Search
Close this search box.
Facebook Instagram Linkedin

Tag: lgpd

Categories
Data Protection

Data Leaks in Brazil: Alert for Companies and Customers

Imagine you discover a loan of almost R$94,000.00 in your name, without ever having applied for it. Reason: growth of data leakage in Brazil.

This is what happened to Camilla Gomes, who shared her story on
LinkedIn News.
 A project analyst who, after receiving a message from a supposed flower shop, fell for a sophisticated scam.

Camilla went through a fake facial recognition check and, unknowingly, had her photo used to authorize the opening of a line of credit.

This is just one example of how data leaks in Brazil affect the lives of many people, leaving them vulnerable to scams and fraud.

Brazil faces a growing crisis of improper disclosures of personal and business records, ranking 12th among countries with the most data leaks in 2022.

Despite the implementation of the General Data Protection Law (LGPD), cases of information theft and leakage continue to increase.

In this article, we will analyze the reasons why Brazil is one of the main targets for cybercriminals and how the CipherTrust solution can help in data protection and privacy.

Data Leaks: The Roots of the Problem

Information leaks in Brazil have several causes, and to understand them, it is fundamental to analyze the country’s digitalization history and the relationship between the public and private sectors in the defense of personal information.

  • Accelerated digitization and infrastructure failures

The digitalization process in Brazil occurred quickly, but not always with the necessary infrastructure to adequately protect personal records.

The pressure to keep up with global trends and the growing demand for digital services has led to an accelerated implementation of computerized systems, often leaving crucial security aspects aside.

  • Vulnerabilities in the public sector

Most of the data leaked in Brazil comes from public agencies, where technological updating processes are slow, and the lack of investments aggravates the situation.

In addition, the implementation of transparency systems without adequate criteria contributes to the exposure of sensitive information, making it easier for cyber criminals to access this information.

  • Design Issues in the Private Sector

In the private sector, design flaws in information systems also contribute to the vulnerability of records. An example of this is the use of personal identification numbers, such as CPF and RG, as keys to access information and financial operations.

This practice increases the value of this data to criminals and amplifies the exposure of personal information, making it easy targets for scams and fraud.

  • Insufficient privacy and data security culture

The lack of a culture of privacy and information security in Brazil is another factor contributing to the vulnerability of information.

Companies and government agencies do not always have clear and effective policies to protect the details of their customers and users, resulting in a failure to protect this information.

LGPD implementation challenges and insufficient ANPD contribute to data leaks

Although the creation of the LGPD and the ANPD (National Agency for Data Protection) represents an advance in the scenario of information defense in Brazil, the effective application of these regulations still faces challenges.

The lack of human and financial resources available to the ANPD, as well as the difficulty of adapting organizations to the new legislation, limits the scope of actions to combat data leakage and fraud.

These factors combined create an enabling environment for cybercriminals, who take advantage of weaknesses in data safeguarding in Brazil to carry out attacks for financial gain.

To face this scenario, it is essential to invest in efficient solutions, such as the CipherTrust platform, and promote a cultural change that values privacy and the defense of personal records.

CipherTrust: Enhanced data protection and privacy for enterprises

Companies in all industries face increasing challenges in ensuring data security and privacy in an increasingly complex threat landscape.

The CipherTrust Data Security Platform solution is an integrated set of solutions that unify the discovery, protection and control of records in a single, comprehensive platform, addressing the challenge of enterprises regarding information defense and privacy.

Main benefits of the CipherTrust solution in preventing data leakage

  • Simplifying Data Security

The CipherTrust platform enables organizations to discover, protect and control their most sensitive records on-premises and in the cloud in a simplified way.

With an integrated and unified approach, companies can effectively manage protection and minimize the risks of data leaks and breaches.

  • Accelerated time to compliance

The CipherTrust solution offers comprehensive information security features such as data discovery and classification, encryption, granular access controls, audit logs, tokenization, and key management.

These features help companies comply with information security and privacy requirements, making the process of compliance with regulations such as LGPD faster and more efficient.

  • Promoting Safe Migration to the Cloud

CipherTrust Data Security Platform enables enterprises to confidently migrate their workloads to cloud and on-premises environments, ensuring continuous protection and control of their data.

In addition, the solution makes it easy to repatriate records back to the site when necessary, maintaining the integrity of the information at all times.

By adopting the CipherTrust platform, Brazilian companies can more effectively face the challenges of cybersecurity, ensuring the defense and privacy of their clients’ data.

This comprehensive, integrated solution enables organizations to minimize risk and adapt to the increasing demands of a constantly evolving digital environment while securing customer information and trust.

The urgency to combat data leaks in the current scenario

With the growing number of data leaks and the complexity of cyber threats in Brazil and worldwide, ensuring security, protection, and privacy has become an absolute priority for companies in all sectors.

Adopting robust and comprehensive solutions, such as the CipherTrust Data Security Platform, is essential to effectively address the challenges and risks inherent in today’s digital environment.

It is always worth remembering

It is vital to remember that compliance with laws such as LGPD should not be seen as a legal obligation, but an opportunity for companies to improve security practices, building trust and loyalty with customers and partners.

Data protection and privacy are no longer optional issues, but strategic imperatives that directly impact the reputation, business continuity, and success of companies in the global marketplace.

The adoption of solutions such as CipherTrust Data Security Platform represents an essential investment to ensure the resilience and prosperity of organizations in an increasingly connected and digitalized world.

About Eval

With a track record of leadership and innovation dating back to 2004, Eval not only keeps up with technological trends, but we are also in an incessant quest to bring news by offering solutions and services that make a difference to people’s lives.

With value recognized by the market, EVAL’s solutions and services meet the highest regulatory standards of public and private organizations, such as SBIS, ITI, PCI DSS, and LGPD. In practice, we promote information security and compliance, increase companies’ operational efficiency, and reduce costs.

Innovate now, lead always: get to know Eval’s solutions and services and take your company to the next level.

Eval, safety is value.

Written by Arnaldo Miranda, Evaldo. Ai, reviewed by Marcelo Tiziano and designed by Caio.

Categories
Data Protection

Data Protection in the Cloud: A Critical Challenge for Enterprises

In 2022, the“Cloud Security Report” published by Fortinet revealed that 22% of respondents considered cloud security to be one of the biggest challenges in adopting cloud computing technology.

However, the 2023 report shows a significant change. Cloud adoption has remained stable, with almost 40% of respondents claiming to have moved more than half of their workloads to the cloud, and 58% expecting to do the same in the next 12 to 18 months.

Even so, data protection in the cloud remains a major concern, with 95% of companies worried about security in public cloud environments.

The Impact of Cloud Security: An Updated Perspective

As we saw in the research published by Fortinet, cloud security remains a major challenge, especially for companies that are migrating critical data and applications to the cloud.

In many cases, cloud adoption is being inhibited by a series of related challenges that prevent faster and wider adoption of cloud services.

Configuration error remains the biggest security risk in the cloud, according to 59% of cybersecurity professionals. Despite the economic headwinds, cloud security budgets are increasing for most organizations (60%) by an average of 33%.

In addition, 44% of organizations are looking for ways to achieve better visibility and control in the security of hybrid and multi-cloud networks.

On the other hand, 90% are looking for a single cloud security platform to protect data consistently and comprehensively across their entire cloud presence.

Therefore, to navigate the complex landscape of cloud security, organizations must adopt a proactive and centralized approach.

By incorporating cybersecurity into their migration to the cloud, companies can reduce risk, improve security and save costs.

By tackling cloud security challenges head on and harnessing the power of centralized platforms, organizations can unlock the full potential of the cloud while protecting their critical assets.

How does the lack of cloud security affect companies’ willingness to adopt cloud technologies?

This is due to the fact that the cloud suffers from constant threats that companies need to address on an ongoing basis.

Attacks such as DDoS, credential theft, malware and other types of threats are becoming increasingly sophisticated. And that’s not counting internal risks, which can also lead to compromised data security in the cloud.

In addition, companies also face the challenge of compliance. With increasing regulations, such as
General Data Protection Law (LGPD)
 e
Payment Card Industry Data Security Standard (PCI DSS)
companies need to ensure that they are complying with all legal and regulatory requirements.

Other challenges companies face when it comes to data protection in the cloud

Besides the possibility of suffering attacks, there are other challenges that companies face when it comes to ensuring data protection in the cloud.

The following are some of the most pressing issues that companies must deal with when migrating their technology infrastructure to the cloud.

  1. Shortage of experienced professionals directly impacts data protection in the cloud

Migrating to the cloud requires highly skilled and experienced professionals. However, the lack of qualified professionals is one of the main problems companies face today.

With the growing demand for cloud IT professionals, the competition to hire these professionals is increasing, which means that companies have to spend more to hire and retain these employees.

A high risk that must be prioritized.

  1. APIs that are not safe to use

APIs are extremely important for allowing applications and devices to communicate with each other, but they also pose a major security risk in the cloud.

If APIs are not properly secured, cybercriminals can easily use them to gain unauthorized access to companies’ data and information.

One of the concerns companies have today is how to securely store and distribute API keys, also known as API secrets, given the high volume and agility required by DevOps teams.

 

  1. Insecure Cloud Data Storage

Business data is often stored on insecure cloud devices, which means it is subject to various risks, including cyber attacks.

If company data is not properly protected, cybercriminals can easily access it and steal the information.


Sometimes companies even have numerous protections in place, but even so, the hacker needs just one loophole, as reported
recently
a
leak,


Docker Hub images leak sensitive data and private keys.

In case specific it was evenencryption was used to protect the data, but the storage of the keys was not.

  1. Use of open source applications

Open source applications are increasingly popular as they are considered cheaper and easier to deploy.

Applications can pose a major risk to companies’ cloud data protection, since cybercriminals can easily find and exploit the vulnerabilities present in them.

  1. Incorrect settings

Incorrect configurations are another major cloud data protection problem faced by companies. If the settings are not adjusted correctly, this can allow cybercriminals to gain unauthorized access to company data and information.

In addition, incorrect configurations can also prevent companies from accessing the security features needed to secure their networks.

In fact, data protection in the cloud is a critical challenge for companies of all sizes. With the increased adoption of the cloud, cybercriminals are increasingly looking for new ways to attack companies.

Companies must therefore ensure that they are properly prepared to meet these challenges, otherwise they may suffer serious consequences.

Thales Data Protection on Demand (DPoD): Data protection in the cloud on demand

The award-winning Thales Data Protection on Demand is a cloud-based platform that offers a wide range of cloud HSM and key management services through a simple online marketplace.

Security is now simplified, more cost-effective and easier to manage because there is no hardware to buy, deploy and maintain.

Just click and deploy the services you need, provision users, add devices and get usage reports in minutes.

With DPoD, you can:

  • Focus on services, not hardware;
  • Buy only what you need and reduce costs;
  • Protect data anywhere;
  • Get real-time reports and visibility;
  • Easily integrate with existing applications, IT infrastructure and services.
With DPoDthere is no need for initial capital investment and prices are based on usage

There is no hardware or software to buy or upgrade. You have the flexibility to buy services to meet changing business needs.

In addition, Thales Data Protection on Demand allows you to easily integrate your cloud and IT services. Pre-configured APIs make it easy to integrate key management and HSM services on demand.

With DPoD, you can protect sensitive data in any environment – cloud, virtual or local. Protect the data you create, store and analyze. Encrypt your blockchain, cloud and Internet of Things (IoT) applications.

DPoD offers infinite scalability and elasticity. Expand HSM and key management services up and down automatically. Easily grow key and HSM management capacity and encryption capabilities without limitations.

Focus on your business

There’s no need to buy, provision, configure and maintain technology assets. The entire technological infrastructure is managed by Thales, including an SLA.

Thales Data Protection on Demand was awarded the Gold 2022 Cybersecurity Excellence Award for the best managed security service. This award honors individuals and companies that demonstrate excellence, innovation and leadership in information security.

In short, in addition to encrypting the data, store the key in a cloud HSM that is separate from your current infrastructure in order to increase the degree of security, so that once your company’s data has been leaked, the hacker will not have access to the cloud HSM in an environment outside your applications’ cloud.

Find out how the Eval and Thales partnership can help your company

The partnership between Eval and Thales allows your company to benefit from the Data Protection on Demand solution without the need to purchase, provision, configure and maintain hardware and software for your HSM and cryptographic key management needs.

All physical hardware, software, and infrastructure are managed by the existing official partnership between Eval and Thales, including an SLA, so you can focus on your business.

We deploy and manage cryptographic key management module services and hardware security, on demand and in cloud adoption.

With on-demand data protection, Eval and Thales can offer encryption and key management services quickly and easily.

Ensure your company’s cybersecurity with the expertise of Eval Professional Services

Eval Professional Services is made up of a team of experts who ensure that your company is in good hands.

With qualified professionals certified by Thales, we offer security services tailored to the needs of your business.

Take advantage of our vast experience and expertise in information security and LGPD compliance.

From defining the scope of the project to handing it over to the client, we provide customized solutions that integrate cutting-edge encryption technologies and secure access control infrastructure.

As your partner, we are ready to help you carry out digitization projects in compliance with security and data protection regulations.

Our commitment to excellence allows us to minimize risks, maximize performance and guarantee the data protection in cloud adoption that your customers and partners expect.

We share our experience in all business flows to help you protect what is most valuable: your data and customers.

Discover the benefits of Professional Services for your company.

About Eval

With a track record of leadership and innovation dating back to 2004, Eval not only keeps up with technological trends, but we are also in an incessant quest to bring news by offering solutions and services that make a difference to people’s lives.

With value recognized by the market, EVAL’s solutions and services meet the highest regulatory standards of public and private organizations, such as SBIS, ITI, PCI DSS, and LGPD. In practice, we promote information security and compliance, increase companies’ operational efficiency, and reduce costs.

Innovate now, lead always: get to know Eval’s solutions and services and take your company to the next level.

Eval, safety is value.

Written by Arnaldo Miranda, Evaldo. Ai, reviewed by Marcelo Tiziano and designed by Caio.

Categories
News and Events

Sequoia Logistica and Eval Improve Data Security

Sequoia Logística stands out in the Brazilian market as a leading company in logistics and transportation services, helping more than 4,000 clients with innovative and technological solutions, in addition to meeting important regulatory requirements, such as LGPD.

With the help of Eval, a reference company in digital certification and information security in Brazil and an official Thales partner, Sequoia Logística sought to improve protection of sensitive data.

At the same time, the company maintained high performance and compliance with regulations, such as Brazil’s General Data Protection Law (LGPD).

Data protection: securing personal records without hindering operational efficiency

Sequoia Logistics was faced with the challenge of protecting sensitive personal information of millions of customers while ensuring compliance with LGPD. In addition, they sought to avoid data breaches and service interruptions.

This challenge involved several critical aspects that required an efficient and comprehensive solution for data protection.

Data protection at scale

Given the amount of personal information collected and processed by Sequoia Logistica, including names, addresses, and contact information, it was essential to find a solution that could handle a large volume of data.

The ideal solution should be scalable and able to protect the data of millions of customers without hindering the company’s operational efficiency.

LGPD Compliance

The LGPD requires organizations to adopt appropriate technical and administrative measures to protect the personal data of their customers.

To comply with this regulation, Sequoia Logística needed to implement a solution that would ensure adequate data protection and make it easier to demonstrate compliance to the authorities.

Prevention of data breaches and service interruptions

Data breaches can cause significant damage to a company’s reputation, as well as result in fines and penalties.

Therefore, it was crucial for Sequoia Logistics to find a solution that would help prevent unauthorized access to sensitive data and quickly identify potential threats.

In addition, the solution should be able to mitigate the risk of service interruptions, ensuring continuity of operations and on-time delivery of hundreds of thousands of orders daily.

Maintaining the performance of IT systems

As Sequoia Logística’s operational efficiency relies heavily on its IT systems, it was critical that the data protection solution did not adversely affect the performance of these systems.

The ideal solution should be easy to integrate and implement, without causing disruption or delay to the company’s daily operations.

Given these challenges, Sequoia Logística sought to find a comprehensive and efficient solution that would meet its needs for data protection, regulatory compliance, and operational performance.

Solution: Partnering with Eval and adopting CipherTrust Transparent Encryption

The search for an effective security solution led Sequoia Logística to work with Eval, a trusted partner that introduced them to Thales and the CipherTrust Data Security Platform solution, approved after conducting proof-of-concept (PoC) tests for centralized key management.

Implementation: Securing 14 critical environments with CipherTrust Transparent Encryption

The successful implementation of the CipherTrust Transparent Encryption solution at Sequoia Logistics involved several important and strategic steps to secure its 14 critical production environments.

The following are details of how the company approached and executed this implementation.

  • Solution Selection and Evaluation

Sequoia Logistics, with Eval’s assistance, conducted considerable research and proof-of-concept (PoC) testing to evaluate CipherTrust Transparent Encryption.

These tests focused on ease of implementation, security policy enforcement, and impact on operations, ensuring that the solution met their specific needs.

  • Planning and Preparation

Prior to implementation, Sequoia Logistics and the Eval team carefully planned the integration of CipherTrust Transparent Encryption into critical production environments.

This included identifying the systems and applications that required protection, defining security policies, and establishing an implementation schedule to minimize the impact on daily operations.

  • Agent installation and configuration

The Sequoia Logistics team and Eval installed and configured CipherTrust Transparent Encryption agents on the operational file systems or device layers of critical production environments.

The installation of the agents allowed encryption and decryption to occur transparently, without affecting the performance of applications running above the agents.

  • Implementation of security policies and access control

With CipherTrust Transparent Encryption in place, Sequoia Logistics applied granular security policies and established privileged user access controls.

This has enabled the company to restrict and monitor access to sensitive data, reducing the risk of insider threats and data breaches.

  • Monitoring and Auditing

Sequoia Logística used CipherTrust Transparent Encryption’s real-time auditing and monitoring capabilities to track and analyze access to sensitive data, an important requirement of the LGPD.

This has helped the company to quickly identify and respond to suspicious or unauthorized activity, ensuring ongoing compliance and protection of sensitive data.

CipherTrust Transparent Encryption: a comprehensive approach to data protection

CipherTrust Transparent Encryption provides data-at-rest encryption with centralized key management, privileged user access control, and detailed data access auditability logging.

These features help companies to be compliant and meet best practice requirements for data protection wherever they are.

The FIPS 140-2 validated CipherTrust Transparent Encryption agent resides in the operating file system or at the device level, and encryption and decryption are transparent to all applications running above it.

In addition, the solution provides granular access controls that allow companies to determine who can access the data, when they can access it, and what kind of access they have.

CipherTrust Transparent Encryption is an innovative solution from Thales that provides robust protection for data at rest, ensuring that sensitive information is secure and accessible only by authorized users.

Advanced encryption and centralized key management

The CipherTrust Transparent Encryption solution uses advanced encryption algorithms to protect sensitive data, ensuring that only authorized users can access it.

In addition, centralized key management provides efficient control of encryption keys, making administration and recovery easy, even in complex, distributed environments.

Granular access control

Privileged user access control in the CipherTrust Transparent Encryption solution enables organizations to effectively manage access to sensitive data.

With granular policies and separation of roles, you can prevent unauthorized access by administrators or other privileged users, reducing the risk of insider threats and data breaches.

Detailed auditing and real-time monitoring

The CipherTrust Transparent Encryption solution provides detailed audit logs of data access, making it easy to identify and investigate suspicious or unauthorized activity.

In addition, real-time monitoring enables security teams to quickly track and respond to potential threats, ensuring compliance with General Data Protection Law requirements and ongoing protection.

Transparent implementation and optimized performance

The CipherTrust Transparent Encryption solution is designed to be implemented in the operating file system or device layers. This ensures that encryption and decryption is transparent to the applications running above the agents.

This results in minimal or no impact on the performance of systems and operations, allowing organizations to protect their data without compromising efficiency.

Compliance with regulations and best practices

The CipherTrust Transparent Encryption solution helps organizations meet compliance requirements around the world, including LGPD, GDPR and other data protection laws.

Implementing this solution allows companies to demonstrate compliance with regulations, avoiding fines and reputational damage.

In summary, CipherTrust Transparent Encryption offers a comprehensive and efficient solution for protecting data at rest, ensuring optimal security, compliance, and performance for organizations of all sizes and industries.

Eval is official Thales partner

Eval played a key role in the successful implementation of CipherTrust Transparent Encryption at Sequoia Logistics, acting as Thales’ official partner.

The partnership between Eval and Thales ensured that Sequoia Logistica had access to the ideal data security solution to address its specific challenges, such as LGPD, and achieve the desired results.

Experience and expertise that makes the difference for your company

As an official Thales partner, Eval has in-depth knowledge and hands-on experience with Thales’ data security solutions, including the CipherTrust Data Security Platform.

Eval’s team understands how Thales solutions can be adapted and applied to different industries and use cases, ensuring that customers get the maximum benefit from their implementations.

In addition, the partnership between Eval and Thales ensures that customers, such as Sequoia Logística, receive the highest level of technical support and consulting during implementation and beyond.

Eval’s team works closely with customers to understand their specific needs, provide expert advice, and ensure that the chosen data security solution is implemented effectively and efficiently.

In conclusion, the partnership between Eval and Thales played a crucial role in the successful implementation of CipherTrust Transparent Encryption at Sequoia Logistics.

Eval’s expertise, combined with Thales’ state-of-the-art data security solution, has enabled Sequoia Logistics to meet its data protection and regulatory compliance challenges effectively and efficiently.

About Eval

Eval has been developing projects in the financial, health, education, and industry segments for over 18 years. Since 2004, we have offered solutions for Authentication, Electronic and Digital Signature, and Data Protection. Currently, we are present in the main Brazilian banks, health institutions, schools and universities, and different industries.

With market recognized value, Eval’s solutions and services meet the highest regulatory standards for public and private organizations, such as SBIS, ITI, PCI DSS, and LGPD. In practice, we promote information security and compliance, increase companies’ operational efficiency, and reduce costs.

Innovate now, lead always: get to know Eval’s solutions and services and take your company to the next level.

Eval, safety is value.

Categories
Data Protection

Ransomware Clusters: Protect Yourself and Prevent Attacks

Ransomware groups continue to take advantage of vulnerabilities to infect and extort their victims. It is important that individuals and businesses are aware of these vulnerabilities and take the necessary precautions to protect themselves from infection.

By knowing what to look for, we can help minimize the chances of falling victim to cybercriminals, ransomware attacks, and all their effects.

In this article, we will discuss how to protect yourself against ransomware group attacks, the dangers of not being prepared, and what to do to protect yourself.

Groups specializing in malware distribution

Ransomware groups are organized criminal gangs that specialize in distributing different types of malware

They often take advantage of old vulnerabilities to infect their victims. This is because many people and companies do not keep their software up to date, leaving it vulnerable to attack.

According to the analysis of ransomware attacks recorded between January and March 2022 by cybersecurity researchers at Digital ShadowsLock Bit 2.0 and Conti were the two most active ransomware gangs during the three-month reporting period, accounting for 58% of all incidents.

Ransomware gangs usually infect a computer using social engineering techniques, such as sending malicious e-mails that contain infected attachments or links.

Once a victim opens the attachment or clicks on the link, the ransomware runs and encrypts the computer’s data. After encrypting the data, the gangs usually demand a ransom in virtual currency to decrypt it.

In addition, ransomware gangs can also infect a computer using exploits and unknown vulnerabilities, also known as Zero-Day attacks.

This is done by exploiting a flaw in the computer’s software that has not yet been fixed by the manufacturer. By doing so, ransomware gangs can gain complete access to the organization’s computer and networks.

Once ransomware has access to a network, it can spread to other computers connected to the network and encrypt the data on all computers.

This makes it even more difficult for an organization to recover its data, as they need to pay ransoms for all infected computers.

Ransomware groups have made their operations professional

As ransomware groups are becoming more professional with their attacks, it is important that individuals and businesses take the necessary precautions to protect themselves. One way to do this is to know what to look for to identify a possible ransomware attack.

Some of the most common vulnerabilities that ransomware groups are exploiting include old exploits in established products such as operating systems and productivity tools.

By keeping them up to date, we can help mitigate the risk of being infected by ransomware.

As ransomware operations have become more complex, they require an increasing range of specialized skills to be executed successfully.

For example, some ransomware groups are recruiting IT professionals to help encrypt their victims’ systems and ensure that the attack is successful.

The groups are increasingly specializing in certain industries to ensure that the victims are willing to pay the ransom.

For example, some ransomware groups are focused on attacking hospitals because they know that these organizations cannot stop functioning and need their systems to operate.

This means it is crucial that companies identify the types of ransomware that are being targeted and take the necessary steps to protect themselves.

In addition, it is important that companies keep a backup of their data so that they can restore their systems if they are infected by ransomware.

Finally, it is also a good idea to educate yourself and others about the dangers of ransomware. By doing so, we can help decrease the chances of being a victim of an attack.

 

infographic about the data protection platform CipherTrust

 

How to protect yourself from ransomware groups

There are a few steps you can take to protect yourself from ransomware groups.

  • First of all, make sure that you have up-to-date security software installed on your computer and that it is running the latest patches;
  • The second step is to be aware of the types of ransomware that exist and the methods they use to infect their victims. This will help you identify an attack if it happens;
  • Third, make sure you have a backup of your data in case you get infected. This way you can restore your systems without having to pay the ransom.

Also, be very careful what files you download and open, especially if they are from unknown or untrusted sources.

If you suspect that you have been infected with ransomware, do not attempt to pay the ransom, as this only encourages the attackers and may not result in the release of your files.

Instead, contact a professional malware removal service or your local authorities for assistance.

By following these simple steps, you can help keep yourself protected against ransomware groups.

Your company’s cybersecurity with real-time data protection and secure encryption

O
CipherTrust
is the ideal solution against ransomware attacks. In a simple, comprehensive and effective way, the solution
CipherTrust
 provides capabilities to secure and control access to databases, files, and containers – and can protect assets located in cloud, virtual, big data, and physical environments.

With CipherTrust, you can protect your company’s data and anonymize your sensitive assets, ensuring security for your company and avoiding future problems with data leakage.

Eval Professional Services has a team of specialized professionals with the best practices in the market

Benefit from our many years of experience and expertise in information security and compliance with LGPD (General Data Protection Law). We will be your partner for realizing digitization projects in compliance with security and data protection regulations.

We share our expertise across all business flows in healthcare organizations to help you minimize risk, maximize performance, and ensure the data protection your patients and partners expect.

About Eval

Eval has been developing projects in the financial, health, education, and industry segments for over 18 years. Since 2004, we have offered solutions for Authentication, Electronic and Digital Signature, and Data Protection. Currently, we are present in the main Brazilian banks, health institutions, schools and universities, and different industries.

With market recognized value, Eval’s solutions and services meet the highest regulatory standards for public and private organizations, such as SBIS, ITI, PCI DSS, and LGPD. In practice, we promote information security and compliance, increase companies’ operational efficiency, and reduce costs.

Innovate now, lead always: get to know Eval’s solutions and services and take your company to the next level.

Eval, safety is value.

Categories
Data Protection

Cybersecurity: Healthcare accounts for 24.7% of breaches

As health systems and hospitals were under stress as a result of the current global health crisis, their IT departments also faced critical situations and staff shortages as they battled relentless cyber attacks.

Cyber security breaches hit a historic high in 2021, exposing a record amount of patients’ protected health information,
according to a report by Critical Insights
.

In 2021, 45 million individuals were affected by attacks on healthcare data, up from 34 million in 2020. That number has tripled in just three years to 14 million in 2018, according to the report, which analyzes healthcare data breaches reported to the U.S. department of health and human services by healthcare organizations.

The total number of individuals affected has increased by 32% from 2020, meaning that more records are exposed for data breaches in the healthcare sector each year.

The total number of violations increased by only 2.4%, from 663 in 2020 to 679 in 2021, but still reached historic records.

Whether as a ransomware attack vector, credential collection, or device theft, healthcare is the primary target for attackers to monetize with personal patient information and sell on the Dark Web or hold an entity unable to provide patient care until ransomed.

As we move into 2022, healthcare organizations need to be aware of cybersecurity requirements

According to a study by Tenable, an American cybersecurity company, 1,825 data breach incidents were publicly disclosed between November 2020 and October 2021.

The industries most affected by data breaches in the healthcare sector were (24.7%), education (12.9%), and government (10.8%). In Brazil, the segments that suffered the most from cyber incidents were government (29.8%) and the financial sector (27%), respectively.

Also according to the study done by Critical Insights, data breaches in the healthcare industry, especially against health plans will increase by almost 35% from 2020 to 2021.

And attacks against business partners or third-party vendors increased by almost 18% from 2020 to 2021.

In Brazil, examples such as the Fleury group, the Hospital das Clínicas de São Paulo, the hospitals Sírio-Libanês, do Amor (formerly the Cancer Hospital), Santa Casa de Barretos, and Laboratório Gross have also been victims of cybercriminals against their institutions’ cybersecurity in recent years.

One of the most recent cases occurred in October 2021 with insurer Porto Seguro, which also has a segment related to health plans, the cyber attack caused instability in service channels and in some of its systems. Even non-insurance products, such as credit cards, have experienced instability.

Cyber attacks against providers, where most breaches are historically reported, have declined somewhat after peaking in 2020. Last year, 493 providers reported a data breach, a drop of about 4% from 515 in 2020.

However, it is too early to tell whether this modest improvement represents the beginning of a longer trend in the right direction, according to the report’s authors.

The years 2021/22 offered a ‘perfect storm’ for cybercriminals with ransomware attacks targeting enterprise cybersecurity

In practice, thecybersecurity teams are trying hard and trying to do a good job of reinforcing their defensesWhether internally or through partnerships with managed security providers, the measures are a response to the increase in attacks that occurred in 2020, when cybercriminals increased their efforts to take advantage of vulnerabilities exposed during the first chaotic days of the pandemic.

Cyber security incidents remain the most common cause of breaches with a 10% increase by 2021. Cybercrime was also responsible for the vast majority of individual records affected by breaches, which means that these records were probably sold on the dark web, according to the report.

The data also indicates an increase in cybercriminal incidents in ambulatory/specialty clinics, which saw a 41% increase in these types of breaches in 2021 compared to 2020.

As we move into 2022, healthcare organizations need to be aware not only of their cybersecurity posture, but also of third-party vendors who have access to data and networks. We are seeing more awareness and proactive approaches to cyber security in this industry, but there is still a long way to go.

 

CipherTrust Discovery and Classification

Cyber security in 2022 will be marked by major attacks on the healthcare sector

This is no time for healthcare organizations’ cybersecurity teams to let their guard down. Cybercriminals are aiming at bigger targets. Exploits, especially ransomware, are becoming more sophisticated.

Cybercriminals are expanding their activities to take advantage of security vulnerabilities throughout the healthcare supply chain, from business partners to health plans and outpatient facilities.

To strengthen their defenses, healthcare organizations need to establish a comprehensive risk management program and should classify their business partners by risk level based on the type of data that third parties can access.

Other steps organizations can take include establishing procedures and processes to evaluate third parties before granting access to data, emphasizing protection in any business agreements with third parties, and working with cybersecurity companies for managed intrusion detection and response services.

CipherTrust Data Security Platform is an important resource in combating data breaches in the healthcare industry

According to IDC, more than 175 zetabytes of data will be created by 2025, and today more than half of all corporate data is stored in the cloud.

To handle the complexity of where data is stored, CipherTrust Data Security Platform provides strong capabilities to protect and control access to sensitive data in databases, files, and containers. Specific technologies include:

CipherTrust Transparent Encryption

Encrypts data in on-premises, cloud, database, file, and Big Data environments with comprehensive access controls and detailed data access audit logging that can prevent the most malicious attacks.

CipherTrust Database Protection

It provides transparent column-level encryption of structured and confidential data that resides in databases such as credit card, social security numbers, national identification numbers, passwords, and e-mail addresses.

CipherTrust Application Data Protection

It offers APIs for developers to quickly add encryption and other cryptographic functions to their applications, while SecOps controls the encryption keys.

CipherTrust Tokenization

It offers application-level data tokenization services in two convenient solutions that provide customer flexibility – Token without Vault with dynamic policy-based data masking and Tokenization in Vault.

CipherTrust Batch Data Transformation

Provides static data masking services to remove sensitive information from production databases so that compliance and cybersecurity issues are alleviated when sharing a database with a third party for analysis, testing, or other processing.

CipherTrust Manager

It centralizes keys, management policies, and data access for all CipherTrust Data Security Platform products and is available in FIPS 140-2 Level 3 compliant physical and virtual formats.

CipherTrust Cloud Key Manager

It offers its own key lifecycle management (BYOK) for many cloud infrastructure, platform, and software-as-a-service providers.

CipherTrust KMIP Server

It centralizes key management for the Key Management Interoperability Protocol (KMIP) commonly used in storage solutions.

CipherTrust TDE Key Manager

Centralizes key management for encryption found in Oracle, SQL and Always Encrypted

The portfolio of data protection products that make up the CipherTrust Data Security Platform solution enables healthcare organizations to protect data at rest and in motion across the entire IT ecosystem and ensures that the keys to this information are always protected and only under your control.

It simplifies data cybersecurity, improves operational efficiency, and accelerates compliance time. Regardless of where your data resides.

The CipherTrust platform ensures that your data is secure, with a wide range of proven, industry-leading products and solutions for deployment in data centers, either those managed by cloud service providers (CSPs) or managed service providers (MSPs), or as a cloud-based service managed by Thales, a leading cybersecurity company.

Tool portfolio that ensures data and cyber protection

With data protection products from the CipherTrust Data Security Platform, your healthcare organization can:

Strengthen cybersecurity and compliance

CipherTrust data protection products and solutions address the demands of a number of cybersecurity and privacy requirementsincluding electronic identification, authentication, and trust, Payment Card Industry Data Security Standard (PCI DSS), General Data Protection Law (LGPD)among other compliance requirements.

Optimizes efficiency of staff and resources related to cybersecurity

CipherTrust Data Security Platform offers the broadest support for handling personal patient data in data security use cases in the industry, with products designed to work together, a single line for global support, a proven track record of protecting against evolving threats, and the industry’s largest ecosystem of data security partnerships.

With a focus on ease of use, APIs for automation, and responsive management, the CipherTrust Data Security Platform solution ensures that your teams can quickly deploy, secure, and monitor the protection of your business.

In addition, professional services and partners are available for design, implementation, and training assistance to ensure fast and reliable implementations with minimal staff time.

Reduces total cost of ownership

CipherTrust Data Security Platform’s data protection portfolio offers a broad set of data security products and solutions that can be easily scaled, expanded for new use cases, and have a proven track record of protecting new and traditional technologies.

With CipherTrust Data Security Platform, healthcare institutions can prepare their investments for the future while reducing operational costs and capital expenditures.

About Eval

EVAL has been developing projects in the financial, health, education and industry segments for over 18 years. Since 2004, we have offered Authentication, Electronic and Digital Signature and Data Protection solutions. Currently, we are present in the main Brazilian banks, health institutions, schools and universities, and different industries.

With value recognized by the market, EVAL’s solutions and services meet the highest regulatory standards of public and private organizations, such as SBIS, ITI, PCI DSS, and LGPD. In practice, we promote information security and compliance, increase companies’ operational efficiency, and reduce costs.

Innovate now, lead always: get to know Eval’s solutions and services and take your company to the next level.

Eval, safety is value.

Categories
Data Protection

ROI in Cybersecurity: How to quantify something that doesn’t happen?

The best result of a well-executed cybersecurity strategy is basically a company with no disruption to its operations or systems in the event of an external threat. In other words, it is having an efficient cybersecurity ROI.

However, while this is undoubtedly a positive result, it can become a major challenge when it comes to proving ROI in cybersecurity.

With the lack of visible results to share, you may find yourself answering questions from business leaders about the true value of cybersecurity.

While preventing damage from cyber attacks should only be seen as a justification for investing in cybersecurity, if the result is invisible, the risk is that this investment will come under the spotlight and its validity will be questioned.

So, with cybersecurity investment spanning technology, people, and processes, how can you best demonstrate the tangible cybersecurity ROI of your investment in data protection and privacy?

ROI in cybersecurity, how do you quantify the value of something intangible?

Organizations make their investment and spending decisions by estimating ROI. If you, for example, spend $10 million developing a new product, you expect to make $100 million in profit. If you spend $15 million on a new IT system, you expect to achieve $150 million in productivity increases.

But if you spend $25 million on cybersecurity, what is the resulting value benefit to the organization?

Furthermore, how can you systematically and quantitatively determine which of the numerous cybersecurity tools and technologies available will provide your organization with the best possible increase in cyber resiliency for the money spent?

In 2017, IT security spending increased from 5.9% to 6.2% of total IT spending year over year, but in 2019, IT security spending fell to 5.7% of total IT investments.

The absence of tangible reasons to spend not only causes frustration among IT professionals, it also leaves organizations exposed to glaring cybersecurity flaws and malicious cybercriminals waiting for the right moment to strike.

After all, no leadership will make large investments in a strategy that does not have tangible returns.

How to calculate ROI in cybersecurity?

First, ensure that you have a defined, layered security strategy in place to provide the best possible protection on company or financial reputation as a result of a cyber attack or breach.

Several examples from previous years have already shown the consequences of not keeping customers’ personal data protected from cyber threats, according to cybersecurity firm Coveware, for example, the average cost of a ransomware attack last year was $84,116, although some ransom demands were as high as $800,000.

Demonstrate competitive advantage

To truly demonstrate the value of your cybersecurity investment, be sure to emphasize the impact that effective security protocols have on the entire enterprise.

For many companies, cybersecurity is a prerequisite for business commitments and regulatory requirements, such as the General Data Protection Act (LGPD).

With good security credentials and robust processes, companies can open up markets and revenue streams that were previously impossible to reach, proving the long-term cybersecurity ROI of an investment in data protection and privacy.

Maximize your technology investment and ensure ROI in cybersecurity

A study done by IBM with 500 global organizations, including Brazil, and with more than 3,200 security professionals shows that the average cost of a data breach is $3.86 million.

The study also shows that technologies such as artificial intelligence (AI), machine learning, process automation with robots (RPA), analytics, and others can help the company save money in the event of a breach.

Maximizing your investment in cybersecurity is crucial to demonstrating ROI in cybersecurity. There are tangible ways to achieve this by generating greater efficiency, for example by reducing the time needed to eliminate the noise created by outdated technologies, especially when it comes to monitoring and response.

Outdated technology frameworks usually produce multiple alerts, which means that you need to review and apply your own knowledge before drafting a response.

However, developments in artificial intelligence now allow patterns and behaviors across technologies to be identified in real time, reducing the noise to a few actionable alerts.

Discover security and data protection solutions

The latest security, data protection, and data privacy solutions offer great benefits in terms of driving efficiency and demonstrating ROI in cybersecurity.

The IBM report also finds that companies with fully deployed security automation compared to those without it realize a cost savings of $3.58 million.

Readiness for incident response can also help keep costs down when responding to a data breach.

In fact, companies without an incident response team averaged $5.29 million in breach costs, compared to $2 million for companies that maintain an incident response team and simulations, according to IBM.

Therefore, by combining artificial intelligence, automation, and human analysis to detect and act on cyber threats, they can reduce cyber risk and the dwell time of breaches, allowing your staff to focus efforts on other areas.

Finally, consider adopting a protection framework that is available as a hybrid security operations center.

This gives you the flexibility to adapt it to your needs, while at the same time helping to develop the right skills internally in the company, again enabling consolidation of security vendors.

a-file-id=”5623726″ height=”382″ src=”https://mcusercontent.com/24a0afe85a95b938f0283f881/images/38e2ea96-1011-d7be-9a45-490706e654b7.png” style=”border: 0px ; width: 600px; height: 300px; margin: 0px;” width=”300″ />

 

Earning Board Trust and Securing ROI in Cybersecurity

The methods and reasons for cyber attacks will continue to evolve and you need to make informed decisions about potential risks and mitigate them through the right security processes, technology, and controls.

While proving cybersecurity ROI has potentially been difficult for security teams historically, by implementing the right strategy, clear communication channels, and leveraging the right technologies such as security, data protection, and privacy solutions, this can be easily overcome.

Solutions like these help drive digital transformation across the enterprise, enabling your organization to adapt to the growing digital economy and face evolving threats with greater confidence.

And it is this business case that you can present to get the support of top management and the board.

CipherTrust: protect your company and maximize your ROI in cybersecurity

In the challenge of ensuring an efficient ROI in cybersecurity, companies can rely on the CipherTrust Data Security Platform solution, which allows companies to protect their structure against cyber attacks.

According to IDC, more than 175 zetabytes of data will be created by 2025, and today more than half of all corporate data is stored in the cloud.

To handle the complexity of where data is stored, CipherTrust Data Security Platform provides strong capabilities to protect and control access to sensitive data in databases, files, and containers. Specific technologies include:

CipherTrust Transparent Encryption

Encrypt data in on-premises, cloud, database, file, and Big Data environments with comprehensive access controls and detailed data access audit logging that can prevent the most malicious attacks.

CipherTrust Database Protection

It provides transparent column-level encryption of structured and confidential data that resides in databases such as credit card, social security numbers, national identification numbers, passwords, and e-mail addresses.

CipherTrust Application Data Protection

It offers APIs for developers to quickly add encryption and other cryptographic functions to their applications, while SecOps controls the encryption keys.

CipherTrust Tokenization

It offers application-level data tokenization services in two convenient solutions that provide customer flexibility – Token without Vault with dynamic policy-based data masking and Tokenization in Vault.

CipherTrust Batch Data Transformation

Provides static data masking services to remove sensitive information from production databases so that compliance and security issues are alleviated when sharing a database with a third party for analysis, testing, or other processing.

CipherTrust Manager

It centralizes keys, management policies, and data access for all CipherTrust Data Security Platform products and is available in FIPS 140-2 Level 3 compliant physical and virtual formats.

CipherTrust Cloud Key Manager

It offers its own key lifecycle management (BYOK) for many cloud infrastructure, platform, and software-as-a-service providers.

CipherTrust KMIP Server

It centralizes key management for the Key Management Interoperability Protocol (KMIP) commonly used in storage solutions.

CipherTrust TDE Key Manager

Centralizes key management for encryption found in Oracle, SQL and Always Encrypted SQL.

The portfolio of data protection products that make up the CipherTrust Data Security Platform solution enables enterprises, seeking to improve their cybersecurity ROI, to protect data at rest and in motion across the IT ecosystem and ensures that the keys to this information are always protected and only under their control.

It simplifies data security, improves operational efficiency, and accelerates compliance time. Regardless of where your data resides.

The CipherTrust platform ensures that your data is secure, with a wide range of proven, industry-leading products and solutions for deployment in data centers, either those managed by cloud service providers (CSPs) or managed service providers (MSPs), or as a cloud-based service managed by Thales, a leading security company.

Tool portfolio that ensures data protection

With CipherTrust Data Security Platform’s data protection products, your company achieves cybersecurity ROI in different ways:

Strengthen security and compliance

CipherTrust data protection products and solutions address the demands of a range of security and privacy requirements, including electronic identification, authentication and trust, Payment Card Industry Data Security Standard (PCI DSS), General Data Protection Act (LGPD), and other compliance requirements.

Optimizes team and resource efficiency

CipherTrust Data Security Platform offers the broadest support for data security use cases in the industry, with products designed to work together, a single line for global support, a proven track record of protecting against evolving threats, and the industry’s largest ecosystem of data security partnerships.

With a focus on ease of use, APIs for automation, and responsive management, the CipherTrust Data Security Platform solution ensures that your teams can quickly deploy, secure, and monitor the protection of your business.

In addition, professional services and partners are available for design, implementation, and training assistance to ensure fast and reliable implementations with minimal staff time.

Reduces total cost of ownership

When it comes to cybersecurity ROI, CipherTrust Data Security Platform’s data protection portfolio offers a broad set of data security products and solutions that can be easily scaled, expanded for new use cases, and have a proven track record of protecting new and traditional technologies.

With CipherTrust Data Security Platform, companies can prepare their investments for the future while reducing operating costs and capital expenditures.

About Eval

EVAL has been developing projects in the financial, health, education and industry segments for over 18 years. Since 2004, we have offered Authentication, Electronic and Digital Signature and Data Protection solutions. Currently, we are present in the main Brazilian banks, health institutions, schools and universities, and different industries.

With value recognized by the market, EVAL’s solutions and services meet the highest regulatory standards of public and private organizations, such as SBIS, ITI, PCI DSS, and LGPD. In practice, we promote information security and compliance, increase companies’ operational efficiency, and reduce costs.

Innovate now, lead always: get to know Eval’s solutions and services and take your company to the next level.

Eval, safety is value.

Categories
Data Protection

IoT Security: Risk in +50% of Medical Devices

More than half of the real-time connected IoT medical devices in hospitals currently pose IoT (Internet of Things) security threats due to existing critical vulnerabilities that can considerably compromise patient care.

This is shown in the report

State of Healthcare IoT Device Security Report

 2022 report from Cynerio, a company that develops IoT security platforms for healthcare.

According to the survey, 53% of the Internet-connected medical devices analyzed had a known vulnerability; for every smart device connected at the bedside, one-third were identified as presenting a critical risk.

Cynerio analyzed more than 10 million IoT medical devices in more than 300 global hospitals and medical facilities.

The report warns that if these medical devices were accessed by cybercriminals, it would affect service availability, data confidentiality, and even patient safety.

IoT security in healthcare: a major target for cyber attacks

And even with continued investments in cybersecurity, critical vulnerabilities remain in many of the medical devices that hospitals rely on for patient care.

In practice, healthcare institutions need advanced solutions that mitigate risks and enable them to fight back against cyber attacks, it could mean life or death for patients.

Of all medical IoT devices, the report found that infusion pumps are the most common device with some type of vulnerability at 73%, especially since they represent 38% of a hospital’s IoT.

If criminals hack into an IV pump, it would directly affect patients, since they are directly connected to their users.

Some of the main causes of vulnerabilities found in healthcare facilities result from relatively simple things, such as out-of-date programs.

For example, the report found that most IoT medical devices were running older versions of the operating system.

In addition, default passwords, used on every smart device, across the organization are common risks, especially since these credentials are weak and protect about 21% of smart devices.

In fact, healthcare has become the number one target of cybercriminals in recent years, mainly due to outdated systems and insufficient cybersecurity protocols.

Growing IoT Adoption Has Advantages and Vulnerabilities

The Internet of Things has over the years brought immense advantages to medical organizations and their patients.

From giving patients clearer visibility into their treatment to reducing some of the cost, access, and care coordination challenges currently facing the healthcare industry, IoT is poised to change the way we keep individuals healthy.

According to the report

Global Market Insights report

, the global healthcare cybersecurity market is expected to increase above $27 billion by 2025, with a CAGR of 19.1% from $8.2 billion in 2018.

The Internet of Medical Things (IoMT) has offered a simple doorway for cybercriminals trying to misuse and profit from vulnerabilities.

A
Open Source Cybersecurity Intelligence Network and Resource
 states that there are, on average, 6.2 vulnerabilities per medical device.

Considering the sheer volume of IoT medical devices currently present in clinics and clinical environments, this shows a picture of high risk regarding IoT security.

IoT security poses risk to patient care

Because edge devices are absent in a secure network environment, it is simpler for cybercriminals to control the connected medical device, for example, a health assessment device, portable ventilator, or insulin pump, which sends crucial information to the hospital.

In addition, many of these devices are with default passwords and inaccessibility firewalls that make them more vulnerable.

Cybercriminals can gain access to the device to deploy harmful code and make unapproved modifications to the device’s software.

Appropriate anti-malware mechanisms should be in place to ensure the integrity of the device and protect it from spyware and Trojan attacks, thus ensuring IoT security.

Also regarding IoT security, healthcare institutions should still ensure the device is configured with strict password policies.

Compliance with the General Law on Data Protection (LGPD) is also required for equipment used to obtain patient health information.

Infographic about the data protection platform CipherTrust

 

An organization is only as strong as its weakest link

This means it is more important than ever that healthcare organizations protect and invest in IoT security on all network-connected devices.

Implying the implementation of a solution that can track all traffic to and from IoT devices, as well as limit who and what each device can talk to.

Finding a way to secure and track what machines and devices are doing is crucial. In addition, a vigorous, strong, cloud-oriented network infrastructure is critical.

As medical organizations seek to access the benefits of IoT devices, many of them become obvious targets for cybercriminals.

Getting the right infrastructure and processes in place to protect your frontline will help prepare for the correct and safe use of devices, as well as have the best patient outcomes.

CipherTrust Data Security Platform is the right solution for your hospital to ensure IoT security

The CipherTrust Data Security Platform solution is an important technology resource that can be associated with the use of the Internet of Things (IoT), further extending the security and protection of data.

According to IDC, more than 175 zetabytes of data will be created by 2025, and today more than half of all corporate data is stored in the cloud.

To address the complexity of IoT security, the CipherTrust Data Security Platform solution provides strong capabilities to protect and control access to sensitive data in databases, files, and containers. Specific technologies include:

CipherTrust Transparent Encryption

Encrypts data in on-premises, cloud, database, file, and Big Data environments with comprehensive access controls and detailed data access audit logging that can prevent the most malicious attacks.

CipherTrust Database Protection

It provides transparent column-level encryption of structured and confidential data that resides in databases such as credit card, social security numbers, national identification numbers, passwords, and e-mail addresses. Fundamental to ensuring IoT security in healthcare facilities.

CipherTrust Application Data Protection

It offers APIs for developers to quickly add encryption and other cryptographic functions to their applications, while SecOps controls the encryption keys.

CipherTrust Tokenization

It offers application-level data tokenization services in two convenient solutions that provide customer flexibility – Token without Vault with dynamic policy-based data masking and Tokenization in Vault.

CipherTrust Batch Data Transformation

It provides static data masking services to remove sensitive information from production databases, so that compliance and security issues, directly linked to the IoT security issue, are alleviated when sharing an information database with a third party for analysis, testing, or other processing.

CipherTrust Manager

It centralizes keys, management policies, and data access for all CipherTrust Data Security Platform products and is available in FIPS 140-2 Level 3 compliant physical and virtual formats.

CipherTrust Cloud Key Manager

It offers its own key lifecycle management (BYOK) for many cloud infrastructure, platform, and software-as-a-service providers.

CipherTrust KMIP Server

It centralizes key management for the Key Management Interoperability Protocol (KMIP) commonly used in storage solutions.

CipherTrust TDE Key Manager

Centralizes key management for encryption found in Oracle, SQL and Always Encrypted SQL.

The portfolio of data protection products that make up the CipherTrust Data Security Platform solution enables healthcare organizations to protect data at rest and in motion across the entire IT ecosystem and ensures that the keys to this information are always protected and only under your control.

It simplifies IoT security over data, improves operational efficiency, and accelerates compliance time. Regardless of where your data resides.

The CipherTrust platform ensures that your data is secure, with a wide range of proven, industry-leading products and solutions for deployment in data centers, either those managed by cloud service providers (CSPs) or managed service providers (MSPs), or as a cloud-based service managed by Thales, a leading security company.

Tool portfolio ensuring data protection in IoT devices

With data protection products from the CipherTrust Data Security Platform, your healthcare organization can:

Strengthen security and compliance

CipherTrust data protection products and solutions address the demands of a range of security and privacy requirements, including electronic identification, authentication and trustThe Payment Card Industry Data Security Standard (PCI DSS), the General Data Protection Act (LGPD), and other compliance requirements.

Optimizes staff and resource efficiency in IoT devices

CipherTrust Data Security Platform offers the broadest support for data security use cases in the industry, with products designed to work together, a single line for global support, a proven track record of protecting against evolving threats, and the industry’s largest ecosystem of data security partnerships.

With a focus on ease of use, APIs for automation, and responsive management, the CipherTrust Data Security Platform solution ensures that your teams can quickly deploy, secure, and monitor the protection of your business.

In addition, professional services and partners are available for design, implementation, and training assistance to ensure fast and reliable implementations with minimal staff time.

Reduces total cost of ownership

CipherTrust Data Security Platform’s data protection portfolio offers a broad set of data security products and solutions that can be easily scaled, expanded for specific use cases for IoT security, and have a proven track record of protecting new and traditional technologies.

With CipherTrust Data Security Platform, healthcare institutions can prepare their investments for the future while reducing operational costs and capital expenditures.

About Eval

EVAL has been developing projects in the financial, health, education and industry segments for over 18 years. Since 2004, we have offered Authentication, Electronic and Digital Signature and Data Protection solutions. Currently, we are present in the main Brazilian banks, health institutions, schools and universities, and different industries.

With value recognized by the market, EVAL’s solutions and services meet the highest regulatory standards of public and private organizations, such as SBIS, ITI, PCI DSS, and LGPD. In practice, we promote information security and compliance, increase companies’ operational efficiency, and reduce costs.

Innovate now, lead always: get to know Eval’s solutions and services and take your company to the next level.

Eval, safety is value.

Categories
Data Protection

Health 5.0: Global Revolution with Medical Technologies

With Health 5.0, we are facing a paradigm shift in digital technologies, from traditional health to smart health, which is expected to revolutionize the sector globally.

Smart health incorporates digital technologies to navigate medical information effortlessly, linking individuals, resources and organizations, and then efficiently reacting to the demands of the healthcare environment in an efficient manner.

In practice, smart health connects different stakeholders in the healthcare system, such as patients, professionals, organizations and regulators.

This is achieved with emerging technologies including artificial intelligence (AI), internet of things (IoT), cloud computing, blockchain, 5G connectivity and internet of medical things (IoMT), among other technological innovations that continue to evolve.

These technologies play an important role in the development of the innovative Health 5.0 concept.

Health 5.0 represents a significant boost in innovation

Similar to the automobile industry, the healthcare system has gone through generations, from health 1.0 to smart health, with the revolution in various support sectors.

For example, from 1970 to 1990, many medical systems used paper-based solutions due to the lack of digital technologies.

Healthcare support industries have embraced industry 4.0 and are now moving to industry 5.0. This revolution continues to redefine how modern, digitally high-tech companies improve business operations and increase efficiency across the value chain.

Just like manufacturing, healthcare service delivery is at the beginning of a paradigm shift to reach the new era of health 5.0.

This is a complex era in many respects, including intelligent disease control and detection, virtual care, intelligent monitoring, decision-making and medical science.

The transition from health 4.0 to health 5.0

The gain generated by the boost in digital and medical technologies has led to the development of advanced medical imaging, tracking and healthcare 4.0 systems.

Countries such as the United States, Germany and the United Kingdom have transformed their healthcare systems into a value-based system to improve patient-centered healthcare services through smart, connected care and personalized medicine.

Health 4.0 incorporates the principles and applications of industry 4.0 in healthcare, enabling real-time personalization of care for patients and professionals.

Thus, Health 4.0 supports resilient performance in health systems, which refers to their adaptive capacity to deal with complexity.

Innovative digital technologies adopted in the area of health 4.0 promote real-time customization of patient care and communication between actors in the value chain and the dissemination of health-related information.

The collection of large volumes of data on processes, patients, equipment and materials, processing and transformation of medical data into information, the digitization and automation of health processes, are examples of the advances generated by Health 4.0.

In this context, the process of health service delivery becomes a complex one. system equipped with technologies such as IoTThis will include the use of radio frequency identification, smart wearable medical devices, smart sensors and medical robots, integrated with cloud computing, big data, business intelligence (BI), AI and technical decision support to achieve smart and interconnected healthcare delivery.

However, the lack of recognition, coupled with the shortage of personalized, intelligent and comprehensive medical applications, requiring greater integration of smart sensors, AI and big data has taken it to the next level, making Health 5.0 have a greater focus on customer experience.

Technologies that are part of health 5.0

Emerging digital technologies used in health 5.0 include nanotechnology, 5G connectivity, drone technology, blockchain, robotics, big data, IoT, AI and cloud computing.

Health 5.0 will benefit from nanotechnology applications

Nanotechnology presents unprecedented opportunities to transform health services. Basically, nanotechnology plays a crucial role in therapeutic medicine, rapid diagnostics, surveillance and monitoring, and the development of new forms of personal protective equipment and vaccines.

Nanotechnology involves the manipulation, fabrication, material, modes and use of nanodevices in various applications.

IoT has been widely used in healthcare to connect medical devices and share data over the internet.

There are several emerging variations of sensor-based IoT in healthcare, each with its own peculiarities.

For example, IoT facilitates the introduction of the internet of health things, internet of wearable things, IoMT, among other variations.

These IoT variations provide networked healthcare, which supports the integration of smart medical devices and comprehensive sharing of health data remotely.

For example, smart devices enable remote monitoring in medical services and change the concept of traditional healthcare to smart healthcare.

Thus, through variations of IoT, patient data, sensed by biosensors and smart wearable devices, is remotely accessed, processed and analyzed by medical professionals to improve the delivery of healthcare services.

The inclusion of automation, along with AI, is expected to revolutionize service delivery in Health 5.0

Embedded AI devices based on highly integrated sensors, such as smart wearable devices, help monitor, collect and diagnose diseases from symptoms extracted from sensory data.

Intelligent systems recognize the environment through sensors and take reasonable actions. AI in health 5.0 includes several concepts such as disease detection and diagnosis, development of smart medicines, effective remote monitoring of patients, effective use of robotic surgical systems and the development of smart sensor-based AI devices.

5G technology provides high data throughput and bandwidth

Digital automation of emerging technologies such as robots, AI, smart devices, nanotechnology and cloud computing requires high and continuous data rates to collect, store, reformat and track health data to provide faster and more consistent access.

In this way, 5G technology has become a prime and essential technology for health 5.0 as it provides a high data rate to the user and huge network signal coverage and can handle 1000 times more traffic on the transmission channel.

The growing amount of health data generated from digital technologies is adding value to scientific findings in Health 5.0.

Digital health technologies such as telemedicine, electronic medical records, and other digital health platforms have significantly improved the efficiency and costs of hospitals, along with reducing medical errors and, most importantly, sharing patient data remotely.

In Health 5.0, the future interconnectivity of smart sensors, smart devices and other digital technologies will eventually increase the amount of health data, which results in big data.

This data will eventually be used for disease prevention, detection and monitoring, as well as to provide personalized care. Thus, big data for health 5.0 positions patients and healthcare professionals on the brink of great prospects and is expected to impact medical systems in unprecedented ways.

CipherTrust Discovery and Classification

Emerging digital technologies continue to evolve, presenting unprecedented opportunities for global health systems.

Health 5.0 is at the beginning of a paradigm shift to reach the new era of intelligent disease control and detection, virtual care, smart health management and monitoring, decision making and precision medicine.

This revolution continues to redefine how high-tech digital companies improve healthcare operations and increase efficiency across multiple medical systems to deliver patient-centric healthcare services through smart, connected care and personalized medicine.

CipherTrust for Security and Data Protection in Healthcare 5.0

According to IDC, more than 175 zetabytes of data will be created by 2025, and today more than half of all corporate data is stored in the cloud.

To handle the complexity of where data is stored, CipherTrust Data Security Platform provides strong capabilities to protect and control access to sensitive data in databases, files, and containers. Specific technologies include:

CipherTrust Transparent Encryption

Encrypts data in on-premises, cloud, database, file, and Big Data environments with comprehensive access controls and detailed data access audit logging that can prevent the most malicious attacks.

CipherTrust Database Protection

It provides transparent column-level encryption of structured and confidential data that resides in databases such as credit card, social security numbers, national identification numbers, passwords, and e-mail addresses.

CipherTrust Application Data Protection

It offers APIs for developers to quickly add encryption and other cryptographic functions to their applications, while SecOps controls the encryption keys.

CipherTrust Tokenization

It offers application-level data tokenization services in two convenient solutions that provide customer flexibility – Token without Vault with dynamic policy-based data masking and Tokenization in Vault.

CipherTrust Batch Data Transformation

Provides static data masking services to remove sensitive information from production databases so that compliance and security issues are alleviated when sharing a database with a third party for analysis, testing, or other processing.

CipherTrust Manager

It centralizes keys, management policies, and data access for all CipherTrust Data Security Platform products and is available in FIPS 140-2 Level 3 compliant physical and virtual formats.

CipherTrust Cloud Key Manager

It offers its own key lifecycle management (BYOK) for many cloud infrastructure, platform, and software-as-a-service providers.

CipherTrust KMIP Server

It centralizes key management for the Key Management Interoperability Protocol (KMIP) commonly used in storage solutions.

CipherTrust TDE Key Manager

Centralizes key management for encryption found in Oracle, SQL and Always Encrypted SQL.

The portfolio of data protection products that make up the CipherTrust Data Security Platform solution enables healthcare organizations to protect data at rest and in motion across the entire IT ecosystem and ensures that the keys to this information are always protected and only under your control.

It simplifies data security, improves operational efficiency, and accelerates compliance time. Regardless of where your data resides.

The CipherTrust platform ensures that your data is secure, with a wide range of proven, industry-leading products and solutions for deployment in data centers, either those managed by cloud service providers (CSPs) or managed service providers (MSPs), or as a cloud-based service managed by Thales, a leading security company.

Tool portfolio that ensures data protection

With data protection products from the CipherTrust Data Security Platform, your healthcare organization can:

Strengthening safety and compliance in Health 5.0

CipherTrust data protection products and solutions address the demands of a range of security and privacy requirements, including electronic identification, authentication, and trust, Payment Card Industry Data Security Standard (PCI DSS), General Data Protection Law (LGPD) together with the National Data Protection Authority (ANPD), among other compliance requirements.

Optimizes team and resource efficiency

CipherTrust Data Security Platform offers the broadest support for data security use cases in the industry, with products designed to work together, a single line for global support, a proven track record of protecting against evolving threats, and the industry’s largest ecosystem of data security partnerships.

With a focus on ease of use, APIs for automation, and responsive management, the CipherTrust Data Security Platform solution ensures that your teams can quickly deploy, secure, and monitor the protection of your business.

In addition, professional services and partners are available for design, implementation, and training assistance to ensure fast and reliable implementations with minimal staff time.

Reduces total cost of ownership

CipherTrust Data Security Platform’s data protection portfolio offers a broad set of data security products and solutions that can be easily scaled, expanded for new use cases, and have a proven track record of protecting new and traditional technologies.

With CipherTrust Data Security Platform, healthcare institutions can prepare their investments for the future while reducing operational costs and capital expenditures.

About Eval

EVAL has been developing projects in the financial, health, education and industry segments for over 18 years. Since 2004, we have offered Authentication, Electronic and Digital Signature and Data Protection solutions. Currently, we are present in the main Brazilian banks, health institutions, schools and universities, and different industries.

With value recognized by the market, EVAL’s solutions and services meet the highest regulatory standards of public and private organizations, such as SBIS, ITI, PCI DSS, and LGPD. In practice, we promote information security and compliance, increase companies’ operational efficiency, and reduce costs.

Innovate now, lead always: get to know Eval’s solutions and services and take your company to the next level.

Eval, safety is value.

Categories
Data Protection

How to prevent cyber attacks: Key ways to protect yourself

While cyber attacks and threats are an ongoing struggle and a major challenge for businesses , they can be avoided by knowing the various types of protocols, exploits, tools, and resources used by cybercriminals. In addition, knowing where and how to expect attacks ensures that you create preventive measures to protect your systems.

Basically, cyber attacks are executed with malicious intent, when a cybercriminal tries to exploit a vulnerability in an organization’s system or individuals. These attacks threaten to steal, alter, destroy, disable, gain access to, or make use of an unauthorized asset.

In practice, cyber attacks, threats, and vandalism are a dangerous and growing problem for companies.

Almost every modern organization requires at least one computer network and the assets that make up its connectivity structure, such as switches, access points, and routers, to operate in its IT infrastructure. Besides this, we have as computational structure servers, desktops, laptops, printers, and other mobile devices that complete a technological architecture.

Unfortunately, while these devices and applications offer a great benefit to the enterprise, they can also pose a risk. All it takes is inefficient asset management or an employee clicking on a malicious link, and then cybercriminals gain access to your network and infect your systems.

But this risk can be reduced.

How to prevent cyber attacks?

Preventing a breach of your network and systems requires protection against a variety of cyber attacks. For each attack, the appropriate countermeasure must be deployed/used to prevent it from exploiting a vulnerability or weakness.

The first line of defense for any organization is to assess and implement security controls.

1. Break the pattern of cyberattack

Preventing, detecting or stopping the cyber attack at the earliest opportunity limits the impact on business and the potential for reputational damage.

Even though it is usually the more motivated attackers who have the persistence to carry out multi-stage attacks, they often do this using common, cheaper, and easier-to-use tools and techniques.

Therefore, implement security controls and processes that can mitigate attacks, making your company a difficult target.

Likewise, take a defense-in-depth approach to mitigate risk across the full range of potential cyber attacks, giving your company more resilience to deal with attacks that use more customized tools and techniques.

Como o Ransomware utiliza Protocolos de Acesso Remoto (RDP) Desprotegidos

2. Reduce your exposure by using critical security controls against cyber attack

Fortunately, there are effective and affordable ways to reduce your organization’s exposure to the most common types of cyber attack on Internet-exposed systems.

  • Boundary firewalls and Internet gateways – establish network perimeter defenses, particularly Web proxying, Web filtering, content scanning, and firewall policies to detect and block executable downloads, block access to known malicious domains, and prevent users’ computers from communicating directly with the Internet;
  • Malware protection – establish and maintain malware defenses to detect and respond to known cyber attack code;
  • Patch management – fixes known vulnerabilities with the latest software version to prevent attacks that exploit software bugs;
  • Allow list and run control – prevents unknown software from being run or installed, including AutoRun on USB and CD drives;
  • Secure configuration – restrict the functionality of each device, operating system, and application to the minimum necessary for business operation;
  • Password policy – make sure that an appropriate password policy is in place and followed;
  • User access control – includes limiting the execution permissions of normal users and enforcing the principle of least privilege.

3. Attenuate the ‘research’ stage

Any information published for open consumption should be systematically filtered before being released to ensure that anything of value to an attacker (such as software and configuration details, names/jobs/titles of individuals, and any hidden data) is removed.

Training, education, and user awareness are important. All your users must understand how published information about your systems and operation can reveal potential vulnerabilities.

They need to be aware of the risks of discussing work-related topics on social media and the potential to be targeted by cyber attack and phishing attacks. They must also understand the risks to the business of releasing confidential information in general conversations, unsolicited phone calls, and e-mail recipients.

4. Reduce the ‘delivery’ stage

The delivery options available to an attacker can be significantly reduced by applying and maintaining a small number of security controls, which are even more effective when applied in combination:

  • Up-to-date malware protection can block malicious e-mails and prevent malware from being downloaded from websites;
  • Firewalls and proxy servers can block unsafe or unnecessary services and can also keep a list of known bad sites. Similarly, subscribing to a site reputation service to generate a list of denied sites can also provide additional protection;
  • A technically enforced password policy will prevent users from selecting easily guessed passwords and lock accounts after a specified number of unsuccessful attempts. Additional authentication measures for access to particularly confidential corporate or personal information should also be in place;
  • Secure configuration limits system functionality to the minimum necessary for business operation and should be applied systematically to all devices used to conduct business.

5. Minimize the ‘breach’ stage of the cyber attack

As with the delivery stage, the ability to successfully exploit known vulnerabilities can be effectively mitigated with just a few controls, which are best deployed together.

  • All malware depends on known and predominantly patched software flaws. Effective vulnerability patch management ensures that patches are applied at the earliest opportunity, limiting the time your organization is exposed to known software vulnerabilities;

  • Malware protection at the Internet gateway can detect known malicious code in an imported item, such as an e-mail. These measures should be complemented by malware protection at key points in the internal network and on users’ computers, where available;
  • Well implemented and maintained user access controls will restrict the applications, privileges, and data that users can access. The secure setup can remove unnecessary software and default user accounts. It can also ensure that default passwords are changed and that all automatic features that can activate malware immediately (such as AutoRun for media drives) are disabled;

  • Training, education and user awareness are extremely valuable in reducing the likelihood of successful ‘social engineering’. However, with the pressures of work and the sheer volume of communications, you cannot rely on this as a control to mitigate even a cyber attack;
  • Finally, the key to detecting a breach is the ability to monitor all network activity and analyze it to identify any malicious or unusual activity.

If all measures for the research, delivery and breach stages are consistently in place, most cyber attacks can be prevented.

However, if the cybercriminal is able to use tailored features, you should assume that they will bypass them and get into your systems. Ideally, companies should have a good understanding of what constitutes ‘normal’ activity on their network, and effective security monitoring should be able to identify any unusual activity.

Once a technically capable and motivated attacker has full access to your systems, it can be much more difficult to detect their actions and eradicate their presence. This is where a complete defense-in-depth strategy can be beneficial.

The CipherTrust Data Security Platform solution allows companies to protect their structure against cyber attacks

According to IDC, more than 175 zetabytes of data will be created by 2025, and today more than half of all corporate data is stored in the cloud.

To handle the complexity of where data is stored, CipherTrust Data Security Platform provides strong capabilities to protect and control access to sensitive data in databases, files, and containers. Specific technologies include:

CipherTrust Transparent Encryption

Encrypt data in on-premises, cloud, database, file, and Big Data environments with comprehensive access controls and detailed data access audit logging that can prevent the most malicious cyber attacks.

CipherTrust Database Protection

It provides transparent column-level encryption of structured and confidential data that resides in databases such as credit card, social security numbers, national identification numbers, passwords, and e-mail addresses.

CipherTrust Application Data Protection

It offers APIs for developers to quickly add encryption and other cryptographic functions to their applications, while SecOps controls the encryption keys.

CipherTrust Tokenization

It offers application-level data tokenization services in two convenient solutions that provide customer flexibility – Token without Vault with dynamic policy-based data masking and Tokenization in Vault.

CipherTrust Batch Data Transformation

Provides static data masking services to remove sensitive information from production databases so that compliance and security issues are alleviated when sharing a database with a third party for analysis, testing, or other processing.

CipherTrust Manager

It centralizes keys, management policies, and data access for all CipherTrust Data Security Platform products and is available in FIPS 140-2 Level 3 compliant physical and virtual formats.

CipherTrust Cloud Key Manager

It offers its own key lifecycle management (BYOK) for many cloud infrastructure, platform, and software-as-a-service providers.

CipherTrust KMIP Server

It centralizes key management for the Key Management Interoperability Protocol (KMIP) commonly used in storage solutions.

CipherTrust TDE Key Manager

Centralizes key management for encryption found in Oracle, SQL and Always Encrypted SQL.

The portfolio of data protection products that make up the CipherTrust Data Security Platform solution enables companies to protect data at rest and in motion across the entire IT ecosystem and ensures that the keys to this information are always protected and only under your control.

It simplifies data security, improves operational efficiency, and accelerates compliance time. Regardless of where your data resides.

The CipherTrust platform ensures that your data is secure, with a wide range of proven, industry-leading products and solutions for deployment in data centers, either those managed by cloud service providers (CSPs) or managed service providers (MSPs), or as a cloud-based service managed by Thales, a leading security company.

Tool portfolio that ensures data protection against cyber attacks

With data protection products from the CipherTrust Data Security Platform, your company can:

Strengthen security and compliance against cyber attack

CipherTrust data protection products and solutions address the demands of a range of security and privacy requirements, including electronic identification, authentication, and trust, Payment Card Industry Data Security Standard (PCI DSS), General Data Protection Law (LGPD)among other compliance requirements.

Optimizes team and resource efficiency against cyber attacks

CipherTrust Data Security Platform offers the broadest support for data security use cases in the industry, with products designed to work together, a single line for global support, a proven track record of protecting against evolving threats, and the industry’s largest ecosystem of data security partnerships.

With a focus on ease of use, APIs for automation, and responsive management, the CipherTrust Data Security Platform solution ensures that your teams can quickly deploy, secure, and monitor the protection of your business.

In addition, professional services and partners are available for design, implementation, and training assistance to ensure fast and reliable implementations with minimal staff time.

Reduces total cost of ownership

CipherTrust Data Security Platform’s data protection portfolio offers a broad set of data security products and solutions that can be easily scaled, expanded for new use cases, and have a proven track record of protecting new and traditional technologies.

With CipherTrust Data Security Platform, companies can prepare their investments for the future while reducing operating costs and capital expenditures.

About Eval

EVAL has been developing projects in the financial, health, education and industry segments for over 18 years. Since 2004, we have offered Authentication, Electronic and Digital Signature and Data Protection solutions. Currently, we are present in the main Brazilian banks, health institutions, schools and universities, and different industries.

With value recognized by the market, EVAL’s solutions and services meet the highest regulatory standards of public and private organizations, such as SBIS, ITI, PCI DSS, and LGPD. In practice, we promote information security and compliance, increase companies’ operational efficiency, and reduce costs.

Innovate now, lead always: get to know Eval’s solutions and services and take your company to the next level.

Eval, safety is value.

Categories
Data Protection

Fighting cyber attacks: the importance of prevention

Throughout 2021, individuals, businesses and governments have all been concerned about combating cyber attacks.

Keeping our data safe in a world where everything is on the Internet, from travel diaries to credit card information, data protection has become one of the most pressing challenges of cybersecurity.

Ransomware, phishing attacks, malware attacks, and other cybersecurity threats are some examples. No wonder that one of the fastest growing areas in IT is combating cyber attacks.

The need for data protection is increasingly recognized by organizations.

Companies, in particular, are paying more attention, as data breaches cause great damage every year and expose large amounts of personal information.

The fight against cyber attacks is increasing as society is increasingly connected

Although many of the attacks that occurred in 2021 were caused by the increased use of the Internet as a result of the pandemic of coronaviruses and blockades, the threat to businesses remains significant.

With the cost of combating global cyberattacks estimated to reach $10.5 trillion by 2025, according to
Cybersecurity Ventures
a specialist cybercrime magazine, the threats posed by cybercriminals will only increase as organizations become more reliant on the internet and technology.

Ransomware cases increased in 2021 by about 62% from 2019, and it is considered the top threat this year. In fact, cyber threats are becoming more sophisticated during these times and are much more difficult to detect.

The nature of all attacks are much more dangerous than a simple theft. So let’s dig a little deeper into this discussion by showing the top cyber attack cases occurring in 2021.

The Colonial Pipeline

If we are going to talk about cyber attacks occurring in 2021, then Colonial Pipeline should be on the list.

Considered the largest fuel pipeline in the United States, it experienced a cyber attack in May 2021, disrupting fuel distribution in 12 states for a few days. The company had to pay $4.5 million as ransom to resolve the situation.

Florida’s supply system

A cybercriminal tried to poison the water supply in Florida and managed to increase the amount of sodium hydroxide to a potentially dangerous level.

The cyber attacks occurred by hacking into the IT systems of the Oldsmar city water treatment plant, briefly increasing the amount of sodium hydroxide from 100 parts per million to 11,100 parts per million. This scenario is an example of how an invasion of critical infrastructure at any level puts residents’ lives at risk.

Microsoft Exchange

A massive cyber attack has affected millions of Microsoft customers worldwide, in which cybercriminals actively exploited four Zero Day vulnerabilities in Microsoft’s Exchange Server solution.

At least nine government agencies, as well as more than 60,000 private companies in the United States alone, are believed to have been affected by the attack.

Aircraft Manufacturer Bombardier

A popular Canadian aircraft manufacturer, Bombardier, suffered a data breach in February 2021. The breach resulted in the compromise of confidential data of suppliers, customers, and about 130 employees located in Costa Rica.

The investigation revealed that an unauthorized party gained access to the data by exploiting a vulnerability in a third-party file transfer application.

Acer Computers

World-renowned computer giant Acer suffered a ransomware attack, being asked to pay a ransom of $50 million, which made the record for the largest ransom known to date.

A cybercriminal group called Revil is believed to be responsible for the attack. The digital criminals also announced the breach on their website and leaked some images of the stolen data.

In Brazil it was no different in terms of the intensity of attacks and cybercrime

In a survey conducted by digital security company Avast, cybercriminals continue to take advantage of the Covide-19 pandemic by exploiting people’s habits created during the lockdown period to spread scams.

Following the global trend, ransomware attacks, cryptocurrency malware, and other scams were prevalent in Brazil.

For mobile devices, adware and fleeceware are among the top threats. According to Avast, the growth of ransomware attacks in Brazil was stronger than the global average.

Combating cyber attacks is already a major concern for most Brazilian companies today, as many of these attacks occurred only in 2021, such as the one that occurred at Lojas Renner, which completely paralyzed the system.

We still had the case of the Fleury group, which was unable to perform tests for several days, and JBS, which was forced to pay US$ 11 million in ransom for the hacker attack on its operation in the United States, all these situations put the issue even more in evidence in Brazil.

Organs and companies linked to the Brazilian government have also been targeted by cybercriminals. Social Security, the Ministry of Labor, the Federal Public Ministry, Petrobras, among other organizations have also suffered attacks.

How Ransomware uses Unprotected Remote Access Protocols (RDP)

Already in 2021, the LGPD offered an opportunity for companies to rethink how they fight cybercrime.

The General Data Protection Law (LGPD) went into effect in September 2020. The overall goal of the new legislation is to establish a regulatory framework for the protection of personal data, making it easier for all Brazilian citizens to understand how their data is used and, if necessary, to file a complaint about its processing.

The goal of the LGPD can be summarized in three key points:

  • Strengthening the rights of individuals;
  • Train the actors involved in data processing;
  • Increase the credibility of regulation through cooperation between data protection authorities.

If there is one thing that the LGPD achieved during the year 2021, it was to raise awareness about data protection and privacy issues. In practice, companies cannot sweep incidents under the rug because of the risk of revenue-based fines.

The data protection law has also given companies more visibility into the data they are collecting. The basic principle of the LGPD is that companies know what data they have and ensure that they are processing it correctly and securely.

LGPD compliant companies now have the basic elements they need to build a good information security program because if you don’t know what you have, you don’t know what to protect.

The Data Protection and Privacy Act has also changed the financial equation for organizations when it comes to privacy risk. This has encouraged companies to think holistically about risks and invest in improving privacy controls and governance.

Invest in 2022 and beyond. CipherTrust solution enables the fight against digital crime

According to IDC, more than 175 zetabytes of data will be created by 2025, and today more than half of all corporate data is stored in the cloud.

To handle the complexity of where data is stored, CipherTrust Data Security Platform provides strong capabilities to protect and control access to sensitive data in databases, files, and containers. Specific technologies include:

CipherTrust Transparent Encryption

Encrypt data in on-premises, cloud, database, file, and Big Data environments with comprehensive access controls and detailed data access audit logging that can prevent the most malicious attacks.

CipherTrust Database Protection

It provides transparent column-level encryption of structured and confidential data that resides in databases such as credit card, social security numbers, national identification numbers, passwords, and e-mail addresses.

CipherTrust Application Data Protection

It offers APIs for developers to quickly add encryption and other cryptographic functions to their applications, while SecOps controls the encryption keys.

CipherTrust Tokenization

It offers application-level data tokenization services in two convenient solutions that provide customer flexibility – Token without Vault with dynamic policy-based data masking and Tokenization in Vault.

CipherTrust Batch Data Transformation

CipherTrust’s solution designs data protection products and solutions against cyber attacks to meet a range of security and privacy requirements, including electronic identification, authentication, and trust.

CipherTrust Manager

It centralizes keys, management policies, and data access for all CipherTrust Data Security Platform products and is available in FIPS 140-2 Level 3 compliant physical and virtual formats.

CipherTrust Cloud Key Manager

It offers its own key lifecycle management (BYOK) for many cloud infrastructure, platform, and software-as-a-service providers.

CipherTrust KMIP Server

It centralizes key management for the Key Management Interoperability Protocol (KMIP) commonly used in storage solutions.

CipherTrust TDE Key Manager

Centralizes key management for encryption found in Oracle, SQL and Always Encrypted SQL.

The portfolio of data protection products that make up the CipherTrust Data Security Platform solution enables companies to protect data at rest and in motion across the entire IT ecosystem and ensures that the keys to this information are always protected and only under your control.

It simplifies data security against cyber attacks, improves operational efficiency, and accelerates compliance time. Regardless of where your data resides.

The CipherTrust platform offers a wide range of proven, market-leading products and solutions to ensure the fight against cyber attacks.

These products can be deployed in data centers or at cloud service providers (CSPs) or managed service providers (MSPs). In addition, you can also count on the cloud-based service managed by Thales, a leading company in the security industry.

Portfolio of tool to ensure cybercrime is tackled

With data protection products from the CipherTrust Data Security Platform, your company can:

Strengthen security and compliance

CipherTrust designs its data protection products and solutions against cyber attacks to meet a range of security and privacy requirements, including electronic identification, authentication, and trust.

In addition, these products are also compliant with the Payment Card Industry Data Security Standard (PCI DSS), the General Data Protection Act (LGPD), and other compliance requirements.

Optimizes team and resource efficiency against security incidents

CipherTrust Data Security Platform is the industry leader and provides extensive support for data security use cases.

With products designed to work together, a single thread for global support, and a proven track record of protecting against evolving threats, this platform also boasts the industry’s largest ecosystem of data security partnerships.

The CipherTrust Data Security Platform solution was developed with a focus on ease of use, with APIs for automation and responsive management.

With this solution, your teams can quickly implement, secure, and monitor the protection of your business against cyber attacks.

In addition, professional services and partners are available to assist in implementation and staff training, ensuring fast and reliable implementations.

In this way, it is possible to reduce the time required from your staff for these activities.

Reduces total cost of ownership

The CipherTrust Data Security Platform offers a broad set of data security products and solutions for protection against cyber attacks.

This portfolio can be easily scaled, expanded for new use cases, and has a proven track record of protecting both new and traditional technologies.

With the CipherTrust Data Security Platform, companies can prepare their investments to combat cyberattacks while reducing operational costs and capital expenditures.

About Eval

EVAL has been developing projects in the financial, health, education and industry segments for over 18 years. Since 2004, we have offered Authentication, Electronic and Digital Signature and Data Protection solutions. Currently, we are present in the main Brazilian banks, health institutions, schools and universities, and different industries.

With value recognized by the market, EVAL’s solutions and services meet the highest regulatory standards of public and private organizations, such as SBIS, ITI, PCI DSS, and LGPD. In practice, we promote information security and compliance, increase companies’ operational efficiency, and reduce costs.

Innovate now, lead always: get to know Eval’s solutions and services and take your company to the next level.

Eval, safety is value.

Where We Are

Rua Paulistânia, nº 381, 2º andar,
Sumarezinho
São Paulo - SP,
ZIP CODE: 05440-000

Contact

(11) 3670 - 3825
(11) 3865 - 1124
[email protected]

Facebook Instagram Linkedin
logo-tales-azul
keyfactor-logo
logo-valid-certificadora-digital
google-safe-browsing
Privacy Policy

Copyright © 2023, EVAL TECNOLOGIA EM INFORMÁTICA. All rights reserved - CNPJ 05.278.889/0001-97