ABE Fixes It

Home

Contact

https://www.scmagazine.com/news/prudential-financial-february-incident-exposed-data-of-nearly-37k-customers

As part of our response, we have worked with leading cybersecurity experts to confirm the unauthorized third-party no longer has access to our company systems ...

Last updated July 24, 2024

https://www.bankinfosecurity.com/synthetic-id-fraud-rises-98-in-auto-lending-industry-a-25157

Synthetic identity fraudsters target the auto lending industry the most, leading to a 98% increase in attempts and a staggering $7.9 billion in losses for the industry in 2023.

https://www.scmagazine.com/news/change-healthcare-incident-caused-by-compromised-citrix-credentials

... threat actors used compromised credentials to remotely access a Change Healthcare Citrix portal — a portal that lacked multifactor authentication (MFA), a basic tenet of cybersecurity.

https://www.youtube.com/watch?v=1fwrtV-VZZ0

... why identity security remains the most unprotected part of the security stack, and what needs to change to advance the state of cybersecurity.

May 14, 2024

Hed Kovetz, CEO of Silverfort

Identity security will continue to be the most unprotected part of the “security stack” until ABE security provides these two things:

1. User-owned digital identity certificates with their private keys in the

user’s device, and

2. Measurable reliability of the validity of the user’s claim of identity.

Suparna Goswami

The synthetic identity problem will be solved when ABE security provides these two things:

1. User-owned digital identity certificates with their private keys in

the user’s device, and

2. Measurable reliability of the user’s claim of identity.

Until then, victims need to figure out how to absorb the increasing cost of synthetic identity fraud.

What good is multifactor authentication when you don’t have confidence in the user’s claim of identity in the first place?

Compromised authentication credentials will not exist when certificate authentication replaces usernames and passwords.

ABE security provides certificate authentication based upon:

1. User-owned digital identity certificates with their private keys in

the user’s device, and

2. Measurable reliability of the user’s claim of identity.

Until then, compromised credentials obtained by phishing, social engineering, or other methods will continue to be an open door to bad actors.

Prudential Financial: February incident exposed data of nearly 37K customers

What’s that saying about closing the barn door after the horse has been stolen?

To paraphrase: We have worked with security experts to increase our level of hope that the jewel thieves will be happy with what they stole and they won’t be back for more. If they do return, we’ll try our best to recognize them.

Regardless of how that third party got access to the company systems, it could not have happened if the systems were protected by ABE certificate authentication based upon:

1. User-owned digital identity certificates with their private keys in the

user’s device, and

2. Measurable reliability of the user’s claim of identity.

https://www.wired.com/story/crowdstrike-outage-update-windows/

... the issues were caused by a “defect” in code the company released for Windows. The issue has been identified, isolated and a fix has been deployed,”

July 19, 2024

Part of the update release process would ordinarily have included vetting of the code by a Microsoft certification process that typically takes days or weeks – an unacceptable delay for this emergency update responding to a known imminent threat. A process workaround was used to bypass that certification.

ABE security borrows a familiar and proven concept from the physical world: the professional licensing of highly paid – very highly paid –individuals who sign off on various objects and processes, taking personal and legal responsibility and putting their livelihood on the line in case of failure.

Such a professionally licensed individual – in this case, a specially trained code auditor available on short notice – would have uncovered the same coding mistake that was later found AFTER the global IT meltdown.

Videos

... with PROFESSIONAL LICENSING

... with MEASURABLY RELIABLE IDENTITIES