Latest

Critical Infrastructure Security

Open Cybersecurity Alliance: In Pursuit of Interoperability

Geetha Nandikotkur  •  October 17, 2019

Eighteen technology companies have formed the Open Cybersecurity Alliance to foster the development of open source tools to improve interoperability and data sharing between cybersecurity applications. But some observers say getting all players to agree on a common platform will be challenging.

3rd Party Risk Management

Robotic Process Automation: Security Essentials

Suparna Goswami  •  October 17, 2019

Robotic process automation aims to use machine learning to create bots that automate high-volume, repeatable tasks. But as organizations tap RPA, they must ensure they take steps to maintain data security, says Deloitte's Ashish Sharma.

Business Continuity Management / Disaster Recovery

Ransomware Attacks: STOP, Dharma, Phobos Dominate

Mathew J. Schwartz  •  October 16, 2019

Ransomware is once again the most common illicit profit-making tool in online attackers' arsenal, police warn. Security firm Emsisoft says the most-seen strains in recent months include STOP, Dharma .cezar, Phobos, GlobeImposter 2.0 and Sodinokibi. Less widely seen Ryuk also continues to generate big profits.

Cybercrime

'Silent Librarian' Revamps Phishing Campaign: Proofpoint

Apurva Venkat  •  October 16, 2019

"Silent Librarian," a hacking group with apparent ties to the Iranian government, is continuing to revamp and refine its phishing techniques as it targets research universities in the U.S. and Europe in an attempt to steal intellectual property, according to the security firm Proofpoint.

Blockchain & Cryptocurrency

Phony Company Used to Plant macOS Malware: Report

Apurva Venkat  •  October 16, 2019

Security researchers have found that a hacking group, which may have North Korean ties, recently created a phony company offering a cryptocurrency exchange platform as a step toward planting malware on the macOS devices of employees of cryptocurrency exchanges.

CISO Trainings

The Ultimate Missing Link in Cyber: Continuous Compromise Assessment

Information Security Media Group  •  October 16, 2019

According to Ricardo Villadiego, Lumu Technologies' Founder and CEO, organizations are "sitting on a gold mine: their own data". Under the single premise that organizations should assume they are compromised and prove otherwise, Lumu seeks to empower enterprises to answer the most basic question: Is your organization...

Endpoint Security

IoT in Vehicles: The Trouble With Too Much Code

Jeremy Kirk  •  October 16, 2019

The threat and risk surface of internet of things devices deployed in automobiles is exponentially increasing, which poses risks for the coming wave of autonomous vehicles, says Campbell Murray of BlackBerry. Large code bases, which likely have many hidden software bugs, are part of the problem, he says.

Business Continuity Management / Disaster Recovery

Pitney Bowes Says Ransomware Behind System Outages

Jeremy Kirk  •  October 15, 2019

Pitney Bowes says it was infected by file-encrypting malware that has affected online accounts and mailing products but that client data doesn't appear to be at risk. The postage meter maker says "all options" are being considered for recovery, meaning that it could pay a ransom.

Legislation & Litigation

How Has FTC Data Security Enforcement Changed?

Marianne Kolbasuk McGee  •  October 15, 2019

In the wake of a federal appeals court ruling last year vacating a Federal Trade Commission enforcement action against LabMD, the FTC's data security consent orders are becoming far more detailed and rigorous, says former FTC attorney Julie O'Neill.

Cybercrime

Stung by Takedowns, Criminals Tap Distributed Dark Markets

Mathew J. Schwartz  •  October 15, 2019

Law enforcement success inevitably sparks criminals to become more innovative, including shifting from centralized markets - such as Hansa and Wall Street Market - to encrypted and distributed marketplaces, says the University of Surrey's Alan Woodward.

Governance

CCPA Amendments Signed; Draft Regulations Released

Scott Ferguson  •  October 14, 2019

Gov. Gavin Newsom has signed into law six amendments to the California Consumer Privacy Act as well as another bill updating the state's long-standing data breach law. Meanwhile, draft CCPA implementation regulations have been unveiled.

Governance

Imperva's Breach Post-Mortem: API Key Left Exposed

Jeremy Kirk  •  October 14, 2019

Cybersecurity vendor Imperva's breach post-mortem should serve as a warning to all those using cloud services: One mistake can turn into a calamity. The company accidently left an AWS API key exposed to the internet; the key was then stolen and used to steal a sensitive customer database.