UCS - Insider Threat Blog Article - 062022

Insider Threat - Define and Defend

When you think of cybersecurity threats to your company, you’re almost always thinking about threats from outside your sphere. Dark Web profiteers. Competitors. Malicious hacking groups. Cybercriminals. But are you considering the possibility that an insider threat can be the biggest risk to your organization?

Read more


Poison Attacks 101 - UCS Blog Article

Poison Attacks 101

Smart technology is everywhere. Not just in our offices, but even in our day-to-day lives with tools like Google Home and Alexa becoming a commonplace. With technology becoming smarter every minute, the risks are increasing by the minute as well. Cyber-criminals are finding new ways to corrupt our IT networks to disrupt our businesses, hold our data hostage and even clear out personal bank accounts. Some of the more overt, commonly known acts of cyber-crime include hacking, phishing, and ransomware attacks. This article discusses a lesser-known cyber-crime. Let's take a look at Poison Attacks 101.

What Are Poison Attacks

Poison attacks are attacks on the ability of a system to make smart decisions. Think about this for a second. How do systems make intelligent decisions? Based on the training or data they receive. This data is used to hone the artificial intelligence of the system to help make smart decisions. Poison attacks mess with the very base layer – the training data set - by skewing the system’s data model in such a way that the output is no longer as intended. They create a new normal for everything and are primarily used as a backdoor attack method. In a backdoor poison attack, the attacker creates a loophole in the core data rule and trains the system to adhere to that rule so it can be exploited at a later time.

For example, let’s say the access control for a particular file is set such that it will allow only those beyond the VP level to view the data. If someone changes the main parameter to include manager level access, the core data set is violated and the system will not detect an intrusion by someone at the manager level, even if they log in with their credentials.

Poison Attack Methodologies

Poison attack methodologies typically fall into one of the following 4 categories:

    • Logic Corruption
    • Data Manipulation
    • Data Injection
    • DNS Cache Poisoning

Logic Corruption

In Logic Corruption, the attacker changes the basic logic used to make the system arrive at an output. It essentially changes the way the system learns, applies new rules and corrupts the system to do whatever the attacker wants.

Data Manipulation

In Data Manipulation, as the name suggests, the attacker manipulates the data to extend data boundaries that result in backdoor entries that can be exploited later. Unlike Logic Corruption, the attacker doesn’t have access to the logic, so they work with the existing rule and push data boundaries further with a view to accommodate them later.

Data Injection

In Data Injection, the attacker inserts fake data into the actual data set to skew the data model and ultimately weaken the outcome. The weakened outcome then serves as an easy entryway for the attacker into the victim’s system.

Protecting Yourself Against Poison Attacks

Data poisoning by way of logic corruption, data manipulation and data injection happens when the attacker finds a way to access your data set. The kind of poison attack varies depending on the level of access the attacker is able to achieve. Here’s what you can do to ensure such access is prevented:

  1. The data poisoning attacks discussed above adversely affect your IT system’s machine learning capabilities. So, the first logical step would be to invest in a good machine learning malware detection tool. These tools are different from the typical anti-malware tools you get in the market and are specifically designed to prevent machine learning capability poisoning.
  2. Always follow general IT security best practices such as:
    • Training your employees to identify spam, phishing attempts, and possible malware attacks.
    • Following good password hygiene, which means never sharing passwords and only using passwords that meet the required security standards.
    • Having a powerful IT audit process, tracking and version control tools, so as to thwart any possible insider attack.
    • Ensuring the physical security of your IT systems by way of bio-metric access, CCTV systems, etc.

DNS Cache Poisoning

In one of the most common poisoning attacks, the attacker poisons the DNS Cache with the aim of leading visitors to a fake website. In a DNS cache poisoning case, the attacker gains control of the DNS server and then manipulates cache data such that anyone typing the URL of the actual website is redirected to the fake one. This could be a phishing site where the attacker would have carefully laid out a trap to capture the unsuspecting victim’s personal data or secure information. For example, the visitor thinks they are logging into their bank’s website online, but are actually on the attacker’s phishing site, where they enter the login credentials.

Protecting Yourself Against DNS Cache Poisoning Attacks

As discussed before, one of the most common poisoning attacks are DNS attacks. You can prevent this by bringing a trained professional onboard for your DNS server set-up. An expert will know to set up your DNS server such that it has a minimum relationship with other, external DNS servers, thus limiting your attacker’s ability to corrupt your DNS server using theirs.

As a best practice, ensure that your DNS servers only store data related to your domain and not any other information. It is harder to corrupt the system when it focuses on a single element.

Another best practice is to ensure that you are up-to-date on all DNS security mechanisms and are using the most recent version of the DNS.

Ensure your site has an SSL certificate and is using HTTPS protocol. Using encryption, a site with HTTPS protocol allows for a more secure connection between its server and the internet and is better at keeping cyber-criminals out. Have an SSL certificate also ensures your site’s name shows up alongside the URL in the address bar. This is an easy way for visitors to identify if they are on a genuine site or not, thus helping them steer clear of phishing attacks and clone sites.

Data poisoning is one of the lesser-known and hence less talked about forms of cyber-crime. But, it can inflict great damage – perhaps even more damage than the other obvious threats such as viruses and ransomware, because, unlike a Denial of Service (DDoS) attack or a Ransomware attack where you know the moment the malware has hit your system, in a data poisoning attack, the malware is incorrect data that slithers into your system quietly and changes its overall functioning before delivering the big blow.

Preventing attacks on your data and infrastructure is where Unique Computing Solutions specializes with comprehensive Managed Security Service packages an a complete team of professionally educated technicians to back it all up. Give us a call today to see how we can help improve your security from day one: 708-922-9444


Email Protection 101 - UCS Blog Article

Email Protection 101

Email is the most critical communication tool for your business. Communicating via email is fast and easy, just like using a phone, but also leaves a legal trail of evidence that brings accountability to any communication. In this quick Email Protection 101 article we are going to show you some of the most common ways of helping secure your most used form of communication both at work and at home.

Read more


Cloud Security Essentials - UCS Blog Article

Cloud Security Essentials

More and more businesses are switching to the Cloud to store their data and rightly so. The Cloud offers numerous benefits over the traditional, physical on-site server, however it also comes with it's own potential issues. Follow along as we explore Cloud Security Essentials in the article below.

Read more


Employees and Cybersecurity - UCS Blog Article

Employees and Cybersecurity

For any organization, employees are the biggest asset. But, what happens when your biggest assets also turn out to be your greatest threats and liabilities? Let's take a moment to talk about Employees and Cybersecurity. That is, after all, how cyber-crime can change the game.

Read more


Must-Have IT Checklists for SMBs - UCS Blog Article

IT Checklists for SMBs

Whether you have your own in-house IT Team, or have outsourced your IT needs to be taken care of by a Managed Service Provider, you need to have a bunch of ‘IT Checklists’ readily available...and that can be a daunting task. Stay tuned and follow along as we provide our Must-Have IT Checklists for SMBs that you can use for your own business.

Read more


Recognizing Phishing Attacks - UCS Blog Article

Recognizing Phishing Attacks

Cybercrime is on the rise, and hackers are using any opportunity to take advantage of an unknowing victim to gain access to personal information for financial gain. Recognizing phishing attacks or attempts can help you ensure that critical information and data remains secure.

Read more


SMB Security Tips - Our Top 7 - UCS Blog Article

SMB Security Tips - Our Top 7

A massive global shift to remote working environments has created an open-season for cybercriminals. No business - big or small - is safe. Small and medium businesses (SMBs) seemingly have a target on their backs, so strengthening your company's security posture is essential right now. This process doesn't have to be stressful or time consuming. There are simple ways to protect business data against ransomware attacks right away and long term solutions to help your business boost resilience to cyber attacks. Here are a few of our top SMB security tips and suggestions:

Read more


On-Site Support Guidelines - COVID-19 Re-Opening Phase

Unique Computing Solutions has always taken pride in being able to lead the way in advanced network and IT solutions coupled with the superior customer service that our clients have come to expect. On the heels of several countries, states, and communities set to begin a strategic re-opening process, we wanted to keep you up to date on what we are doing internally and how we plan to move forward in this new normal.

Read more


New Security Concerns Over Video Conferencing Apps

As you may have read or seen recently, Zoom Video Conferencing has been in the news regarding security concerns over their platform as more and more businesses transition to remote work environments. Although some of these concerns have been addressed by Zoom and are currently being worked on by their developers, we have been made aware of 2 new risks that pose a serious threat to platform users.

Read more