Possible vulnerabilities in your company!

[sanjida708]

In a company, vulnerabilities can arise in various processes and technological assets.

Examples of this include: poorly configured computer network, incorrect denmark phone number data implementation, deficient internal controls in a system, weak passwords, sensitive data without adequate security policies, inadequate auditing, among others.

In fact, vulnerabilities can manifest themselves in different ways, depending on the use of technology in each company. The lack of continuous monitoring and a complete assessment of the digital infrastructure can result in vulnerabilities that go unnoticed, favoring cyberattacks.

For this reason, vulnerability analysis is extremely important to prevent any security breaches in a company.

Therefore, it is necessary to identify and correct vulnerabilities regularly and continuously in order to guarantee the security of business assets and prevent possible financial and brand reputational damage.

In our example, as in most cases, Sossegado 's badge contained sensitive data such as the company name, full name, photo, CPF and the company registration number. With this data, criminals can cause a series of damages, both to the victim and to the company in which he works.

Among the threat types in this example are:

Loan request in the victim's name
Providing databases for purchases or fraud
Extortion
Access to company premises posing as the victim
It is worth noting that card copying devices are increasingly popular and that simply bringing the device close to the badge is enough for it to be copied and then used for cloning. If the criminal in our example had one of these devices in his hands, the badge would remain on the table and the possibilities of attack would be the same.

#In a meeting
Entering a password near other people

“Ms. Calma enters the meeting room. Among the people in the room, there is an employee with whom Calma does not get along very well, and the only available chair is next to her. She sits down, opens her laptop and makes some notes about the meeting, writes down the pending issues and at the end of the meeting, turns everything off and leaves. The next morning, her presence is requested in the IT room, and she receives information that she deleted confidential and critical files from the server. Desperate, Ms. Calma claims her innocence and, after a long investigation, the IT team sees that the security cameras show that she left at the time she said she would and that someone used her password to delete the files.”

This technique, although popularly known by several names, is called shoulder surfing . In this case, someone with malicious intent within the company itself wanted to cause serious damage to the company and to a person for personal reasons, but the applications for this attack are very diverse. In addition to the example mentioned, this technique is very common in ATM or bank queues, where victims are robbed as they leave and the criminals immediately use their cards. It is also commonly used to steal cell phones, that is, before stealing, the criminals wait for the victim to use the device and memorize their PIN.

When taking vacation
Posting lots of photos on social media

This warning is primarily aimed at social media users who make any of the following mistakes: accepting anyone as a contact and posting sensitive information. It also applies to people who, despite not accepting anyone on social media, publish sensitive information publicly.

Considering that all information that allows us to identify your behavior patterns is sensitive, as it gives access to you physically, let's take a common example.

“ Mr. So-and-so goes on vacation and posts a series of photos of himself packing his bags, asking his contacts if he’s forgotten anything, and in the middle of these photos he shows the flight tickets to his destination at the airport. In one of the posts he mentioned that he would be traveling for 20 days. When he returns from his wonderful trip, he realizes that his house had been robbed and all his belongings stolen. So-and-so doesn’t understand how this could happen now…”

Steps for vulnerability assessment

Vulnerability assessment, in addition to covering the analysis phase, also involves identifying weaknesses, using different criteria that allow qualifying and quantifying their impact.

In general, vulnerabilities can be found in systems because they may contain known and unknown security flaws (0-day vulnerabilities), default settings or the result of configuration errors.

To solve these problems, different methods can be applied to assess failures in a company's infrastructure. In general, the following activities are considered.