The Top 15 Security Posts – Vetted & Curated
*Threats & Defense*
1. Cisco fixes three high-level bugs, but a fourth remains unpatched (SC Media, Mar 06 2020)
The flaw with no current fix is CVE-2020-3155: a validation error in the SSL implementation of Cisco Intelligent Proximity, a solution that helps laptops, smartphones and other devices automatically discover and link with Webex video devices and collaboration endpoints. If exploited, the vulnerability could enable remote attackers to view or alter information shared on these Webex devices and endpoints.
2. FBI Working to ‘Burn Down’ Cyber Criminals’ Infrastructure (SecurityWeek, Mar 06 2020)
To thwart increasingly dangerous cyber criminals, law enforcement agents are working to “burn down their infrastructure” and take out the tools that allow them to carry out their devastating attacks, FBI Director Christopher Wray said Wednesday.
3. Most Cyberattacks in 2019 Were Waged Without Malware (Dark Reading, Mar 04 2020)
If the “malware-free” attack trajectory continues, it could mean major trouble for defenders, according to experts from CrowdStrike and other security companies.
Filter Out the Noise
Since I started this curated newsletter in June 2017, I’ve clipped ~13,000 articles and narrowed them down into the best 20 per day & best 15 per week. This is my favorite way to cut through all the security marketing and hype. If you’re enjoying it, tell a friend. If you hate it, tell an enemy.
Thanks! – Lucas Samaras
Share on Twitter Facebook LinkedIn
*AI, IoT, & Mobile Security*
4. Before Clearview Became a Police Tool, It Was a Plaything of the Rich (NYT, Mar 05 2020)
Investors and clients of the facial recognition start-up freely used the app on dates and at parties — and to spy on the public.
5. This Small Company Is Turning Utah Into a Surveillance Panopticon (Vice, Mar 05 2020)
Banjo is applying artificial intelligence to government-owned surveillance and traffic cameras across the entire state of Utah to tell police about “anomalies.”
6. T-Mobile Notifying Customers of Data Breach (SecurityWeek, Mar 05 2020)
Wireless carrier T-Mobile is sending notifications to its customers to inform them of a data breach that resulted in some of their personal information being compromised
*Cloud Security, DevOps, AppSec*
7. The DevOps Sweet Spot: Inserting Security at Pull Requests (Part 1) (DevOps, Mar 11 2020)
While it’s true that security scans may be automatically started, they still finish in siloed processes that don’t keep up with the pace of releases. We call this “automation for automation’s sake.” It does not measurably improve defect density, slow the accrual of technical debt or reduce mean time to repair (MTTR). The only value that automating this way provides is checking a box on a compliance form.
8. How financial institutions can approve AWS services for highly confidential data (AWS Security Blog, Mar 10 2020)
“As a Principal Solutions Architect within the Worldwide Financial Services industry group, one of the most frequently asked questions I receive is whether a particular AWS service is financial-services-ready.”
9. Facebook Awards $55,000 for Flaw That Could Lead to Account Hijacking (SecurityWeek, Mar 10 2020)
A researcher has earned $55,000 from Facebook for reporting a serious vulnerability that could have been exploited by hackers to steal access tokens and hijack accounts.
*Identity Mgt & Web Fraud*
10. 99% of compromised Microsoft enterprise accounts lack MFA (Sophos, Mar 09 2020)
Cybercriminals compromise over a million Microsoft enterprise accounts each month as too few customers use multi-factor authentication.
11. Through apps, not warrants, ‘Locate X’ allows federal law enforcement to track phones (Protocol, Mar 05 2020)
Federal agencies have big contracts with Virginia-based Babel Street. Depending on where you’ve traveled, your movements may be in the company’s data.
12. FBI Arrests Alleged Owner of Deer.io, a Top Broker of Stolen Accounts (Krebs on Security, Mar 10 2020)
FBI officials last week arrested a Russian computer security researcher on suspicion of operating deer.io, a vast marketplace for buying and selling stolen account credentials for thousands of popular online services and stores.
*CISO View*
13. Panel outlines massive federal cybersecurity overhaul (POLITICO, Mar 11 2020)
The Cyberspace Solarium Commission made more than 75 recommendations based on 30 meetings, 300 interviews and nearly a year of work.
14. Live Coronavirus Map Used to Spread Malware (Krebs on Security, Mar 12 2020)
“Cybercriminals constantly latch on to news items that captivate the public’s attention, but usually they do so by sensationalizing the topic or spreading misinformation about it. Recently, however, cybercrooks have started disseminating real-time, accurate information about global infection rates tied to the Coronavirus/COVID-19 pandemic in a bid to infect computers with malicious software.
15. High-Stakes Security Setups Are Making Remote Work Impossible (Wired, Mar 13 2020)
Staffers at power grids, intelligence agencies, and more often don’t have the option to work from home, even in light of Covid-19.