This week’s drilldown focuses on two items (included below) from NewsBites Issue 30
and Issue 31. These items map to a theme I’ve been emphasizing recently in many SANS webinars: We had to react quickly to the massive change in business operations because of the coronavirus. As we start to prepare for restoring business operations, there is an opportunity, and more importantly a need, to make security gains as part of that transition to the “new normal.”
The first item details more security and privacy improvements from Zoom, now allowing paying users to keep their Zoom data and traffic within a specified data center region. Consumers generally don’t care about where the information they expose in social media gets stored because the entire purpose of using Facebook, Instagram, Twitter, etc. is to expose their videos and pictures!
However, when consumers start using Zoom for doctor’s appointments and other sensitive uses, even Harry and Harriet Homeowner begin to worry. Their healthcare providers and banks already worry, because businesses have to worry about compliance with GDPR, HIPAA, CalOPPA and other regimes that give citizens rights about how organizations use and store their data. Government agencies often require that all data storage in cloud systems be in their home country.
So, it is good to see Zoom joining other established cloud service providers and offering geographic restrictions on data centers. Almost all business use of any cloud services should include this capability as a required feature, though it may not always be free.
The second item is another in what has been a never-ending series of Google announcing it has pulled malicious extensions from the Chrome Web Store or malicious Android apps from Google Play. Now, the fact that the Chrome browser and Android phones (as well as Apple iOS devices and Apple App Store) use a whitelist mechanism for limiting what executables can be installed is a huge improvement over how PCs and the Windows OS work.
However, smartphones are about to take a major leap--from addictive game-playing cameras that you can also talk on to critical health care devices that can still do those other things. Widespread testing for and surveillance of coronavirus markers will be critical to the global economy opening up again.
We have already seen malicious actors going after everything related to defeating the coronavirus, and they will surely be attacking those mobile testing/status apps. Security teams should start preparing now by reviewing existing user guidance for safe business use of smartphones and developing enhanced security guidelines for when coronavirus status apps are in use.
____________________________________________________________
Zoom to Allow Paying Users to Choose Meeting Traffic Routing (April 14, 2020)
Staring Saturday, April 18, users who pay for the Zoom videoconferencing platform will be able to choose which data center regions their meeting traffic travels through. Users will not be able to opt out of their default data center region, which is where their account is provisioned. Zoom's current data center regions are the United States, Canada, Europe, India, Australia, China, Latin America and Japan/Hong Kong.
Editor’s Note
[Pescatore] There was once a myth that "cloud makes location obsolete." It has never been true. For many reasons, location of data centers still matters. All the major enterprise-class SaaS and IaaS providers have offered data center location selection (not always for free). It is good to see Zoom listening to enterprise needs and following suit. Zoom also continues to release security improvements, important to keep up with them and ratchet up the safety of your use of Zoom.
[Neely] Zoom is not the only video teleconference (VTC) service which routes through distributed data centers. While the primary focus for VTCs should be secure meeting configuration, if you are covering information with location or export controls, the region needs to be appropriate to avoid penalties.
[Murray] The leakage of video conferencing traffic in the network is a potential risk, but for most applications and environments, this risk does not compare to the risk of improper settings and misuse.
Google Removes Malicious Chrome Extensions From Web Store
(April 15, 2020)
Google has pulled nearly 50 malicious extensions from its Chrome Web Store. These bad apps were pretending to be legitimate cryptocurrency wallet apps, but actually stole cryptowallet keys and other sensitive information.
Editor's Note
[Pescatore] A key element of the world recovering from COVID-19 is testing, and a critical part of making widespread testing work will be smartphone apps used for demonstrating an individual’s testing status and tracing possible contacts if someone is found to be infected. Google and Apple need to really step up the security of apps and extensions that make it through their testing. Longer wait times for most apps and extensions to come out of the process are worth it now to significantly elevate the trust and safety levels of phones for this coming critical use. Google and Apple are already working together on the tracing side of the problem. A joint effort on radically reducing “badware” that gets through their testing regimes should be a key part of that.
