Security managers are constantly asked what keeps them up at night. Unfortunately, given today's threat landscape, it's a very long list.
Here's some help navigating through seven common security flaws, from lack of encryption in cloud apps to holes in Microsoft Word and issues with IoT devices.
Lack of encryption in cloud apps. Medium and large enterprises develop and use enterprise applications on a large scale for various purposes, but a lack of encryption coupled with serious security flaws in these applications makes enterprises vulnerable to sophisticated hacking operation. Research released by security firm Trend Micro found that enterprises downloaded 81 percent of their data on applications that didn't include encryption for data at rest. At the same time, because most of these applications were developed without keeping IT security departments in the loop, the IT teams were not able to patch flaws in vulnerable applications.
Elevation of privilege vulnerabilities. On a typical Patch Tuesday one week Microsoft took care of 50 vulnerabilities, and the majority of the fixes dealt with elevation of privilege vulnerabilities that can allow attackers with a foothold on the computer to gain SYSTEM-level privileges. Security experts often say that more than even malware prevention, handling access and privileges issues can stop the majority of serious breaches.
Flaws in Microsoft Word. What can go wrong with Microsoft Word? Plenty. Israeli cybersecurity firm Votiro found that malicious actors can abuse Microsoft Word's Online Video feature to deliver videos that secretly exhaust their viewers' computer processing power and then mine cryptocurrencies. When it works properly, the Online Video feature lets users insert remote videos directly into their documents without having to embed them. But Votiro's Amit Dori claims because of insufficient sanitation, the feature makes Word software vulnerable to browser-based cryptojacking. Word has become a de facto standard, so this potentially affects millions of machines.
Holes in messaging apps. Don't trust messaging apps? Maybe that's a good idea. Academic researchers found vulnerabilities in the group communications protocols of three encrypted messaging apps: WhatsApp, Signal and Threema. The flaws reportedly allow attackers to willfully subvert their integrity and confidentiality. While these messaging apps tend to hold up for one-to-one communications, they break down when three or more users communicate as a group, according to a paper published by researchers at Germany's Ruhr-University.
Overlooking holes in Bluetooth. In the aftermath of the initial reports last year about BlueBorne Bluetooth vulnerabilities, researchers published papers that say Bluetooth technology has long been overlooked by security researchers. In a technical paper published by IoT security company Armis, too many apps are defined in the stack layer with endless replication and features. This complexity has dissuaded researchers from careful auditing, but CheckPoint Software Technologies warns that it may only be the tip of the iceberg.
Flaws in PostScript printers. Initial reports came out about a year ago, but it's still scary. Last year, German researchers from Ruhr-University found that roughly 20 popular models of printers are vulnerable because of a 33-year-old flaw that lets an attacker access and manipulate documents, steal passwords and shut down printers. The vulnerability is present in just about every PostScript printer ever produced, according to researcher Jens Muller in an advisory.
Issues with IoT systems. IoActive and Embedi researchers released a white paper that outlines 147 vulnerabilities in 34 mobile applications used in tandem with Supervisory Control and Data Acquisition (SCADA) systems. The vulnerabilities could let an attacker compromise industrial network infrastructure by allowing them to disrupt an industrial process or cause a SCADA operator to unintentionally perform a harmful action on the system.
