More than four-fifths (81%) of UK retailers are putting their customers at risk of email fraud by not implementing the recommended level of domain-based message authentication, reporting and conformance (DMARC) protection.

This is according to a new study by Proofpoint, which warned of a likely surge in fraudulent emails targeting online shoppers ahead of this year’s Black Friday and Cyber Monday.

DMARC is an email authentication, policy and reporting protocol designed to improve and monitor protection of the domain from fraudulent emails. Yet worryingly, ahead of the Black Friday and Christmas shopping periods, Proofpoint said just 19% of UK retailers have adopted the recommended level of DMARC protection (reject), which blocks fraudulent emails from reaching their intended targets.

The research also showed that under half (45%) of UK retailers have implemented the minimum level of DMARC protection, which prevents malicious actors from spoofing their domain. This is significantly lower than the proportion of global retailers (70%) included in the Forbes Global 2000 who have implemented this level of DMARC protection. Additionally, more than a third (36%) of UK retailers have no published DMARC record at all, leaving themselves wide open to impersonation attacks.

Email has become an increasingly important means by which retailers contact customers about offers amid the shift to e-commerce during COVID-19, and fraudsters have heavily exploited this trend.

Adenike Cosgrove, cybersecurity strategist, International, Proofpoint, commented: “Organizations in all sectors should look to deploy authentication protocols, such as DMARC, to shore up their email fraud defenses. Cyber-criminals will always leverage key events to drive targeted attacks using social engineering techniques such as impersonation and will capitalize on a time when guards are down and attentions are focused on grabbing seasonal bargains. Ahead of Black Friday, shoppers must be vigilant in checking the validity of all emails, and retailers must do better to ensure their customers remain safe online.”

Yesterday, Kaspersky released new research, which found online payment fraud surged by 208% between September and October 2021, further highlighting the threats facing online shoppers.

The UK’s cybersecurity sector appears to be faring pretty well in terms of its diversity, but challenges around inclusion, career progression and discrimination persist, according to a new government report.

The second annual Decrypting Diversity report from the National Cyber Security Centre (NCSC) was compiled from interviews with 945 professionals working in the industry.

The headline figures are encouraging: over a third (36%) of respondents were female, which is a higher proportion than in some studies, and 10% were from the LGB community, which the report claimed is higher than the 2.2% of the population that is LGB according to 2018 ONS data.

A quarter identified as having a disability, more than the 14% of the IT workforce as a whole and the 20% figure for the UK’s working population. The report also claimed that the statistics for ethnic minorities (15%) and trans and non-binary (1%) respondents were in line with those of the national population.

However, there are still clear areas where improvement is necessary. For example, only one in 20 respondents were aged 18-24, just 3% entered via a school leaver or apprenticeship scheme, and 12% via a graduate scheme. The NCSC said increasing these figures needs to be a priority.

More concerning is that over a fifth (22%) of respondents said they’ve experienced discrimination in the past year, up from 16% in 2020. In addition, the number claiming to have experienced a career barrier due to one of their characteristics also surged, from 14% last year to 25%.

The NCSC claimed these figures might have been influenced by this year’s survey asking about a broader set of characteristics.

However, it’s also true that women, those from ethnic minority backgrounds, and those who are lesbian or gay experienced higher-than-average levels of discrimination. Women and ethnic minority respondents were also more likely to have experienced career roadblocks.

Another key stat – the degree to which individuals feel included, accepted and treated equally at work – didn’t move from last year. That means over a fifth (22%) of respondents feel they can’t be themselves at work.

Diversity and inclusion (D&I) is one of the four key pillars of the UK Cyber Security Council, commissioned by the government in 2019.

CEO Simon Hepburn said the council would play its part in helping to drive positive change.

“The sector must succeed at this. It’s vital not just to help the sector fill the tens of thousands of vacancies that exist, but for the sector and the UK to benefit from the wider range of abilities, improved creativity, different thinking and alternative contributions of a truly diverse, inclusive cybersecurity workforce,” he added.

“The council and the NCSC are in lockstep over the D&I objectives for the sector and, to that end, we also welcome and agree with the conclusions of the report.”

The report’s six recommendations include: better use of data to monitor and improve the “talent lifecycle;” learning from D&I best practice; publicizing success stories; and ensuring roles and skills are described consistently and made clear and accessible to all.

UK government security experts have been forced to notify over 4000 domestic online businesses that their websites were infected with digital skimming code.

GCHQ agency, the National Cyber Security Centre (NCSC), informed 4151 compromised online shops up to the end of September. Most of these were exploited via a known bug in the popular Magento e-commerce software.

The NCSC argued it was particularly important that digital retailers get their house in order ahead of the busy festive shopping period, which begins at the end of this week with the Black Friday weekend.

“We want small and medium-sized online retailers to know how to prevent their sites being exploited by opportunistic cyber-criminals over the peak shopping period. Falling victim to cybercrime could leave you and your customers out of pocket and cause reputational damage,” said NCSC deputy director for economy and society, Sarah Lyons.

“It’s important to keep websites as secure as possible and I would urge all business owners to follow our guidance and make sure their software is up-to-date.”

The compromised sites were found by the NCSC’s highly successful Active Cyber Defence program, which proactively looks to remove malicious sites and tackle scams before they can impact large numbers of consumers.

It resulted in the take-down of 2.3 million cyber-enabled “commodity campaigns” last year, including hundreds of phishing campaigns using NHS branding and scores of malicious apps.

The NCSC’s actions highlight the continued threat from digital skimming groups such as those filed under the umbrella term “Magecart.”

These groups struck global targets frequently in 2019 and 2020, but little activity has been reported this year. In September 2020, for example, around 2000 stores running Magento were attacked in a single weekend, the most extensive recorded campaign of its kind until that moment.

The British Retail Consortium has developed a Cyber Resilience Toolkit for retailers in partnership with the NCSC

Most UK business leaders expect cyber-threats to surge next year, with ransomware, business email compromise (BEC), cloud and supply chain attacks all predicted to increase, according to PwC.

The findings come from the consulting giant’s 2022 Global Digital Trust Insights Survey and were distilled from interviews with 257 business and technology executives in the UK.

Although most (63%) respondents said they expect security budgets to increase next year, even more (66%) predicted cyber-threats would rise. Ransomware (61%), BEC (61%), malware via software updates (63%), and cloud compromise (64%) were among the most notable.

Bobbie Ramsden-Knowles, crisis and resilience partner at PwC UK, claimed the firm’s threat intelligence team has tracked more ransomware incidents globally up to September this year than for the whole of 2020.

“Whereas other types of crises may be perceived as ‘black swan’ events that cannot be predicted, ransomware attacks have become so widespread that we have seen a common set of challenges and decisions that all organizations would face,” he added.

“Developing – and aligning – ransomware playbooks for executive crisis teams and operational responders is a no-regrets move. And, testing these through war games and exercises can reduce uncertainty, build confidence in the ability to respond and help prioritize focus on preventative measures.”

Part of the challenge for executives appears to be mitigating cyber risk stemming from the growing complexity of environments. Some 86% of UK respondents cited this as a concern, especially in the context of multi-vendor cloud and other platforms.

Just two-fifths claimed to have formally assessed their cloud (41%) and supply chain (42%) risks.

Of equal concern is that, despite increased spending, few respondents are confident that they can drive a good return on their investments.

“For example, while 37% of UK respondents said they had implemented cloud security at scale, just 18% are fully realizing the benefits of their investment. The remainder either weren’t investing in this area or hadn’t yet implemented it at scale,” explained PwC UK cybersecurity chair Richard Horne.

“To overcome this challenge and build greater confidence in their security investments, organizations must improve their cyber risk modeling and analysis. This ensures increases in cyber budgets are allocated to priority risks and help build long-term resilience.”

A newly discovered vulnerability found in two devices made by Cisco could cause remote access to be disrupted.

The flaw – CVE-2021-34704 – was detected by Positive Technologies researcher Nikita Abramov in October in the firewalls of Cisco ASA (Adaptive Security Appliance) and Cisco FTD (Firepower Threat Defense).

If the vulnerability is exploited, the organization’s firewall will be weakened, leaving it more vulnerable to attack, and employees who are working remotely would be blocked from accessing their organization’s internal network. 

According to Abramov, an attacker does not require elevated privileges or special access to exploit the flaw. All it takes is the formation of a simple request, in which one of the parts is of a different size than that expected by the device. 

Further parsing of the request will trigger a buffer overflow/overrun as the amount of data in the buffer exceeds its storage capacity. The impacted system will then shut down abruptly and restart.

Abramov said: “If hackers disrupt the operation of Cisco ASA and Cisco FTD, a company will be left without a firewall and remote access (VPN). If the attack is successful, remote employees or partners will not be able to access the internal network of the organization, and access from the outside will be restricted. At the same time, firewall failure will reduce the protection of the company.”

Describing the impact such an outcome could have on an organization. Abramov said: “All this can negatively impact company processes, disrupt interactions between departments, and make the company vulnerable to targeted attacks.”

According to Forrester Research, Cisco is an enterprise firewall market leader that has deployed more than 1 million security appliances around the globe. 

An assessment of the flaw determined it to be of high severity with a CVSSv3.0 score of 8.6. A fix for the flaw has been created and users are advised to follow the manufacturer’s recommendations outlined in its security advisory and install updates as soon as possible. 

Positive Technologies has previously discovered vulnerabilities in Cisco Firepower Device Manager (FDM) On-Box and critical flaws in Cisco ASA, such as CVE-2020-3187, CVE-2020-3259, and CVE-2020-3452.