Articles

Be wary of plausible-looking log-in forms - they could be a phishing attack designed to steal your password. An Apple iOS researcher has discovered that it takes hardly any time or expertise to knock together the coding for a bogus pop-up requesting a user's credentials. Even Apple's two-factor authentication is far from impregnable.

For instance, the counterfeit form that asks users to 'Sign in to iTunes' is almost impossible to distinguish from the real thing - and yet it was the work of a mere quarter of an hour to create it.

As is often the case, malicious actors thrive on human fallibility, carelessness or time pressure. The best way to avoid this pitfall is to click on the 'Home' button. If the app vanishes, it's a phony. Also, avoid entering credentials into a pop-up - close it and instead open 'Settings' manually.

​​​​​​See the full article on ibtimes.co.uk and find out more about our Cyber Cover here.

There's probably no mention of malware in the Hippocratic Oath. However, malicious software is now posing as much as a threat to patient's lives as a hospital superbug or a slip of the scalpel.

While doctors battle to restore their charges to good health, their efforts are being under minded by lax security in medical machinery. Alarmingly, 85% of hospitals in the US don't have any specialist IT security staff. 

The effect of the WannaCry ransomware incursion on the NHS earlier this year highlighted the vulnerability of hospitals worldwide to a malware attack - which could easily have prevented patients receiving life-saving treatment. In a simulated exercise, US doctors found that patients could die almost immediately if lifts and refrigerators failed to function. 

Some machines are just too old to be patched and manufacturers of new systems are failing to address security issues with adequate speed. Red tape is also slowing down the security process. Perhaps a high profile catastrophe or two will help to focus attention on this problem.

​​​​​​See the full article on theregister.co.uk and find out more about our Cyber Cover here.

A cyber attack forces Taxis Palmerston North and First Direct taxis in Christchurch to shut down their systems. 

NZ Taxi's communications managing director Mark Bramston said the attack happened on Tuesday and systems were shut down to protect business, client operations and data.

The ransomware attack affected taxi dispatching services in both Palmerston North and Christchurch, including their backup servers and database.

Bramston said the threat was isolated and no other business operations were affected. There was no evidence to suggest confidential information or personal data of any kind had been disclosed and they believed the ransomware breached their systems via a remote desktop login.

Work was underware to bring the systems back online.

"We have reported this extremely concerning incident to Cert NZ, NZ Transport Agency and the police and are working with our dispatching manufacturer to help ensure the environment is as secure as possible.

"We offer our sincerest apologies to our customers for the disruption to our services".

​​​​​​See the full article on stuff.co.nz and find out more about our Cyber Cover here.

The impacts of cyber-crime are being felt by many businesses, with more than $730,000 worth of direct financial losses caused by cyber-attacks, according to a recent report form the Computer Emergency Response Team New Zealand (CERT NZ).

In a recent report, PwC ranked cyber-attacks as the fourth-biggest risk facing the NZ insurance industry. As a response to this growing threat, the government in 2016 invested $22.2 million to set up CERT NZ, an organisation that supports businesses and individuals affected by cybercrime. 

In a report from MinterEllisonRuddWatts, CERT NZ has said that 33.6% of the incidents reported were related to phishing, a practice of sending fraudulent e-mails, which is one of the easiest routes for hackers.

"This means if your staff aren't vigilant and don't know what a phishing email might look like, your business and its operating systems are at real risk" MinterEllisonRuddWatts said.

MinterEllisonRuddWatts enumerated a quick guide on how to educate employees to prevent corporate systems from being breached:
 

•   Update passwords frequently
•   Do regular back-ups
•   Remind staff not to ignore system updates
•   Instruct staff to be cautious of suspicious links
•   Support staff with regular training
•   Share stories of cyber-attacks

Surely everyone has at some time been the recipient of an amateurish email scam from Nigeria? Well, Nigerian scammers have just got a whole lot more professional - so much so that an international cybersecurity specialist mistook a long 20-something chancer from the outskirts of Lagos for a full-on, nation-state hacking operation.

The attacks against more that 4,000 global energy, construction, mining, oil and infrastructure companies took place in spring. It employed a phishing scheme to spread malware-infected emails that appeared to come from Saudi Arabia's huge state owned oil and gas company Saudi Aramco, with the objective of raking in corporate banking details.

Despite the somewhat homespun nature of the attack, at lease 14 companies fell for the scam, parting with several thousand dollars. This demonstrates that phishing still works - exploiting human gullibility and a general lack of corporate good practice. 
 

Troy Hunt in an Australian web security expert and creator of the "Have I Been Pwned?" website that allows users to check if their personal data has been breached. In his latest blog he pulls together information from a number of sources to give a fascinating and very practical guide to the ways in which we can keep our online accounts safe by improving our password etiquette - and how businesses should ensure users' password security.

Hunt reviews all aspects of authentication - including how to make passwords more secure, the hazards of password hints, the value of password managers and how systems should react to multiple logon attempts.

While he does not approve of compulsory password changes, as attackers generally exploit stolen passwords straight away, he does advocate the monitoring of logins to detect unusual use.

His insistence that users should be notified of abnormal behaviour might might not sit well with everyone, as notifications of this kind can (and already do) spiral out of control. More practically and arguably easier to implement, Hunt argues that all previously breached passwords should be blocked.

There's a whole lot more in this blog post, and if nothing else, it makes for an interesting read, illustrating the many possible pitfalls of password management. 
 

Webinar software is widely used and trusted by businesses and individuals around the world, some of whom may not be as cyber aware as they could be. In many cases, the launching of a webinar app requires the download of a file onto a viewer's device, which can act as the vehicle for malicious code.

Until recently there were a few critical vulnerabilities in Cisco's widely-used WebEx video conferencing software which were arguably a bit more pernicious. A vulnerable Windows machine could visit a modified and malicious page on the internet which would then use the webinar plug-in to make the machine do its bidding.

In order to rectify this, Cisco has taken steps to repair the holes in the Chrome and Firefix WebEx plugins that run on Microsoft Windows and which are integral to large numbers of its telecoms customers.

Cisco has now issued patches for both browser extensions and, to be on the safe side, has also released an update for Microsoft browsers. In order to ensure their system is covered, Windows users should check the browser's extensions menu for updates. 
 

Local arms of global companies are shutting down operations as a precaution against a worldwide ransomware attack.

The ransomware virus cripples computers running Microsoft Corp's Windows by encrypting hard drives and overwriting files, then demands $US300 in bitcoin payments to restore access.

A major international law firm, DLA Piper, has shut down its New Zealand office among others because of the attack.

The market research firm Colmar Brunton has also shut down operations as a precaution since its British parent company was attacked. 

The Cadbury chocolate factory in Hobart has also been targeted, the ABC reported.

New Zealand's cyber emergency response authority, Cert NZ, advised people to back up their systems and store files outside their network. If the ransomware did hit, people should turn off their computer, and not turn it on again, as an IT specialist may be able to recover their files. 

Nick Savvides, strategist at security firm Symantec, said New Zealand was not immune to the fast-growing area of cyber crime. 
 

Google warned users to beware of emails from contacts asking them to click on a link to Google Docs, after a large number of people complained their accounts had been hacked.

Google has taken steps to protect users from the attacks by disabling offending accounts and removing malicious pages.

The attack used a relatively novel approach to phishing - a hacking technique designed to trick users into giving away sensitive information - by gaining access to user accounts without needing to obtain their passwords.

They did so by getting an already logged-in user to grant access to a malicious application posing as Google Docs.

Google encourages users to report phishing emails in Gmail, and if you think you've clicked on a fraudulent email, visit g.co/SecurityCheckup and remove apps you don't recongnise.
 

No one likes unsolicited mail. So, on the face of it, Unroll.me's inbox decluttering service looks like a godsend - except that by giving it access to your account you are laying yourself open to even more invasion of your privacy.

And it's not just Unroll.me that passes on users' private details to interested third parties. Google and Facebook apps, sites and plugins, are equally inclined to use your data to their advantage.

Fortunately, it is relatively easy to extricate yourself from these intrusions, as outlined in wired.com's editorial. Give it a try during your lunch break, you might be surprised to see how many applications you've unwittingly granted access to. It is certainly worth bearing in mind that the more add-ons you have, the more access points there are to your data and the more vulnerable your information becomes.

Cybercrime costs New Zealand businesses about $250m-$400m a year - though that is only an estimate as a vast number of cyber attacks are not reported.

According to leading cybersecurity company Kordia and Peter Bailey, general manager of Aura Information Security (Kordia's specialist arm), New Zealand is particularly vulnerable. Bailey says there are five most common mistakes companies make in addressing - or not addressing - the need for cybersecurity:

1. People believe it won't happen to them
   "People still think we are geographically isolated, a small country at the end of the world that doesn't have anything worth stealing," says Bailey.
    
2. Internal/personal security laxes
   Bailey says the widespread habit of using the same or similar passwords for work and personal accounts is also a hacker's dream. The massive 2015 cyber attack on US health insurance giant Anthem (78 million customer records exposed) came when an employee opened a "phishing" email. Educate your staff. 
    
3. General lack of "security hygiene"
   Many people and businesses ignore running windows or anti-virus updates, preferring to address other, more convenient mattes. But those updates are a built-in line of defence for software and apps to patch any discovered vulnerabilities or potential backdoors into the system. 
    
4. Not all cyber attacks come from computers
   The vulnerability of staff can be a great source of wealth for hackers, Bailey says. A test that Bailey runs is when they "pretend to be an IT repair company and ask for information over the phone, or call someone and pretend to be an executive and shot at them until they give us the passwords we need. It often works".
    
5. Business partners need to be part of your network
   Third parties - business or suppliers - can also be a way in for hackers. The infamous hack of 40 million customers' credit and debit card details from the US Target chain of stores came about when hackers compromised a contractor to gain entry and the acquired advanced rights. At a minimum agree some security measures with supplies and contractors. 

Android smartphone users are at risk from new Trojan malware that cons victims by tracking and mimicking their activities in order to steal data.

The malware uses a persistent update screen to encourage victims to download a bogus Adobe Flash Player app as a security measure. If the user succumbs to the constant badgering, the attackers can then install malware, and potentially spyware or ransomware, on to their device. Once in, they can go about their malicious activities undetected. 

In order to avoid falling victim, Android smartphone users should only download apps from bona fide sites. Anyone already infected can either try to remove the malware manually or use a mobile security solution to spring clean their device. 

Consumer Protection and accounting software company Xero have advice on reducing the risk of fraud or email accounts being compromised.

Improve your email security

If your email provider offers Two-Factor or Multi-Factor authentication (2FA/MFA) make sure you use this. This adds another layer of protection to your email account that makes it much harder for attackers to get access, even if your password is compromised.

Check the account number

Tell customers to check with you in person - and not by email - any invoice with a new payment bank account number.

Look for signs

Tell customers to think twice about invoice double ups and check for obvious signs of a scam, eg:

•    an unusual sender's email address
•    spelling mistakes
•    demands for payment by a certain date
•    signs the email is different from ones they usually get from you.

Sometimes we seem to invent things just for the heck of it. Wired.com relishes the task of exposing the risk of having everyday household devices linked to the Internet of Things. 

It asks, for instance, whether it is essential to be able to start your shower while you are still in bed? Is it vital to have a rubbish bin that opens and closes when you tell it to? How has humanity survived until now without a hair brush that listens to your hair, counts brush strokes and gauges pressure on the scalp? Or a patio umbrella that moves automatically to block the sun?

While none of these innovations pose a huge security risk, they do introduce potentially hack-able items into the home. And with most consumers not changing factory setting passwords, these smart devices can all too easily be drafted into nefarious cyber work. 
 

Today's business world is digital, connected and mobile, and that brings with it increased cyber risk.

Cyber criminals know that if they can reach a user they can gain access to an organisation's data, particularly those who are accessing key systems and data via devices that aren't comprehensively managed by the business.

The below steps are designed to help businesses of all sizes to balance the need for a free and mobile workforce with security requirements.

Understand the needs of your workforce
Engagement with users is essential for developing an organisations end-user computing strategy.

Understand your key risk points
Evaluate and rank your organisations devices and applications according to their perceived level of risk.

Develop firm, transparent policies
A firm policy framework should be based on balancing your end-user needs and your risk points

Communicate and educate
The key for all cyber security policies is to communicate transparently with you staff as end-users will only adopt them if they understand why they are in place.

If New Zealand businesses embrace cyber security, and able to use the internet and the cloud to its full potential, they will be able to increase productivity. 
 

Mean-spirited hackers left residents shivering when they launched a recent DDoS attack on the heating systems at two apartment blocks in Finland. Using IoT devices, the cyber attack disabled the computer systems that control the buildings' central heating and hot water distribution. Once the affected smart home systems had been disconnected from the internet, the heating began to function normally again.

This kind of IoT attack is made easier because of reluctance amongst property companies and private home owners to invest in network firewalls. On a somewhat grander scale, a similar attack recently took the whole of Liberia offline. So when are we going to see legalised minimum security standards for IoT implemented?
 

Up to 10,000 webcams will be recalled in the aftermath of a cyber attacks that blocked access last week to some of the world's biggest websites, Chinese manufacturer Hangzhou Xiongmai Technology Co has told Reuters.

Friday's internet outage alarmed security experts because it leveraged a new type of attack using simple webcams and other connected devices that often lack proper security. 

Hackers harnessed hundreds of thousands of those devices globally to flood US-based internet infrastructure provider Dyn with so much traffic that it could not cope, cutting access to major websites including PayPal, Spotify and Twitter.

The US Department of Homeland Security (DHS) said it had discussed the attacks in a conference call with 18 major communications service providers and was working to develop a new set of "strategic principles" for securing internet-connected devices. 
 

Twitter, Spotify, Reddit, Soundcloud, PayPal and several other well-known sites have been briefly hit by web attacks.

All the firms are customers of a company called Dyn, which they use to help users find their sites online.

In a statement on its websites, Dun posted information about the incidents and said it had been subjected to Distributed Denial of Service (DDoS) attacks.

These attempt to overwhelm servers by bombarding them with huge amounts of data.

The incidents mark a change in tactics, as DDoS attacks are more typically aimed at a single site. 

Dyn said that at lease some of the malicious traffic was coming from connected devices, including webcams and digital video recorders, that had been infected with control software named Mirai. 
 

Kiwi gullibility has been exposed by a cyber security test devised by consultant KPMG.

More than one in 12 workers were fooled into giving away their computer passwords by the simplest of tricks.

KPMG send a fake "scam" email to 8333 people employed by 35 organisations that had agreed to participate in the trial. 1009 of the staff clicked on the link, and 702, or 8.4 per cent, entered their password details. 

The email said their employers had signed up to a "password quality checking website" and invited them to click on a link to check the quality of their password. The email contained some warning signs that should have indicated something was amiss.

"We made the email look like it was sent from an employee within the organisation, but the name did not match the email address. The email also did not include a signature block, and there was no personalised greeting - a couple of red flags" KPMG partner Philip Whitmore said. 
 

The number of Kiwi domains caught up in a global data hack of popular US online file hosting service Dropbox has been estimated at 120,000, while the Government warns that one in five New Zealanders were affected by cybercrime last year - figures that are on the rise.

The New Zealand National Cyber Security Centre (NCSC) has published information on the extent of the breach in New Zealand.

"Since the 2012 breach, the affected accounts have had an enforced password change," a statement by NCSC says. 

"Additionally due to the passwords being hashed and salted, it is very difficult for the passwords to be cracked".

While the risk is low, as with all passwords, the NCSC recommends using complex passwords, two-factor authentication where possible, consider using a password manager tool, and making sure that devices and/or accounts are secured with different passwords.
 

What happens when you add an S to HTTP? Answer - the Internet magically becomes a whole lot more secure.

Hypertext Transfer Protocol (HTTP) is the foundation of data communication for the World Wide Web. Imagine the internet as a series of tubes. Security-wise, with HTTP those tubes are totally transparent. Anyone can look inside and see exactly what information is being transferred at any one time. On the other hand, HTTPS - the S stands for Secure - renders those tubes opaque. It is, in its simplest sense, a basic form of encryption.

Any site asking users to share personal information - from names, to card details and everything in between - should have the secure protocol in place. Google's Chrome browser is encouraging website owners to replace HTTP with HTTPS and will highlight websites which haven't done so as unsecured. Apple and Facebook are due to follow suit shortly. 
 

Gugi, a new banking Trojan, has found a way of sidestepping Google's Android defence system and pilfering users' mobile banking credentials. Gugi creates a bogus overlay screen, then tricks users into handing over their log-in details for their accounts.

Android's 6.0 Marshmallow operating system is designed to prevent this happening, but Gugi has found a way to bypass this. If it doesn't get what it wants, it goes on to block the device - rather like a spoilt child. While Gugi is so far mostly confined to Russia, it is thought to be spreading rapidly. Another reminder why anti-virus and malware detection programs for mobile phones are ever more crucial. 
 

New Zealand companies are being warned they are as vulnerable to cyber-ransoming as any other global company, with as "onslaught" of malicious hackers.

Cyber crimes, and cyber-ransoming in particular are on the rise in New Zealand, according to the GCSB. In a cyber-ransoming attack, a company or individual's online files are locked down, and a ransom demanded for access to be restored.

Technology strategist Mark Shaw said while ransomware had been around for a while, there had been a "significant resurgence" in the past few years. There had been concerted efforts to target business, he said.

"While it takes a lot more effort to target a business, to find vulnerabilities, in their public facing, internet presence, the pay back is significant."

Robert Harris, a New Zealander working in the United States for a security company, said hackers did not care "who you are, where you are" or what you did. 

"To them you're just an IP address and if they can penetrate your network, once they're in there, they'll go as far as they can with the sophisticated devices they've got. 

"It's changed a lot from the days when you've got the kids in hoodies trying to cause chaos, the cyber attacks are very sophisticated now - and it's really not a matter of if, but when, you're going to be breached."
 

Pokemon Go has swept the world in recent weeks and cyber criminals have been quick to note the opportunities for exploitation. A new Android lockscreen malware called Pokemon GO Ultimate poses as an app for the game, infecting a victim's phone immediately following installation and then locking the screen.

Upon restarting their device, the programme then runs in the background, busily clicking on online porn ads. Available through Google Play, the app is a well-thought-out piece of malware as it changes its name and appearance once downloaded, making it easier for it to run unnoticed in the background. 

And it is not the only fake app riding on the wave of Pokemon Go popularity. Two others deliver scareware ads and, depending on IP location, use scam ads and other bogus notifications, all with the ultimate aim of relieving users of their money. So while the dangers of traffic accidents and annoyed partners may not be threat enough to keep people from playing Pokemon Go, perhaps the threat of devices being infected by Pokemon-branded malware is. 
 

A leading Japanese travel agency fears that cyber criminals may have stolen the personal details of nearly 8 million of their customers - including names, home and email addresses and, most worryingly, passport numbers.

Using a common phishing scam, the hackers used a targeted email attack to access the agency's systems. An employee opened a malicious file attachment containing a virus that gave the intruder access to data contained on its server.

They are not alone. Over 6 million cyber incidents against Japanese government agencies were reported in 2015, up from just under 4 million in the previous year - reinforcing the notion that personal information has never been more vulnerable.
 

If you think Ransomware is a nuisance now, brace yourself - it's about to get a whole lot worse as malware becomes ever more sophisticated and insidious. Ransomware is a type of malware that holds a large collection of data hostage on a victim's computer; including important documents, photos and videos. It allows criminals to effectively kidnap data and then sell it back to the victim; whether that is an individual, a business or an organisation storing large quantities of sensitive data.

While non of us like to think we would succumb to ransom demands, sometimes our stored information is just too valuable to lose. Cyber criminals count on exactly this soft spot - and are raking in the money. So how to prevent falling victim to ransomware? Make sure your anti-virus is up to date and that you have a contingency plan in place in case the unimaginable happens. And always keep an eye out for suspicious activity. 
 

Tech company Symantec's latest Internet Security Threat Report said malware had risen at a staggering rate with 430 million new malware variants discovered in 2015, showing that cybercriminals were "leveraging vast resources" to try to overwhelm defences and enter corporate networks.

Last year, New Zealand's global rank rose in five out of six threat categories; spam, phishing hosts, bots, network attacks and web attacks. It also had the eighth-highest proportion of global phishing traffic.

Symantec's Mark Shaw said the increase in ransomware attacks in New Zealand was a growing problem. 

"We saw that increase by 163 percent over the last year. In New Zealand that is around 108 attacks per day."

Mr Shaw said individuals might be asked to pay up to $400, but businesses or organisations like hospitals could be demanded ransoms of tens of thousands of dollars to decrypt files.

"The reason New Zealand is targeted is that we are an affluent nation, but certainly they recognise there is a lot of monetary gain to be made out of both ransomware and the specific markets they target. So we see New Zealand and Australia - Australia actually came in number one, we came in number four - as being consistent and continual targets for ransomware campaigns".
 

Congratulations to CFC Underwriting who were named the Digital/Cyber Risk Insurance Provider of the Year at the Commercial Insurance Awards.

CFC also went on to win the ultimate accolade of the evening, being named the Overall Winner.

In winning the Digital/Cyber Risk Insurance Provider of the Year category, CFC was recognised for having delivered the best digital risk offering in the market over the last year. 

CFC's Cyber Practive Leade, Vicky Paxton, says: "The cyber team is overwhelmed to have won this award. We've made a huge investment in cyber this year and it's been a real team effort across products, claims, marketing and underwriting. To have been recognised by the judges for setting the standard in this vital area of coverage is testament to the passion our company has for this emerging class of insurance. We are incredibly proud and it will spur us on to continue to drive forward its development and innovation."
 

Not even your mouse and keyboard are safe now, as researchers have discovered a flaw in many leading models of wireless accessories. The protocols used to connect these wireless devices to a PC are usually unecrypted, leaving them wide open to outsider attack.

Using a cheap over-the-counter USB dongle, a savvy hacker can use a short code mimicking the PC's real owner, allowing them access to the computer. Researchers have tested leading brands and successfully trialled what are termed "MouseJacks" on numerous occasions.

MouseJack is part of a bigger picture as accessing remote devices across radio airwaves in the latest developing trend amongst hackers - the wireless IoT making it increasingly easy to access systems via peripheral entry points which have historically not been as well protected as, for instance, hardware.
 

Internet fraudsters conned the NZ Fire Service out of $52,000 by impersonating its national commander, Paul Baxter.

The fraudster faked an email from Commander Baxter, asking for the $52,000, and a senior Fire Service staff member followed orders.

Commander Baxter admitted the con was a real blow to him and the team. The money went into a bank account in Turkey, and was gone. "It looks like we'll never be able to recover it. It was withdrawn from the account the day after it was transferred," he said.

"Whaling attacks" are on the rise in New Zealand Government departments and businesses.

NetSafe says in 2015 there were 12 successful whaling attacks which totalled $497,000. In January this year, 3 more were hit costing a further $250,000.
 

Cyber thieves are turning entrepreneurs and are now selling ransomware packages on the dark web. Ransomware is a type of malware which, once installed on a machine, encrypts all the data making it unusable until a ransom is paid and the encryption is removed. One of the common packages for sale is Ransom32, which is written in common codes such as HTML and Javascript; this is believed to be a first for such a virus.

As well as selling the malware, cyber thieves also take a commission of 25% on any ransom collected by the purchaser of the package. Remarkably, Ransom32 even comes with some basic tips to maximise successful heists and the collection of ransom money.

Industry experts advise that the best and most reliable way to protect against ransomware attacks is to always have data backed up, with a system in place to ensure that this is performed very regularly. And the usual advice still holds true when guarding against malware; never open any unsolicited emails or click on links when you are unsure of the source.

A family in Alaska have put their festively decorated home online where visitors are able to remotely control the Christmas lights on the exterior of the house, creating their own light show spectacular.

One of the residents of this property in Fairbanks, Alaska, is an IT expert and set up the system so that users can change the light setting on windows, doors, railings and a Christmas tree in the yard.

The website has proved very popular and the occupants of the house are quite sanguine about the constantly changing display. Fortunately they have no neighbours to upset although the costs associated with running the show are not enviable.
 

You may need to dust off Scrabble and Monopoly this holiday season after hacking group Phantom Squad has promised on Twitter that they will take down the PlayStation network and Xbox over the Christmas period. This is not an original idea; last year, another group called Lizard Squad did just that and took down both.

If successful, not only would players be unable to pit their wits against other gamers online but anyone unwrapping a new console under the Christmas tree will find it rendered useless as it requires network support to set up.

Phantom Squad claim their motivation is to demonstrate the lack of cyber security afforded by Sony and Microsoft despite the huge revenue earned by these companies. However, some industry commentators feel that this could just be a bit of festive mischief with a dash of attention-seeking thrown in for good measure. 
 

As part of the new Cyber Security Strategy and Action Plan, the Government has launched the cyber credentials scheme for Kiwi SMEs.

In New Zealand, around 95% of small businesses use the internet, 66% have a website, and 44% use internet sales, according to the Government.

A survey of New Zealand small businesses released in October reveals that 42% of small businesses are concerned about hackers gaining access to their data.

The cyber credentials scheme proposed for small businesses will mean that businesses with good cyber security practices will have a 'cyber security tick' similar to schemes that acknowledge, for example, healthy food choices or energy efficient appliances.

Amy Adams, Communications Minister, says, "It will enable small businesses to demonstrate to their customers and business connections that they have put in place the basic cyber security practices".

The proposal is similar to the UK's 'Cyber Essentials' scheme. The details of the cyber credentials scheme are in development, and small businesses will be a part of the process, the Government said in a statement. 

The scheme complements the Connect Smart online questionnaire and SME Cyber Security Toolkit - two initiatives already underway as part of the Connect Smart public-private collaboration to improve cyber security, Adams says.
 

The University of Adelaide's Business School has suggested in recent research that businesses should better understand the computer profile of their employees as certain behaviours may indicate a propensity to a greater risk of cyber security issues. This profiling is not necessarily about intended security breaches, but about lax behaviour and lack of online awareness.

The researchers identified that impulsive or careless behaviour was in fact much more likely to be linked to causing security breaches. This behaviour was more likely to be seen in younger users or those who perceived themselves to be internet savvy.

The suggestion is therefore to build up a profile of employees' usage and highlight areas where training can be offered to increase online awareness and potentially avoid the devastating impact of a security breach or other type of internet attack. 
 

Online cyber criminals deleted an Auckland couple's computer files, including precious photos and videos of their children, and demanded a ransom of $750 to restore them.

"We didn't even know we had it. It was on our machine for quite a few weeks before we even noticed anything was untoward. It was only when we were trying to play some music files that we realised we couldn't. That was because [the malware] had actually removed the original file and then encrypted ... a new copy of that file that was unplayable; we couldn't run it using any application at all."

There were also new files that directed the victims to the virus to a site which explained that to obtain the encryption key to unlock their files they must the equivalent to $750 in bitcoin digital currency. On top of that, the ransom would double if not paid within a week.

The man searched online without success for a solution, until he contacted NetSafe, which pointed him to the website bleepingcomputer.com, where he found free software which, after a 12-hour "deep scan", enabled the recovery of deleted files. This retrieved about 80 per cent of that data. 

NetSafe and the police told people not to pay ransoms. Instead, people should regularly update their devices' software, use an up-to-date anti-virus programme and back up files on USB memory sticks or hard drives or to remote "cloud" storage services. 
 

An Australian man visiting Hamilton blames "naivety" when he found out his bank account was emptied, after a thief stole his tablet from a rented car. 

The 39-year-old man was parked at a friend's house when he discovered his iPad among other items were stolen from the car.

He then discovered the thief had accessed his bank account, by using credit card details stored when he had purchased apps, music and movies.

District prevention manager Inspector Kent Holdsworth urged electronic device owners to check their security settings, as this could happen to anyone.
 

Kiwi accounting software firm Xero is seeing an increase in phishing scams, including some that have impersonated Xero's branding, the company has advised.

"Our monitoring has shown that a small number of our customers have had their Xero accounts compromised," the company says in a statement, "As a precaution we are asking our customers to reset their passwords."

Before users reset their passwords, Xero is recommending they update anti-malware (anti-virus) software with the latest signatures and run a full scan of their computer.
 

A recent Kaspersky Lab survey shows that over a third of companies do not trust their suppliers. The principal reason for this loss of faith in suppliers derives from the fact that they were to blame for 18 percent of cyber incidents in 2015.

"In order to avoid damages and to ensure secure communication with suppliers, a comprehensive multi-layered approach is required," says Konstantin Voronkov, Head of Endpoint Product Management, Kaspersky Lab.

"The first thing to do it to delineate access rights to different areas of the corporate network for different employees".

Cyber incidents involving suppliers cost small and medium businesses $67,000 on average, while the figure for large corporations is $3.27 million.

New Zealand organisations' confidence in their information security measures is falling, according to a PwC study. 

The annual Global State of Information Security Survey shows 65% of respondents are "confident" or "somewhat confident" their cyber-security activities are effective. This compares with 83% last year.

PwC says the figures may represent increased understanding of risks, with previous years' high confidence not matched with actual measures in place. 

The survey found 25% of New Zealand organisations with cyber insurance made a claim in the past year, compared with 50% globally. 

An interesting gap has come to light in the protection offered by US banks to businesses who fall victim to cyber theft. Whilst a private individual is protected by legislation from theft of their funds electronically, businesses may not be even though they may be owned by a single person. Whilst a bank will compensate an individual for losses from their bank account, a small private company may have to bear such losses alone. Alarmingly, the FBI has revealed that in excess of 8,000 businesses have fallen victim to this kind of attack in the last two years.
 

This places a heavy burden on companies of all sizes to up the ante when it comes to internet security, an expensive load for smaller operations to bear particularly as this kind of threat seems to be becoming more commonplace. Some of these frauds have been alarming in their sophistication meaning that increasing firewalls alone is not sufficient to prevent such threats; security needs to operate on many different levels and this is both time-consuming and costly.
 

American banks are strenuously resisting pressures to make them bear more responsibility for the protection of business funds, although many argue that as gatekeepers and administrators of accounts, they are perhaps best placed to review and verify transactions.
 

Leading law firm, DLA Piper, has revealed the biggest trends the insurance industry will face over the coming year.

One trend that shows no sign of abating is cyber insurance, as the team at DLA Piper continue to see an uptick in cyber activity.

"Our cyber team experts have considered the real and continuing risks associated with cyber breaches and the industry's response to those risks," the report states. "The message continues to be that breaches are inevitable so organisations need to prepare".

Senior associates at DLA Piper write that they see a future where cyber insurance "will be as common as any other type of insurance," but the industry and those that require cyber cover still need to catch-up.
 

Christchuch business, Leeding Sign Designs, was forced to pay almost a thousand dollars to an overseas web site that encrypted files on its computers.

The email remained unopened, but the virus still managed to get a foothold.

Director Darren Leeds sought advise, but was told he had no alternative but to pay them the ransom that was demanded.

Netsafe digital project manager Chris Hails said 50 ransom-ware attacks were reported to them last month alone, and the problem is only getting worse.
 

Sony Pictures Entertainment have agreed a settlement with employees who had their personal information leaked online by hackers.
 

Last year, cyber criminals infiltrated databases and stole reams of private data, including confidential emails, actors' personal details and even financial and medical records of staff members.
 

Current and former employees subsequently banded together to take legal action against the company, but it has now emerged that Sony Pictures bosses have agreed a settlement with the group.

It has been revealed that a well-known UK holiday company Thomson has experienced a data breach which compromised the personal details of around 500 of its customers. The BBC reports that an email which clearly revealed customer details such as name, address and flight date, was mistakenly sent out. This could have clear implications surrounding the security of customers’ homes whilst they are away.
 

Thomson has apologised for the mistake, but some customers remain angry that the first they heard about the leak was when they were contacted by reporters. Furthermore, the holiday firm has said that they won’t be offering compensation to affected parties, though several holidaymakers are considering cancelling or changing their holiday dates for fear of being burgled whilst they are away.
 

Thomson said that the error was identified quickly and that the email recall was successful in many cases.
 

The advent of so-called quantum computers is giving rise to fears that the encryption process that many people rely upon to protect their data could be breached by unscrupulous individuals, thereby rendering this seemingly fail-safe security measure valueless. This latest development has been revealed by experts at the National Security Agency.
 

Complicated algorithms are used to encrypt all sorts of data, a procedure which involves two different processes, one at the inception of the data and another at the receiving end. Industry experts believe that quantum computers, whilst still only a distant concept, would theoretically have the ability to crack the algorithms.
 

NSA is now issuing advice to groups and agencies to use what are termed as quantum-resistant algorithms in their defence against hackers. The NSA has not always received a favourable press but its warning seems to be genuine and without any form of hidden agenda.