Cyber Defense eMagazine October Edition for 2021

More documents

Recommendations

Info

Being Mindful of Communication Security The potential risks of communication APIs and CPaaS and secure vendor selection criteria. By James Ryan, Director of Information Security, BISO, IntelePeer The pandemic accelerated the demand for various things, from vaccines to virtual telecommunications platforms. Cloud services also rose in use to enrich customer communication channels, from Software as a Service (SaaS) and Infrastructure as a Service (IaaS) to Platform as a Service (PaaS) and Communication Platform as a Service (CPaaS) seeing considerable growth. In 2017, Frost and Sullivan's researchers found that of 1,695 companies, 81% had already deployed CPaaS, and that number has only increased since the pandemic. Nevertheless, this shift to a cloud-based infrastructure introduced a new attack surface, opening fresh cyber threats to businesses. As part of an organizational security effort, enterprises must select the most secure and reliable providers within the CPaaS space. Cyber Defense eMagazine – October 2021 Edition 64 Copyright © 2021, Cyber Defense Magazine. All rights reserved worldwide.
What data security risks do communication APIs and CPaaS create? The integration of CPaaS services and Application programming interfaces (APIs), often used by CPaaS providers to deliver added value, can be infiltrated by sophisticated attackers to modify content during transmission. Sometimes, open APIs leave data exposed, making them vulnerable to attacks such as unwanted access to API infrastructure resulting in potential data leakage. A famous example of a data leak was when Facebook's API got exploited, compromising users' information. Although most enterprises won’t have the same level of open API access that caused the Facebook data breach – the same principles apply. With API abuse, a bad actor, having obtained stolen credentials, can, depending on the level of access, manipulate a company’s budget, steal personal information, and even lock an enterprise out of its own API and CPaaS systems. Similarly, unsecured code can jeopardize a business, leaving it susceptible to further data security risk. Besides the loss of revenue and productivity often associated with data breaches and network downtime, the erosion of customer trust is perhaps the most long-term consequence of a data breach due to compromised APIs and CPaaS solutions. Having secure communication, and by extension, a secure CPaaS provider is an essential business requirement. Any organization that communicates with its customers, employees and suppliers and collaborates with devices must prioritize the devolvement of a security strategy. Selecting a safe and secure CPaaS Vendor When selecting a CPaaS vendor, they must prove their commitment to security – it cannot be an afterthought. Some initial checklist investigations include examining the vendor’s certifications and the maturity of those certifications. Note, some vendors perform self-certification processes to fluff up their resumes. By confirming the level of encryption that the CPaaS provider offers, companies can make a more accurate judgment of the vendor’s security capabilities. Enterprises should also understand what processes and tools CPaaS vendors use to keep communications safe. Likewise, it’s helpful to send a thorough questionnaire to several vendors to rate their security prioritization. Having multiple choices, complete with notes and ratings, will provide an organization’s IT team with a more holistic view of their options. Beyond these preliminary inquiries, other best security practices for selecting an apt CPaaS vendor involve consistently calculating the risk verse benefit. Given that every company will at one point in time experience an unexpected circumstance after implementation, it’s always suitable to complete a risk/benefit assessment. After companies have selected a CPaaS vendor and the implementation process is complete, organizations must focus their attention on endpoint management (laptops, mobile phones, and PCs) as it is necessary to protect the cloud network and customer data. An ideal CPaaS partner will have available teams ready to assist customers with issues or projects that might arise or direct the client's attention to necessary system changes and patches. Such updates could include replacing a cipher suite or an algorithm for a certain circuit; it is helpful for organizations themselves to be up-to-date on CPaaS standards. Cyber Defense eMagazine – October 2021 Edition 65 Copyright © 2021, Cyber Defense Magazine. All rights reserved worldwide.
Page 1 and 2:
The Top 6 Cyber Attacks Of 2021 So
Page 3 and 4:
Protecting SMBs from Current Cybers
Page 5 and 6:
@CYBERDEFENSEMAG CYBER DEFENSE eMAG
Page 7 and 8:
Cyber Defense eMagazine - October 2
Page 9 and 10:
Page 11 and 12:
Page 13 and 14: Cyber Defense eMagazine - October 2
Page 35 and 36: #2 Florida’s water system A hacke
Page 37 and 38: Raise Cyber Security Awareness: Whe
Page 39 and 40: Source Code Protection Market Do we
Page 41 and 42: of script administration, no backup
Page 43 and 44: to steal “the keys to the kingdom
Page 45 and 46: Part 1 - Using a Proxy Server - BUR
Page 47 and 48: Below we have an example of interce
Page 49 and 50: Having the device UUID and being co
Page 51 and 52: In the second part, we demonstrate
Page 53 and 54: Currently, we are bound to use tech
Page 55 and 56: You can be a hacker too! Remember,
Page 57 and 58: The Brutal Reality of Brute Force A
Page 59 and 60: Multi-factor authentication is one
Page 61 and 62: Why outdated software poses cyberse
Page 63: About the Author Roman Davydov is a
Page 67 and 68: Is the Edge Really Secure? By Cheta
Page 69 and 70: Or, let’s spend some time discuss
Page 71 and 72: accessible. Different agencies have
Page 73 and 74: Making Sure the Lights Don’t Go O
Page 75 and 76: Gösgen’s IT Security Officer, Fr
Page 77 and 78: MFA works a few different ways, but
Page 79 and 80: Get Ahead of the Game: Packet Captu
Page 81 and 82: investigations and the ability to t
Page 83 and 84: Thousands of Fortinet VPN Account C
Page 85 and 86: and operating costs. FIDO2 is the s
Page 87 and 88: As ports have been steadily ramping
Page 89 and 90: About the Author Working at the int
Page 91 and 92: Today’s Threat Landscape The 2021
Page 93 and 94: Thwarting Today’s Phishing Attack
Page 95 and 96: Security is Everyone’s Job Employ
Page 97 and 98: CapitalOne data breach occurred as
Page 99 and 100: About eSentire eSentire Inc., is th
Page 101 and 102: Complying with regulations Security
Page 103: Cyber Defense eMagazine - October 2
Page 115 and 116:
Free Monthly Cyber Defense eMagazin
Page 117 and 118:
show all

Cyber Defense eMagazine October Edition for 2021

Create successful ePaper yourself

Delete template?

Save as template?