Latest

3rd Party Risk Management

House Passes Bills on Both Supply Chain, Telecom Security

Dan Gunderman  •  October 21, 2021

In a busy congressional day for cybersecurity legislation, the U.S. House of Representatives passed several bills on Wednesday, targeting both software supply chain and telecommunication system security. One observer describes them as "a win-win for the government and U.S. citizens."

3rd Party Risk Management

Ransomware: Average Ransom Payment Stays Steady at $140,000

Mathew J. Schwartz  •  October 21, 2021

When a business, government agency or other organization hit by ransomware opted to pay a ransom to its attacker in Q3, the average payment was $140,000, reports ransomware incident response firm Coveware. It says the attack landscape has seen some notable shifts since the Colonial Pipeline attack.

3rd Party Risk Management

CISA Leader Backs 24-Hour Timeline for Incident Reporting

Dan Gunderman  •  October 20, 2021

A top leader of the U.S. Cybersecurity and Infrastructure Security Agency has voiced support for a 24-hour timeline for cyber incident reporting involving critical infrastructure, signaling a push by the Biden administration to implement a rapid mechanism for federal response.

Endpoint Security

Why Reporting Security Bugs Can Be Fraught With Tension

Jeremy Kirk  •  October 20, 2021

Reporting security vulnerabilities to organizations with no disclosure policies can be fraught with tension. In the worst conflicts, security researchers could face lawsuits or even prosecution. Experts say laws should provide a safe harbor for responsible security research.

Business Continuity Management / Disaster Recovery

BlackMatter Ransomware Defense: Just-In-Time Admin Access

Mathew J. Schwartz  •  October 19, 2021

How many ways do U.S. businesses need to be told to lock down their systems to safeguard themselves from ransomware? That's the focus of a new, joint cybersecurity advisory from the U.S. government pertaining to BlackMatter, following an advisory issued last month about Conti.

Breach Notification

Sinclair TV Stations Targeted in Weekend Ransomware Attack

Dan Gunderman  •  October 18, 2021

Sinclair Broadcast Group, Inc., which owns or operates 186 television stations across 87 U.S. markets, has been hit with a ransomware attack that has disrupted operations. The company says the attack has impacted its ability to deliver advertisements and certain programming.

Breach Notification

Thingiverse Breach: 50,000 3D Printers Faced Hijacking Risk

Jeremy Kirk  •  October 18, 2021

A data breach affecting MakerBot's Thingiverse 3D printing repository website is far bigger than what the company has acknowledged, a former employee claims. Upwards of 2 million users may have been affected by the breach, which left their 3D printers at risk of being hijacked.

Anti-Money Laundering (AML)

Treasury Dept. to Crypto Companies: Comply with Sanctions

Dan Gunderman  •  October 16, 2021

The U.S. Department of the Treasury unveiled additional steps to curb the illicit use of cryptocurrencies on Friday, warning enterprises not to engage with sanctioned entities exploiting the financial system - particularly to launder ransomware proceeds.

►

3rd Party Risk Management

ISMG Editors' Panel: Are Our Systems Too Complex to Secure?

Anna Delaney  •  October 15, 2021

In this update, four editors discuss key cybersecurity issues, including addressing the complexity of security, the rising number of victims targeted by double extortion ransomware and the Information Commissioner's Office's recent consultation on creating an international data transfer agreement.

Access Management

Missouri Refers Coordinated Bug Disclosure to Prosecutors

Jeremy Kirk  •  October 15, 2021

A newspaper reporter in Missouri who responsibly reported the exposure of Social Security numbers on a state government website has been accused of malicious hacking by the state's governor. The governor alleged the publication of the vulnerability after it was fixed was part of a "political vendetta."

Account Takeover Fraud

Teenage Cybercrime: Giving Young Hackers A Second Chance

Anna Delaney  •  October 15, 2021

The latest edition of the ISMG Security Report features an analysis of attempts made by European law enforcement to encourage young cybercriminals to channel their skills in more ethical ways. Also featured: Fraud detection and response; inspiring behavioral change.

Endpoint Security

Australia Plans Ransomware Attack Reporting Requirement

Jeremy Kirk  •  October 14, 2021

Australia plans to require businesses with more than $10 million in revenue to report ransomware attacks to the government, part of a comprehensive strategy to fight the attacks that also includes new criminal penalties and assistance to victims. The plan would need to be passed by Parliament.