Visualizing code in strains of ransomware that trace to North Korean hackers (Source: Trellix)

Cause for Concern? Ransomware Strains Trace to North Korea

Mathew J. Schwartz • May 16, 2022

If you were a nation with legions of hackers at your disposal, seeking to sidestep crippling international sanctions, would you look to ransomware to fund your regime? That question is posed by new research that finds state-sponsored North Korean hackers haven't stopped their ransomware experiments.

Business Continuity Management / Disaster Recovery

Fortinet CEO Ken Xie: OT Business Will Be Bigger Than SD-WAN

Latest

Next-Generation Technologies & Secure Development

Late-Stage Startups Feel the Squeeze on Funding, Valuations

Michael Novinson • May 13, 2022

Mature cybersecurity startups are beginning to slow hiring and prune operating expenses as macroeconomic storm clouds obscure future funding sources. Emerging vendors must grapple with an IPO market that has essentially dried up and investors unwilling to offer valuations anywhere near 2021 levels.

3rd Party Risk Management

A $150 Million Plan to Secure Open-Source Software

Brian Pereira • May 13, 2022

The Linux Foundation and the Open Source Security Foundation have put forth a nearly $150 million investment plan, spread across two years, to strengthen open-source security in the U.S. The plan was announced at the Open Source Software Security Summit II in Washington, D.C., on Thursday.

Blockchain & Cryptocurrency

ISMG Editors: What Have We Learned From the Conti Leaks?

Anna Delaney • May 13, 2022

In the latest update, four editors at Information Security Media Group discuss the intriguing insights exposed by the leak of ransomware gang Conti's internal communications, the U.S. Treasury's first-ever sanctions on a cryptocurrency mixer and the latest cyber activity in Russia's hybrid war.

3rd Party Risk Management

COVID Delays Patching of Vulnerable Konica Minolta Printers

Mihir Bagwe • May 13, 2022

Hundreds of thousands of Konica Minolta printers used in businesses have reportedly been vulnerable to three critical flaws since 2019. Although a patch was available, deployment was delayed as the firmware update required physical access to the printers and COVID-19 made that difficult.

CyberArk Debuts $30M Venture Fund to Back Talented Startups

Michael Novinson • May 12, 2022

CyberArk has unveiled a $30 million fund to back early-stage startups with unique approaches to solving large problems in the cybersecurity industry. CyberArk Ventures will offer the company broader visibility into adjacent markets and provide high-value integrations that can evolve over time.

3rd Party Risk Management

Microsoft Patch Tuesday: PetitPotam Cornered Again

Brian Pereira • May 12, 2022

Three of 74 vulnerabilities identified by Microsoft are "critical" as they exploit remote code execution with escalation of privileges. There are also updates for a new NTLM relay attack using an LSARPC flaw, tracked as CVE-2022-26925, which is a Windows LSA spoofing vulnerability.

Access Management

Zero Trust, Cloud Adoption Drive Demand for Authorization

Suparna Goswami • May 12, 2022

With zero trust and cloud infrastructures at the top of security practitioners' road maps, there has been an uptick in authorization-related initiatives. Security experts discuss the challenges of authorization and describe how firms can use authorization strategies to better protect themselves.

Cryptocurrency Fraud

Proof of Concept: Crypto - A New National Security Threat

Anna Delaney • May 12, 2022

In the latest "Proof of Concept," Ari Redbord, head of legal and government affairs at TRM Labs, and former CISO David Pollino of PNC Bank join editors at ISMG to discuss the U.S Treasury's decision to sanction cryptocurrency mixer Blender.io. They also assess software supply chain security.

Access Management

Lessons for Cybersecurity Leaders From Russia-Ukraine War

Anna Delaney • May 12, 2022

The latest edition of the ISMG Security Report analyzes what lessons cybersecurity leaders can learn from the Russia-Ukraine war. It also examines the Okta data breach and Lapsus$ attack and describes how tech companies are supporting new developments in the FIDO protocol.

Business Continuity Management / Disaster Recovery

Russia-Ukraine War: 7 Cybersecurity Lessons Learned

Mathew J. Schwartz • May 11, 2022

As the Russia-Ukraine war continues, what cybersecurity lessons should be learned? At the CyberUK conference in Wales, cybersecurity czars focused on surprises - including low online attack volume and the role of hacktivists - and lauded Ukraine's cyber resilience, honed by years of stress testing.

Business Continuity Management / Disaster Recovery

Hybrid War: 'It's Going to Get a Lot Worse'

Anna Delaney • May 11, 2022

Russia's use of wiper malware, DDoS attacks and targeted disinformation show it no longer depends on traditional methods in its war with Ukraine. John Walker, a professor and counterintelligence expert, says organizations need to be "more realistic" about how they handle cyberattacks.

Attack Surface Management

New LookingGlass CEO Bryan Ware to Diversify Customer Base

Michael Novinson • May 11, 2022

New CEO Bryan Ware plans to leverage LookingGlass' nascent attack surface management capabilities to capture clients in verticals such as pharmaceuticals, manufacturing and utilities. The company tapped former CISA leader Ware to serve as its next CEO following the acquisition of Next5.