Secure the Village
Stan Stahl talks to Larry Marino on Sunday Morning Newsmakers: We discuss the attack on the LA Times, ransomware, email validation, WiFi & router security, breach notification, GDPR, & cybersecurity regulations: Sunday Morning Newsmakers with Larry Marino, January 6, 2019
Individuals at Risk
Identity Theft
Year of Free Credit Report Monitoring Is Ending. Here’s What to Do Now: Consumers affected by Equifax’s huge data breach in 2017 may need to re-establish protections on their credit report if they “locked” their files as part of the company’s free credit-monitoring offer. The New York Times, January 11, 2019
Cyber Update
Patch Tuesday, January 2019 Edition: Microsoft on Tuesday released updates to fix roughly four dozen security issues with its Windows operating systems and related software. All things considered, this first Patch Tuesday of 2019 is fairly mild, bereft as it is of any new Adobe Flash updates or zero-day exploits. But there are a few spicy bits to keep in mind. Read on for the gory details. KrebsOnSecurity, January 9, 2019
Cyber Defense
Yet Another Bypass: Is 2FA Broken? Authentication Experts Weigh In: A penetration testing tool called Modlishka can defeat two-factor authentication in the latest 2FA security issue. We asked a roundtable of experts what it all means. ThreatPost, January 11, 2019
Cyber Warning
This Trojan attack adds a backdoor to your Windows PC to steal data: A well-resourced and prolific hacking group is distributing a new strain of malware that gives the hackers remote desktop access as part of an information-stealing campaign targeting banks, retailers and businesses. ZDNet, January 10, 2019
Malware found preinstalled on some Alcatel smartphones: A weather app that comes preinstalled on Alcatel smartphones contained malware that surreptitiously subscribed device owners to premium phone numbers behind their backs.ZDNet, January 10, 2019
eBay Site Selling Cheap Office Professional. Buyer beware!!! … Dirt-Cheap, Legit, Windows Software: Pick Two: Buying heavily discounted, popular software from second-hand sources online has always been something of an iffy security proposition. But purchasing steeply discounted licenses for cloud-based subscription products like recent versions of Microsoft Office can be an extremely risky transaction, mainly because you may not have full control over who has access to your data. KrebsOnSecurity, January 8, 2019
Cryptography failure leads to easy hacking for PlayStation Classic: In the days since the PlayStation Classic’s official release, hackers have already made great progress in loading other PlayStation games (and even non-PlayStation software) onto the plug-and-play device. What’s more, it seems some sloppy cryptography work on Sony’s part is key to unlocking the device for other uses. ars technica, December 10 2018
Information Security Management in the Organization
Cyber Warning
Hackers Using Zero-Width Spaces to Bypass MS Office 365 Protection: Security researchers have been warning about a simple technique that cybercriminals and email scammers are already being using in the wild to bypass security features of Microsoft Office 365, including Safe Links, which are originally designed to protect users from malware and phishing attacks. TheHackerNews, January 10, 2019
Cyber Defense
There’s a sizable gap between confidence in security programs and their effectiveness: A Syncsort survey of over 300 respondents found that while 85 percent of respondents are either very or somewhat confident in their organization’s security program, 41 percent said their company had experienced a security breach and 20 percent more were unsure. HelpNetSecurity, January 11, 2019
Who Takes Responsibility for Cyberattacks in the Cloud? A new CSA report addresses the issue of breach responsibility as more organizations move ERP application data the cloud: When cloud data is breached, who is responsible? A new Cloud Security Alliance (CSA) report poses the question at a time when companies are moving enterprise resource planning (ERP) application data to the cloud and expect cloud-focused cyberattacks to increase in 2019. DarkReading, January 11, 2019
6 Serverless and Containerization Trends CISOs Should Track. Security leaders must stay on top of a fast-moving world of cloud deployment options: Cloud deployments are not only growing in complexity, but they are way more integral to the delivery of business-critical technology – so much so that they make early cybersecurity challenges from software-as-a-service (SaaS) apps seem quaint in comparison. As developers, testers, and operations staff speed along with continuous delivery/continuous integration (CI/CD) efforts, the use of containers and serverless technology is skyrocketing. With it brings plenty of new impending security issues. DarkReading, January 11, 2019
Secure The Human
This Security Stunt Cleverly Illustrates What a Cyber Attack Would Look Like in Real Life. Employees of a U.K. bike shop were in for a surprise: What might it look like if some sketchy characters targeted a business in the real world using cyber crime tactics? Global insurer Hiscox decided to demonstrate on a bike shop to help illustrate the threat reportedly faced by a third of British businesses. AdWeek, January 11, 2019
Cyber Fine
Neiman Marcus Settles Lawsuit Over Payment Card Breach: Forty-three states have reached a settlement with Neiman Marcus over its 2013 data breach, one of several breaches from that period blamed on card-scraping malware. BankInfoSecurity, January 10, 2019
Cyber Insurance
Cyber-insurance shock: Zurich refuses to foot NotPetya ransomware clean-up bill – and claims it’s ‘an act of war’. US snack food giant Mondelez is suing for $100m: US snack food giant Mondelez is suing its insurance company for $100m after its claim for cleaning up a massive NotPetya ransomware infection was rejected – for being “an act of war” and therefore not covered under its policy. The Register, January 11, 2019
Cyber Talent
The cybersecurity skills shortage is getting worse. More than half of organizations report a “problematic shortage” of cybersecurity skills, and there is no end in sight: At the end of each year, ESG conducts a wide-ranging global survey of IT professionals, asking them about challenges, purchasing plans, strategies, etc. As part of this survey, respondents were asked to identify areas where their organization has a problematic shortage of skills. CSO, January 10, 2019
Demand for cybersecurity first responders rises as salaries shoot up: Demand for cybersecurity first responders rises as salaries shoot up As cybersecurity’s importance grows among organizations, a new role that has emerged and is in demand across technology companies is that of cybersecurity first responders (CFR), who are increasingly being hired at junior and mid levels, according to HR experts. ET Tech, January 10, 2019
Cybersecurity in Society
Cyber Attack
Ryuk ransomware gang probably Russian, not North Korean: The Ryuk ransomware is most likely the creation of Russian financially-motivated cyber-criminals, and not North Korean state-sponsored hackers, according to reports published this week by four cyber-security firms –Crowdstrike, FireEye, Kryptos Logic, and McAfee. ZDNet, January 11, 2019
The cyber-attack that sent an Alaskan community back in time: In 2018, a remote Alaskan community’s infrastructure was hit by a malware attack which forced it offline. It was only then they realised how much they depended on computers. BBC, January 9, 2019
Cyber Freedom
Ga. Voting Tech Panel Goes Against Cybersecurity Expert, Urges Ballot-Marking Devices: Georgia voters should use some kind of device — like a touchscreen computer — to mark paper ballots when they go to the polls in 2020, according to recommendations by a state panel tasked with reviewing how Georgia’s 16-year-old voting machines should be replaced. WABE, January 11, 2019
National Cybersecurity
The Shutdown Is Hurting Cybersecurity. And the consequences could last long after the government reopens: In the midst of a federal government shutdown, it’s easy to get caught up in the short-term consequences: the federal workers going without pay, the long lines at airport security, the overflowing toilets at national parks. But the long-term effects may be even more devastating, at least when it comes to cybersecurity—and the problems could affect more than just the government. Slate, January 10, 2019
3 Urgent Areas of Action to Address National Cybersecurity Risks: The Aspen Cybersecurity Group, a nonpartisan subset of The Aspen Institute comprised of government officials, industry-leading experts, and academic and civil leaders, convened in early November to address cybersecurity risks and the actions that must be taken to protect enterprise networks from cyberthreats. SecurityIntelligence, January 9, 2019
How a Russian firm helped catch an alleged NSA data thief. The U.S. has accused Kaspersky Lab of working with Russian spies. But sources say the company exposed a massive breach that U.S. authorities missed: The 2016 arrest of a former National Security Agency contractor charged with a massive theft of classified data began with an unlikely source: a tip from a Russian cybersecurity firm that the U.S. government has called a threat to the country. Politico, January 9, 2019
What the U.S.’ Pursuit of Foreign Nation-State Hackers Means for Cybercrime Victims and Targets: For years, the U.S. has maintained an active enforcement campaign against overseas cyber criminals and while these past efforts have not been haphazard, they have not necessarily been part of a specific drive to address the serious issue of foreign cybercrime committed by nation states. Recent announcements by the DOJ show that this enforcement campaign is accelerating and expanding. LJN, January 2019
Cyber Enforcement
El Chapo was brought down by a sysadmin. Christian Rodriguez says he set up secure VoIP communications for the cartel: a system whose encryption keys he wound up giving to the FBI: It’s time to crown a new Sysadmin From Hell. Or from heaven, if you’re law enforcement. His name is Cristian Rodríguez: a Colombian IT geek who wound up working for drug kingpin “El Chapo” Joaquin Guzmán, got flipped by the FBI, and is likely going to go down in history as being the man most responsible for (probably) sending his ex-boss to jail – likely, for life. ZDNet, January 11, 2019
German Police Identify Suspect Behind Massive Data Leak. Anger at Politicians and Public Figures Allegedly Motivated 20-Year-Old Suspect: Following the massive leak of sensitive information tied to about 1,000 German celebrities, journalists and politicians, including Chancellor Angela Merkel, police say they have arrested a suspect who has confessed to stealing and dumping the information online (see: Hackers Leak Hundreds of German Politicians’ Personal Data). BankInfoSecurity, January 10, 2019
Boston Children’s Hospital Hacker Gets Long Prison Sentence. Hacktivist Martin Gottesfeld Also Ordered to Pay Restitution: A hacktivist who launched distributed denial-of-service attacks on Boston Children’s Hospital and another local facility in 2014 has been sentenced to 10 years in federal prison and ordered to pay nearly $443,000 in restitution. BankInfoSecurity, January 9, 2019
Artificial Intelligence
Never mind killer robots—here are six real AI dangers to watch out for in 2019: Once it was fashionable to fret about the prospect of super-intelligent machines taking over the world. The past year showed that AI may cause all sorts of hazards long before that happens. Technology Review, January 7, 2019
Cyber Humor
SecureTheVillage Calendar
Webinar: Your Business Is Not Prepared For Cyber Threats (And What To Do About It)
January 16 @ 10:00 am – 11:00 am
Webinar: Managing Cyber-Risk and Insurance
January 17 @ 10:00 am – 11:00 am
Webinar: SecureTheVillage February Webinar
February 7 @ 10:00 am – 11:00 am
Financial Services Cybersecurity Roundtable – February 2019
February 8 @ 8:00 am – 10:00 am
Webinar: SecureTheVillage March Webinar
March 7 @ 10:00 am – 11:00 am
The post Cybersecurity News of the Week, January 13, 2019 appeared first on Citadel Information Group.
from Citadel Information Group
via Citadel Information Group