Professional Documents
Culture Documents
In this e-guide
In this e-guide:
Singapore banks adopt The hack of the Philippine Commission on the Elections in April sent
voice biometrics for user shockwaves through the region, and in this guide we look at the incident in
authentication
detail. But it is not just the public sector that needs to protect its users. With
the increasing use of digital channels for banking, financial services
Singapore to block internet
access for its public organisations are investing in the latest security technologies.
servants from 2017
This guide also outlines some of the technology options available to IT and
How to use a netstat security leaders trying to resolve malware issues or diagnose a security
command in Windows to problem.
watch open ports
Page 1 of 28
E-guide
In this e-guide
Singapore to block internet Two hacking groups, the Anonymous Philippines and LulzSec Philippines,
access for its public claimed responsibility for stealing personal information, including fingerprint
servants from 2017
data and passport information, belonging to around 50 million people.
How to use a netstat While Comelec claimed that no sensitive information was released, cyber
command in Windows to security firm Trend Micro said the incident was the biggest government-related
watch open ports
and passport numbers and expiry dates of 1.3 million
The problem of passwords
and how to deal with it As soon as the news of the hack emerged, questions were raised, such as: How
was a hack of this magnitude allowed to happen? Why was the government in
Getting more CW+ essential
Manila downplaying the scale of this incident? Could such a hack have been
content prevented? What could governments in other Asean countries learn from this
breach of security?
Page 2 of 28
E-guide
was indeed perpetrated by these groups, as has been claimed, then this is a
The problem of passwords
case of an attack being carried out by cybe
and how to deal with it
Activists are cyber criminals whose motivations are driven by a strong moral,
Getting more CW+ essential religious or political belief, explained Vanell. In this case the motivator appears
content to have been political beliefs and distrust of the political system.
Page 3 of 28
E-guide
These groups are motivated by a desire to change the world, often via illegal or
In this e-guide questionable means. As reported by the Manila Bulletin, Asis wanted to highlight
security deficiencies in the Comelec website.
Philippines government data
breach is a warning to Asean -of-
region service attack, or causing financial loss or loss of reputation to those with
opposing beliefs, the activist often has the skills and the means to leave
Singapore banks adopt
voice biometrics for user citizens' fingerprint data is now reportedly ava
authentication
Hacking and data theft have become professionalised
Singapore to block internet
This attack is the latest in a string of cyber incidents to have affected the
access for its public
servants from 2017 Philippine government. Also in April, the Philippine central bank said it had foiled
attempts to hack its website
Swift [Society for Worldwide Interbank Financial Telecommunication] about
How to use a netstat
command in Windows to
recent mult
watch open ports
While the Manila voter data hack was reportedly committed by activists, there
are numerous threat actors out there each and every one of them is
The problem of passwords
dangerous in their own way. Hacking and data theft have become
and how to deal with it
well-funded.
Getting more CW+ essential
content
challenge where technology is revolutionising traditional industries and enabling
Page 4 of 28
E-guide
enormous growth but is at the same time opening up new avenues for cyber
In this e-guide
Philippines government data However, it does not help if governments rush to a deny security breaches that
breach is a warning to Asean make it to the headlines, according to Cathy Huang, research manager at
region Asia-Pacific services and cloud research group.
Page 5 of 28
E-guide
In this e-guide
support with regular updates, not just after an incident happens. Organisations
Philippines government data must update security patches regularly to ensure its IT system security is
breach is a warning to Asean
region
According to Vanell, organisations from the public and private sectors should
Singapore banks adopt take proactive measures to address cyber threats.
voice biometrics for user
authentication n top of risk identification and asset protection, organisations can get on the
Page 6 of 28
E-guide
In this e-guide
Citi expects at least one million of its 15 million consumer banking customers in
How to use a netstat the Asia-Pacific region to use voice recognition technology for authentication in
command in Windows to the next 12 months. The number of users is expected to grow to three million
watch open ports
within three years.
The problem of passwords The capability uses complex mathematical algorithms to identify customers
and how to deal with it through their voiceprint, which, like a fingerprint, is unique to each person. A
voiceprint cannot be reverse engineered once stored.
Getting more CW+ essential
content
-Pacific receive about 35 million calls annually, of
which a large portion are manually verified. With voice biometric authentication,
Page 7 of 28
E-guide
In this e-guide said Rahul Joshi, head for consumer banking operations Asia-Pacific, at Citi.
Voice biometrics is more secure, said Lena Low, executive director of Customer
How to use a netstat Centre at DBS, as customers do not need to remember their PIN or divulge
command in Windows to
personal information in public when on the phone to customer service officers.
watch open ports
OCBC Bank launched speech recognition at its contact centre in April 2016,
The problem of passwords and will launch voice biometrics to all its retail customers later in the year.
and how to deal with it
According to Praveen Raina, senior vice-president, group operations and
Getting more CW+ essential technology, at OCBC, speech recognition has been well accepted by customers
content because it reduces the time it takes to get help without having to navigate a
menu of options.
Page 8 of 28
E-guide
Southeast Asian Nations] mainstream adoption will depend on how well all parts
Page 9 of 28
E-guide
of the financial, retail and device ecosystems work to raise the availability and
In this e-guide
Page 10 of 28
E-guide
In this e-guide
However, public servants will still be able to access the internet through their
Getting more CW+ essential
content
personal devices that are not linked to the government e-mail systems. Their
workstations will also remain connected to the
Page 11 of 28
E-guide
officers will be able to send their work emails to their private accounts, if
In this e-guide required.
Philippines government data Government sources have also said officers who need internet access for their
breach is a warning to Asean work will be issued separate computers for such use.
region
According to an Infocomm Development Authority of Singapore (IDA)
Singapore banks adopt
-
voice biometrics for user
authentication
IDA, the government agency that is leading this initiative, has been trialling this
with some employees in the agency since April 2016.
Singapore to block internet
access for its public
servants from 2017
Getting more CW+ essential to the Internet, you are essentially blocking one
content
Page 12 of 28
E-guide
In this e-guide
Page 13 of 28
E-guide
In this e-guide
Netstat, the TCP/IP networking utility, has a simple set of options and identifies
Singapore banks adopt
a computer's listening ports, along with incoming and outgoing network
voice biometrics for user
authentication connections. This data can be very helpful if you're trying to resolve a malware
issue or diagnose a security problem.
How to use a netstat Another reason I find Netstat such a useful tool is that it can be found on almost
command in Windows to any computer by default, from Unix and Linux machines through to Windows
watch open ports
and Macs. The fact that you don't have to install and run a separate diagnostic
tool can be a life saver when dealing with a client's PC or a quarantined
The problem of passwords machine.
and how to deal with it
Every open port on your computer is an entry point that can be exploited to gain
Getting more CW+ essential covert access. So if you need to know what connections a machine has to the
content Internet and what services may be open and running, Netstat can quickly tell
you.
Page 14 of 28
E-guide
Page 15 of 28
E-guide
Page 16 of 28
E-guide
Philippines government data 'LISTENING' shows a classic open port listening for inbound connections.
breach is a warning to Asean 'ESTABLISHED' means there's an actual connection between your machine and
region the remote IP and port that is able to exchange traffic. Occasionally, you'll see
'CLOSE_WAIT' in this column, which is a state that TCP goes into while ending
Singapore banks adopt an established connection.
voice biometrics for user
authentication As you can see, there are plenty of entries with a local address of 0.0.0.0 plus a
port. This designation means the port is listening on all network interfaces and
Singapore to block internet will accept any incoming connection on that port number.
access for its public
servants from 2017 The local address entries beginning 127.0.0.1 are processes listening for
connections from the PC itself, not from the Internet or network. If the IP
address in this column is your local network IP, then the port is only listening for
How to use a netstat
command in Windows to
connections from your local network. The port is listening for connections from
watch open ports the Internet if it displays your online IP address.
A quick glance through Netstat's output can alert you to many potential
The problem of passwords
problems. For example, if your security policy bans the use of Internet Relay
and how to deal with it
Chat (IRC), but there are numerous connections to port 6667 (the default IRC
port) on a remote machine, then there's a chance that the PC has a Trojan
Getting more CW+ essential
connected to a remote IRC server waiting to receive commands. Although
content
Netstat only takes a snapshot, you can use the interval option to refresh the
output every so many seconds. Use the Netstat command below, for example:
Page 17 of 28
E-guide
You can, of course, achieve more accurate and detailed results using a port
Getting more CW+ essential
scanner such as Nmap.
content
Page 18 of 28
E-guide
However, Netstat, is already built-in and the commands are quick and easy to
In this e-guide use. You may also be interested in Microsoft's Sysinternals Process Monitor
tool, an advanced monitoring utility for Windows that shows real-time file
Philippines government data system, Registry and process/thread activity.
breach is a warning to Asean
region
aware that running them with the interval option would be a drain on a system's
Singapore banks adopt resources.
voice biometrics for user
authentication About the author: Michael Cobb, CISSP-ISSAP is the founder and managing
director of Cobweb Applications Ltd., a consultancy that offers IT training and
Singapore to block internet support in data security and analysis. He co-authored the book IIS Security and
access for its public has written numerous technical articles for leading IT publications.
servants from 2017
Page 19 of 28
E-guide
In this e-guide
Passwords are a ubiquitous part of the digital age. They are the keys to
Singapore banks adopt
unlocking our online profiles that are hosted across a plethora of websites. With
voice biometrics for user
authentication each of our profiles necessitating a separate password, it is not uncommon for
people to need up to 50 passwords.
Page 20 of 28
E-guide
The problem with passwords is that, for them to be effective, they need to be an
In this e-guide uncommon word, of eight letters or more and not used anywhere else. However,
Philippines government data difficult to have complex and unique passwords for as many sites as re
breach is a warning to Asean
says security advisor Sean Sullivan of F-Secure
region
Singapore banks adopt According to Microsoft TechNet, for a password to be effective, it needs to
voice biometrics for user meet the following criteria:
authentication
Changed every 60 days
At least eight characters long
Singapore to block internet
Use both upper and lower case characters
access for its public
Contain a combination of alphanumeric characters and symbols
servants from 2017
Unique (only used for this particular profile/website)
Stored using a reversible encryption.
How to use a netstat
command in Windows to Using these minimum requirements means that there are at least 2x1014
watch open ports different possibilities.
A normal PC running a freely distributed brute force password cracker can
The problem of passwords attempt eight million passwords a second, meaning it would take up to 315 days
and how to deal with it to break a password of the type prescribed above. However, a high-end
computer with 25 GPUs was recently found to achieve 350 billion passwords a
Getting more CW+ essential second, which would only take up to 10 minutes to break the same password.
content
Page 21 of 28
E-guide
Singapore to block internet Some companies go so far as to make their employees change their password
access for its public
servants from 2017 that it is going to be written on a post-
are easily researchable, so security researchers say that you should lie to these
Getting more CW+ essential
content
Page 22 of 28
E-guide
Using password lockers is one solution for keeping track of multiple passwords,
In this e-guide
passwords. Some password lockers, such as F-Secure KEY, also contain a
Philippines government data notes field, where users can store the answers they gave for the security
breach is a warning to Asean
questions.
region
Two-factor authentication is becoming increasingly adopted as a form of
Singapore banks adopt identification and authorisation. Most financial institutions now use two-factor
voice biometrics for user authentication as part of their online banking systems. Users not only need to
authentication know their login and password, but also a random single-use code that is either
sent to their security token or as a text message to a verified mobile phone.
Singapore to block internet
access for its public This is not a foolproof system, as the mobile phone or security token could be
servants from 2017 stolen. But using two-factor authentication means that there is an addition level
of security to overcome before access is gained.
How to use a netstat
command in Windows to
Biometric authentication
watch open ports methods such as fingerprints, voiceprint or facial recognition, is becoming
increasingly used as the systems become more affordable.
The problem of passwords
Biometric security at HSBC
and how to deal with it
HSBC recently introduced biometric security for their 15 million First Direct
Getting more CW+ essential customers. The HSBC Banking application on Android and iOS devices will now
content offer First Direct customers the opportunity to identify themselves using finger
and voiceprint authentication, rather than stating their telephone security
Page 23 of 28
E-guide
Philippines government data The voice recognition software, provided by Nuance Communications, is so
breach is a warning to Asean accurate that it is even able to differentiate between identical twins. Through
region analysing speech, the voice recognition software is able to measure the speed,
Singapore banks adopt the shape of their larynx, vocal tract and nasal passages.
voice biometrics for user
authentication However, this accuracy also means that it may deny access if an account holder
has a sore throat, or if customers have recently switched devices and are
Singapore to block internet therefore using a new microphone.
access for its public Although HSBC was not the first bank to offer biometric security to their
servants from 2017 customers, it is certainly the largest planned rollout of voice biometric security
technology in the UK.
How to use a netstat
command in Windows to
Despite the inevitably large financial impact this rollout will have, HSBC will no
watch open ports doubt be able to regain this through swifter banking (as authentication takes
just over 10 seconds), a reduction in callcentre staff and a decrease in
The problem of passwords
fraudulent activity, due to the increased security that biometric systems offer.
and how to deal with it
However, the cost is not as high as might be expected because it is only the
software that needs to be implemented. All of the biometric authentication is
Getting more CW+ essential
content
Page 24 of 28
E-guide
building, such as if they have left the company, without having to change pin
How to use a netstat
command in Windows to
codes for everyone else. However, it has not always been successful.
watch open ports
Page 25 of 28
E-guide
businesses that have strong legal obligations to protect their data, I do not think
In this e-guide
comes up with a solution where biometrics [are] used as a username, rather
Philippines government data than a password, then that is great. Then two-factor authentication is right there
breach is a warning to Asean
on my person m
region
The future of passwords
Singapore banks adopt
voice biometrics for user But what does the future hold for passwords? Google
authentication and Projects division are intending to replace passwords for Android apps with
a trust score. Currently called Project Abacus, the trust score will be calculated
Singapore to block internet based on typing speed, vocal inflections, facial recognition, as well as proximity
access for its public to familiar Bluetooth devices and wireless routers. Should the user not meet the
servants from 2017 minimum trust score criteria, they will be subsequently asked to submit their
password to authenticate their identity.
How to use a netstat
command in Windows to
To ensure they are adequately protected, companies should always ensure they
watch open ports change any default passwords and enforce the minimum recommended
password requirements through the group policies of their networks. For
The problem of passwords
companies that handle confidential data, it is now worth considering the use of
and how to deal with it second-factor authentication through biometrics or security tokens. Given the
wide range of systems currently available, determining whether a particular
system will be cost-effective is a balance between cost and risk.
Getting more CW+ essential
content
Ongoing developments are leading to increasingly robust authentication
systems that are better able to resist future network breaches. Companies that
Page 26 of 28
E-guide
fall behind will risk losing customer confidence, while those that stay ahead will
In this e-guide demonstrate how seriously they take data security.
Page 27 of 28
E-guide
In this e-guide
track such premium content down on your own, ultimately helping you to solve
Singapore banks adopt
voice biometrics for user
your toughest IT challenges more effectively and faster than ever before.
authentication
How to use a netstat 2016 TechTarget. No part of this publication may be transmitted or reproduced in any form or by any means without
written permission from the publisher.
command in Windows to
watch open ports
Page 28 of 28