Everyone wants to keep themselves secure and to do so, people spend a vast amount of fortune. Therefore, security investment has increased significantly in the past few decades, and various new technologies and techniques have been discovered to tackle security leaks. Yet human mistakes are often overlooked among them. There isn’t a single person alive who has never made mistakes; making mistakes is a fundamental part of human nature – that’s how humans grow and learn.

An attacker can use many high-level vulnerabilities to break into a system. According to a study by IBM, human mistakes are the leading cause of 95% of cyber security breaches. Data loss, misdelivery, and other human-related errors were listed among them. So, if we somehow eliminate these errors, 9.5 out of 10 cyber breaches may not have occurred.

Still, in many cases, the attacker’s success involves provoking or capitalizing on human error, like using social engineering to guess the password or something similar.

Social Engineering

Social Engineering is a term related to a broad range of human interaction attacks. It mainly uses psychological manipulation to trick users into making security mistakes like concealing their true identities and motives by presenting themselves as trusted individuals. It is quite a popular technique among attackers as it’s often easier to exploit people than any network or software.The first step in social engineering attacks is gathering information or performing research on the target. Target may be an enterprise, so in that case, the attacker will gather information regarding the organizational structure, internal operations, employees, and so on. One common tactic is to focus on the behavioral patterns of employees who have initial access by scanning their social media profiles or behavior online. There are various types of social engineering techniques. A few of the most common types are:

1. Baiting

   As the name suggests, in this type of attack, an attacker uses the greed or curiosity of the user. Suppose an attacker leaves a malware-infected external device in a place that is sure to be found by an innocent user. The user, or in this case, “target”, inserts this device into their system and unintentionally installs the malware.

2. Pretexting

   Pretexting involves an attacker obtaining information through a series of lies or scams to gain access to the confidential data of the target (user). A pretexting fraud could involve an attacker pretending to need financial or personal data to verify whether the user is authenticated or not. This way, the attacker will gain data from the user.

3. Scareware

   This technique involves the user believing that their system is infected with malware, to which an attacker offers a solution. This, in reality, is a trick to gain access to the user’s system utilizing providing solution.

4. Diversion Theft

   This involves tricking a delivery agency into going to the wrong pickup or drop-off address and intercepting the transaction. An agency can carefully avoid this if they are more careful about things.

5. Quid pro quo

   In this type of attack, an attacker pretends to provide something to the target in exchange for some information. For example, an attacker may call a target (randomly selected) pretending to be technical support. This way, the attacker may come across some genuine user who needs help and have them launch some malware or gather information from them by interaction.

In 2013, the Syrian Electronic Army was able to gain access to the Associated Press’ Twitter account by a phishing email, which contained a malicious email. An Attacker sent this email to an AP employee under the guise of another fellow employee. This way, the hacker could send fake news from AP’s Twitter handle. AP could have prevented these if the technology department had carried out routine checks on employees and had a secure email gateway.

What does Human Error mean in Cyber Security?

Human error means unintentional actions like an email misdelivery (email sent to wrong recipient or address) or poor password hygiene (weak passwords are relatively easier to crack or guess) by the employees or users that cause, spread, or allow a security breach. So, this contains a vast range of activities, from downloading a virus-infected application to failing to use a strong password. These are a few reasons why human error is so challenging to address. With so many websites, tools, and services used, employees and users need different usernames and passwords, making them opt for shortcuts to make life a bit easier. This increases the threat of cybercriminal activities and other types of security breaches.

Why is Human Error so Dangerous?

Security breaches exploit the weakest link, which in many cases are humans themselves than any of the code they write. These human errors can be exhibited in multiple ways – from failing to stop a phishing attack (clicking an anonymous source’s link and exposing the network to the attacker) to having weak passwords. It also leads to Data breaches.

A cybercriminal can manage to guess the password or use social engineering to get an employee to make some payment to a transaction site controlled by the criminal, if proper technical security measures are not taken care of (SSL Cert or good firewall).

What factors lead to Human error?

Several factors play into human error, but the most common are these three-

• Opportunity

  Error can occur when there is an opportunity for it. This process may seem apparent initially, but if more options are there for things to go wrong, the chances are that users may make a mistake.

• Lack of awareness

  Most human errors result from users not knowing the right course of action. For example, users who aren’t aware of the risk of phishing are far more vulnerable to falling for phishing attacks, and someone who doesn’t know the risk of public Wi-Fi will quickly have their session hijacked or credentials stolen.

• Environment

  There are many environmental factors leading to human errors. The physical environment of a workplace can increase the number of mistakes. Culture also plays an important role here. An end-user will often know the right course of action, but they may fail to carry it out because there may be an easier way to do things or believe it is not essential. A culture where security is always left in the background will lead to more errors.

Few examples of Human Error

Human error can compromise security in endless possible ways, but some types of error stand out more than others.

• Misdelivery

  Sending some information to the wrong recipient is a pervasive threat to data security. One of the most severe data breaches was caused when an NHS practice revealed the email addresses (identity) of more than 800 patients who had visited HIV clinics. The employee sending those emails to HIV patients accidentally entered their email address into the “To” field rather than the “Bcc” field.

• Patching

  Cyber attackers are constantly looking for new exploits in the software technologies. So, when these exploits are discovered, the developers resolve them and send out the patch or updates to all the users before cybercriminals can attack. That is why it is essential to install the security updates at the earliest. In 2017, WannaCry ransomware affected many computers worldwide, damaging millions of dollars. Yet the exploit, dubbed ‘EternalBlue’, was patched by Microsoft months before the attacks.

• Password problems

  This saying – “Humans and passwords simply don’t get along,” may be funny, but it’s valid to a certain extent. The National Centre for Cyber Security’s 2019 report showed an unfortunate truth, 123456 remains the most popular password globally, and 45% of people reuse the password of their primary email account on other services.

• Phishing attack

  Sometimes, attackers might leave an external drive (like a USB drive) within the user’s or target’s reach. The user or target could connect this external drive to their system out of curiosity. And in this way, the attacker would be able to carry out a successful phishing attack. Thus, the user needs to be careful and think more than once before performing such actions.

Types of Human Error

There are many chances and situations for human errors. Still, people can broadly categorize them into two different types. Their difference is whether the user or person in question has the necessary knowledge to perform the correct action.

1. Skill-based error

   These consists of small mistakes like slips and lapses while performing familiar tasks and activities. These may occur when an employee or a user is tired or not paying attention, is distracted, etc. Here, the end-user knows the correct approach but fails to do so by error or negligence.

2. Decision-based error

   These errors arise when a user makes a wrong decision, which may occur in either of the scenarios – the user not having required knowledge, not having enough information, or not realizing that they are leading to a decision from their action.

How do we prevent Human errors?

By applying the following practices and solutions, there’s a chance to prevent security breaches effectively:

• Update corporate security policy

  An organization’s security policy should clearly outline how to handle critical data (including passwords, too), who can access those, and what security software to use upon these data.

• Use the principle of least privilege

  The most straightforward way to secure data access is to deny all access by default. Using Zero Trust security or network to design an IT system is a very secure approach where users and employees of an organization are authenticated, authorized, or continuously validated for security purposes. Privileged access can however be granted on a case basis. This way, organizations can prevent accidental data leaks.

• Offer regular training and personal development

  Technology is in a state of constant advancement, so demands from clients and customers are also increasing. Training and opportunities to acquire new skills can help employees keep themselves up-to-date.

• Consider cloud storage and document management

  Using the cloud to store the documents means that the files are backed up regularly, and more than one individual has access.

Conclusion

Humans don’t have to be the weakest link, though. The fewer opportunities for mistakes, the fewer users are tested for their knowledge; the more knowledge users possess, the less likely they are to make mistakes. Statistics show that 95% of security breaches are due to human error. Still, it also shows that even the smallest step towards resolving human error can end up being the biggest one in ensuring robust security.

Asymmetric encryption, commonly known as public-key cryptography, is based on calculations that are extremely hard to crack even with the most powerful computers available today. However, using encryption with private and public keys still has one issue. The public keys are presumed to be open, which means that anybody may access them. Nothing can prevent a malicious party from claiming ownership of a public key that is not theirs. Public Key Infrastructure can be used to solve this integrity issue.

Information can be exchanged on an insecure network, such as the internet, securely and privately using PKI. To achieve this, PKI uses two key technologies: digital signatures and digital certificates which are the key components in the certificate authority trust model.

What is a Digital Signature?

The term digital signature is comprised of two words: digital and signature, so let’s try to elaborate on each of these terms one by one.

• What is meant by digital?

  Digital elaborates the electronic technology that generates, stores, and processes data in terms of positive and negative states. Positive is represented by the number 1 and 0 represents the non-positive. Thus the data is expressed as a string of 0’s and 1’s which is transmitted or stored with digital technology.

• What is a Signature?

  To show whether a document is approved by us or created by us, we generally sign a document. This signature proves to the recipient that this document is coming or generated from a legitimate source. This signature present on the document signifies the authenticity of the document.

For example, When X sends a message to Y, Y wants to check the legitimacy of the message and confirm whether it is coming from X, not from some third party or malicious Z. So, Y can ask X to electronically sign the message. The identity of X is proved by this electronic signature which is called a digital signature.

Features of a Digital Signature

1. Message Integrity

   In signing and verifying algorithms, the message’s integrity is preserved by using a hash function.

2. Message Authentication

   The verification of the message is done by using the sender’s public key. When X sends a message to Y. The public key of X is used by Y for verification and the public key of X can’t create the same signature as Z’s private key.

3. Message Nonrepudiation

   Non-repudiation is the guarantee that the originator of a message cannot deny any previously sent messages, commitments, or actions.

What is a Digital Certificate?

A digital certificate is a collection of electronic credentials that are used to confirm the identity of the certificate holder using encryption keys (public and private keys). These keys sign and encrypt information digitally. A digital certificate guarantees that the certificate includes a public key that belonged to the SSL requestor to whom it was issued.

A digital certificate is issued by a certificate authority. A digital certificate holds two keys: a public key and a private key. While the receiver has the recipient’s private key, the certificate contains the public key. A message that has been encrypted with a public key can only be decrypted with the mathematically linked private key. When a certificate is issued by a certificate authority, it contains the encryption algorithm, digital signature, serial number, expiry dates, and name of a certificate owner. The process of certificate issuance starts with the submission of a CSR (certificate signing request) and submission of the required information.

The verification of the domain ownership along with business registration documents is done after the information is submitted. After the verification, a digital certificate is issued by the certificate authority and needs to be installed on the server.

Who Can Issue a Digital Certificate?

The responsibility for issuing digital certificates falls on the certificate authority. They will attach their signatures to the certificates as evidence of the legitimacy and reliability of the entity that made the request. The management of domain control verification is largely under the responsibility of the certificate authority. In essence, certificate authorities are vital to the functioning of the public key infrastructure and the security of the internet.

Benefits of Digital Certificates?

Digital certificates play an important role in the cybersecurity landscape. Some of the key advantages of having a digital certificate are made up of the following:

1. Data Security, Confidentiality, and Integrity Through Encryption

   The protection of sensitive data is one of the most significant functions that digital certificates provide. Information cannot be viewed by anybody who is not allowed to read it thanks to digital certificates. Therefore, having a digital certificate will be advantageous for people and organizations transporting vast amounts of data. Consider the use of an SSL certificate, which assures that hackers cannot intercept user data by helping to encrypt data sent between website servers and browsers.

   Additionally, digital certificates assist in resolving issues with message confidentiality and privacy. They enable private communication between parties using a public network. Digital certificates also contribute to the maintenance of data integrity by preventing intentional or unintentional tampering with the data while it is in transit.

2. Authenticity or Identification Benefits

   Digital certificates have been at the forefront of the fight against fraudsters and fake websites that appear as authentic ones in an era of extensive data breaches and increasing cyberattacks. They show that websites and servers are exactly who they claim to be and identify every participant in the communication chain. As you are aware, before granting a digital certificate, certificate authorities investigate a company or website. The certificate details will contain all the necessary information about the website. This data is what aids in proving the legitimacy of the website.

3. Scalability

   The same encryption strength is provided to businesses of all shapes and sizes by digital certificates such as SSL certificates. These certificates are also very scalable because they may be issued, canceled, and renewed in a matter of seconds.

4. Reliability and Cost-effectiveness

   The trusted certificate authorities have the responsibility of issuing digital certificates. For the CA to issue a certificate, it must thoroughly investigate each applicant, meaning the organization that uses the certificate cannot be tricked by the hacker. Digital certificates also provide the necessary encryption strengths at a reasonable cost. You shouldn’t be shocked to find that most digital certificates cost around $100 or less each year.

5. Public Trust

   Visitors to your website are worried about their security and wouldn’t take the chance of going to an unsafe website. Because of this, most of them will seek confirmation that your website is trustworthy and safe. You may utilize it in a variety of ways to gain user trust, and getting a digital certificate is the ideal option.

Digital Certificate vs. Digital Signature: What’s the Difference?

The basic difference between a digital certificate and a digital signature is that the certificate attaches the digital signature to an entity, while the digital signature must guarantee the security of the data or information from the moment it is sent. Digital certificates are used to validate the sender’s and the digital signature is used to validate the sent data.

A digital certificate is a collection of the digital or electronic credentials (file or passwords) issued by a trusted certificate authority and linked to digital messages/communications to validate the legitimacy of the sender, server, or device using the public key infrastructure (PKI). In comparison, a digital signature is a hashing approach that verifies the users’ identities and provides authenticity using a numeric string.

Using cryptographic key technology, a digital signature is simply attached to an email or document. The same hash algorithm is used by the signature to decrypt the message when it is received by the recipient.

Conclusion

Both the digital signature and the digital certificate are essential components of security. In our daily lives, we use them both. So next time you visit a website don’t forget to verify whether it has a valid digital certificate or not. We at Encryption Consulting with top-of-the-line consultants provide a vast array of PKI services to easily manage and store your digital certificates.

An electronic signature, often known as an e-signature, is a legally recognized method of obtaining consent or approval on electronic documents or forms. It is a collection of many ways for affixing identity to documents. They are created using an electronic technique and can be as simple as a photograph of a handwritten signature or as complex as a PKI-generated digital signature certificate. E-signature has grown exponentially due to the increased need for paperless work; documents must be signed, and e-signing is a convenient, efficient, and modern alternative.

In other definitions, an E-signature can be stated as “An electronic sound, symbol, or process attached to or logically associated with a record adopted by a person with the intent to sign the record.”

Benefits of Electronic Signatures

• The signatory is clearly identified.
• Ensures the document’s integrity by ensuring that it has not been updated or amended after signing.
• It ensures non-repudiation since it is credible proof of the signatory’s consent, as they cannot deny signing the document.

Types of Electronic Signatures

Electronic signatures are mainly divided into three categories. The distinction is based on electronic Identification, Authentication, and Trust Services regulation (eIDAS). Throughout the EU, this law creates the legal framework for electronic identity, signatures, seals, and documents.

1. Simple or Basic electronic signature (SES)

   The most basic and popular form of e-sign, which is used widely. This signature is not cryptographically encrypted. The intention of the signer to sign the document is used as confirmation of its validity. This signature form is simple, but it’s also simple to forge because there are minimal security mechanisms to verify the signer’s legitimacy.

   Use cases include Biometric Signature, Manual Signature, One-time passwords (OTP), etc.

2. Advanced electronic signature (AES)

   This signature is substantially more secure than ordinary electronic signatures because the signer’s validity must first be verified before the signature can occur. To assure authenticity, digital certificates and public keys are created, managed, distributed, used, stored, and revoked using Public Key Infrastructure (PKI). A Certificate Authority (CA) normally certifies these signatures.

   Use cases include Biometric/Manual Signatures, Banking Card, Email OTPs, etc.

3. Qualified Electronic Signature (QES)

   This is the highest level of E-sign available for use. Qualified electronic signatures include those for advanced electronic signatures and digital signatures and additional requirements for the equipment used to produce the signature. Before use during the signing process, the EU assured Certification Authority must have obtained the device. Both the digital security protocol and the devices that allow for signature creation are included in QES. This increases the legitimacy and integrity of signed documents.

   Use cases include Smartcards, Electronic Identity Cards, Payment Cards, etc.

Parameter for selecting the right kind of E-signature

• Integrity
• Identity
• Authentication
• Authenticity

Differentiation based on the level of assurance:

Difference between Digital Signature and Electronic Signature

Although the terms electronic signature and digital signature are frequently used interchangeably, the meanings and concepts of both are different. The key difference is that the Certification authorities permit digital signatures primarily used to safeguard documents. In contrast, an electronic signature is frequently associated with a contract where the signer intends to do so.

Digital Signature

• It is used for securing a document
• Generally authorized by CA and have more security features in hand.
• Adobe and Microsoft are two common types of digital signatures.

Electronic Signature

• Primarily used for verifying a document
• Not authorized usually and has less security than DS.
• Verbal, electronic ticks, and scanned signatures are the most common types of electronic signatures.

Conclusion

E-signatures, also known as electronic signatures, is a collection of diverse methods for attaching identity to documents. Electronic signatures on electronic records have been introduced and adopted by many businesses, customers, and even some government processes. There are three types of e-signs: SES, AES, and QES, with SES being the basic and common form and QES being the most secured one. E-signature is based on Identity, Integrity, and Authentication. Talking about digital signatures vs. e-signatures, a digital signature focuses on the document’s security, whereas an e-signature majorly focuses on verification.

The Domain Name System (DNS) is one of the best-known protocols on the Internet. Its main function is to translate human-readable domain names into their corresponding IP addresses. It is important as all devices on the Internet derive the IP address of a particular server from the DNS regularly. The translation process through which DNS queries are exchanged between the client and the DNS server or the resolver. DNS tree is architected from the top down and is called “DNS Hierarchy, “depicted in Fig. 1.

There are two types of DNS resolvers:

• Authoritative

  Authoritative name servers give answers in response to queries about IP addresses. They only respond to queries about domains to be configured to respond.

• Recursive

  Recursive resolvers provide the proper IP address requested by the client. They do the translation process by themselves and return the final response to the client.

In this article, we will be focusing on the second type, recursive DNS resolvers.

DNS Cache Poisoning Attacks

Classic DNS cache poisoning attacks (around 2008) targeted a DNS resolver by having an off-path attacker fooling a vulnerable DNS resolver into issuing a query to an upstream authoritative name server.

The attacker attempts to inject negative responses with the spoofed IP of the name server. If the rogue response arrives before any legitimate ones which matches the “secrets” in the query, then the resolver will accept and cache the rogue results.

The attacker would also need to guess the correct source/destination IP, source/destination port, and the query’s transaction ID (TxID), which is 16-bit long. When the source and destination port (i.e., 53) were fixed, 16-bit was the only randomness. Thus an off-path attacker can brute force all possible values with 65,536 responses, and a few optimizations such as birthday attacks that can speed the attack even further.

Defenses against DNS Cache Poisoning attacks

Since then, several defenses have been promoted to mitigate the threat of DNS cache poisoning. They effectively render the classic attack useless. We describe below the solutions deployed which includes randomization of:

1. The source port is perhaps the most effective and widely deployed defense as this increases the randomness to 32 bits from 16 bits. An off-path attacker would now have to guess both the source port and Transaction ID (TxID) together.

2. Capitalization of letters in domain names (0x20 encoding) – The randomness can often depend on the number of letters, which can be quite effective, especially for longer domain names. It is a simple protocol change, but it has significant compatibility issues with authoritative name servers. Thus, the most popular public resolvers do not use 0x20 encoding. For example, Google DNS uses 0x20 encoding only for allowed name servers; Cloudflare has recently disabled 0x20 encoding.

3. Choices of name servers(server IP addresses). Randomness also depends on the number of name servers. Most domains utilize less than ten name servers, summarizing to only two to three bits. It has also been shown that an attacker can generate query failures against certain name servers and effectively “pin” a resolver to the one remaining name server.

4. DNSSEC – The success of DNSSEC depends on the support of both resolvers and authoritative name servers. But, only a small fraction of domains are signed – 0.7% (.com domains), 1% (.org domains), and 1.85% for Top Alexa 10K domains, as reported in 2017. In the same study, it is stated that only 12% of the resolvers enabling DNSSEC do attempt to validate the records received. Thus, the overall deployment rate of DNSSEC is far from satisfactory.

Conclusion

DNS Cache poisoning attack is ever-changing, with new attack surfaces appearing. As we previously stated, modern DNS infrastructure has multiple layers of caching. The client often initiates a query using an API to an OS stub resolver, a separate system process that maintains OS-wide DNS cache. Stub resolver does not perform any iterative queries; instead, it forwards the request to the next layer.

A DNS forwarder also forwards queries to its upstream recursive resolver. DNS forwarders are commonly found in Wi-Fi routers (e.g., in a home), and they maintain a dedicated DNS cache. The recursive resolver does the real job of iteratively querying the authoritative name servers. The answers are then returned and cached in each layer.

All layers of caches are technically subject to the DNS cache poisoning attack. But we generally tend to ignore stub resolvers and forwarders, which are also equally susceptible to attacks. As the industry moves forward, we should be better prepared for such attacks and have better defenses accordingly.