What do you read when you read the following:
“BEC groups launch executive impersonation attacks in at least 13 languages”
Specifically this is interesting:
“These attacks demonstrate that BEC is a global issue and not just an English-only phenomenon,” said Crane Hassold, director of threat intelligence at Abnormal Security. “Our findings also show how cybercriminals are always looking to exploit various tools, such as Google Translate, to expand their potential victim population. This is why it’s so important for organizations to protect themselves with inbound defenses that look at potential threats holistically and leverage behavioral analytics to protect employees against these more dynamic, sophisticated threats.”
Criminal hackers have always used tools that we use to attack all the people that they can.
This new phenomenon opens non- English speaking areas or people. This means that if you know another language expect to see spam and phishing attacks in that language not just English as before.
In effect one must always be on lookout for phishing attacks no matter where one is.
We have to take a hold of the new PCI 4.0 and make this aspect our own:
Promote security as a continuous process.
Why it is important: Criminals never sleep. Ongoing security is crucial to
protect payment data.
Examples:
• Clearly assigned roles and responsibilities for each requirement.
• Added guidance to help people better understand how to implement and
maintain security.
Image and info from PCI DSS v4.0 at a glance doc
It is important to create and embed a continuous process inside your company. And get used to the aspect of computer security – “Criminals Never Sleep”
How do we know that? you are on the Internet… so we are connected to the globe on which someone has daylight at all times. Thus a criminal never sleeps.
Once we truly understand that then we can create processes and go on from there.
How do we create processes to set up a security policy?
Find the template to get started and go from there. where would one go to get started with the security policy? My book gets you started on a policy by using the PCI v3.2.1 standard.
Or peruse the SANS website where one can look at 6 different categories of security policies:
1. Application Security
2. General
3. Server Security
4. network Security
5, Incident Handling
6. Retired
Contact us to discuss