{"id":5282,"date":"2015-10-12T09:46:29","date_gmt":"2015-10-12T13:46:29","guid":{"rendered":"https:\/\/www.kaspersky.co.in\/blog\/?p=5282"},"modified":"2019-11-22T15:38:19","modified_gmt":"2019-11-22T10:08:19","slug":"security-week-41-research-censored-outlook-web-access-hacked-subscriber-data-lost","status":"publish","type":"post","link":"https:\/\/www.kaspersky.co.in\/blog\/security-week-41-research-censored-outlook-web-access-hacked-subscriber-data-lost\/5282\/","title":{"rendered":"Security Week 41: research censored, Outlook Web Access hacked, subscriber data lost"},"content":{"rendered":"
\n
\n

Today is special corporate edition of our weekly news digest, which we will devote to ROI, EBITDA, TCO, IFRS, CRM, SLA, NDA, GAAP and the likes. Just kidding \u2013 as always, we\u2019ll talk about the most important security news of the week. As it happened this week, they are all relevant to corporate security, in one way or another. We\u2019ll cover the cases of companies being hacked and data being leaked and companies reacting on the incidents.<\/p>\n

\"Where<\/a><\/p>\n

What is the difference between end-user security and corporate security? First, while users enjoy the luxury of relatively simple security solutions, corporations security is something very complex \u2013 due to several reasons, but mostly due to complexity of their IT infrastructure. Second, in order to protect corporate infrastructure from threats, particular policies should be applied on all levels of the organization.<\/p>\n

Anyway, how are businesses performing in terms of security? To be honest, not that well. For example, Gartner thinks<\/a> that in three years companies would spend 30% of their budget on security. Moreover, the old-school approach of role-based access, which used to be the cornerstone of corporate security, is hopelessly obsolete. Now 90% of effort is spend on preventing the breach of the perimeter and only 10% on detection and response.<\/p>\n

https:\/\/twitter.com\/CiscoEnterprise\/status\/652566712383107072<\/a><\/p>\n

That means, once an intruder manages to infiltrate the infrastructure, he finds himself in a very comfortable environment, which frequently results in devastating consequences for the victim. So, Gartner\u2019s recommendation to change this ratio to 60\/40 makes sense. For instance, our report on Carbanak<\/a>, a notorious campaign against banks and financial organizations, showed that the criminal remained undetected in this \u201c10%\u201d zone for quite a while.The previous editions of Security Week can be found here<\/a>.<\/p>\n

Outlook Web App as the entry point into corporate infrastructure<\/h3>\n

News<\/a>. Research<\/a> by Cybereason. Microsoft\u2019s feedback<\/a>.<\/p>\n

If one hacks one of many corporate PCs, bugs the compromised machine and drains the data, what would the output be for a hacker? If it is a regular employee\u2019s laptop, the culprit would be able to steal some work-relevant data and, possibly, other information from the file servers this employee had access to.<\/p>\n

But the campaign would be much more \u2018efficient\u2019 if the surveillance is installed on a computer of a boss or an admin who typically enjoy higher privileges. The unsolicited access to a mail server would compromise an enormous amount of data sent through the email. A report prepared by Cybereason proves that sky mail is not the limit.<\/p>\n

\n

Targeted attack exposes Outlook Web Access weakness: https:\/\/t.co\/5rshOVB5iB<\/a><\/p>\n

\u2014 Eugene Kaspersky (@e_kaspersky) October 7, 2015<\/a><\/p><\/blockquote>\n