easily accepted and implemented by both banks and its users.