COVID-19 cybersecurity: Pro-bono Pentests for COVID-19 related Apps & Software
April 22, 2020
Website Security Analysis and Signs to Identify Malware
May 12, 2020
Steve Morgan, Editor-in-Chief, Cybercrime Magzine Interviewed Sandeep Kamble, Founder & CTO at SecureLayer7
Online Fraud Attack
Online fraud attack detection continues to grow in complexity with many solutions measuring dynamic behavioral characteristics. Security and risk management leaders responsible for fraud prevention should focus on creating a trusted ecosystem, and seek orchestrated solutions to improve customer experience says Gartner Research Paper.
You can read more details about the interview published at cybercrime magazine here.
Podcast Transcript
Steve: Tell us about your background and how that led you to startup SecureLayer7.
Sandeep: Sure, thank you for having me on! It is a pleasure to be here.
Well, when I was 17, I got introduced to the computer, and I think it was in the year 2006, that I started learning about how the computer software and hardware works and learned the basics of computers online on a few Yahoo groups. I started using Yahoo Messenger, MSN Messenger, to chat with other online computer experts.
One day something unexpected happened. I was not able to access Yahoo Messenger or reset my password. Then I realized my Yahoo ID had been hacked. After a few months of understanding, I learned that it was session hijacking, and this was the turning point for me. As a curious mind, I started learning about how computer hacking works, and I got passionate about it.
This leads me to understand how the technology works, how to really dig deep into the technology, how I can manipulate the technology, and that is when I started writing code in VB and C for tricking the technology in the year 2008.
In 2011, I finished my computer engineering from JNEC. I’m still the passionate hacking guy in an ethical way and constantly am looking into web applications, reverse engineering, developing web exploits, network security. Now I wanted to solve the security problem for others.
From 2011 to 2016, I was doing lots of security assessments independently, and finally, I decided to start SecureLayer7 in 2016 officially. Now, SecureLayer7 is serving the US, EU, and Middle East markets with a team of 50+ security engineers.
Steve: You have a new product, AuthSafe. Before you tell us about it, we’d like to know what problems it solves. I believe you’re preventing account takeovers. Is that right, and how serious of a problem is that?
Sandeep: First, I would like to answer about what problem we solve.
The idea behind the product AuthSafe is to predict, detect, prevent, and respond to online fraud attacks in real-time using our cognitive engine.
Authsafe’s technology help to prevent all manners of Account Takeover (Online Fraud Attack) efforts and new online fraud account registration attack. Through manual attempts or automated tools methods, including credential stuffing.
Once you prevent online fraud attack, this will result in the reduction of fraud chargebacks, decrease in account takeover, decrease in online fraud registration, decrease in the manual review of online fraud attacks and finally increase in the orders, transactions, and support teams will be busy in other important work instead of handling the online fraud attacks support tickets.
Second, you asked about how serious this problem is?
Bad attackers use different methods to breach, social engineer, phish, trick their own way into getting customer’s username and password. A successful account takeover means a hacker’s access to the bank account or e-commerce account or healthcare account for further malicious activity or stealing data from accounts. For example: what if a person’s bank account gets hacked and fraud transfers take place. This leads to big problems. This where AuthSafe comes into the picture to prevent such attacks.
Steve Do most organizations realize how pervasive keystroke malware is, as well as automated bots that profile websites and guess passwords, automated brute force attacks, and credential stuffing?
Sandeep: First, it is quite difficult to learn the online fraud attack patterns, if the organizations do not have machine learning-enabled fraud prevention product. I’ve seen many organizations, and they fail to understand the cause of the fraud because they don’t realize how the information is flowing and from where the requests are coming.
Second, organizations use rule-based detection and which fails miserably because it will generate lots of false positives, and the support team will get busy replying to the end-users.
For example: If a sophisticated credential stuffing attack happens on the digital commerce or financial institute and if the attacker uses the multiple IPs address from the same city of end-user, then these attacks mostly go undetectable. Because these requests appear as legitimate a user.
To detect such attacks, organizations must have protection for users before and after login. Understanding user behavior, devices activities, and all actions must be performed in real-time.
Steve: So tell us about AuthSafe, and keep it simple. We want everyone to understand – from CEOs to CISOs to cybersecurity professionals. And then for more of a technical deep dive they can visit your website for more information.
Sandeep: AuthSafe provides user behavior, and online fraud attack trained models to enable risk-based authentication to stop cybercriminal accessing compromised end-user and prevent online fraud attacks.
AuthSafe also provides real-time risk scores based on the historical and current behavior of the end-users.
Using these risk scores, organizations can enforce adaptive authentication if the risk is high. Organizations can challenge the end-user by elevating the authentication for 2FA if the risk is low then the end-user will login without any challenges.
To tell you, the AuthSafe team, along with the Gartner research team, is working on a goal to reduce the organization cost associated with frauds attack.
