The Top 15 Security Posts – Vetted & Curated
*Threats & Defense*
1. DHS, FBI Issue SamSam Advisory (Dark Reading, Dec 04 2018)
Following last week’s indictment, federal government issues pointers for how security pros can combat SamSam ransomware.
2. Banks Attacked through Malicious Hardware Connected to the Local Network (Schneier on Security, Dec 07 2018)
Kaspersky is reporting on a series of bank hacks — called DarkVishnya — perpetrated through malicious hardware being surreptitiously installed into the target network: In 2017-2018, Kaspersky Lab specialists were invited to research a series of cybertheft incidents. Each attack had a common springboard: an unknown device directly connected to the company’s local network.
3. The Dark Side of the ForSSHe (WeLiveSecurity, Dec 05 2018)
ESET researchers discovered a set of previously undocumented Linux malware families based on OpenSSH. In the white paper, “The Dark Side of the ForSSHe”, they release analysis of 21 malware families to improve the prevention, detection and remediation of such threats
Tell Your Friends
If you’re enjoying Mosaic’s independent news curation, forward it to a friend today. “Hey, instead of sifting through vendor marketing and duplicate news, I found this curated news feed from Mosaic Security Research. Check it out.”
Thanks! – Lucas Samaras
Share on Twitter Facebook LinkedIn
*AI, IoT, & Mobile Security*
4. Nokia: IoT Botnets Comprise 78% of Malware on Networks (Infosecurity Magazine, Dec 06 2018)
Nokia is warning of a deluge of IoT malware after revealing a 45% increase in IoT botnet activity on service provider networks since 2016. The mobile networking firm’s Threat Intelligence Report for 2019 is is based on data collected from its NetGuard Endpoint Security product, which it says monitors network traffic from over 150 million devices globally.
5. Combating Potentially Harmful Applications with Machine Learning at Google: Datasets and Models (Google Online Security Blog, Nov 15 2018)
“In a previous blog post, we talked about using machine learning to combat Potentially Harmful Applications (PHAs). This blog post covers how Google uses machine learning techniques to detect and classify PHAs. We’ll discuss the challenges in the PHA detection space, including the scale of data, the correct identification of PHA behaviors, and the evolution of PHA families.”
6. Your Apps Know Where You Were Last Night, and They’re Not Keeping It Secret (The New York Times, Dec 10 2018)
Dozens of companies use smartphone locations to help advertisers and even hedge funds. They say it’s anonymous, but the data shows how personal it is.
*Cloud Security, DevOps, AppSec*
7. AWS re:Invent Security Recap: Launches, Enhancements, & Takeaways (AWS Blog, Dec 10 2018)
Here are the top Security, Identity and Compliance releases from re:invent 2018…
8. Google+ to shut earlier as new bug exposed data of 52.5 million users (WeLiveSecurity, Dec 11 2018)
There is no evidence that the flaw was misused during the six days it was alive, said the tech giant.
9. Forget Shifting Security Left; It’s Time to Race Left (Dark Reading, Dec 12 2018)
Once DevOps teams decide to shift left, they can finally look forward instead of backward.
*Identity Mgt & Web Fraud*
10. New Australian Backdoor Law (Schneier on Security, Dec 12 2018)
“Last week, Australia passed a law giving the government the ability to demand backdoors in computers and communications systems. Details are still to be defined, but it’s really bad.”
11. Report: Pioneering Privileged Access Management (Help Net Security, Dec 07 2018)
Gartner released the first-ever Magic Quadrant for Privileged Access Management*, – it is, in our view, a significant milestone for the industry. We believe it spotlights the critical importance of protecting privileged credentials amidst digital transformation initiatives and the ever-changing threat landscape.
12. Privacy Regulation Round-Up (Info-Tech Research Group, Inc., Dec 11 2018)
This Privacy Regulation Round-Up summarizes the latest major global privacy regulatory development, announcements, and changes. This report is updated on a monthly basis.
*CISO View*
13. Scanning for Flaws, Scoring for Security (Krebs on Security, Dec 12 2018)
“Is it fair to judge an organization’s information security posture simply by looking at its Internet-facing assets for weaknesses commonly sought after and exploited by attackers, such as outdated software or accidentally exposed data and devices? Fair or not, a number of nascent efforts are using just such an approach to derive security scores for companies and entire industries. What’s remarkable is how many organizations don’t make an effort to view their public online assets as the rest of the world sees them — until it’s too late.”
14. Unencrypted medical data leads to 12-state litigation (Naked Security – Sophos, Dec 07 2018)
The Attorneys general of 12 states are suing an e-record provider who lost 3.9 million personal healthcare records in 2015.
15. 7 Lessons from Marriott Starwood breach and what Mueller teaches us (Gartner Blog Network gbn-feed – Gartner Blog Network, Dec 10 2018)
Here are the lessons that stand out to me from the Marriott/Starwood breach