Are you safeguarded against Ransomware?

Encryption for security

On Friday May 12, 2017 saw one of the largest global Ransomware attacks in the internet history. In two days, the attack had left over 125,000 computers across 104 countries useless. Public utilities in Spain and England’s National Health Services (NHS) had to shut down operations. Ransomware, is often transmitted by email or web pop-ups, involves locking up people’s data and threatening to destroy it if a ransom is not paid. As a classic Ransomware tactic, affected computers were asked to pay $3000 in bitcoin to the culprit strain known as WannaCry. Its majestic scale was eclipsed by poor execution and low ransom fees — certain signs of an amateurish attack.

According to Kaspersky Labs, the WannaCry, Ransomware is based on a vulnerability that was identified in the Windows Server Message Block protocol and was patched in Microsoft’s March 2017 Patch Tuesday security updates. “On May 12, 2017 we detected a new Ransomware that spreads like a worm by leveraging vulnerabilities that have been previously fixed,” Microsoft’s summary of the attack began. “While security updates are automatically applied in most computers, some users and enterprises may delay deployment of patches. Unfortunately, the malware, known as WannaCrypt, appears to have affected computers that have not applied the patch for these vulnerabilities. While the attack is unfolding, we remind users to install MS17-010 if they have not already done so.”

Vulnerabilities exploited by the Attack
This attack not only impacted computers and businesses but also impacted innocent patients who were kept waiting before receiving care. A lot of organizations are responsible for this attack. Security experts believe the malware may have initially asked people to download it through email in the form of a phishing attack. After that, the malicious code traveled to a broader network of computers that were linked together through the Windows file-sharing system. Organizations across the globe take a lot of efforts to stop phishing however most took the “bait” in this case. Another aspect that helped WannaCry conduct the attack successfully was users’ complete neglect towards updating the OS. There are still millions of computers using Windows XP, and without custom support, they’re all vulnerable — not just to this latest Ransomware, but to dozens of other vulnerabilities unearthed in the last three years. The vulnerability targeted last week doesn’t exist in systems released since Windows 8 (which introduced SMBv3), so the main targets were Windows 7 and Windows XP. Windows 7 users are still receiving patches, but XP has been unsupported since April 2014.  As organizations handling tons of information, we must understand and accept that the most crippling wars of the future will be in cyberspace, with no bloodletting. To stay prepared, we must build robust counter-intelligence, including a highly capable cyber-expert who is proactive rather than reactive.

Preventing Cyber-attacks
Organizations need to play smart to prevent Ransomware attacks. While it is important to have firewalls and staff trainings around cyber-security, it is equally important to have the most updated software and the right hardware installation. Most computers impacted by WannaCry were on Windows XP that was stopped way back in 2008, and organizations like the NHS had time till 2014 to switch over. However, most of the networks hit on Friday had complex embedded systems that could barely survive a patch.

Installing antivirus software and being wary of suspicious emails or pop-ups is a comprehensive strategy against Ransomware attacks and should be a part of your business security plan. Creating regular back-ups of your data will go a long way in your preparedness to tackling cyber-attacks.
We hope WannaCry makes people more aware of the loopholes that exist in their systems.

For any requirements of SSL certificates kindly visit HTTPS.IN

How to Choose the best SSL Certificate provider

Technology has changed the retail landscape forever and is redefining e-Commerce every day. Many customers are still skeptical about exchanging their financial details online fearing information security. To win them over, organizations need to get an SSL certificate and migrate from HTTP to HTTPS. Since 2017, Chrome has already started tagging HTTPS websites as “secure” for exchanging financial information. A “secure” tag can certainly win consumer trust, translating to better customer conversion opportunities and better revenues for which the organisation must identify the best SSL Certificate provider.

Before organizations migrate their website from HTTP to HTTPS, they have they need to identify what needs to be validated, and from who to buy the validation certificate. There are three types of validations available that help in identifying what needs to be validated however, there are a lot of SSL certificate vendors in the market and the problem is how to Choose the best SSL Certificate provider.
Domain Validation: Domain Validation, or DV is the lowest level of validation and the SSL certification is given only for the domain name. The Certification Authority (CA) will only check if the website domain is authentic and the rights to use it are with the applicant only. These certifications need not have the ownership information displayed in them. There are minimal checks by the CA here and thus has the highest vulnerability to phishing attacks.
Organization Validation (OV): Also known as Business Validation or high-assurance certification, the OV involves a physical investigation by the CA to ascertain the authentication of domain and the organization. An OV certification holds the organization name.
Extended Validation: Extended Validation (EV) is the highest form of authentication. EV certificates follow the highest standards for identity assurance to establish the legitimacy of online entities; this includes rigorous and meticulous documentation checks. The process involves physical investigation and thus may take longer for the certification to be awarded.
How to Choose the right SSL Certificate provider:
After you have identified the level of certification needed, you need to choose the certification authority to buy the SSL from. The number of SSL vendors available in the market may confuse you.Buying Cheap SSL Certificate may Cost You More! Here are some pointers that may help you identify the right partner:

• CA reputation: SSL validation is essentially a product and the CA is a vendor. The service provided and the security guarantee is of prime importance. Accessing the CA’s reputation in the market will help you decide better.
• Customer Service: Getting your SSL validation and migrating from HTTP to HTTPS can be tricky. A CA with a strong Customer service offering should be a deciding criteria as a real human can help you tide over all your issues and answer all your questions.
• Issuance Speed: The issuance speed majorly dependent on the type of validation and also depends on the CA. OV and EV validations involve physical while selecting a CA, it is best to understand how fast they can complete the validations.
• Warranty: The CA warranty affects the user, the amount of warranty basically assures the customers of the seriousness a website has about their personal information. Considering the amount a CA offers as warranty should be one of the evaluation criteria.
• Certification Validity: Generally an SSL certificate is valid for a year, however there are CA’s in the market that offer validation for multiple years. This saves you the trouble of revalidation every year.
• Security Seals: Many CA’s provide a site seal to websites that have their certification. These seals are a feel good factor for the customers. You may decide to either show the seal or to hide it in the website.

To asses and evaluate the right validation required for the website and decide how to choose the right best SSL Certificate provider and to get technical support visit www.https.in .