The Great Resignation is trend in which large numbers of employees have voluntarily been resigning from their jobs. As of August 2021, 65% of people in the United States were looking for a new job and 25% had quit. According to a Tessian survey of IT leaders, 71% said that the Great Resignation has increased security risks.
People and data are the most valuable resources that companies have. Make sure that your company does not lose either during the Great Resignation. It is very common that employees take data with them when they leave their jobs.
Curious to know why people take a company’s data with them?
- They think the information will help them in their new job.
- They worked on the document, so they believe it belongs to them.
- They share the data with their new employer.
Insider threats are on the rise and are amplified by digital workspaces, flexible and remote work, the agile behavior of companies without strict policies and now also by the Great Resignation. The overall number of incidents has increased by 44 percent in the last two years. 29% of employees admitted that they took data with them when they quit (Tessian).
Which departmental employees are most likely to take data with them?
- Marketing (63% of respondents admitted taking data)
- HR (37% of respondents admitted taking data)
- IT (37% of respondents admitted taking data)
Data security is now more important than ever before. We are in a time when employees are leaving their jobs or employers are terminating employees’ contracts due to the anticipated recession. To ensure that your business is not harmed, you should protect your data.
How to prepare for the Great Resignation and not lose any data
- Establish an offboarding process
- Set security policies
- Identify your sensitive data and monitor who has access to it
- Educate your employees about proprietary data
- Use a DLP solution
With Safetica you have all your security policies in your hands. Decide whether you want to simply log all operations, notify users about risk and allow them to proceed, or restrict an operation entirely. Perform a security audit and locate your sensitive data across your environment and see who accesses it and how.
The solution runs in the background and keeps data secured.
Here are some specific use-cases for how Safetica protects your data:
- Blocks sending emails to private email addresses or restricts specific email domains
- Blocks data capture (like screenshots)
- Restricts usage of private/unencrypted personal devices
- Restricts data upload to the cloud
- Notifies employees about potential risky operations
On top of all this, Safetica is super simple to implement and use. With our cloud-native SaaS DLP Safetica NXT, you can protect your data from day one. Get a free trial and check it out yourself.
As part of our mission to secure the world’s OT, IoT and Cyber Physical infrastructures, we invest resources into offensive research of vulnerabilities and attack techniques.
Ripple20 are 19 vulnerabilities revealed by Israeli firm JSOF that affect millions of OT and IOT devices. The vulnerabilities reside in a TCP/IP stack developed by Treck, Inc. The TCP/IP stack is widely used by manufacturers in the OT and IoT industries and thus affects a tremendous amount of devices.
Among the affected devices are Cisco Routers, HP Printers, Digi IoT devices, PLCs by Rockwell Automation and many more. Official advisories by companies who confirmed having affected devices can be found here, in the “More Information” section.
The most critical vulnerabilities are three that can cause a stable Remote Code Execution (CVE-2020-11896, CVE-2020-11897, CVE-2020-11901) and another that can cause the target device’s memory heap to be leaked (CVE-2020-11898).
On behalf of our customers, we set out to explore the real impact of these vulnerabilities, which we’re now sharing with the public.
The research has been conducted by researchers Maayan Fishelov and Dan Haim, and has been managed by SCADAfence’s Co-Founder and CTO, Ofer Shaked.
We set out to check the exploitability of these vulnerabilities, starting with CVE-2020-11898 (the heap memory leak vulnerability), one of the 19 published vulnerabilities.
We created a Python POC script that is based on JSOF official whitepaper for this vulnerability. According to JSOF, the implementation is very similar to CVE-2020-11896, which is an RCE vulnerability that is described in the whitepaper. Also mentioned about the RCE vulnerability: “Variants of this Issue can be triggered to cause a Denial of Service or a persistent Denial of Service, requiring a hard reset.”
Test 1 target: Samsung ProXpress printer model SL-M4070FR firmware version V4.00.02.18 MAY-08-2017. This device is vulnerable according to the HP Advisory.
Test 1 result: The printer’s network crashed and required a hard reset to recover. We were unable to reproduce the heap memory leak as described, and this vulnerability would have been tagged as unauthenticated remote DoS instead, on this specific printer.
Test 2 target: HP printer model M130fw. This device is vulnerable according to the HP Advisory.
Test 2 result: Although reported as vulnerable by the manufacturer, we were unable to reproduce the vulnerability, and we believe that this device isn’t affected by this vulnerability. We believe that’s because the IPinIP feature isn’t enabled on this printer, which we’ve verified with a specially crafted packet.
Test 3 target: Undisclosed at this stage due to disclosure guidelines. We will reveal this finding in the near future.
Test 3 result: We found an unreported vendor and device, on which we can use CVE-2020-11898 to remotely leak 368 bytes from the device’s heap, disclosing sensitive information. No patch is available for this device. Due to our strict policy of using Google’s Responsible Disclosure, we’ve reported this to the manufacturer, to allow them to make a patch available prior to the publication date.
We’ve confirmed the exploitability vulnerabilities on our IoT lab devices.
On the negative side: The vulnerabilities exist on additional products that are unknown to the public. Attackers are likely to use this information gap to attack networks.
On the positive side: Some devices that are reported as affected by the manufacturers are actually not affected, or are affected by other vulnerabilities. It might require attackers to tailor their exploits to specific products, increasing the cost of exploitation, and prevent them from using the vulnerability on products that are reported as vulnerable.
SCADAfence Research Recommendations
Check your asset inventory and vulnerability assessment solutions for unpatched products affected by Ripple20.
The SCADAfence Platform creates an asset inventory with product and software versions passively and actively, and allows you to manage your CVEs across all embedded and Windows devices.
Prioritize patching or other mitigation measures based on: Exposure to the internet, exposure to insecure networks (business LAN and others), criticality of the asset.
This prioritization can automatically be obtained from tools such as the SCADAfence Platform.
Detect exploitation based on network traffic analysis.
The SCADAfence Platform detects usage of these exploits in network activity by searching for patterns that indicate usage of this vulnerability in the TCP/IP communications.
If you have any questions or concerns about Ripple20, please contact us and we’ll be happy to assist you and share our knowledge with you or with your security experts.
About Version 2 Limited
Version 2 Limited is one of the most dynamic IT companies in Asia. The company develops and distributes IT products for Internet and IP-based networks, including communication systems, Internet software, security, network, and media products. Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 Limited offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.
SCADAfence helps companies with large-scale operational technology (OT) networks embrace the benefits of industrial IoT by reducing cyber risks and mitigating operational threats. Our non-intrusive platform provides full coverage of large-scale networks, offering best-in-class detection accuracy, asset discovery and user experience. The platform seamlessly integrates OT security within existing security operations, bridging the IT/OT convergence gap. SCADAfence secures OT networks in manufacturing, building management and critical infrastructure industries. We deliver security and visibility for some of world’s most complex OT networks, including Europe’s largest manufacturing facility. With SCADAfence, companies can operate securely, reliably and efficiently as they go through the digital transformation journey.