Will Websites Be the Next Target of Ransomware Attacks?

Recent research by Wordfence indicates that Wordpress might be the next big ransomware target. Wordfence found that certain Wordpress plugins exhibit malicious behaviour in the form of ransomware against the host website. Typically, these plugins will encrypt the data on the website, thereby rendering it non-functional, and then attempt to extort payment from the owner in order to decrypt the website. An obvious concern arises as to how susceptible large corporate or enterprise websites are to similar attacks. It’s Wordpress today, which is more the domain of private blogs or small business sites, but how long before these attacks are adapted to target larger enterprise websites? One advantage businesses may have is that the technical or security skill level of members of a typical corporate IT or security department is significantly higher than that of an average Wordpress user. Wordpress by its nature and design is easily extensible by many freely available and powerful marketplace plugins; however there is nothing to prevent an attacker embedding a malicious payload (in the form of ransomware toolkit) into a plugin. Most corporate or enterprise sites, on the other hand, will be bespoke software development projects written in one of...
Read more

Security: Make a Commitment to Working With Development

The days of security and development working side by side in separate silos are over. With the DevOps-induced security “shift left,” security testing now falls in the realm of the developer, and leaves security in more of an enabling, rather than enforcing, role. And this new role requires a new understanding of developer priorities and processes. The security function cannot be effective in a DevSecOps world without a thorough grasp of how developers work, the tools they use, the challenges they face and how security fits into this picture. In a DevSecOps environment, developers own the testing of applications in their development environment, fixing flaws to pass policy and continuing to build code. Security owns setting policies, tracking KPIs and providing security coaching to developers. In addition, security is responsible for providing developers with support in integrating scalable tools like Veracode into their SDLC. With the traditional security role of running scans on completed code and passing back reports to developers, a lack of understanding of the developer function wasn’t necessarily a show-stopper. But security’s new role does require this understanding – without it, security professionals simply won’t be effective and will get left behind as the...
Read more