A Review of the Best News of the Week on Cybersecurity Management & Strategy
The Same Old Encryption Debate Has a New Target: Facebook (Wired, Oct 03 2019)
Attorney general William Barr seems eager to reignite the encryption wars, starting with the social media giant.
Russian Secret Weapon Against U.S. 2020 Election Revealed In New Cyberwarfare Report (Forbes, Oct 08 2019)
A terrifying new report maps out Russia’s full cyberwarfare ecosystem, an attack structure designed to be “almost impossible” to defend against.
Credit Info Exposed in TransUnion Data Security Incident (BleepingComputer, Oct 10 2019)
Using a credential stuffing attack, an unauthorized person was able to gain access to a TransUnion Canada web portal and use it to pull consumer credit files.
Filter Out the Noise
Since I started this curated newsletter in June 2017, I’ve clipped ~11,000 articles and narrowed them down into the best 20 per day & best 15 per week. This is my favorite way to cut through all the security marketing and hype. If you’re enjoying it, tell a friend. If you hate it, tell an enemy.
Thanks! – Lucas Samaras
Share today’s post on Twitter Facebook LinkedIn
Alabama Hospital System Halts Admissions Amid Malware Attack (SecurityWeek, Oct 03 2019)
A hospital system that serves a large part of rural west Alabama temporarily quit accepting new patients after a ransomware attack crippled some of its computer systems Tuesday.
Small businesses increasingly a target for cybercriminals (AP, Oct 08 2019)
While small and mid-sized businesses are increasingly targets for cybercriminals, companies are struggling to devote enough resources to protect their technology from attack.
Health, personal data of 1 million New Zealanders exposed in series of intrusions (SC Magazine, Oct 09 2019)
The medical and personal information of about 1 million people was exposed after a breach of Tū Ora Compass Health, a primary health organization (PHO) located in New Zealand.
10 Steps to Assess SOC Maturity in SMBs (Dark Reading, Oct 07 2019)
Facing a system and organization controls audit doesn’t have to be stressful for small and midsize businesses if they follow these guidelines.
Nearly 70 US Government Organizations Hit by Ransomware Since January (Infosecurity Magazine, Oct 03 2019)
Government entities, schools, and healthcare providers are the main focus of this year’s US ransomware attacks
U.S. and Baltic States sign Energy Partnership Deal against cyber-attacks (CISO MAG, Oct 08 2019)
The United States and Baltic states recently signed an energy partnership agreement to protect the Baltic energy grid from cyber-attacks.
Unmask cybercriminals through identity attribution (Help Net Security, Oct 08 2019)
Part of taking action, however, requires knowing who the bad actor is in the first place; in other words, attributing and uncovering the identities of cyber adversaries.
Internal user mistakes create large percentage of cybersecurity incidents (Help Net Security, Oct 08 2019)
Internal user mistakes created the largest percentage of cybersecurity incidents over the past twelve months (80%), followed by exposures caused by poor network system or application security (36%), and external threat actors infiltrating the organization’s network or systems (31%), SolarWinds research reveals.
Class-Action Lawsuit Filed Against CafePress Following Data Breach (Infosecurity Magazine, Oct 07 2019)
CafePress is accused of allowing a breach by failing to update flawed security software
Magecart Group Tied to Cobalt Hackers (SecurityWeek, Oct 07 2019)
Security researchers were able to link one of the hacking groups operating under the Magecart umbrella to the infamous threat actor known as the Cobalt Group.
A Roundtable of Hackers Dissects ‘Mr. Robot’ Season 4 Episode 1: ‘Unauthorized’ (VICE, Oct 07 2019)
Technologists, hackers, and journalists recap the much-awaited fourth season opener of the realistic hacking show.
The lack of cybersecurity talent is ‘a national security threat,’ says DHS official (TechCrunch, Oct 03 2019)
The lack of cybersecurity talent is ‘a national security threat,’ says DHS official TechCrunch
New US-UK Agreement Speeds Law Enforcement’s Access to User Data (SecurityWeek, Oct 08 2019)
The United States and the United Kingdom have signed an agreement designed to help law enforcement agencies gain faster access to data related to serious crimes. This is the first such agreement based on the Clarifying Lawful Overseas Use of Data Act, or CLOUD Act, which was enacted into U.S. federal law on March 23, 2018.
Winning the security fight: Tips for organizations and CISOs (Help Net Security, Oct 09 2019)
If you ask Matthew Rosenquist, a former Cybersecurity Strategist for Intel (now independent), overcoming denial of risk, employing the right cybersecurity leader, and defining clear goals are the three most critical objectives for avoiding a negative outcome.
Digital transformation requires an aggressive approach to security (Help Net Security, Oct 09 2019)
Professionals don’t have a full picture about what tools are used in their organization. Beyond network and vulnerability scanning, respondents were asked about 10 other tool categories, and the lack of related knowledge is striking. For example, 25% do not know if their organization is using interactive application security testing (IAST), while 19% don’t know if they are using software composition analysis (SCA) or cloud middleware.
DHS seeks subpoena powers to identify vulnerable systems – TechCrunch (TechCrunch, Oct 10 2019)
Homeland Security’s cybersecurity division is pushing to change the law that would allow it to demand information from internet providers that would identify the owners of vulnerable systems, TechCrunch has learned.
A Realistic Threat Model for the Masses (Dark Reading, Oct 09 2019)
For many people, overly restrictive advice about passwords and other security practices is doing more harm than good. Here’s why.