There is no denying that data security is something that all businesses need to take seriously today. Unfortunately, there are many companies out there who are failing to do so. This is because they have the “it won’t happen to me attitude.” However, many companies have closed after a data breach. Therefore, to save the future of your business and your job, try to convince your boss with these quotes…

We are going to start with a quote from the founder and CEO of Blue Lava, Inc, Demitrios ‘Laz’ Lazarikos, who talks about implementing a modern program on cyber risk. From privileged access management services to network segregation, we need to stay ahead of the times with our strategy.

“A modern cybersecurity program must have Board and Executive level visibility, funding, and support. The modern cybersecurity program also includes reporting on multiple topics: understanding how threats impact revenues and the company brand, sales enablement, brand protection, IP protection, and understanding cyber risk.”

If your boss thinks he or she is above the law, William Malik, VP and Research Area Director for Information Security at Gartner has a great quote on the matter…

“A business will have good security if its corporate culture is correct. That depends on one thing: tone at the top. There will be no grassroots effort to overwhelm corporate neglect.”

Chairman of the Ponemon Institute, Dr. Larry Ponemon, has spoken about insider attacks. Insider attacks – whether malicious or accidental – are the most common. However, they’re not being taken as seriously as they should…

“We discovered in our research that insider threats are not viewed as seriously as external threats, like a cyberattack. But when companies had an insider threat, in general, they were much more costly than external incidents. This was largely because the insider that is smart has the skills to hide the crime, for months, for years, sometimes forever.”

While some business owners do implement cyber security controls, there seems to be a lack of thought behind the strategy that is implemented, and this is what Dr. Chris Pierson, CEO at Binary Sun Cyber Risk Advisors has said on the matter…

“What we should actually be doing is thinking about what are our key controls that will mitigate the risks. How do we have those funneled and controlled through the team that we have, how do we work through that in a well-formatted, formulated process and pay attention to those controls we have chosen? Not a continual, add more, add more, add more.”

One of the biggest problems with data security is that a lot of business owners believe it is nothing more than an IT issue. Steven Chabinsky, Global Chair of Data, Privacy & Cybersecurity at White & Case LLP, has put this into perspective…

“Thinking of cybersecurity solely as an IT issue is like believing that a company’s entire workforce, from the CEO down, is just one big HR issue.”

So there you have it: some of the most compelling quotes out there regarding cyber security today. We hope these will help you to convince your boss that it’s critical!

Throughout the years, the concept of blockchain technology has gradually overtaken the business world. But no longer is it only being associated with cryptocurrency. Now it’s finding its way into other industries such as eCommerce and logistics management. 

Helping to digitize businesses, it’s a popular technology due to its ability to solve challenges such as security breaches. But that’s not the only benefit that comes with investing in blockchain technology. If your business is interested in investing in enterprise software development and in blockchain in particular, then the following information can prove to be invaluable. 

What is it?

Before getting into the advantages, it’s important to first understand exactly what blockchain is. Arguably one of the most disruptive technologies, it’s something that should no longer be ignored. To put it simply, blockchain is a collection of digital technology information which is stored within a database.  This will typically include:

• Information about certain customer transactions including key data such as the time, monetary amount, date and more. 
• Information about exactly who is buying your products or services. Revealing shopping behaviors, it’s stored with a digital signature rather than a specific name. 
• Unique blocks of information – which can easily be distinguished from one another. For example, if one customer buys one item and then in the future buys a different one, they will be in different blocks.

What Are The Benefits?

1. An Increased Level of Efficiency

One of the most important benefits that come with implementing blockchain technology within your business is the elevated level of efficiency it can provide. Removing the need for a third-party due to its more decentralized design, it will make your operating processes far more streamlined. 

With blockchain technology, you can step away from the more traditional, time-consuming processes that were rife with human error and automate them. Ensuring that they are completed more quickly and accurately, you can spend the time that you saved on other areas of your business. 

As well as making the overall process more streamlined and convenient, it allows for everyone to access the same information at one time – making financial record-keeping more trustworthy in the long term. 

One industry that could particularly benefit from faster payments and transactions is the real estate market. With a simpler system of ownership records, it will make the process of selling properties far easier. It will also open up the possibility of automating agreements between tenants and landlords, which will similarly speed up the process. 

1. Greater Transparency Overall

A notable characteristic that blockchain has is its ability to be transparent. As the technology is a type of a transaction or distributed ledger, it allows those within a network to share all of the same documentation instead of individual copies. 

By making this open to viewing, it directly adds a remarkable layer of accountability, giving each sector within the business the responsibility to act correctly towards the company’s growth and its customers. The fact that each document can only be updated through the agreement of all participants also ensures that no illegitimate changes can be made. More consistent, transparent and accurate, the staff will perform better together in the long run.

1. An Increased Level of Security 

As aforementioned, an increased level of security is one of the key benefits that come with blockchain technology. Far more secure than the more traditional record-keeping systems, it will ensure that each transaction that’s made is heavily encrypted and linked to the last transaction. But how does it do this?

Without getting too technical, blockchain technology is created with several ‘blocks’ which are formed by a computer network. Once created, they are added to a ledger which fuses a chain of information. As it is such a complex technology that exists across several serves rather than one (as most traditional technologies are), it’s one of the most protected from breaches. 

This level of security is particularly important for businesses that store sensitive customer data such as – healthcare, within the government and in financial services. 

1. Reduced Costs

For many businesses, it’s important to cut costs where you can. And with blockchain technology, you can do exactly that. Although the initial investment might seem expensive, the benefits that come with it make it more than worth it for many businesses. As mentioned above, it removes the need for third parties. And because of this, you can work directly with your clients and customers.

This will, in turn, help to reduce your overall costs. With this new automated technology, you also no longer have to review information separately. Helping to save time and therefore save money. You can then reinvest the money that you’ve saved by not having to deal with third parties in other aspects of your business – such as marketing or IT.

1. Enhanced Traceability 

Traceability is key within many businesses – as without it, you can’t identify transactions. With blockchain technology, you can reap the benefits that come with an enhanced level of traceability. For example, every time that someone purchases a product from your business, it will create a digital audit trail which is recorded within the blockchain. Showcasing who and when they were bought, it can easily be traced if need be.

Helping to prevent fraud (if you have a business that’s involved in exchange), verify the authenticity and improve security, it’s an essential addition for many. In particular, this heightened level of traceability can be ideal if your business traditionally deals with products which are traded through a very complex supply chain – such as within medicine. Tracking exactly who manufactured and distributed each item, it will be easier to recall products if need be.

Final Thoughts

The impact that blockchain technology can have within a business is clear. A type of technology that is ever-developing and growing in popularity, it’s something that’s here to stay. Of course, before you invest in the technology, it’s vital that you thoroughly research the pros and cons and how it could directly affect your business’ operations.

Facebook’s WhatsApp mobile app has had a rough time lately with regard to software vulnerabilities. In November 2019, the social media company quietly issued a security patch for a buffer overflow vulnerability contained in their messaging application.

However, the vulnerability disclosed in November 2019 is not the only recent vulnerability discovered and patched in the secure messaging application. Earlier in 2019, another buffer overflow vulnerability was discovered and patched by the company. Both of these vulnerabilities are rated as “severe” due to the fact that an attacker exploiting them can run malicious code on the target device.

To make things worse, the vulnerabilities in WhatsApp can be exploited by an unauthenticated attacker. These vulnerabilities were discovered in functions that process data sent by another WhatsApp user to the target. By taking a simple action – initiating a WhatsApp call or sending an MP4 video to the target – an attacker can trigger the vulnerability, giving them control over the device. These vulnerabilities can then be exploited to place spyware on the victim’s device and to view the user’s messaging history within the app.

A Brief History of WhatsApp Security

The recent WhatsApp vulnerability is not the first buffer overflow contained within the mobile app. In May 2019, a different buffer overflow vulnerability was discovered in how WhatsApp processed the data contained within an incoming call.

This vulnerability was created because WhatsApp uses a special binary format for sending data between devices and then unpacks this data at the recipient device. If an attacker sent a specially formatted packet, which lied about the length of a certain field, the recipient’s WhatsApp would unpack the data into a place on the stack that did not have sufficient space for it. As a result, the attacker would have the ability to write to memory that should have been outside of their control. This vulnerability was concerning since it allowed remote code execution on a target device without any user interaction required. The malicious packet was sent as part of initiating a call, so, even if the user rejected the call, the damage was already done.

This past WhatsApp vulnerability has been the source of significant controversy. While Facebook was in the process of patching the vulnerability, they observed someone trying to exploit it on the device of a UK-based human rights lawyer. Additional investigation pointed to the use of the vulnerability to spy upon individuals who would be of interest to certain governments.

The Israeli-based NSO Group is well known for developing and selling exploits to governments for use in surveillance activities that fall outside the scope of law enforcement activities. This, and the fact that the observed attack used infrastructure previously linked to the NSO Group, has led Facebook to believe that the company was beyond the exploitation of the WhatsApp vulnerability. As a result, Facebook has begun a lawsuit against the NSO Group for exploitation of a vulnerability in one of their products.

The Newest WhatsApp Vulnerability

The buffer overflow vulnerability disclosed in May was not the last such vulnerability in the WhatsApp platform. In November 2019, Facebook patched another vulnerability in WhatsApp that was similar in scope, severity, and potential impact.

This vulnerability dealt with how WhatsApp handled MP4 video files. Along with a video file comes a stream of metadata containing details about the file. When parsing this metadata, WhatsApp is vulnerable to a stack-based buffer overflow attack. This would allow the attacker to perform a Denial of Service attack (crashing the app) or to run attacker-controlled code on the app that could give access to previous conversations that the user has performed on the app. Exploitation of the vulnerability only requires an attacker to know the phone number of the victim and to send them a malicious MP4 video via WhatsApp.

Luckily, while the new vulnerability had the potential to be at least as damaging as the previous buffer overflow flaw, it appears that this one was not being actively exploited by attackers prior to being patched by Facebook. However, this demonstrates the importance of keeping such applications up-to-date (so that Facebook-provided security patches are applied) and to consider the risks associated with using these applications for personal communications.

Protecting Against Buffer Overflow Vulnerabilities

Buffer overflow vulnerabilities are nothing new. They are extremely simple vulnerabilities – only involving a failure to properly manage memory and user input – yet they can be extremely difficult to detect. A wide range of buffer overflow vulnerabilities exist, and sometimes apparently “safe” code can be vulnerable since another vulnerability can be exploited to bypass existing protections against buffer overflows.

The two major WhatsApp vulnerabilities disclosed and patched in 2019 demonstrate the potential impact of a buffer overflow vulnerability in a critical application. Both of these vulnerabilities could be exploited without user interaction, and enabled an attacker to run malicious code within the victim application. In one case, the vulnerability was exploited multiple times to spy upon parties of interest to various governments, leading to a lawsuit by Facebook against the suspected perpetrator.

Protecting against buffer overflow vulnerabilities requires the ability to identify and block potential exploits before they reach a vulnerable application. Deploying a strong web application firewall (WAF) to protect an organization’s web presence and runtime application self-protection (RASP) for critical or potentially vulnerable assets is an important first step toward protecting an organization and its software assets against exploitation.