A Review of the Best News of the Week on Cybersecurity Management & Strategy
Nation-State Hackers Breached FireEye, Stole Its Red Team Tools (Dark Reading, Dec 08 2020)
"Novel techniques" used by the attackers cheated security tools and forensics, according to FireEye CEO Kevin Mandia.
Industry Reactions to FireEye Breach: Feedback Friday (SecurityWeek, Dec 11 2020)
Cybersecurity firm FireEye this week revealed that a highly sophisticated threat group likely sponsored by a foreign government breached its network and stole some of its Red Team tools.
Foxconn hit with record-breaking $34 million ransom demand after cyber attack (Graham Cluley, Dec 08 2020)
The world’s largest electronics manufacturer, Foxconn, has suffered a cyber attack and extortionists are reportedly demanding a $34 million ransom be paid for the recovery of its data.
Filter Out the Noise
Since I started this curated newsletter in June 2017, I’ve clipped ~17,000 articles and narrowed them down into the best 20 per day & best 15 per week. This is my favorite way to cut through all the security marketing and hype. If you’re enjoying it, tell a friend. If you hate it, tell an enemy.
Thanks! – Lucas Samaras
Share today’s post on Twitter Facebook LinkedIn
Cybercrime costs the world more than $1 trillion, a 50% increase from 2018 (Help Net Security, Dec 07 2020)
Cybercrime costs the world economy more than $1 trillion, or just more than one percent of global GDP, which is up more than 50 percent from a 2018 study that put global losses at close to $600 billion, McAfee reveals. Beyond the global figure, the report also explored the damage reported beyond financial losses, finding 92 percent of companies felt effects beyond monetary losses.
The 2020 Workshop on Economics and Information Security (WEIS) (Schneier on Security, Dec 04 2020)
The workshop on Economics and Information Security is always an interesting conference. This year, it will be online. Here’s the program. Registration is free.
Google Cloud Hires First CISO (SecurityWeek, Dec 11 2020)
Google has snapped up Goldman Sachs cybersecurity veteran Phil Venables to manage security and risk for the important Google Cloud franchise.
A Cybersecurity Policy Agenda (Schneier on Security, Dec 11 2020)
“The Aspen Institute’s Aspen Cybersecurity Group — I’m a member — has released its cybersecurity policy agenda for the next four years.
The next administration and Congress cannot simultaneously address the wide array of cybersecurity risks confronting modern society. Policymakers in the White House, federal agencies, and Congress should zero in on the most important and solvable problems. To that end, this report covers five priority areas where we believe cybersecurity policymakers should focu”
Enigma Machine Recovered from the Baltic Sea (Schneier on Security, Dec 04 2020)
German divers searching the Baltic Sea for discarded fishing nets have stumbled upon a rare Enigma cipher machine used by the Nazi military during World War Two which they believe was thrown overboard from a scuttled submarine.
Recruitment giant Randstad hit by ransomware, sensitive data stolen (Graham Cluley, Dec 07 2020)
One of the world’s leading recruitment agencies has found itself the victim of ransomware. In a statement published on Thursday last week, Randstad said that it had “recently become aware of malicious activity” on its network. That “malicious activity” was the Egregor ransomware…
Israel shaken by data leak after ransomware attack at Shirbit insurance company (Graham Cluley, Dec 07 2020)
A hacking gang calling itself Black Shadow has demanded a giant insurance firm pay a US $3.8 million ransom after encrypting and stealing sensitive data and documents about its clients.
Vermont Hospital Cyberattack Cost Estimated at $1.5M a Day (SecurityWeek, Dec 09 2020)
A late October cyberattack on the computer systems of the University of Vermont Medical Center is costing the hospital about $1.5 million a day in lost revenue and recovery costs, its CEO said.
Payment Processing Giant TSYS: Ransomware Incident “Immaterial” to Company (Krebs on Security, Dec 10 2020)
“Payment card processing giant TSYS suffered a ransomware attack earlier this month. Since then reams of data stolen from the company have been posted online, with the attackers promising to publish more in the coming days. But the company says the malware did not jeopardize card data, and that the incident was limited to administrative areas of its business.”
Kmart, a vulnerable target, among those hit in Egregor ransomware attack spree (SC Media, Dec 04 2020)
Kmart stores have dwindled in number since the company filed for bankruptcy in 2018. Some argue that makes the one-time retail giant a logical target.
Eli Lilly CISO on COVID vaccine suppliers: ‘My biggest concern is their being aware they are a target’ (SC Media, Dec 03 2020)
The comments come on the heels of IBM’s discovery that hackers had targeted the cold storage suppliers for COVID-19 vaccine distribution.
Most Victim Organizations Suffer Second Intrusion Within a Year (Infosecurity Magazine, Dec 08 2020)
CrowdStrike calls for continuous monitoring to keep threats at bay
Gula Tech Foundation to Award $1M in Grants to Infosec Nonprofits (Dark Reading, Dec 08 2020)
The first Gula Tech Foundation competitive grant program will focus on increasing African American engagement in cybersecurity.
Why Compliance Is No Longer King for Financial Services Cybersecurity (Dark Reading:, Dec 08 2020)
Financial services companies’ experience in risk management serves them well when it comes to minimizing their cyber-risk.
US Healthcare Provider Proposes $4.2m Data Breach Settlement (Infosecurity Magazine, Dec 08 2020)
Montana healthcare provider tries to resolve lawsuit filed on behalf of victims of 2019 data breach
Lawyer up: Following a breach, companies often call outside counsel first (SC Media, Dec 09 2020)
BakerHostetler assisted in about 1,600 cases tied to cyber breaches this year — about 60 percent more than 2019.
Venafi Becomes Unicorn After Investment From Thoma Bravo (SecurityWeek, Dec 10 2020)
Private equity firm Thoma Bravo on Thursday announced a strategic growth investment in machine identity solutions provider Venafi.