You’re as secure as your apps’ developers allow them to be

We rely on our apps. Every day, we use our favorites to check the news, the weather forecast for our upcoming holidays, and to communicate with our beloved ones. Some apps, especially system apps, are continuously used regardless of other apps that are in use. Keyboard is one of them. Recently, a dangerous vulnerability was discovered […]

Obtaining your .BANK Domain; a New Best Practice

It will take a little more effort and a little more time to register new .BANK domains for your bank’s trademarks, trade names and service marks, but it’s worth it.

Twitter Card Style: 

summary

Remember how quick it was to register your bank’s .com and other domains. You went to your registrar’s homepage, typed in preferred domain names, clicked a few times, entered billing information and you were done. Within a few seconds, you had confirmations and a new online home.

It will take a little more effort and a little more time to register new .BANK domains for your bank’s trademarks, trade names and service marks, but it’s worth it. Here’s why:

All .BANK domains will be verified by Symantec before the registration is confirmed; part of the enhanced security requirements for .BANK domains required by the .BANK registry fTLD.  Because this process cannot be fully automated, it requires that we talk to one or two people at your bank.

Verification ensures that only eligible institutions – banks, bank associations, regulators and certain core service providers – have .BANK domains. It also ensures that the person registering .BANK domains for your bank is authorized to do so. Verification protects the integrity of the .BANK gTLD and the integrity of the banks and other organizations that register .BANK domains. You can learn more about the verification process and Symantec’s role here.

During the registration process you will be asked for the bank’s contact information, regulatory ID number, and the government regulatory authority that charters your bank.

You registrar will also request the name and contact information of someone at your company who can verify the employment information of the registrant contact and the share the name and contact information for someone who can verify that the registrant contact is authorized to register the domains requested.

You can help make the registration process smooth and quick by following a few simple guidelines.

  1. Make sure you have all the necessary information, including contact information for others at your bank, available when you start the registration process.
  2. Tell your colleagues that they will receive an important call from Symantec, and why. It will only take them a few minutes to get us the information we need.
  3. Finally, take a few minutes over the next day or two to see if your colleagues have received a call from a Symantec representative and were able to give us the information we need to verify your bank’s .BANK domain(s).

These few additional steps will help ensure that you get the okay for your .BANK domains as fast as possible. The process typically takes a day of two. It is not as fast as a click, but your bank’s new .BANK domains will set a solid foundation on which to build and maintain your online brand.

Digital Bank.jpg

iCloud celebrity photo hack: What’s fappening?!

Just about a year after a plethora of celebrities’ nude photos were leaked online, two homes in south Chicago have been raided and investigators have named one of the suspected hackers. As this controversial story and investigation continues to unfold, Avast researchers have come up with a few speculations regarding the origin and motivation behind […]

??????????????????????????????????

      No Comments on ??????????????????????????????????

攻撃者は、テキストメッセージとちょっとしたソーシャルエンジニアリングを利用するだけで Gmail、Hotmail、Yahoo メールのアカウントを侵害しています。

Read More

New Rules: Feds Mandate HTTPS on U.S. Government Sites

The White House has mandated that all public-facing Web sites of the federal government must implement HTTPS within the next two years.

Twitter Card Style: 

summary

Have you read the news lately? It seems like hardly a week can go by without another data breach happening.

In the past few years, cybercriminals have upped their game considerably, using incredibly sophisticated attacks in growing number. Out of every six large companies, five were targeted last year for attack—that’s a 40% increase over 2013.*

The recent breach on federal employees’ private data, allegedly from China, only underscores the continued looming menace cybercriminals present—and this threat hasn’t gone unnoticed by the feds.

In a January 12 post on the White House Blog, President Obama is quoted as saying: “This is a direct threat to the economic security of American families, and we’ve got to stop it.” Further adding, “If we’re going to be connected, then we need to be protected.”  So true! And that line of thinking is what prompted the U.S. government’s latest move.

To help combat these attacks, the White House has mandated that all public-facing Web sites of the federal government must implement HTTPS within the next two years.

This is no minor security update. It carries far-reaching implications that extend beyond the fed. Here’s what we mean.

What HTTPS Offers to Everyone

HTTPS provides a secure line of communication over the Internet, combining the usual HTTP (Hypertext Transfer Protocol) that you see in the address bar of unsecure sites, with SSL (Secure Sockets Layer) that you’re likely to see on most sites involving financial transactions.    

This federal move shouldn’t come as a surprise, as the majority of the U.S. government sites have already made the switch to the secure protocol. This includes whitehouse.gov, which made the switch on March 11, 2015, to other federal sites that made the jump earlier, like ftc.gov, donotcall.gov, and others.

This goes beyond the initial site communication handshake—drilling down to subdomains, like examplesection.whitehouse.gov, too.

Up until now, many government sites are current with NIST-recommended SSL standards, but the administration has now moved to make prioritizing security and privacy a common practice among all aspects of federal government sites.

Make no mistake about it, this is huge!

These extra security measures follow the Always On SSL tenets advocated by the Online Trust Alliance, exhibiting some of the strongest moves yet to protect the identity and personal information of U.S. citizens online.

Others Must Follow, Strengthening the Security of the Web

Cybercrime isn’t going to easily back down.

Now, it’s far too easy to compromise private information on sites with subpar security. Today’s cybercriminals are smart and tenacious. By protecting all aspects of a site with SSL—not just transaction pages—businesses can help quell social engineering techniques. These complex ruses can now fool even the savviest netizens into handing over their private information to the bad guys.   

Nothing is 100% unhackable now and forever. But just like locking your car doors when you’re out, providing as much security as possible is still a good great idea! By expanding the coverage of SSL, we help further the strength and backbone of the Internet itself.

*2015 Internet Security Threat Report, Volume 20

Easy Ways to Help Boost Your Bottom Line with SSL

Let your site visitors know their transactions are secure!

Twitter Card Style: 

summary

Attending to all of the day to day routines in running a small business can eat up so much of your time that you don’t have any spare moments (or energy left) to devote to actually growing your business. Everything seems to fall into the bucket of “get it done and out the door.”

We’re here to help.

There are only so many ways to reduce the costs of running your business no matter how silver-tongued your negotiations may be, and one person can only juggle so many hats when trying to be the owner, customer service manager, IT department, and graphic designer all rolled into one. (Whew!)

Take a breather and discover some easy things you can do tomorrow to help your business grow. Let’s get right to them!

Let your site visitors know their transactions are secure

People care about security—a lot. They also care about appearances. There’s a reason why your local bank always has employees dressed to the nines, cameras everywhere, and a security guard.  

Use this frame of mind when designing your website. With all of the stories of data breaches hitting the news, customers are more wary than ever about handing over their credit card information. They want to feel secure.

Assure them right up front by displaying a SSL (Secure Socket Layer) Trusted Site Certificate in a highly visible location. Use it in multiple places, like your home page, login page, and buy page. It’s recognized worldwide and immediately assures people that they’re dealing with the right business—you.

Show visitors the green bar

Not all SSL certificates are created equally. EV (Extended Validation) certificates include a green bar where you type the URL. The exact appearance differs slightly depending upon which browser you’re using. No doubt you’ve seen this when visiting your financial institution online.

Now, your average customer isn’t going to think, “Aha! That site is using a certificate with extended validation. Cool!” But customers will recognize the visual cue (green means go), and they will have seen it at other sites known for their security and be assured they’re not on some phishing site.

Moving over to EV SSL certificates is painless and it’s an easy way to lump your small business in with the big boys for a fairly nominal annual cost.

Avoid cutting corners on security

To many small businesses, every dollar counts. But while you can save the freshly stocked break area for later, online security doesn’t fall into the “nice to have” category. It’s now essential. One data breach is all it takes to destroy everything that you’ve worked so hard to build up.

While the number of mega breaches decreased in 2014, according to the 2015 Website Threat Security Report, the overall number of breaches increased. As the report recommends, keeping your server configuration up to date and ensuring that old, unsecure versions of the SSL protocol (SSL2 and SSL3) are disabled, and newer versions of the TLS protocol (TLS1.1 and TLS1.2) are enabled and prioritized is the way to go.

Sound like technobabble gobbledygook? It isn’t hard to implement, and the digital stitch in time here could pay off far more than saving time later. Talk to your SSL salesperson and make sure you’re up to speed.

While you may not have the budget of some major corporation (yet!), these methods are some easy ways to tweak your SSL certificates and help you get the most mileage out of them.