Input: Search Free Trial Get Demo Day April 13, 2017 Its Baaack! Dridex Targets UK With a New Set of Guns April 13, 2017 In the midst of the recent revival of Dridex, the notorious family of banking trojans, a Dridex attack scheme targeted at stealing UK users online banking credentials was detected this week and is being blocked by Cyrens security cloud. This new attack is initiated by an email PDF attachment claiming Company Partners Resources Investor Relations Products Freeware Demo Solutions Contact Us Privacy Management Service by Data443

Output: product_security_features,end_user_security,threat_prevention,incident_response


Input: Search Free Trial Get Demo Is Monday the Worst Day of the Weekfor Security? April 27, 2017 The IT manager responsible for information security at an enterprise account  lets call him Steve  recently shared an interesting story. In general, he felt that they handle security pretty well, but he detailed one challenge that they havent yet been able to solve  users roaming outside the office security perimeter. As is typical of many businesses today, this company supplies its knowledge workers with laptop computers. Previously they used desktops, but the company found that using laptops rather evidently enables employees to work when theyre out of the office, and not just in it. In the case of the company in question, this means that around 40 of their 1,200 employees now use notebook computers outside the office. From a business perspective, this change enabled the company to increase customer satisfaction, because employees are now more responsive to customer needs regardless of time or location, in addition to increasing productivity, as many employees now work in the evening and on weekends. But from the perspective of the information security team, the change has not gone so well. To explain why, Steve walked me through an average Monday morning under the new model. The most marked event every Monday morning for Steve and his security colleagues is that as employees arrive at the office and start connecting to the network, security alerts begin to come in at a rapid rate It turns out that while their employee laptops have a standard build that includes endpoint security, once users leave the office, they also leave the protection of the companys on-premise Web security solution and venture onto the Internet largely unprotected. In the office, an on-premises Web security gateway inspects traffic and blocks many transactions, covering up for user bad behavior or inadvertent misfortune. While this is good news, it can also create a learned behavior in users, that it is okay to click on almost any link you wish, as the Web security tool will ensure that you will not come to any harm. This is where the problem starts. Over the course of the weekend, employees connect to the Internet  often through public WiFi networks, many of which are unsecured  and surf the Web at will. While sites that users visit in their normal browsing habits may not harbor threats, the fact that they are outside the corporate perimeter and without the filter of corporate gateway security policies can lead them to connect to sites containing inappropriate and potentially malicious content or exposed when possibly clicking on links contained in phishing emails. In most cases, endpoint security tools are ineffective in detecting and blocking such threats, because their threat definitions are updated on a periodic basis rather than in real-time. With Web security effectively turned off, the user is unprotected or is at a minimum operating with a far lesser degree of protection, but they do not necessarily realize this. As a result, when they connect to risky web sites or click on links in emails, they can easily fall prey to cyber threats such as drive-by malware, phishing schemes, and new exploits. Once this happens, the device can be easily compromised, with valuable data either being exfiltrated directly from the machine, or installed malware being programmed to lie dormant until the device is connected to the corporate network so that it can begin work then. This brings us back to where the story began, with Steves incident management system filling with alerts on Monday mornings. While its labor-intensive to rebuild the affected machines, and users are unproductive while this happens, that is not the worst of the problem. Steve is more worried about the compromised machines that he hasnt yet found The bottom line In todays business and technology environment, where users connect to resources inside and outside the traditional network perimeter  from whereever they are and however they can manage to connect  information security must follow the user, to provide a clean network connection at all times. Anything else is a recipe for a bad case of the Monday Morning Blues. We recommend you do a quick 30-second test of your Web security when both in your office and when roaming outside of your office, and compare the results. Try it for Free Instant Data Classification Cyren URL Category Chacker Prev Its Baaack! Dridex Targets UK With a New Set of Guns Infosec Island When Is Apple.com Not Apple.com? Next Company Partners Resources Investor Relations Products Freeware Demo Solutions Contact Us Privacy Management Service by Data443

Output: product_security_features,end_user_security,threat_prevention,security_best_practices,data_protection,incident_response


Input: Search Free Trial Get Demo Day June 5, 2017 New Cyren Threat Report Ransomware June 5, 2017 Cyren has just released a new, revised special threat report on ransomware, which provides context and depth to the many ransomware-related headlines weve been bombarded with lately. 2016 was truly the Year of Ransomware  or, given recent events, will 2017 surpass it? Get Up to Speed This report provides Company Partners Resources Investor Relations Products Freeware Demo Solutions Contact Us Privacy Management Service by Data443

Output: threat_prevention,security_best_practices,technical_documentation


Input: Search Free Trial Get Demo Day May 2, 2017 Infosec Island When Is Apple.com Not Apple.com? May 2, 2017 To get up to speed on the latest technique used by phishing site operators to present legitimate-but-fake ! web sites, check out Cyren security researcher Magni Sigurdssons column in Infosec Island, which details how cybercriminals are exploiting a browser capability for representing non-Latin characters to make users think they really Company Partners Resources Investor Relations Products Freeware Demo Solutions Contact Us Privacy Management Service by Data443

Output: threat_prevention


Input: Search Free Trial Get Demo Day June 7, 2017 Malware  HTTPS The Rising Trend in Malware Delivery June 7, 2017 While over half of global web traffic is now encrypted, the real extent to which malware is being hidden in HTTPS has been an open questionuntil now. HTTPS is the standard protocol used for secure communication over computer networks. It works by encrypting traffic in between browsers and a website, Company Partners Resources Investor Relations Products Freeware Demo Solutions Contact Us Privacy Management Service by Data443

Output: threat_prevention,data_protection,security_best_practices,technical_documentation


Input: Search Free Trial Get Demo Its Baaack! Dridex Targets UK With a New Set of Guns April 13, 2017 In the midst of the recent revival of Dridex, the notorious family of banking trojans, a Dridex attack scheme targeted at stealing UK users online banking credentials was detected this week and is being blocked by Cyrens security cloud. This new attack is initiated by an email PDF attachment claiming to be a confirmation letter or scanned document, then proceeds as shown below by our step-by-step security lab analysis. This is a different tack from the most common recent reports of Dridex attacking Windows users through spam campaigns with attached RTF documents with a .doc or .zip extension, which exploit a zero-day phishing vulnerability in Microsoft Word identified as CVE-2017-0199. Upon opening the PDF, which Cyren detects as JSDridLdr.A!Eldorado, the user is prompted with a notification that an embedded file is to be automatically opened. The embedded document is automatically opened through a PDF OpenAction event using the following PDF javascript code. uk_confirmation_ph975721850.pdf --- PDF Object 12 ---  TypeCatalogPages 8 0 RNames 11 0 ROpenAction  SJavaScriptJS 5 0 R   --- PDF Object 5 --- var a43ifa10023alerta2 this.exportDataObject cName 20170406824631.docm, nLaunch 2  Scan_776850.pdf --- PDF Object 11 ---  TypeCatalogPages 7 0 RNames 10 0 ROpenAction  SJavaScriptJS var a11ifa50alerta this.exportDataObject cName ScanData309093.docm, nLaunch 2    The exportDataObject function takes two parameters, cName and nLaunch. cName specifies the file attachment to be exported from the PDF and nLaunch, with a value of 2, directs the reader to save the attachment to a temporary file and ask the operating system to open it. In this case, an OpenXML-formatted macro-enabled document .DOCM is opened by Windows with Microsoft Word. The exported document is detected by Cyren as PP97MDownldr.gen. By default, Microsoft Word disables the automatic execution of VBA macros and will prompt the user with a notification similar to the snapshot below. Once the user enables the content, the VBA macro code is automatically executed with the use of the AutoOpen method. Similar to a few variants of macro-based malware, this variant stores a few of its needed strings in user form controls to evade analysis from known tools and scanners. The code attempts to download an encrypted executable from one of the listed URLs in its code medredacted.comkjv783r outofredacted.orgkjv783r jenya.redacted.comkjv783r sseleman.redacted.com874hv americasphotostudio.redacted.net874hv majestic-redacted.com874hv The downloaded data is decrypted using XOR operations with a 32-byte key hard-coded in the VBA code, saved in the Windows temporary directory using the filename redchip.exe and executed through the Shell.Application.Open method. The decrypted executable is detected by Cyren as W32Dridex.KJ.gen!Eldorado and confirmed to employ the new code injection known as AtomBombing. Researchers from IBM X-Force has published a detailed report on how Dridex exploits AtomBombing to inject its code into selected system processes to attain persistence and evade detection. Once it has found a target process to inject into, it gathers the following system information Computer name User name Operating system install date The gathered information is concatenated together with a 2-byte seed using the following format ComputerNameUserName00InstallDate2-byte seed Dridex generates the MD5 Hash from this built string, then converts it into GUID string format as shown below. 0012F44C 00C28AE0 ASCII 89bd3ac962a1ebc0e9112f6111f0f5eb 0012EEBC 7FFDFC00 UNICODE 89bd3ac9-62a1-ebc0-e911-2f6111f0f5eb This GUID is then used for the checking and creation of mutex names, event names and probably keys. Try it for Free Instant Data Classification Cyren URL Category Chacker Prev Point, Click and Hack  Phishers Try Wix Is Monday the Worst Day of the Weekfor Security? Next Company Partners Resources Investor Relations Products Freeware Demo Solutions Contact Us Privacy Management Service by Data443

Output: product_security_features,end_user_security,data_protection,threat_prevention,technical_documentation


Input: Search Free Trial Get Demo Students Targeted by Test Prep SEO Attack April 4, 2017 College entrance exams are anxiety inducing for many students, now made all the more stressful by the discovery by Cyren researchers of malware targeting students seeking an exam reviewer or test preparation service. A recent search for college entrance exam reviewer pdf led to an SEO search engine optimization attack based on these keywords. An SEO attack is designed to attract searchers to the destination webpage containing downloadable or drive-by malware. The malicious webpage is constructed to include the necessary keyword combinations, so that the search engine will rank the page high in search results, increasing the probability that searchers will follow the link. The screens below show two search engines ranking the malicious page high in the search results. Clicking the highlighted search result above will lead to a page like this Clicking the short URL above hxxpshorl.comvivufretrasuste will lead to the download of a RAR archive file named college_entrance_exam_reviewer_with_answer_pdf_dow.rar as seen below The Rar file college_entrance_exam_reviewer_with_answer_pdf_dow.rar contains the file college_entrance_exam_reviewer_with_answer_pdf_dow.exe that shows a compressed archive icon. We detect this as W32FusionCoreDownldr.A.gen!Eldorado. Upon execution of the file college_entrance_exam_reviewer_with_answer_pdf_dow.exe the user is shown the following initialization window while downloading and then loading file window following download below It uses User-Agent  Christmas Mystery and communicates to the server 52.174.48.249 as shown in the code snippet below in order to download a uTorrent program bundled with adware We detect this as W32FusionCoreInstall.A.gen!Eldorado . Upon executing the uTorrent installer bundled with adware, it shows the following step-by-step Windows installation. As a rule of thumb, What You See Isnt Necessarily What You Get . FusionCore poses a security risk to computers. It is an installer which bundles legitimate applications that contain adware, installs toolbars, installs third party applications, or has another unclear purpose. Third party applications are typically installed by default, but users have an option to opt-out of the add-on during or after the installation process. Based on the URL redirection of the short URL hxxpshorl.comvivufretrasuste as seen in the snapshot below. The IP addresses 78.140.165.5 download-performance.com and 88.85.69.163 nottoke.com belongs to AS35415 Webzilla B.V.. We recommend blocking the IP addresses 78.140.165.5 download-performance.com and 88.85.69.163 nottoke.com if you are not already protected by a robust web security service. Try it for Free Instant Data Classification Cyren URL Category Chacker Prev Cyren Unified Internet Security Goes Live Point, Click and Hack  Phishers Try Wix Next Company Partners Resources Investor Relations Products Freeware Demo Solutions Contact Us Privacy Management Service by Data443

Output: threat_prevention,incident_response


Input: Search Free Trial Get Demo Day May 24, 2017 CEO and Chairman of Cyren Shares Insight On The Evolving Security Market May 24, 2017 Lior Samuelson, Cyren CEO and Chairman, has been around technology and businesses for many years, but he is particularly passionate about making the Internet a safer place for users  especially those who seek better security and those on the move with their mobile devices. In this dont want to Company Partners Resources Investor Relations Products Freeware Demo Solutions Contact Us Privacy Management Service by Data443

Output: end_user_security,privacy_policy


Input: Search Free Trial Get Demo Day April 4, 2017 Students Targeted by Test Prep SEO Attack April 4, 2017 College entrance exams are anxiety inducing for many students, now made all the more stressful by the discovery by Cyren researchers of malware targeting students seeking an exam reviewer or test preparation service. A recent search for college entrance exam reviewer pdf led to an SEO search engine optimization attack Company Partners Resources Investor Relations Products Freeware Demo Solutions Contact Us Privacy Management Service by Data443

Output: threat_prevention,incident_response


Input: Search Free Trial Get Demo New Phishing Wave Targets Online Banking and Digital Payment Customers February 15, 2017 Cyren researchers are seeing a new phishing technique targeting online banking users from Wells Fargo, Chase and Capital One, along with digital payment customers from Paypal and Venmo, among others. This new wave of phishing attacks builds on previously known techniques. Phishing email attachments , for example, rely relying on email recipients clicking on HTML attachments to exploit a weakness in many email security systems , but with the additional twist that data URIs are being hidden in the HTML attachments, according to Cyren threat research analysts. In January, WordFence reported use of data URIs for effective phishing attacks against Gmail users. Now, Cyren is seeing that technique newly combined with HTML attachments, an old phishing favorite. Has Reached 50 of Phishing Attacks in One Month The new attack technique has taken root quickly in February, driving up the use of HTML or HTM attachments to nearly 50 of all recent phishing attacks seen recently by Cyren. These attacks are proving effective at evading detection by many email security systems, which typically allow HTML attachments, or are not capable of scanning their content, and therefore do not detect the telltale datatext URI header  as opposed to .exe attachments, which are commonly blocked. URI-based phishing attacks  How they work The Uniform Resource Identifier URI is a string of characters which is opened in the browser URLsearch bar, and essentially includes all the data needed for a phishing page, including images. URLs are a subset of URIs Uniform Resource Identifier and only specify the location of a specific network resource and how it should be accessed. The idea of using data URIs for attacks is not new as far back as 2007 researchers Billy Rios and Nathan McFeters used the concept for attacks against Microsoft Internet Explorer 6 and 7. In 2012 Henning Klevjer, an information security student at the University of Oslo in Norway, published a research paper suggesting the use of URIs for phishing attacks. Attacks in the past month have introduced three new features designed to make the phishing attack more effective 1 The delivery method  disguising the URI link as PDF file icon. 2 including phony URL text at the start of the URI. For example  3 Adding spaces after the URL to force the script part of the URI out of view on the URLsearch bar Now Cyren security analysts are seeing these new methods further enhanced by embedding the URI in an HTML file attachment. For example, in the PayPal phishing email shown below, the recipient is directed to download the attached HTML form and to fill in the required fields. The content of the HTML attachment is very similar to a version used to target Venmo users. The file mostly contains the URI with some HTML headers added on. Note the datatext field in the HTML below which starts the URI. There are several advantages of this approach for the phishers Many email security systems allow HTML attachments  as opposed to .exe attachments which are blocked Very few email security systems actually scan the content of an HTML attachment and would therefore not detect the telltale datatext URI header If the datatext URI header was in the body of the email as opposed to the attachment it might be detected, as more vendors have added detection for this potential threat The email body contains no URLs that can be detected as phishing links Once the user opens the attachment, the URI phishing page opens locally on the user PC. Communication POST of the phished credentials only happens once the user clicks on submit. The actual destination URL that the stolen credentials are sent to is obfuscated in the JavaScript code of the URI. This also prevents blocking of the email attachment in cases where this phishing URL is known. Encrypted HTML POST phishing attack A second version of the HTML attachment attack method uses a full HTML page of the target brand as opposed to the URI technique described above. In this example a phishing email to a Chase customer requires recipients to open the HTML attachment for more info. As above, the advantage of HTML attachments is that the phishing page is loaded locally in the browser and therefore URL filtering solutions cannot detect any network activity. The key to detecting and stopping this type of phishing attack is the POST of the phished credentials that takes place once the victim has filled in the Web form. However, a review of the HTML shows that the POST command and destination URL are encrypted. This prevents email security platforms from scanning the HTML attachment to detect the phishing URL. Short Video Illustrates Phishing Attack and Blocking In the video below, we show how Cyren has decrypted the POST command and URL, and how Cyren WebSecurity uses this data to protect a user who is trying to submit the phishing page. Try it for Free Instant Data Classification Cyren URL Category Chacker Prev New Cerber Ransomware-as-a-Service Causing Fresh Outbreaks French Ministry Survey Delivers Macro Backdoor Next Company Partners Resources Investor Relations Products Freeware Demo Solutions Contact Us Privacy Management Service by Data443

Output: threat_prevention,product_security_features,security_best_practices


Input: Search Free Trial Get Demo Point, Click and Hack  Phishers Try Wix April 7, 2017 Wix allows anyone to create a free website with simple point, click and drag formatting. Of course, anyone can include phishers and malware distributors, and we at the Cyren Security Lab discovered earlier this week just such abuse of a Wix page targeted at Office 365 users, the subject of this article in InfoWorld . Once we notified Wix, they immediately removed the page, but its a critical reminder that a no trust philosophy is paramount when it comes to web security, even and especially when accessing a brand you trust, like Wix. The advantages for the phisher of using Wix are Free hosting of the phishing page Because the domain is very popular, it isnt blocked by many URL filtering and web security products The phishing site, which targeted Office 365 users, was very simple and did not use phishing-related terms  we believe based on the assumption that Wix would scan for these and take down the site. As shown above, the phishing site consisted of a screenshot of an Office 365 login page with login fields overlaid on the screenshot. There is, therefore, no text on the page relating to Microsoft or Office 365  its all image-based. Also the password field is actually spelled with two vs, as in pass vv ord. The separation of the image and the fillable phishing fields is clearly shown when accessed on a mobile device Cyren Web Security and URL filtering users are protected from this and similar threats. Evidently web platform services providers need to be vigilant and constantly review opportunities to enhance security for their customers and those customers users. Try it for Free Instant Data Classification Cyren URL Category Chacker Prev Students Targeted by Test Prep SEO Attack Its Baaack! Dridex Targets UK With a New Set of Guns Next Company Partners Resources Investor Relations Products Freeware Demo Solutions Contact Us Privacy Management Service by Data443

Output: end_user_security,product_security_features,security_best_practices,threat_prevention,technical_documentation


Input: Search Free Trial Get Demo Day April 7, 2017 Point, Click and Hack  Phishers Try Wix April 7, 2017 Wix allows anyone to create a free website with simple point, click and drag formatting. Of course, anyone can include phishers and malware distributors, and we at the Cyren Security Lab discovered earlier this week just such abuse of a Wix page targeted at Office 365 users, the subject of Company Partners Resources Investor Relations Products Freeware Demo Solutions Contact Us Privacy Management Service by Data443

Output: end_user_security,threat_prevention


Input: Search Free Trial Get Demo Engaging the Stakeholders of ECM February 23, 2017 Engaging the Stakeholders of ECM Engaging the Stakeholders of ECM In todays Digital Age, data and information are an organizations lifeblood What are the 3Q revenues from our best-selling product? How many workers under age 30 do we employ? How many software licenses in our IT enterprise are set to expire this year? The answers to these questions cross all business lines and exist in an organizations data environment. The key translating this data into actionable information. Essentially, information is data presented at the right time, to the right people to make informed decisions to resolve specific issues. No matter what business we are in, our decisions depend on information based on accurate, timely, and relevant data. If you and your team spend more time searching for data than you do thinking about solutions, then perhaps you need a new data strategy. Here are factors to consider for success 1 Every Department Matters Data affects every portion of your organization. This is not just the IT teams issue its a whole of business issue. Every group, team, and department produces data, and every one of them needs it for decision making. Successful information governance IG and ECM implementations require buy-in from usersnot just corporate leadership. If possible, identify key leaders and employees in each department, and include those people in your planning meetings. Ask for input on how their teams access and useand wish they could access and usedata in their work. Are there files a group needs to archive but rarely uses? Is a department struggling with multiple copies and levels of security? Do they need to track who and when files are accessed? As you detail the requirements and timeline for ECM migration, incorporate the input from stakeholders and include them in testing and implementation. 2 Lead Up Depending on the size of an organization, the CEO may or may not speak into decisions about information governance and ECM. CEOs in smaller companies tend to engage in day-to-day operations, and conversely, CEOs of larger companies tend to leave daily operations to department heads. The key to successful ECM implementation in either scenario lies in demonstrating the return on investment that efficient IG can bring. From selecting the right software to gathering and preparing data to training users, implementing ECM requires a significant investment of time and money. How will that pay off for the company? What efficiencies will result? How will teams work better together? Is there time savings? What recurring costsor redundant processescan be reduced or eliminated? What can be streamlined? How long will it take to experience the benefits? The answers to these questions provide top managementthe CEO plus the CFO and other C-level execswith the information to not only make real-time decisions about ECM but also to gain approvals from a board of directors or investors. As you and your team choose software and develop a migration plan for ECM, make sure that part of your planning includes engaging company leadership and buy-in. The more they are in the loop, the more they will be rooting for and supporting your implementation project. 3 Start with IT . While its important to include end-users thats everyone and senior management in developing an IG strategy and ECM plan, its also essential that your teamfrom the CIO to the help desk specialistsis on board for change. ECM implementation falls squarely in the responsibilities of CIOs. Treat CIOs as you would CEOs, but share more details and backup, so they become informed supporters. You may find that your CIO becomes the best advocate for ECM as it transforms data into useful, accessible information. And, the great advocate may have a direct line to top management. According to research , 34 of CIOs report directly to the CEO, and CEOs view their IT leaders as key business partners. As the CIO continues to communicate up the ladder, make sure to engage the rest of the IT directors, managers, techs and specialists. Ask for input on how their internal clients store and use files. What will be helpful to the tech team as they serve human resources, sales, marketing, and other departments in the company? These hands-on specialists know whats happening in operations, so make full use of their experience. At the same time, keep them informed of plans and timelines because they are the first line of information for internal customers. An informed team makes for a helpful team. Regardless of your organization, you must have effective ECM to succeed in todays data-driven marketplace. FileFacets can make everyones job easier by providing everything you need to perform sophisticated content analysis and migration all in one integrated solution. We start with a scan to find all your files and then set protocols to process ROT redundant, obsolete, trivial filesresulting in clean and streamlined migration. Additionally, well provide auto classification, metadata mining and attribution as part of the migration process. FileFacets also allows you to design and test migration plans before deploying them to avoid making costly mistakes. In testing, you can solicit end-user feedback and incorporate departmental requirements into the ECM migration plan. Try it for Free Instant Data Classification Cyren URL Category Chacker Prev IAM Concept of the Week Authentication versus Authorization IAM Concept of the Week RBAC versus ABAC Next Company Partners Resources Investor Relations Products Freeware Demo Solutions Contact Us Privacy Management Service by Data443

Output: access_management


Input: Search Free Trial Get Demo Day February 27, 2017 General Availability  ClassiDocs Data Classification  Governance Platform  GDPR February 27, 2017 Well, it is finally here! After demoing 100s of times, running through our performance lab and hundreds of user surveys  we are launching the ClassiDocs Data Classification and Governance platform! A labor of love  the team is proud of the offering. We are getting amazing feedback from customers, Company Partners Resources Investor Relations Products Freeware Demo Solutions Contact Us Privacy Management Service by Data443

Output: compliance_certifications,data_protection,privacy_policy


Input: Search Free Trial Get Demo Cyren Unified Internet Security Goes Live March 27, 2017 Following on the heels of our February announcement , we are pleased to share here that Cyrens SaaS Internet security platform upgrade, Cyren Cloud Security 4.0, went live on March 26. Integrated Web and Email Security This release deepens the integration of our cloud-based enterprise security offerings  web security, email security, DNS-based security and cloud sandboxing  on a unified, globally-operated service platform. Weve enhanced our ability to exploit synergies in service delivery in new ways, and our deep platform integration in terms of threat detection and threat correlation across web, email and DNS traffic is positioned by this release to grow richer, get faster, and be even more effective. Advanced Email Protection and Shadow IT Discovery The platform upgrade also brings new service features with it. Among the highlights are Shadow IT discovery and cloud app usage reporting, incorporated into and a logical extension of the web security service and compelling new advanced threat protection capabilities for email security, most notably the full integration of our cloud-based sandboxing as an in-line layer of defense, first made available last year as part of the web security stack. Cyren Delivering SaaS Simplicity What this means to IT and security managers is that deploying and managing enterprise-grade security just got a whole lot simpler and a whole lot better at the same time. Thats the opportunity in moving security to the cloud, and what this release embodies  a step-change shift in the IT security curve in terms of speed and effectiveness. The old security model, focused on protecting the corporate network perimeter under the formerly true assumption that all relevant IT activity happened inside that perimeter, has been very obviously eroded by Internet access everywhere and the mobility of todays workforce, by the rise of SaaS business applications and movement of corporate data to the cloud, and by the changing nature of threats, which have adapted to these changes and are attacking users with new tactics to evade detection by traditional security appliances. The question is Considering the world has changed, has your approach to security changed with it? Shown above Unified threat dashboard for Cyren Web Security and Cyren Email Security Web and Email Security  More Effective Together The logic of the Cyren Cloud Security 4.0 platform, and the various services operating from it, reinforces that web surfing and email communications are overlapping domains from a security perspective. It follows that they shouldnt be managed in separate silos. Cyrens objective is clearly to help customers rationalize their approach and address their web and email security needs holistically  their Internet security needs, we might say more broadly  by giving them the possibility of managing their integrated defenses from a single administrative console, with the additional logical elements and benefits of what administering unified security services should really mean from an administrative perspective  integrated policy controls, integrated reporting, unified threat dashboards, streamlined user onboarding, etc. Try it for Free Instant Data Classification Cyren URL Category Chacker Prev Companion Ransomware  2-for-1 Malware Distribution Students Targeted by Test Prep SEO Attack Next Company Partners Resources Investor Relations Products Freeware Demo Solutions Contact Us Privacy Management Service by Data443

Output: product_security_features,threat_prevention,security_best_practices,access_management,data_protection


Input: Search Free Trial Get Demo Companion Ransomware  2-for-1 Malware Distribution March 26, 2017 As reported in February , Cerber and other ransomware groups are now offering Ransomware-as-a-Service, giving affiliatespartners a percentage of the collected ransom. In a new sort of two-for-one malware service deal, Cyren has detected variants of the Kovter click-fraud malware being distributed with companion Cerber ransomware by the Kovter malware team. Once the recipient has unknowingly activated the downloader, both pieces of malware are installed and activated. After encrypting files on the victims machine, the companion ransomware will announce its presence  and the victim will evidently now be aware of the existence of that specific malware on their computer. However, the click-fraud Kovter malware is designed to operate silently, and definitely does not announce its presence. Which leaves us to speculate as to why a malware distributor would take the chance of their malware being discovered due to the noisy companion Cerber ransomware, for which we have three not-mutually-exclusive guesses Maximize System Resources for Click-Fraud  Cerber encrypts document or image type files in the system, leaving the victim with almost nothing to work on. This might induce the victim to leave the system idle, the ideal environment for the click-fraud malware to get to work. Distract the Victim Once Kovter has been installed, it becomes file-less and is not easy to detect, since most of its components are encrypted and stored in the registry. Therefore if the victim removes Cerber and restores their files, they may inadvertently leave Kovter installed anyway. And, instead of calling attention to a second malware, the victim will focus on the ransomware and think theyve already taken care of matters. Diversify Revenue If the user pays the ransom, then the Kovter team gets earnings from the ransomware  and per the above will likely continue running a system that has Kovter installed. You Werent There Delivery Failure Notifications Moving on to the mechanics of this particular scheme, spoofed package delivery failure emails allegedly from outfits like FedEx and UPS are commonly used themes in this malware distribution, as shown below. Delivery failure notification emails Downloader Script The first thing we notice about the included attachments is that they are both ZIP file attachments named Delivery-Details.zip, aside from their size, which is coincidentally 666 bytes for both. The ZIP file contains a folder with a javascript, using the same name as the ZIP file, which Cyren heuristically detects as JSDownldr.HX2!Eldorado. Figure 1 Attachment filefolder structure Inspecting the content of Delivery-Details.js shows a really small amount of code which iterates over a list of URLs, where it tries to download and execute another set of scripts. Further research reveals the group behind these malware outbreaks are taking extra precautions and are using multiple, possibly short-lived, servers to hide their activities. Figure 2 Downloader Script Running the script in a script emulator shows the following sequence of events Figure 3 Emulation sequence of events At lines 8-12 , we can see that JSDownldr.HX2!Eldorado was able to download script payload from one of the five URLs in its list, and upon download it immediately executes the script payload using Eval . The downloaded script payload appears to be obfuscated using string concatenation, which forms another downloader script using a similar list of URLs , from where it attempts to download and execute two EXE files. These files are usually downloaded from the same server as iterated in its URL list. Figure 4 Downloaded script payload Executable Payloads The first executable, exe1.exe , yet another variant of the Cerber Ransomware, which Cyren detects as W32Cerber.MX. The ransomware searches for and encrypts files in the affected system, leaving behind ransom notes in the encrypted folders and changes the desktop wallpaper as shown in Figure 5. Figure 5 Cerber ransom note screenshots The second executable, exe2.exe , disguised as the media player WinAmp, is a variant of Kovter, a malware family known to have evolved drastically over the years. This Kovter variant is heuristically detected by Cyren as W32Kovter.T.gen!Eldorado . Figure 6 W32Kovter disguised as WinAmp Similar to the known variants of this malware, it also employs file-less persistence in the system by hiding its components in the system registry, and also taking advantage of Windows Power Shell to load and execute its core module into memory. Since Windows Power Shell is a key component in its persistence mechanism, it will first check if Windows Power Shell is installed in the system, and if not will download and silently install the legitimate Windows patch installers for this Windows component. Once the malware has put everything in place to persist in the system, it proceeds to gather system information, and it sends this out to its control server at either hxxp185.117.72.90upload.php or hxxp185.117.72.90upload2.php . It uses a configuration file, which is encrypted and stored in the malware binary RCDATA resource. This configuration file contains a lot of the information needed by Kovter to run its malicious routines, including the download and control server links used during its initial routines. Figure 7 Decrypted Kovter config file This malware collects and sends out quite a lot of system information, including the following Virtualization VirtualBox VirtualPC QEmu VMWare Sandboxing JoeBox Sunbelt CWS iDefense SysAnalyzer Monitoring Tools regmon filemon procmon Network Analysis Tools WireShark Fiddler HTTPAnalyzer Charles Anti-malware AVG Trend Micro Being an Adware Click Fraud Trojan as it is, the malware then proceeds to silently visit websites, triggering clicks on advertisements by injecting Javascript code that automatically plays document element tags, as shown in the figure below. Figure 8 Kovter adclick-fraud scripts Other References       Try it for Free Instant Data Classification Cyren URL Category Chacker Prev IT Security Survey in the UK  75 Hacked in Past Year Cyren Unified Internet Security Goes Live Next Company Partners Resources Investor Relations Products Freeware Demo Solutions Contact Us Privacy Management Service by Data443

Output: data_protection,threat_prevention,technical_documentation


Input: Search Free Trial Get Demo Day March 8, 2017 Krebs Exposed IoT Botnet Mastermind  Think Thats the End? March 8, 2017 For several years, cybersecurity professionals have been predicting an impending malware onslaught originating from Internet of Things IoT devicessmart everyday household items that can connect to the Internet, such as refrigerators, WiFi routers, DVRs, baby monitors, security cameras, thermostats, and so forth. During 2016, the future became the here and Company Partners Resources Investor Relations Products Freeware Demo Solutions Contact Us Privacy Management Service by Data443

Output: threat_prevention,incident_response


Input: Search Free Trial Get Demo IAM Concept of the Week RBAC versus ABAC February 23, 2017 Introducing our new Concept of the Week blog series  Each week well define and explain the significance of a concept in the world of Identity and Access Management. This week lets discuss Role-Based Access Control RBAC and Attribute-based Access Control ABAC  both are popular approaches to determine who can access an organizations resources and what they can do with those resources. RBAC is the older of the two models, dating back to the early nineties, and focuses on the roles of individual users within an organization and their permissions. The advantage of this approach is that organizations no longer have to grant or revoke access on a case by case basis, instead users are grouped based on their role within an organization. For example, administrators at a hospital may have access to all patient records with the ability to both read and edit those records, while doctors may only access their patients records and then be limited to read-only permission. This model works best for smaller organizations with a defined number of roles and permissions. As an organization grows however, typically the number of roles and resources increase. This leads to greater complexity, and ultimately the two dimensional approach of roles and permissions becomes too inflexible for many organizations. ABAC offers a more flexible and multi-dimensional approach to access control by focusing on attributes and policies. Attributes are pieces of information that act as building blocks to describe relationships between users, actions and resources. When we combine attributes with rules or policies, we then have the ability to create a range of simple or complex access policies depending on the situation. For example, a simple policy would be only hospital administrators can access all patient records. A more complex policy might be that only an administrator, with a speciality in oncology, physically located in a certain hospital department, on a certain device can update a specific patient record. The real advantage of ABAC is that it offers a richness in its ability to describe the relationship between the person accessing the resource that scales much better than RBAC. Not surprisingly, as the world becomes more digital and complex we are seeing more and more organizations adopt ABAC. Indeed, Gartner predicts that by 2020, 70 of organization will use this model. Further reading ABAC Wikipedia RBAC Wikipedia Other blogs in the IAM Concept of the Week series SAML, OAuth2 and OpenID Connect FIDO Fast Identity Online Authentication vs Authorization Try it for Free Instant Data Classification Cyren URL Category Chacker Prev Engaging the Stakeholders of ECM General Availability  ClassiDocs Data Classification  Governance Platform  GDPR Next Company Partners Resources Investor Relations Products Freeware Demo Solutions Contact Us Privacy Management Service by Data443

Output: access_management,product_security_features,security_best_practices,technical_documentation


Input: Search Free Trial Get Demo Global Copycats iPhishing Lost iPhones March 13, 2017 In a post last month , Brian Krebs related the case of an iPhone user in Brazil who, in attempting to recover their phone, suffered a rather insidious phishing attempt. We also had received an almost identical firsthand account  from someone in Israel. A modest web search immediately turns up reports from many countries of iPhone theft victims activating Lost Mode in Find My Iphone, which sends a separate phone number or email contact to the device, and for their trouble receiving in reply a link to a faux iCloud login page, whose design might not pass muster with Jonathan Ive, but to the less discerning and desperate theft victim can be convincing enough. Cyren researchers were able to connect the URLs used in this Israeli case to other registered domains and broader phishing schemes, which provided some insight into the phishing-as-a-service ecosystem PhaaS, anyone?, as we discussed in a blog here last June, and in our special report on phishing published in August. What gives pause is to consider that such an industry has become so fully evolved in so many places, requiring the connection of a presumably low-tech thief to usually an iPhone hardware-savvy repair shop, who in turn makes the connection to the extremely sophisticated phishing operator. How the Scam Works A criminal steals the iPhone. The owner of the phone realizes the phone is missing and initiates the Find My iPhone feature by logging into his Apple iCloud account or using the Find My iPhone app that he has installed on another Apple device, such as an iPad. The owner of a lost or stolen iPhone displays a message on the phone using the Find My iPhone feature. When the Find iPhone icon is clicked, a map appears providing the location of the phone, along with an option to turn on Lost Mode. By using the Lost Mode feature of Find My iPhone, the phones owner can display a custom message on the screen of the lost device. Apple helpfully suggests you may want to indicate that the device is lost or how to contact you. The phones owner enters contact information such as an alternate phone number he can be reached at or an email address and that contact information appears on the screen of the lost iPhone. Want to learn more about cloud-based email  web security? Contact us here ! Try it for Free Instant Data Classification Cyren URL Category Chacker Prev Krebs Exposed IoT Botnet Mastermind  Think Thats the End? IT Security Survey in the UK  75 Hacked in Past Year Next Company Partners Resources Investor Relations Products Freeware Demo Solutions Contact Us Privacy Management Service by Data443

Output: product_security_features,end_user_security,threat_prevention


Input: Search Free Trial Get Demo Day March 13, 2017 Global Copycats iPhishing Lost iPhones March 13, 2017 In a post last month, Brian Krebs related the case of an iPhone user in Brazil who, in attempting to recover their phone, suffered a rather insidious phishing attempt. We also had received an almost identical firsthand account  from someone in Israel. A modest web search immediately turns up Company Partners Resources Investor Relations Products Freeware Demo Solutions Contact Us Privacy Management Service by Data443

Output: end_user_security,privacy_policy


Input: Search Free Trial Get Demo Day February 23, 2017 IAM Concept of the Week RBAC versus ABAC February 23, 2017 Introducing our new Concept of the Week blog series  Each week well define and explain the significance of a concept in the world of Identity and Access Management. This week lets discuss Role-Based Access Control RBAC and Attribute-based Access Control ABAC  both are popular approaches to determine who can access an organizations Engaging the Stakeholders of ECM February 23, 2017 Engaging the Stakeholders of ECM Engaging the Stakeholders of ECM In todays Digital Age, data and information are an organizations lifeblood What are the 3Q revenues from our best-selling product? How many workers under age 30 do we employ? How many software licenses in our IT enterprise are set to Company Partners Resources Investor Relations Products Freeware Demo Solutions Contact Us Privacy Management Service by Data443

Output: product_security_features,access_management,security_best_practices,technical_documentation


Input: Search Free Trial Get Demo Day March 20, 2017 IT Security Survey in the UK  75 Hacked in Past Year March 20, 2017 Cyren teamed with Osterman Research to do extensive interviews of IT and security professionals at over 100 small and mid-sized enterprises SME in the United Kingdom last month, and the resulting report, IT Security in the UK 2017 Business Survey, is now available for free download. A summary overview of Company Partners Resources Investor Relations Products Freeware Demo Solutions Contact Us Privacy Management Service by Data443

Output: data_protection,privacy_policy,technical_documentation


Input: Search Free Trial Get Demo Day March 26, 2017 Companion Ransomware  2-for-1 Malware Distribution March 26, 2017 As reported in February, Cerber and other ransomware groups are now offering Ransomware-as-a-Service, giving affiliatespartners a percentage of the collected ransom. In a new sort of two-for-one malware service deal, Cyren has detected variants of the Kovter click-fraud malware being distributed with companion Cerber ransomware by the Kovter malware team. Company Partners Resources Investor Relations Products Freeware Demo Solutions Contact Us Privacy Management Service by Data443

Output: threat_prevention


Input: Search Free Trial Get Demo IT Security Survey in the UK  75 Hacked in Past Year March 20, 2017 Cyren teamed with Osterman Research to do extensive interviews of IT and security professionals at over 100 small and mid-sized enterprises SME in the United Kingdom last month, and the resulting report, IT Security in the UK 2017 Business Survey , is now available for free download. A summary overview of the report was the subject of a webinar available here . There are a lot of surveys and reports and white papers circulating which inevitably focus on security issues at the largest enterprises, but the amount of information available on the security posture, problems and priorities of small- and mid-sized enterprises and governmental organisations, defined for the purposes of this survey as organisations with 100-5000 employees, is noticeably thin, and so this report fills part of that vacuum of available research. Survey responses were further broken out and compared according to three SME employee size ranges, specifically 100-1000 employees, 1001-2500 employees, and 2501-5000. The survey report is an opportunity for any IT or security professional at a mid-market company in the UK to benchmark themselves against the responses from their peers. Some survey takeaways include Security problems are rampant  75 of organizations surveyed reported a security breach or infection in the last 12 months, rising to 85 for businesses with 1000 or fewer employees. This number is consistent with the finding from a similar U.S. survey done by Osterman and Cyren last June, where the corresponding number was 71. The threats rated of greatest concern are data breaches, ransomware and targeted attackszero-day exploits. Ransomware infections were reported at twice the rate at organizations with fewer than 1,000 employees, when compared to organizations with 2,500-5,000 employees, 6 percent vs. 3 percent, respectively. The greatest security gaps, where IT managers level of concern most outstrips their evaluation of their security capabilities, are in dealing with targetedzero-day attacks, the threat of data breaches, botnet activity, and malicious activity from insiders. Only 19 say their web security is inspecting SSL traffic for threats. IT managers are far more concerned about the costs of infection than the cost of protection. The initial cost of web or email security solutions or their total lifecycle cost were ranked much lower as decision criteria than features like ease of administration, visibility, and advanced security protection the top three categories. IT managers are far more concerned with stopping malware than controlling employee web behavior, with the exception of preventing access to pornography from business networks. Shadow IT is a moderate concern for larger companies, but a low priority for those with 1,000 employees or less, with only 9 considering it of concern. The largest organizations surveyed, with 2,500-5,000 employees, are currently rating application control as the most important capability in evaluating new solutions, with 73 rating it extremely important. This compares to just 43 and 41 percent of organizations in the two smaller employee size categories. Data Loss Prevention is highly utilized in the UK, ranking as the second-most-deployed capability for both web security 64 and email security 62, among the capabilities evaluated. Less than 25 say they protect company-owned or BYOD mobile devices, and less than 30 of remote offices and Guest Wi-Fi networks have gateway security. The vast majority of organizations rely on endpoint protection for traveling employees laptops and to protect use of the web at remote offices. Feel free to reach out to the Cyren team with any questions. I was checking my bank account online when I got alarmed by my browser prompting me that the sites certificate was invalid as shown below Figure 1 Invalid website certificate prompt I usually dont get this prompt since I regularly check my accounts online, so out of concern and curiosity, I clicked on the Continue to this website link and started an investigation. Being taken to a legit-looking but unfamiliar login page as shown below, I called up my friend from another city to give me a screenshot of the banks real web site. Figure 2 Fake redirection page Figure 3 Fake login page Definitely not the same as the legitimate login page screenshot sent by my colleague. Figure 4 Legitimate login page Moving on, I tried to enter dummy credentials of my own into this fake login page and see how it would interact. Figure 5 Dummy credentials for fake login page Low and behold, the web page accepts the credentials I entered and guides me through the following pages Figure 6 Card expiry date? Figure 7 And even OTP! As I have entered dummy credentials in the login page, I also entered dummy values in the above pages only to be taken to a page saying that the site is undergoing maintenance. Figure 8 Site maintenance page Going deeper into my investigation, I opened the page properties to check the invalid certificate, which definitely seems invalid seeing the Issued to and by fields as shown below. Figure 9 Invalid certificate details Were definitely onto something here, so lets pull out our guns and get ourselves busy. Doing a route trace on the web site server we get the following results Figure 10 Traceroute from Fing Checking the whois information of the culprits server IP we get the following info. Figure 11 WhoIs Info Details I know for a fact that I didnt receive any spear-phishing emails nor got my devices infected by banking malware so how did this phishing attack happen? To verify if my devices are compromised or not, I disconnect from my DSL network and try to access the banks website via mobile data connection, and as I suspected, the redirection to the fraudulent page did not reoccur. Running a route trace gives me the following results Figure 12 Traceroute from Fing I reconnect to my DSL network to check if the fraudulent page, which still does show up using in my DSL network. So I call up my ISP to report this incident, got issued a support case ticket and ensured that they will look into it immediately. Also contacted the banks call center to report the incident just to give them a heads up. Thinking back to what I have done so far, I realized one thing. Why did the URL resolve to the correct IP when I connected to my mobile data connection? Lets go back to our first question, how did the phishing attack happen? If the attack was not delivered via email nor was delivered through malware, the attack reoccurs only in my DSL network and route trace to the banks domain server resolves to different IPs can mean that there could be a problem with my DNS settings. This brings us to think about the possibility of DNS poisoning as the root of the attack. DNS spoofing or DNS cache poisoning is a computer hacking attack, whereby data is introduced into a Domain Name System DNS name servers cache database, causing the name server to return an incorrect IP address, diverting traffic to another computer often the attackers. From Wikipedia Normally, a networked computer uses a DNS server provided by the computer users organization or an Internet service provider ISP. DNS servers are generally deployed in an organizations network to improve resolution response performance by caching previously obtained query results. Poisoning attacks on a single DNS server can affect the users serviced directly by the compromised server or indirectly by its downstream servers if applicable. To perform a cache poisoning attack, the attacker exploits a flaw in the DNS software. If the server does not correctly validate DNS responses to ensure that they are from an authoritative source for example by using DNSSEC the server will end up caching the incorrect entries locally and serve them to other users that make the same request.â So how do we resolve the issue while we wait for the ISP to solve the issue on their end? Well, one thing we can do is modify our network configuration and change the DNS server settings. For this case, I tried to use OpenDNS servers. Voila! The phishing page is gone and my online banking access is back to normal. Malicious attackers and cybercriminals out there have a lot of tricks up their sleeves but it does not mean that we dont have tricks of our own. So you dont fall as victims to these types of attacks, it would be very helpful for you to be vigilant enough to read through all of the warnings that you may see when you are doing online transactions. Make your that you are only allowing valid and verified web site certificates in your browsers. Banking web sites will surely have authentication policies in place which we can put also into use as to what I have done by using dummy credentials first. You can even max out the password retry limit and then just request to change your password later on to ensure that you are accessing the valid banking website. You can verify the validity of suspicious URLs or IPs using our reputations services such as CYRENs IP reputation and URL category checker . Lastly, we always recommend users to practice safe browsing habits to thwart off attacks like phishing and scams. Try it for Free Instant Data Classification Cyren URL Category Chacker Prev Global Copycats iPhishing Lost iPhones Companion Ransomware  2-for-1 Malware Distribution Next Company Partners Resources Investor Relations Products Freeware Demo Solutions Contact Us Privacy Management Service by Data443

Output: product_security_features,end_user_security,security_best_practices,data_protection,threat_prevention,incident_response,technical_documentation


Input: Search Free Trial Get Demo Resilient Network Systems Announces Series A Extension Round to Secure Connected Organizations February 9, 2017 RESILIENT NETWORK SYSTEMS ANNOUNCES SERIES A EXTENSION ROUND TO SECURE CONNECTED ORGANIZATIONS 1.2 Million in Additional Funding Led by HRK Investments February 09, 2017 0900 AM Eastern Standard Time SAN FRANCISCO BUSINESS WIRE  Resilient Network Systems , the contextual access control company, today announced a Series A extension round totaling 1.2 million led by HRK Investments, LLP, following the companys 4 million raised in late 2014. This extension comes on the heels of the companys recent announcement of Resilient Access 3.0 , a groundbreaking contextual access solution designed for the connected organization. The new administration will continue to invest heavily in innovative approaches to cybersecurity and access management technologies. Resilient is well positioned to continue to demonstrate how its neutral network approach supports meeting these needs. To compete, organizations need to connect and collaborate in more ways than ever, and at an increasing pace, said Ethan Ayer, CEO of Resilient Network Systems. We have rethought traditional identity access management to give our customers scalable solutions for their toughest external sharing problems. With this extension, we will further fund our sales and marketing initiatives in government and healthcare, and enhance our platform partnerships. Resilient Access 3.0 extends access capabilities to automatically discover, organize and resolve information or attributes needed to make smarter access decisions at scale and connect organizations by going beyond identity to understand the complete context of any access request. Resilient Access 3.0 includes traditional features like single sign-on and multi-factor authentication, but also incorporates a flexible policy workflow engine that enables organizations to quickly and easily safeguard files, apps, documents and data with their own custom access rules. The U.S. government has many missions that depend on information and resources being shared, but with only the right people and under the right conditions, said Richard Spires, Chairman of the Board at Resilient Network Systems and former CIO of DHS. The new administration will continue to invest heavily in innovative approaches to cybersecurity and access management technologies. Resilient is well positioned to continue to demonstrate how its neutral network approach supports meeting these needs. About Resilient Network Systems Resilient Access is a policy-driven contextual access control solution for securely sharing data and connecting organizations. Resilient Network Systems policy workflow engine discovers, organizes and resolves the information or attributes required to provide the context to make smarter access decisions. Resilients unique network-based architecture scales quickly to extend an organizations reach across its entire ecosystem. Resilient Network Systems has customers in the U.S. government, law enforcement and healthcare, and is a privately held, venture-backed company based in San Francisco. For more information, please visit  Contacts Treble Michael Kellner, 512-960-8222  Try it for Free Instant Data Classification Cyren URL Category Chacker Prev GovTech  Adventures and Observations in IAM Contextual Access Control Demo at DHS IAM Concept of the Week Authentication versus Authorization Next Company Partners Resources Investor Relations Products Freeware Demo Solutions Contact Us Privacy Management Service by Data443

Output: product_security_features,access_management,data_protection


Input: Search Free Trial Get Demo Day February 9, 2017 Resilient Network Systems Announces Series A Extension Round to Secure Connected Organizations February 9, 2017 RESILIENT NETWORK SYSTEMS ANNOUNCES SERIES A EXTENSION ROUND TO SECURE CONNECTED ORGANIZATIONS 1.2 Million in Additional Funding Led by HRK InvestmentsFebruary 09, 2017 0900 AM Eastern Standard Time SAN FRANCISCOBUSINESS WIREResilient Network Systems, the contextual access control company, today announced a Series A extension round totaling 1.2 million led by New Cerber Ransomware-as-a-Service Causing Fresh Outbreaks February 9, 2017 Cerber ransomware first appeared in February 2016, and according to initial reports by SenseCy it was offered in the form of Ransomware-as-a-Service RaaS, where affiliates can join in order to distribute the ransomware, while the Cerber developers earn a commission from each ransom payment. Cyren is now detecting fresh outbreaks Company Partners Resources Investor Relations Products Freeware Demo Solutions Contact Us Privacy Management Service by Data443

Output: threat_prevention,privacy_policy


Input: Search Free Trial Get Demo GovTech  Adventures and Observations in IAM Contextual Access Control Demo at DHS February 7, 2017 Demonstrating Contextual Access Control at the 2017 DHS ST Urban Operational Experimentation Event by Daemon Price Its an interesting time to be in Government Technology. Join me here every few weeks where Ill share my observations on the latest technology happenings within the Beltway and across Government. Well discuss the latest trends in Identity and Access Management, as well as some of the conferences and meetings I attend in my role as VP of Business Development and Sales at Resilient Network Systems. Recently, I attended a fascinating demonstration of contextual access control technology for first responders in Brooklyn, New York. On January 24-26, 2017, the Department of Homeland Security DHS Science and Technology Directorate ST held the Urban Operations Experimentation OpEx technology demonstration event at the New York City Emergency Management Center NYCEM . The DHS STs National Urban Security Technology Laboratory NUSTL ran the event. NUSTL is a federal laboratory organized within the DHS STs First Responders Group that provides products and services to help first responders prepare, protect and respond to homeland security threats. The NUSTL OpEx event brought together a series of commercial technology vendors who had submitted proposals the previous year to have their technologies reviewed by first responders in New York. The winning vendors represented various capabilities that met specific first responder challenge areas identified by DHS. Resilient Network Systems RNS teamed with Haystax and Honeycomb Networks to demonstrate a real-time threat intelligence evaluation, prioritization and automated routing capability that included policy-driven contextual access control of the system users and data, and which could deliver new EDXL data feeds for use. After Honeycomb reviewed EDXL protocol information, Haystaxs Constellation analytics platform walked through a mock scenario where the NYCEM had to manage a visiting dignitary in New York whose carefully scheduled agenda is interrupted by unplanned demonstrations, traffic problems, policefire activities, and foul weather that culminates in a tornado event. As the scenario progressed, additional resources were needed onsite in various areas to report and respond to the shifting situation. Some of these resources were purpose-dispatched from the NYCEM and various first responder offices, while others were already in the field on other duties, and still others who were not on duty at all. RNSs Resilient Access system demonstrated how all of these users could be quickly provisioned into Constellation via their mobile devices, with each going through a unique policy-directed authentication workflow that delivered specific individualized access rights to each user. This enabled each user to receive the specific data, and access the specific systems they needed to perform the role assigned by the NYCEM, while still allowing the NYCEM to maintain the security and control critical for the success of their emergency management mission. After presenting to the first responders at the OpEx event for the two planned hours, a QA session between the first responders and Resilient, Haystax and Honeycomb continued for another hour and a half. To DHSs satisfaction, the first responders walked away with a greater understanding of EDXL Emergency Data Exchange Language as a viable protocol for their use, of Constellation as a real-time threat intelligence core capability, and if the numbertypes of questions were any indication, with a new understanding and appreciation of just how powerful policy-driven contextual access control can be in support of their core missions. About the author Daemon Price is the VP of Business Development and Sales at Resilient Networks Systems. A Virginia Tech graduate, where he participated in the Corps of Cadets, Daemon held multiple postings within the Dept. of Agriculture and the Dept. of Commerce before taking his information security experience to the private sector where he worked for both small businesses like SoftMed Systems creator of the original electronic health record and Blackboard education IT innovator to prime contractors like CSC, SAIC and 3M. With government awards and billion dollar solicitation wins to his credit, Daemon continues as a passionate technology evangelist and can be seen often at events held by AFCEA, INSA, NDIA, AUSA, FCW and many others. By identity, we mean a specific set of attributes that, when paired with the right context, and policy evaluation engine, allows the user to connect and access only the company data and apps that they are supposed to have access to. Context is indeed everything. Try it for Free Instant Data Classification Cyren URL Category Chacker Prev IAM Concept of the Week FIDO Fast Identity Online Resilient Network Systems Announces Series A Extension Round to Secure Connected Organizations Next Company Partners Resources Investor Relations Products Freeware Demo Solutions Contact Us Privacy Management Service by Data443

Output: access_management,threat_prevention,data_protection


Input: Search Free Trial Get Demo New Cerber Ransomware-as-a-Service Causing Fresh Outbreaks February 9, 2017 Cerber ransomware first appeared in February 2016, and according to initial reports by SenseCy it was offered in the form of Ransomware-as-a-Service RaaS, where affiliates can join in order to distribute the ransomware , while the Cerber developers earn a commission from each ransom payment. Cyren is now detecting fresh outbreaks of Cerber ransomware being distributed using variants of a popular malware distribution tool known as Nemucod. Cerber ransom message on victims PC The attack is based primarily on email messages with zipped JavaScript attachments with filenames conforming to DOC10 digit-PDF.js and various invoice-related subjects. Following more detailed analysis of the JavaScript attachments, we identified 2 major variants of Nemucod malware, each variant comprising hundreds of samples that all connected to a single distribution site hosting the ransomware. The two major variants are detected by Cyren as JSNemucod.GE!Eldorado and JSNemucod.ED1!Eldorado . Nemucod Documen spelled backwards is a known family of downloaders that have been used to distribute many different types of malware. In June, we reported use of Nemucod to download Locky . The vast number of variants are used to make signature based antivirus detection more difficult. JSNemucod.GE!Eldorado We started seeing this variant late last year. The current versions include minor modification to avoid being detected including a lot of garbage code such as useless functions and variables. The malicious code is inserted in a function in between garbage codes and is not hidden by any encryption. The malware code is just a few lines. Cleaning up the garbage code enables us to easily identify the goal of the malware try to download a file and execute it. The download filename cer.jpg already provides a hint about the payload. Once downloaded, the .jpg extension is replaced with .exe allowing execution of the ransomware. JSNemucod.ED1!Eldorado. For this wave, slightly more effort was put into hiding the malware code. The file also contains garbage code and the encryption routine is put in a Function Constructor. With a little bit of magic dust modification to the file, the malware code is revealed! The code is much longer but the behavior is the same. It will try to download the payload cer.jpg on the same site. Late last year, this same site was used to download the payload c.jpg. As shown above, the same address 203.162.253.20 is now hosting cer.jpg. We note that 203.162.253.20 has a history of distributing other malware. Hashes of the files used for this blog DOC8342682916-PDF.js  1350a98acfe1eea524f8122c4b85b47031e3a610eaa9305430fbe50d2eed4ee2 DOC6248311426-PDF.js  d122f97d5ff55594254d25853bc6b891206c8a1e77e4425a5a986e03eb98606c Cerber Ransomware Payload cer.jpg  0b0470c1e0494cce7f2f638841070bc9e2d5ae239379681a60166999356b7da7 Once activated the Cerber ransomware encrypts a wide range of document and image files and then places the following message in each folder. There is currently no free decryptor available for Cerber. Additional information provided by Cyren researchers Maharlito Aquino and Igor Glik. Want to learn more about cloud-based malware detection ? Contact us here ! Try it for Free Instant Data Classification Cyren URL Category Chacker Prev Fake bank transfer emails stealing Bitcoin and passwords New Phishing Wave Targets Online Banking and Digital Payment Customers Next Company Partners Resources Investor Relations Products Freeware Demo Solutions Contact Us Privacy Management Service by Data443

Output: data_protection,threat_prevention,technical_documentation


Input: Search Free Trial Get Demo Day February 10, 2017 IAM Concept of the Week Authentication versus Authorization February 10, 2017 Introducing our new Concept of the Week blog series  Each week well define and explain the significance of a concept in the world of Identity and Access Management. This weeks post is short but involves two critical and related terms authentication and authorization. These terms are frequently confused mainly Company Partners Resources Investor Relations Products Freeware Demo Solutions Contact Us Privacy Management Service by Data443

Output: access_management,security_best_practices


Input: Search Free Trial Get Demo Day February 15, 2017 New Phishing Wave Targets Online Banking and Digital Payment Customers February 15, 2017 Cyren researchers are seeing a new phishing technique targeting online banking users from Wells Fargo, Chase and Capital One, along with digital payment customers from Paypal and Venmo, among others. This new wave of phishing attacks builds on previously known techniques. Phishing email attachments, for example, rely relying on email Company Partners Resources Investor Relations Products Freeware Demo Solutions Contact Us Privacy Management Service by Data443

Output: end_user_security,threat_prevention


Input: Search Free Trial Get Demo IAM Concept of the Week FIDO Fast Identity Online February 1, 2017 IAM Concept of the Week blog series  Each week we define and explain the significance of a concept in the world of Identity and Access Management. This week our IAM Concept of the Week deals with FIDO  F ast Id entity O nline, an authentication technology largely based on biometrics. FIDO is supported by over 250 companies including Google, Microsoft and Salesforce and saw a 200 increase in adoption in 2016. The FIDO Alliance was created in 2013 by PayPal, Lenovo and others, with the goal of replacing passwords as the main method of authentication. Passwords, as we all know too well, are problematic from both a user experience, and security point of view. McKinsey research found that the average consumers now has 14 different passwords to remember, while a recent study by Verizon found that 63 of all data breaches involved the use of stolen, weak or default passwords. At the core of FIDO is the users smartphone, that uses cryptographic keys to securely authenticate with the FIDO-enabled server of the service or app the user is attempting to access. FIDO is made up of two sets of specifications or user experiences for authentication  UAF Universal Authentication Framework and U2F Universal Second Factor. UAF deals with passwordless authentication while U2F addresses the second factor authentication. Setting up FIDO authentication from a users perspective is straightforward. First the user selects an authentication method on their smartphone. The biometric method will depend on their preference, the capability of their phone, and the methods supported by the FIDO-enabled service. Once a method is selected, say a fingerprint, a biometric template is created along with a private and a public cryptographic key. The private key and biometric template are stored on the users device. The public key is sent to the FIDO-enabled server. Now, anytime the user needs to authenticate, the server just sends a challenge to the users device which is then signed by the private key and returned to the service to identify the user. The advantages of the FIDO approach are obvious Almost frictionless authentication No passwords to remember or reset The biometric data never leaves the phone so the approach is not vulnerable to server-based breaches On the other hand even though the biometric may remain securely on the device, biometrics like fingerprint records exist elsewhere, many times on government-controlled servers. If a biometric is compromised there is no easy way reset it like a password. Supporters of FIDO argue that the standard also includes non-biometrics methods like PIN or tokens and that for sensitive data multi factor authentication is a necessity. Ironically, many implementations of MFA include passwords as a possible factor. Only time will tell the extent to which FIDOs biometric authentication approach will reduce our dependence on the humble password. Further reading Fido Alliance Passwords A long goodbye CSO Other blogs in the IAM Concept of the Week series SAML, OAuth2 and OpenID Connect Try it for Free Instant Data Classification Cyren URL Category Chacker Prev Streamlining the Serious Business of Due Diligence GovTech  Adventures and Observations in IAM Contextual Access Control Demo at DHS Next Company Partners Resources Investor Relations Products Freeware Demo Solutions Contact Us Privacy Management Service by Data443

Output: product_security_features,end_user_security,security_best_practices,data_protection,access_management,threat_prevention,privacy_policy


Input: Search Free Trial Get Demo IAM Concept of the Week Authentication versus Authorization February 10, 2017 Introducing our new Concept of the Week blog series  Each week well define and explain the significance of a concept in the world of Identity and Access Management. This weeks post is short but involves two critical and related terms authentication and authorization. These terms are frequently confused mainly because they are so closely connected and the fact that the two words are so similar. Simply stated authentication is verifying that someone is who they claim to be while authorization is deciding which resources a user should be able to access, and what they should be allowed to do with those resources. Note not to be too pedantic but technically authentication is really validating the credential that has previously been created rather than the actual identity of the person. Well explore this idea in a later post. Obviously before we can authorize a user access to certain resources we first need to be sure that they are who they say they are. Therefore authentication and authorization are inextricably linked. An often used analogy to explain the difference between authentication and authorization involves a traveler arriving at passport control in a foreign country. The traveler presents their passport hoping to gain access to the country. The border control agent reviews the document and accepts that the traveller is who they say they are. Once the traveler has been authenticated he is then authorized access to the foreign country. Finally, there are a number of important protocols to understand in the world of authentication and authorization. Be sure to read a previous post in our IAM Concept of the Week blog series entitled SAML, OAuth2 and OpenID Connect . Further reading Authentication vs. Authorization Axiomatics Other blogs in the IAM Concept of the Week series SAML, OAuth2 and OpenID Connect FIDO Fast Identity Online Try it for Free Instant Data Classification Cyren URL Category Chacker Prev Resilient Network Systems Announces Series A Extension Round to Secure Connected Organizations Engaging the Stakeholders of ECM Next Company Partners Resources Investor Relations Products Freeware Demo Solutions Contact Us Privacy Management Service by Data443

Output: access_management,technical_documentation


Input: Search Free Trial Get Demo Day March 27, 2017 Cyren Unified Internet Security Goes Live March 27, 2017 Following on the heels of our February announcement, we are pleased to share here that Cyrens SaaS Internet security platform upgrade, Cyren Cloud Security 4.0, went live on March 26. Integrated Web and Email Security This release deepens the integration of our cloud-based enterprise security offerings  web security, email Company Partners Resources Investor Relations Products Freeware Demo Solutions Contact Us Privacy Management Service by Data443

Output: product_security_features


Input: Search Free Trial Get Demo Fake bank transfer emails stealing Bitcoin and passwords January 25, 2017 Cyren has discovered an outbreak of malware which is stealing passwords as well as Bitcoin from crypto-currency wallets on PCs. This versatile keylogger malware is being delivered as an attachment to phony bank transfer emails, which inform the recipient that they have received a deposit. The emails are originating primarily from bots in the U.S. and Singapore, and are branded as coming from several different banks, including Emirates NDB and DBS see example below. The email subjects are typically financial transfer-related, including Online wire transfer payment notification Payment update Swift copy The attachments are all named with variations of Swift including swift copy_pdf.ace swift copy.zip swift_copy.pdf.gz Swift here refers to SWIFT codes, used to uniquely identify banks and financial institutions globally for fund transfers, and is evidently used to give the impression that these are genuine interbank transaction reports. The email attachment is an executable file, most typically with PDF in the filename Swift_Copy.Pdf.exe. Cyren researchers report that after execution it deletes itself and creates a file called filename.vbs in the Windows startup folder. Every time the victim restarts or logs into his or her PC after signing out, this script runs, executing the malware itself  filename.exe located in AppDataLocalTempsubfolder. The malware queries the registry for passwords and other sensitive information related to many kinds of software. It especially focuses on FTP and web browsing software and other software that could have credential information. It gathers information from all the web browsers on the computer stored passwords and usernames, history, cookies, cache etc. and email clients as well. The malware also searches the computer for crypto-currency wallets to steal. Among the wallets it tries to find Anoncoin, BBQcoin, Bitcoin, Bytecoin, Craftcoin, Devcoin, Digitalcoin, Fastcoin, Feathercoin, Florincoin, Freicoin, I0coin, Infinitecoin, Ixcoin, Junkcoin, Litecoin, Luckycoin, Megacoin, Mincoin, Namecoin, Phoenixcoin, Primecoin, Quarkcoin, Tagcoin, Terracoin, Worldcoin, Yacoin, and Zetacoin. The malware creates hooks for both the keyboard and the mouse. The API windows call GetAsyncKeyState is called which indicates that the malware is logging every keystroke Keylogger. Want to learn more about cloud-based email  web security? Contact us here ! Try it for Free Instant Data Classification Cyren URL Category Chacker Prev Email Security Survey 75 of Companies Hacked in Past Year New Cerber Ransomware-as-a-Service Causing Fresh Outbreaks Next Company Partners Resources Investor Relations Products Freeware Demo Solutions Contact Us Privacy Management Service by Data443

Output: threat_prevention,data_protection


Input: Search Free Trial Get Demo Day February 7, 2017 GovTech  Adventures and Observations in IAM Contextual Access Control Demo at DHS February 7, 2017 Demonstrating Contextual Access Control at the 2017 DHS ST Urban Operational Experimentation Event by Daemon Price Its an interesting time to be in Government Technology. Join me here every few weeks where Ill share my observations on the latest technology happenings within the Beltway and across Government. Well discuss the Company Partners Resources Investor Relations Products Freeware Demo Solutions Contact Us Privacy Management Service by Data443

Output: access_management,privacy_policy,technical_documentation


Input: Search Free Trial Get Demo Email Security Survey 75 of Companies Hacked in Past Year January 23, 2017 A new survey conducted by Osterman Research and co-sponsored by Cyren shows that 75 of businesses surveyed incurred a security breach in the past 12 months. The top two culprits? Email phishing attacks infected systems at 37 of the companies, while 24 of respondents suffered successful ransomware attacks through file encryption. The 75 number is definitely trending in the wrong direction  it compares unfavorably to the 71 of IT managers and security professionals who reported a breach in the prior 12 months when responding to a similar survey conducted last June , also by Osterman. A white paper entitled  Is Your Email Security Working? A Survey of the State of Ransomware, Phishing, and Business Email Compromise , is available for download from Cyren, and was the topic of a webinar presentation on January 18, now available for on-demand viewing. For further background on these topics, check out the Cyren phishing threat report and our ransomware resource page . The survey explored the top email security issues faced by IT managers and security decision-makers, in particular ransomware, phishing and Business Email Compromise  essentially whaling, or sometimes called CEO fraud. It refers to a sub-genre of spearphishing, with the goal of crafting extremely pointed and believable attacks on senior executives, which can extend to the hackers first infiltrating an organizations network with malware to learn business processes and capture extensive communications. The survey also found that average security spend per employee was 58.33 in 2016, and that while 62 percent of companies plan to increase their security budget in 2017, the average overall increase of less than 1 suggests spending has plateaued, especially in contrast to a 23 jump from 2015 to 2016 Osterman, June 2016. Its clear that the reported death of email has been greatly exaggerated. The survey notes that in a typical workday employees rely on email more than the telephone, instant messaging and social media combined. The typical business email user sends a median of 30 emails and receives 100 each workday, spending 2.5 hours a day doing something in email. Its no surprise that email-delivered security threats are increasing rapidly and costs companies hundreds of millions of dollars each year. Is your email security up to the challenge of protecting your business against ransomware, phishing and business email compromise? Download the survey white paper now to learn more about these threats and what you can do to protect your business. Want to learn more about cloud-based email  web security? Contact us here ! Try it for Free Instant Data Classification Cyren URL Category Chacker Prev The Rise of Botnets Fake bank transfer emails stealing Bitcoin and passwords Next Company Partners Resources Investor Relations Products Freeware Demo Solutions Contact Us Privacy Management Service by Data443

Output: threat_prevention,end_user_security,security_best_practices,data_protection


Input: Search Free Trial Get Demo Streamlining the Serious Business of Due Diligence February 1, 2017 Streamlining the Serious Business of Due Diligence Although the concept of due diligence has become widely accepted as any painstakingly detailed process of investigating and verifying the validity of a fact or situation, the phrase takes on a more profound level of meticulous research when used in the context of the legal profession. In other words, for lawyers, due diligence is serious business. Whether part of an MA mergers and acquisitions or other financial transactions, the practice of due diligence includes a lengthy exploratory process of mining contracts and supporting documentation to understand risks, identify red flags, and determine the suitability of agreements for represented parties and counter-parties. A dedicated team of lawyers and supporting staff can spend hundreds of hours combing through thousands of pages of documents to complete the due diligence phase of a financial deal. Intellectual property IP must be identified, solicited, received, and reviewed  a process that can take months to complete and test the patience and determination of even the most optimistic clients. If only there was a way to cut down on the time and expense of due diligence . . . a shortcut or mechanism, so to speak, that offered attorneys the ability to serve clients more efficiently by moving through the process more quickly and smoothly. In fact, there is. Diligence is about to get its due. Auto-Population of Data Rooms with FileFacets FileFacets ECM support software facilitates ROT redundant, trivial, obsolete processing, content classification, and taxonomy implementation and now offers a revolutionary approach to streamline the due diligence process. Using FileFacets cloud-based portal, attorneys can access client recordsand records stored in files at the firmto auto-populate and compile a comprehensive and complete data room. The system drastically reduces the personnel hours a client must spend finding and organizing records, and it increases efficiency on the lawyer side of the process, too. Data rooms are constructed, organized, and shared in a secure environment that allows accessibility and controlled collaboration as needed among all stakeholders  clients, legal teams, and investors. FileFacets supplies a superior method of document compilation that provides Privacy  Ensure security with flexible controls that allow you to determine and assign multiple levels of access Organization  Upload thousands of documents and create a dynamic, functional framework Ease of Use  Streamline the due diligence process through the identification and extraction of specific and appropriate IP Speed  Shorten the MA life-cycle by slashing hours needed to find, review, and compile documents Efficiency  Reduce time spent fixing incomplete documents missing signatures and exhibits FileFacets lets users aggregate content before the data room allowing them to find relevant data to upload to the Virtual Data Room. With FileFacets in their tool box, law firms can build better quality, more comprehensive data rooms  offering a higher level of client service and increasing their own capacity for revenue. Redefining due diligence is just one of the ways FileFacets can help attorneys and law firms maintain and optimize their information governance IG. Learn more about how incorporating FileFacets into your overall IG plan will address short-term and long-term solutions to common legal industry challenges here Try it for Free Instant Data Classification Cyren URL Category Chacker Prev Concept of the Week SAML, OAuth2 and OpenID Connect IAM Concept of the Week FIDO Fast Identity Online Next Company Partners Resources Investor Relations Products Freeware Demo Solutions Contact Us Privacy Management Service by Data443

Output: product_security_features,access_management,data_protection


Input: Search Free Trial Get Demo Concept of the Week SAML, OAuth2 and OpenID Connect January 27, 2017 Introducing our new IAM Concept of the Week blog series  Each week well define and explain the significance of a concept in the world of Identity and Access Management. This week lets talk about 3 protocols  SAML, OAuth and OpenID Connect  that are often mentioned when discussing authentication AuthN and authorization AuthZ. Remember authentication is verifying that someone is who they claim to be while authorization is deciding which resources a user should be able to access, and what they should be allowed to do with those resources. The table below compares and contrasts the protocols. SAML Security Assertion Markup Language  Is the oldest of the 3 protocols. Its XML-based and is used for exchanging Authn and Authz data between parties, in particular, between identity providers and service providers. Its most common use case is enabling SSO within the enterprise. An example of SAML in action would be a user at work requesting access to a service provider like Google G Suite. Before G Suite can grant access it must first authenticate and then authorize the user. It does this by requesting and receiving an identity assertion or token from an identity provider, in this case the users employer. The token also includes authorization information about which resources the user can access within G Suite, and what they can do with those resources. On the basis of this assertion G Suite makes an access control decision and grants access to the user. Limitations  The standard was not originally designed for mobile or native apps. OAuth2  The Auth here stands for authorization. Developed in 2006 by companies like Twitter and Google, who saw the need to enable third party applications limited access to their users information. OAuth2 offers whats known as delegated access, meaning that an application can take actions or access resources on behalf of a user without having to share credentials with the application. This is made possible by the identity provider issuing a token to the third-party application with the approval of the user. An example of OAuth2 would be a user who signs up with a third-party app that wants to import the users Facebook friends list. To accomplish this the user clicks on the Import contacts from Facebook button from within the app. The user is then taken to Facebook where they need to authenticate. Once they successfully login they will be prompted to share their Facebook friends list. Clicking yes will send the user back to the app along with a token that grants the app permission or authorization to import the Facebook friends list. OAuth2 offers a secure and simple way for consumers to allow access to their resources on the web without having to share their credentials. Limitations  The standard does not include authentication. OpenID Connect OIDC  Is an open standard for authentication that is designed to work in conjunction with the authorization capabilities of OAuth2. OIDC is essentially an identity layer built on top of OAuth2 that allows the verification of the identity of an end-user, as well as, to obtain basic profile information about the end-user. It achieves this by adding an identity token to the OAuth2 authorization flow. In many ways OIDC represents the future of authentication and authorization particularly because it was developed with mobile and native apps in mind. Having said that SAML will be with us for a longer time because of its dominant position within the enterprise. Further reading SAML Wikipedia OAuth2 OAuth.Net OpenID Connect FAQ OpenID.Net Authentication and Authorization OpenID vs OAuth2 vs SAML Other blogs in the IAM Concept of the Week series FIDO Fast Identity Online Try it for Free Instant Data Classification Cyren URL Category Chacker Prev Making Resolutions vs. Transforming Business Streamlining the Serious Business of Due Diligence Next Company Partners Resources Investor Relations Products Freeware Demo Solutions Contact Us Privacy Management Service by Data443

Output: end_user_security,security_best_practices,access_management,technical_documentation


Input: Search Free Trial Get Demo Day February 1, 2017 IAM Concept of the Week FIDO Fast Identity Online February 1, 2017 IAM Concept of the Week blog series  Each week we define and explain the significance of a concept in the world of Identity and Access Management. This week our IAM Concept of the Week deals with FIDO Fast Identity Online, an authentication technology largely based on biometrics. FIDO is supported by Streamlining the Serious Business of Due Diligence February 1, 2017 Streamlining the Serious Business of Due Diligence Although the concept of due diligence has become widely accepted as any painstakingly detailed process of investigating and verifying the validity of a fact or situation, the phrase takes on a more profound level of meticulous research when used in the context of Company Partners Resources Investor Relations Products Freeware Demo Solutions Contact Us Privacy Management Service by Data443

Output: access_management,product_security_features