by snoopy | Aug 31, 2022 | Cybersecurity
Ranked: America’s Best States to Do Business In
The United States often ranks as one of the best countries to start a business in, but the ease with which one can do business varies state by state. There are many considerations that factor into starting a business like the available workforce, the condition of local infrastructure, access to investors, a culture that’s open to business, and so on.
This map ranks America’s best states to do business in based on a study from CNBC which measured 88 factors across 10 broad categories.
Here is a further breakdown of the weight given to each of the 10 categories:
The Most Business Friendly States
North Carolina—coming in first place in the ranking—attracts an extremely talented and innovative workforce, largely thanks to the state’s investment in its Research Triangle Regional Partnership (RTRP).
Notably, there are three ties in the ranking: New York and South Carolina had the same score, tying for 36th, Connecticut and Nevada tied for 39th, and Hawaii and New Mexico tied for 46th.
Other states ranking high on the list are Washington, Virginia, and Colorado. One of the newest individual metrics CNBC took into consideration was an openness to the cannabis industry, likely playing into Colorado’s move up from 8th to 4th compared to last year.
Some states that perhaps surprisingly don’t crack the top 10 include California and New York, both often considered centers of finance and entrepreneurship. But with the high costs of living and of starting a business in those states, their overall score is reduced.
A Look at the Scoring — North Carolina, California, and Nevada
To better understand how this ranking works we’ve broken down three different states and how they ranked in all 10 categories that gave them their overall spot. Here’s a brief look at their place in each category:
While North Carolina is the number one state to do business in and has an extremely strong economy, they are 26th when it comes to the Cost of Doing Business.
Whereas California ranks low overall, the state ranks first in terms of Technology and Innovation, as well as Access to Capital.
Although Nevada scored highly in the Infrastructure and Business Friendliness categories, the state scored poorly in Technology and Innovation, and was dead last in the Education category.
Doing Business in America
New business applications have actually decreased 4% this year in comparison to the same timeframe in 2021.
Here’s a look at new business applications by region as of July 2022:
- Northeast: 63,058
- Midwest: 70,827
- South: 197,663
- West: 94,150
New business applications in July were the highest in the retail trade industry, numbering around 69,000 new applications, according to the U.S. Census Bureau. Applications for professional service businesses were the second highest at 53,000, followed closely by construction businesses at 43,000.
Here’s a closer look at the industry breakdown:
||Number of Applications
|Transportation and Warehousing
|Administrative and Support
|Health Care and Social Assistance
|Accommodation and Food Services
|Finance and Insurance
|Arts and Entertainment
|Management of Companies
A potential looming recession, alongside rising interest rates and inflation, may be creating a sense of cautiousness among businesspeople, leading to the lower rate of business applications compared to last year. And, at existing companies, the economic situation has lead to cuts in growth forecasts and subsequently, major layoffs.
But overall, the U.S. is a country which values entrepreneurship—even during the pandemic, massive spikes in new business formations were recorded—and certain industries and states will continue to flourish in any business environment.
by snoopy | Aug 30, 2022 | Cybersecurity
What Are Tinder Top Picks?
What are Tinder Top Picks? Some newbies at internet poker sites like to play around with the latest trends. They play around with what are known as “tinder top bets” which are a fancy way of saying the least expensive moves in any poker game. Buy Tinder Accounts. They are usually based on a number of different factors.
When you’re looking at what Tinder Top Picks are, you should keep an eye out for two factors: the odds given to your profile by the site and the odds given to you by your own swiping style. Odds that are given to you by the poker site are called “totals.” They are simply the percentages of all your matches winning. If you have a very high percentage of winning moves in your matches and a low percentage of losing moves then you should be looking at a particular stock and that stock’s price, if nothing else, should raise some red flags about what Tinder picks are for you.
The second thing that should jump out at you when you’re looking at what Tinder picks are worth is the amount of time that you spend in front of your computer screen. A lot of poker rooms charge you for the use of their “swipe” feature which essentially is a measure of how many times you wish to gamble on a single card. You’ve seen those ads that say “play for free!” on them… these are places where you have to pay to play.
What are Tinder top picks worth though if you don’t need to pay for a “swipe” to see who you like? You can actually find out who you “like” by using what are called “infrared cameras.” These are cameras that send out invisible signals to computers that are in the same room as the camera. By using special software the camera records the data that it is able to see on the infrared sensor, and this is then processed by what are called “experts” Buy Google Voice Accounts. on the Internet who examine the data in real time to try to figure out what it says.
The data that you get from these experts can tell you everything from age to mood, income, race and other factors. Basically anyone (even you!) can figure out what Tinder top picks if they have the right information. This means that the best way to figure out what are Tinder top picks is to figure out what games you most like to play. If you like slot machines then the odds of winning are incredibly high on any given day.
If you don’t like slots then you might want to consider a game of poker, because the odds are better on poker than on slots. Buy Edu Emails. However, if you do happen to like slots then you should really consider an elo score. An elo score is simply a calculation of the average amount of time someone else has taken to complete a certain task, like spin a lotto ball or catch a ball in a bucket. So if someone else has completed the task quicker than you would then your elo score will be lower than theirs.
From this, all you have to do is figure out what games people you swiped right are playing, and from there you can figure out what are Tinder top picks. If someone likes to play defense on their favored type of machine then maybe you should swipe right on that one. However, if someone likes to play on a machine where they can “spin” balls to make sure that they hit the “green” (it moves a certain distance) then maybe you should leave that one alone. After all, you might have a friend that likes to play with these types of machines, so you might not be swiping your own ball for them.
With the above information on your hands, all you have to do is plug in your own data, and then run an algorithm through it to find the best matches. The only drawback to this is that you cannot use the same software program to check against hundreds of players at once. As I said above, there is a fee to use the program. If you’re willing to pay for a few hundred dollars, then you can get lifetime access to the program and save yourself loads of time. After purchasing the app, you can even run it from your cell phone!
by snoopy | Aug 30, 2022 | Cybersecurity
Phishers are enjoying remarkable success using text messages to steal remote access credentials and one-time passcodes from employees at some of the world’s largest technology companies and customer support firms. A recent spate of SMS phishing attacks from one cybercriminal group has spawned a flurry of breach disclosures from affected companies, which are all struggling to combat the same lingering security threat: The ability of scammers to interact directly with employees through their mobile devices.
In mid-June 2022, a flood of SMS phishing messages began targeting employees at commercial staffing firms that provide customer support and outsourcing to thousands of companies. The missives asked users to click a link and log in at a phishing page that mimicked their employer’s Okta authentication page. Those who submitted credentials were then prompted to provide the one-time password needed for multi-factor authentication.
The phishers behind this scheme used newly-registered domains that often included the name of the target company, and sent text messages urging employees to click on links to these domains to view information about a pending change in their work schedule.
The phishing sites leveraged a Telegram instant message bot to forward any submitted credentials in real-time, allowing the attackers to use the phished username, password and one-time code to log in as that employee at the real employer website. But because of the way the bot was configured, it was possible for security researchers to capture the information being sent by victims to the public Telegram server.
This data trove was first reported by security researchers at Singapore-based Group-IB, which dubbed the campaign “0ktapus” for the attackers targeting organizations using identity management tools from Okta.com.
“This case is of interest because despite using low-skill methods it was able to compromise a large number of well-known organizations,” Group-IB wrote. “Furthermore, once the attackers compromised an organization they were quickly able to pivot and launch subsequent supply chain attacks, indicating that the attack was planned carefully in advance.”
It’s not clear how many of these phishing text messages were sent out, but the Telegram bot data reviewed by KrebsOnSecurity shows they generated nearly 10,000 replies over approximately two months of sporadic SMS phishing attacks targeting more than a hundred companies.
A great many responses came from those who were apparently wise to the scheme, as evidenced by the hundreds of hostile replies that included profanity or insults aimed at the phishers: The very first reply recorded in the Telegram bot data came from one such employee, who responded with the username “havefuninjail.”
Still, thousands replied with what appear to be legitimate credentials — many of them including one-time codes needed for multi-factor authentication. On July 20, the attackers turned their sights on internet infrastructure giant Cloudflare.com, and the intercepted credentials show at least three employees fell for the scam.
In a blog post earlier this month, Cloudflare said it detected the account takeovers and that no Cloudflare systems were compromised. Cloudflare said it does not rely on one-time passcodes as a second factor, so there was nothing to provide to the attackers. But Cloudflare said it wanted to call attention to the phishing attacks because they would probably work against most other companies.
“This was a sophisticated attack targeting employees and systems in such a way that we believe most organizations would be likely to be breached,” Cloudflare CEO Matthew Prince wrote. “On July 20, 2022, the Cloudflare Security team received reports of employees receiving legitimate-looking text messages pointing to what appeared to be a Cloudflare Okta login page. The messages began at 2022-07-20 22:50 UTC. Over the course of less than 1 minute, at least 76 employees received text messages on their personal and work phones. Some messages were also sent to the employees family members.”
On three separate occasions, the phishers targeted employees at Twilio.com, a San Francisco based company that provides services for making and receiving text messages and phone calls. It’s unclear how many Twilio employees received the SMS phishes, but the data suggest at least four Twilio employees responded to a spate of SMS phishing attempts on July 27, Aug. 2, and Aug. 7.
On that last date, Twilio disclosed that on Aug. 4 it became aware of unauthorized access to information related to a limited number of Twilio customer accounts through a sophisticated social engineering attack designed to steal employee credentials.
“This broad based attack against our employee base succeeded in fooling some employees into providing their credentials,” Twilio said. “The attackers then used the stolen credentials to gain access to some of our internal systems, where they were able to access certain customer data.”
That “certain customer data” included information on roughly 1,900 users of the secure messaging app Signal, which relied on Twilio to provide phone number verification services. In its disclosure on the incident, Signal said that with their access to Twilio’s internal tools the attackers were able to re-register those users’ phone numbers to another device.
On Aug. 25, food delivery service DoorDash disclosed that a “sophisticated phishing attack” on a third-party vendor allowed attackers to gain access to some of DoorDash’s internal company tools. DoorDash said intruders stole information on a “small percentage” of users that have since been notified. TechCrunch reported last week that the incident was linked to the same phishing campaign that targeted Twilio.
This phishing gang apparently had great success targeting employees of all the major mobile wireless providers, but most especially T-Mobile. Between July 10 and July 16, dozens of T-Mobile employees fell for the phishing messages and provided their remote access credentials.
“Credential theft continues to be an ongoing issue in our industry as wireless providers are constantly battling bad actors that are focused on finding new ways to pursue illegal activities like this,” T-Mobile said in a statement. “Our tools and teams worked as designed to quickly identify and respond to this large-scale smishing attack earlier this year that targeted many companies. We continue to work to prevent these types of attacks and will continue to evolve and improve our approach.”
This same group saw hundreds of responses from employees at some of the largest customer support and staffing firms, including Teleperformanceusa.com, Sitel.com and Sykes.com. Teleperformance did not respond to requests for comment. KrebsOnSecurity did hear from Christopher Knauer, global chief security officer at Sitel Group, the customer support giant that recently acquired Sykes. Knauer said the attacks leveraged newly-registered domains and asked employees to approve upcoming changes to their work schedules.
Knauer said the attackers set up the phishing domains just minutes in advance of spamming links to those domains in phony SMS alerts to targeted employees. He said such tactics largely sidestep automated alerts generated by companies that monitor brand names for signs of new phishing domains being registered.
“They were using the domains as soon as they became available,” Knauer said. “The alerting services don’t often let you know until 24 hours after a domain has been registered.”
On July 28 and again on Aug. 7, several employees at email delivery firm Mailchimp provided their remote access credentials to this phishing group. According to an Aug. 12 blog post, the attackers used their access to Mailchimp employee accounts to steal data from 214 customers involved in cryptocurrency and finance.
On Aug. 15, the hosting company DigitalOcean published a blog post saying it had severed ties with MailChimp after its Mailchimp account was compromised. DigitalOcean said the MailChimp incident resulted in a “very small number” of DigitalOcean customers experiencing attempted compromises of their accounts through password resets.
According to interviews with multiple companies hit by the group, the attackers are mostly interested in stealing access to cryptocurrency, and to companies that manage communications with people interested in cryptocurrency investing. In an Aug. 3 blog post from email and SMS marketing firm Klaviyo.com, the company’s CEO recounted how the phishers gained access to the company’s internal tools, and used that to download information on 38 crypto-related accounts.
A flow chart of the attacks by the SMS phishing group known as 0ktapus and ScatterSwine. Image: Amitai Cohen for Wiz.io. twitter.com/amitaico.
The ubiquity of mobile phones became a lifeline for many companies trying to manage their remote employees throughout the Coronavirus pandemic. But these same mobile devices are fast becoming a liability for organizations that use them for phishable forms of multi-factor authentication, such as one-time codes generated by a mobile app or delivered via SMS.
Because as we can see from the success of this phishing group, this type of data extraction is now being massively automated, and employee authentication compromises can quickly lead to security and privacy risks for the employer’s partners or for anyone in their supply chain.
Unfortunately, a great many companies still rely on SMS for employee multi-factor authentication. According to a report this year from Okta, 47 percent of workforce customers deploy SMS and voice factors for multi-factor authentication. That’s down from 53 percent that did so in 2018, Okta found.
Some companies (like Knauer’s Sitel) have taken to requiring that all remote access to internal networks be managed through work-issued laptops and/or mobile devices, which are loaded with custom profiles that can’t be accessed through other devices.
Others are moving away from SMS and one-time code apps and toward requiring employees to use physical FIDO multi-factor authentication devices such as security keys, which can neutralize phishing attacks because any stolen credentials can’t be used unless the phishers also have physical access to the user’s security key or mobile device.
This came in handy for Twitter, which announced last year that it was moving all of its employees to using security keys, and/or biometric authentication via their mobile device. The phishers’ Telegram bot reported that on June 16, 2022, five employees at Twitter gave away their work credentials. In response to questions from KrebsOnSecurity, Twitter confirmed several employees were relieved of their employee usernames and passwords, but that its security key requirement prevented the phishers from abusing that information.
Twitter accelerated its plans to improve employee authentication following the July 2020 security incident, wherein several employees were phished and relieved of credentials for Twitter’s internal tools. In that intrusion, the attackers used Twitter’s tools to hijack accounts for some of the world’s most recognizable public figures, executives and celebrities — forcing those accounts to tweet out links to bitcoin scams.
“Security keys can differentiate legitimate sites from malicious ones and block phishing attempts that SMS 2FA or one-time password (OTP) verification codes would not,” Twitter said in an Oct. 2021 post about the change. “To deploy security keys internally at Twitter, we migrated from a variety of phishable 2FA methods to using security keys as our only supported 2FA method on internal systems.”
Update, 6:02 p.m. ET: Clarified that Cloudflare does not rely on TOTP (one-time multi-factor authentication codes) as a second factor for employee authentication.
by snoopy | Aug 30, 2022 | Cybersecurity
I manage a security operations center (SOC) in the midst of the Great Resignation and a massive cybersecurity skills gap. During this time, I’ve learned a few surprising things about how to recruit and maintain a cohesive SOC team.
A 2021 Devo study of more than 1,000 cybersecurity professionals found that working in a SOC has some unique pain points, including the amount of information that needs to be processed and the on-call nature of the job. Alert fatigue also contributes to this pain.
I’ve found that keeping the SOC staffed and engaged starts with a SOC’s most important asset: its people. A people-first approach not only helps with reducing fatigue and burnout, but it also empowers employees to seek out opportunities for their own development, greatly aiding in retention. Here are three ways that I rely on to support my SOC colleagues.
Give and Receive Regular Feedback
Actionable feedback, both given and received, is something that people naturally desire. When done proactively, the team gains a clear understanding of their performance while building trust with their leaders. Even if everything is going well, letting your colleagues know what they are excelling at is imperative. This positive reinforcement often has more impact than letting them know when something needs to be improved.
I have an open-door policy with my team, which allows for a consistent feedback loop. If I need to be doing more for my team, I expect them to tell me where I can improve; on the flip side, hearing if something is going well helps me better calibrate my leadership style to my team.
I also encourage others to find departments within your company that will provide 180-degree feedback. This is vital for me as both a leader and an employee as it empowers me to check my own blind spots. As a leader, you should want to discover the areas where you can grow and better support your team.
Rotate Tasks and Responsibilities
Within my team, I have everyone rotate between managing alerts, self-paced training, and project work. This not only gives each team member a window into different aspects of the SOC, and work to develop themselves, it also removes some of the monotony and stress of the job.
For instance, if you have to come to work every day and consistently worry about urgent tickets and client requests, you will feel anxious and as though you constantly have to fix other people’s problems. These feelings contribute mightily to burnout. Additionally, finding ways to automate regular tasks will reduce the stress and burden placed on the team so they can focus on more strategic work.
Promote Interactions Throughout the Company
It can be easy to get lost looking at each tree in the SOC, when you should instead be focusing on the forest of the company. That is why I encourage my team to take a step back and realize how their work is helping the company and community.
I do this by coordinating opportunities for my team to work with individuals outside their realm, for instance in sales or marketing, so everyone understands the product and overall goals. Also, assisting others outside of your team and even your company helps you to fully understand the value you provide and where others can benefit from your team’s support and expertise.
I encourage my team to complete a quarterly “Do Good” project, which focuses on the needs of the company and the larger security community. For instance, how can we work together to educate others about bad actors and mitigate the threats they pose? In April, the SOC team identified and validated IP addresses that were being used for attacks across several of our clients. After they were identified, we ensured they were available to the public so others could leverage our knowledge to block attackers.
Doing projects like these reminds the team how critical their work is and unites us around a common goal.
The Key Differentiator: How People Are Treated
How the leaders treat their people is a key differentiator in today’s job market, especially as many organizations look to creative ways to solve cybersecurity’s ongoing talent shortage. It goes without saying that employers should also look to train employees rather than expect them to come to an entry-level job with 30 years of experience and a CISSP cert.
When I am hiring, I look for strong base foundations and proven self-starters, along with potential — and desire — to grow, rather than previous experience. It is always rewarding to give deserving people an opportunity and watch them flourish.
Additionally, having your team complete self-paced training and educational opportunities enables each person to work on skills and techniques that will only aid the company down the line. Fostering that growth is just good business.
While there certainly isn’t a one-size-fits-all approach to managing people, as each person, SOC, and company are different, keeping your people at the heart of all things will never go out of style. The stronger your employees, the better off your SOC, and your organization as a whole, will be.