COVID-19 Cyber Crime & Fraud: Most Common Threats

Sensitive Data Exposure: Any sensitive data must remain confidential.

Encourage:
• Employees to use an up-to-date browser.
• Configure servers to choose the best encryption methods for communicating with end users.
• Categorise company data based on sensitivity so that the appropriate security controls can be applied and employees limit the risk of exposure.

Insecure References: A URL link: www.emsou.com/cyber&fraud/finance/robertsmith can expose information about how internal systems and apps work, giving hackers access to them without going through proper authorisation procedures.

• Test applications for insecure references.
• Ensure every user must go through authentication and authorisation.

Broken Access Control: Is about checking the permissions a user has when they login. An online medical system should not let a student nurse change a patient’s medication, but a doctor will need these permissions.

Make sure that:
• The site checks the user is authorised to access each and every web function.
• Systems are configured to deny access by default.
• Permissions granted to different user groups are regularly audited.

Security Misconfigurations: When web apps and systems are not securely configured or maintained. For example, leaving a default account on the server, which is exploitable:

• Use vendor guidelines when hardening hardware and software.
• Have systems in place to ensure baseline compliance and the prevention of unauthorised changes.

Cross Site Scripting (XSS): A hacker will plant malicious code on a website which runs on the browser of a site visitor. The attacker can then hijack the connection, steal credentials and data and install malware.

Mitigation involves:
• Turning code into text when a web page is submitted (‘escaping’).
• Limiting the amount of text that can be entered on a site and use drop downs.
• Adding a security policy in the web page that prevents the running of ‘foreign’ scripts.

Insecure Deserialization: When files are sent over the internet, they are usually translated into a format that can be moved more easily. Once the file reaches its destination, it is translated back into its original form. In one recent example, an attacker corrupted this process by inserting crypto mining software, earning $3 million.

It is advisable to:
• Encrypt the translated data which makes tampering harder
• Use a Web Application Firewall to check packages
• Ensure that the system which translate data cannot run a dangerous payload
• Translate data only if it is ‘digitally signed’. This verifies that the package comes from
a trusted source and has not been tampered with.