NHS Test and Trace has announced that an early-stage UK company will be in charge of managing its supply chain cybersecurity risks.

Risk Ledger, which was part of the fourth cohort of the government-backed London Office for Rapid Cybersecurity Advancement (LORCA) program to promote cyber scaleups, will allow NHS Test and Trace to utilize its ‘social network’ platform. The platform will enable organizations to connect and share risk data securely, quickly and easily. This move is particularly crucial for the UK’s test and trace service, which involves the continued sharing of sensitive data to help control the spread of COVID-19 as lockdown restrictions ease.

The Risk Ledger platform will provide NHS Test and Trace complete visibility of its supply chain, including data needed to identify, measure and mitigate any cyber threats that emerge.

The importance of securing supply chains has come into sharper focus due to recent high profile incidents, especially the SolarWinds attacks at the end of last year.

Creating the NHS Test and Trace system, which includes an official app, has brought about several privacy and data protection concerns. It is hoped the contract with Risk Ledger, which was a winner in the Department for Digital, Culture, Media, and Sport’s ‘Most Innovative UK Cyber SME of the Year’ competition in May, will help assuage some of these fears.

Minister for Digital Infrastructure Matt Warman MP commented: “The government is working tirelessly to secure the nation online and grow the UK’s £8.9bn cybersecurity industry as we build back better from the pandemic. We’re helping SMEs develop innovative products and services, and it’s great to see Risk Ledger, one of the firms we’ve supported, win this contract to protect the Test and Trace system and support the national effort against coronavirus.”

Haydn Brooks, Risk Ledger CEO and co-founder, welcomed the move: “NHS Test and Trace is essentially the biggest new start-up in the UK healthcare market so we are delighted they have chosen to take advantage of our ability to provide enhanced visibility of their supply chain risks. I am proud we will be part of the effort to secure this incredibly important supply chain.

“Healthcare organizations and their supply chains handle lots of highly sensitive data and have a high rate of data breaches. We have already seen during the COVID-19 pandemic that bad actors are actively targeting supply chains to access data and cause disruption.”

Security experts have urged users to think more carefully about their password choice after spotting as many as one million based on simple football-related words.

Authentication firm Authlogics manages a Password Breach Database — a collection of previous stolen or cracked credentials which that allows it to spot trends and offer industry advice.

It claimed that of the one billion passwords in the trove, over 1.1 million are linked to the beautiful game. These are led by the password “football” (353,993), followed by “Liverpool” (215,842), “Chelsea” (172,727), “Arsenal” (151,936) and “Barcelona” (131,090).

The problem for these users is two-fold: not only are such credentials relatively easy to guess or crack, but if they’re reused across multiple accounts, including corporate ones, it could expose them to credential stuffing.

This is the practice of using automated software to try large numbers of previously breached log-ins simultaneously across multiple accounts, hoping that some will work.

Authlogics cited Google research which claims that over half (52%) of users reuse the same password on multiple accounts, with only a third (35%) using a different credential for all log-ins.

“If your password has been breached on one account, and you are one of the 52% of people who reuse their passwords regularly, you might find other accounts which were not breached also compromised,” Authlogics warned.

“If someone is aware of the amount of passwords that are associated with football, and are able to use social engineering tactics to discover which team an individual supports, they can make a good, educated guess as to their password to not just one, but multiple accounts.”

Password managers can help here by storing and recalling unique and robust credentials for each website and online account. Multi-factor authentication (MFA) is also recommended to bolster authentication security.

Authlogics recommended combining letters, numbers and symbols to increase password strength — even if football-mad users want to include their favorite team in their log-ins.

Some 80% of global organizations that have paid a ransom demand experienced another attack, often at the hands of the same threat actors, according to a new study from Cybereason.

The security vendor polled 1,263 cybersecurity professionals in multiple verticals across the US, UK, Spain, Germany, France, the United Arab Emirates, and Singapore to compile its latest report, Ransomware: The True Cost to Business.

It confirmed what law enforcers and commentators have been saying for some time – victim organizations should, if possible, avoid paying their extorters. Some 46% of respondents, rising to 53% in the UK, said they believe the same threat group attacked them the second time.

However, this can be difficult to ascertain definitively given the large number of affiliate groups working with the same malware strains. A Sophos report this week revealed that no two REvil affiliates work in the same way.

Not only does paying a ransom encourage copycat crimes, but there’s no guarantee of a swift return to business-as-usual. Cybereason found that in nearly half (46%) of cases, the victim organization regained access to data following payment, but some or all of it was corrupted.

The report also laid bare the potentially devastating consequences of a successful ransomware attack. Two-thirds (66%) of respondents said they suffered significant revenue loss, over half (53%) said their brand suffered, and a third (32%) lost leadership through dismissal or resignation.

In some cases, an attack can have an existential impact: 29% said they were forced to eliminate jobs following an incident. A quarter (25%) of respondents claimed it led to the organization’s closure.

Big-name organizations from Colonial Pipeline to JBS have recently admitted to paying multimillion-dollar sums to their attackers to mitigate potentially severe customer disruption.

However, Cybereason CEO, Lior Div, was clear about which approach corporate victims should take.

“Paying a ransom demand does not guarantee a successful recovery, does not prevent the attackers from hitting the victim organization again, and in the end only exacerbates the problem by encouraging more attacks,” he argued.

“Getting in front of the threat by adopting a prevention-first strategy for early detection will allow organisations to stop disruptive ransomware before they can hurt the business.”

Security experts have warned of a critical IoT supply chain vulnerability that may affect millions of connected cameras globally, allowing attackers to hijack video streams.

Nozomi Networks revealed the flaw in a popular software component from ThroughTek, which OEMs use to manufacture IP cameras, baby and pet monitoring cameras, and robotic and battery devices.

The bug itself is found in a P2P SDK produced by the firm. In this case, P2P refers to functionality that allows a client on a mobile or desktop app to access audio/video streams from a camera or device through the internet.

Nozomi Networks claimed that the protocol used for transmission of those data streams “lacks a secure key exchange and relies instead it on an obfuscation scheme based on a fixed key.”

This means that unauthorized attackers could access it to reconstruct the audio/video stream — effectively enabling them to snoop on users remotely.

CISA released its own security alert for the ThroughTek P2P SDK yesterday, giving it a critical CVSS score of 9.1. According to the advisory, it affects: versions 3.1.5 and older; SDK versions with nossl tag; and device firmware that does not use AuthKey for IOTC connection, uses the AVAPI module without enabling DTLS, or uses the P2PTunnel or RDT module.

ThroughTek placed the blame firmly on developers who have incorrectly implemented its SDK or failed to update the offering.

It said version 3.3 was introduced in mid-2020 to fix this vulnerability and urged any customers to update the SDK version used in their products.

It also revealed that the bug could lead to unauthorized eavesdropping on camera video and audio and device spoofing and device certificate hijacking.

The case highlights the challenges facing users of IoT and other devices, which have complex supply chains using components from third parties.

Last year, several zero-day vulnerabilities were discovered in a widely used low-level TCP/IP software library that may have impacted hundreds of millions of IoT devices.

In April this year, researchers found multiple flaws dubbed “Name:Wreck” in popular IT software FreeBSD and various IoT/OT firmware types, which they claimed could be present in over 100 million devices.