A Review of the Best News of the Week on Cybersecurity Management & Strategy
Europol announces bust of “world’s biggest” dark web marketplace (Naked Security – Sophos, Jan 14 2021)
Dark web servers are hard to find – but not impossible.
Post-Riot, the Capitol Hill IT Staff Faces a Security Mess (Wired, Jan 11 2021)
Wednesday’s insurrection could have exposed congressional data and devices in ways that have yet to be appreciated.
On US Capitol Security — By Someone Who Manages Arena-Rock-Concert Security (Schneier on Security, Jan 13 2021)
“…I was floored on Wednesday when, glued to my television, I saw police in some areas of the U.S. Capitol using little more than those same mobile gates I had the ones that look like bike racks that can hook together to try to keep the crowds away from sensitive areas and, later, push back people intent on accessing the grounds. (A new fence that appears to be made of sturdier material was being erected on Thursday.) That’s the same equipment and approximately the same amount of force I was able to use when a group of fans got a little feisty and tried to get backstage at a Vanilla Ice show.”
Filter Out the Noise
Since I started this curated security news in June 2017, I’ve clipped ~17,000 articles and narrowed them down into the best 20 per day & best 15 per week. This is my favorite way to cut through all the security marketing and hype. If you’re enjoying it, tell a friend. If you hate it, tell an enemy.
Thanks! – Lucas Samaras
Share today’s post on Twitter Facebook LinkedIn
SolarWinds Hires Chris Krebs and Alex Stamos for Breach Recovery (Dark Reading, Jan 08 2021)
The former US cybersecurity official and former Facebook security chief will help SolarWinds respond to its recent attack and improve security.
More SolarWinds Attack Details Emerge (Dark Reading, Jan 12 2021)
A third piece of malware is uncovered, but there are still plenty of unknowns about the epic attacks purportedly out of Russia.
Hackers Publish COVID-19 Vaccine Data Stolen From EU Medicines Agency (SecurityWeek, Jan 13 2021)
Hackers have started leaking documents related to COVID-19 medicine and vaccines that were stolen from the European Medicines Agency (EMA) in early December 2020.
Watchdog Raises Concerns About Census Bureau’s IT Security (SecurityWeek, Jan 12 2021)
A watchdog agency for the U.S. Census Bureau says that proper information-technology security safeguards weren’t in place leading up to the start of the 2020 census last year, but the statistical agency disputes some of the findings and says no data was compromised.
How to approach threat modeling (AWS Security Blog, Jan 11 2021)
In this post, I’ll provide my tips on how to integrate threat modeling into your organization’s application development lifecycle. There are many great guides on how to perform the procedural parts of threat modeling, and I’ll briefly touch on these and their methodologies. However, the main aim of this post is to augment the existing […]
NSA Recommends Using Only ‘Designated’ DNS Resolvers (Dark Reading, Jan 14 2021)
Agency provides guidelines on securely deploying DNS over HTTPS, aka DoH.
High Court Rules Against Government Bulk Hacking (Infosecurity Magazine, Jan 11 2021)
Use of general warrants to target large numbers is illegal
Ransomware Attack Costs Health Network $1.5m a Day (Infosecurity Magazine, Jan 08 2021)
October ransomware attack is costing Vermont health network millions in lost revenue
PE Firm Completes Acquisition of Forcepoint (SecurityWeek, Jan 11 2021)
It’s a done deal. Investment firm Francisco Partners said on Monday that has completed the previously announced acquisition of Forcepoint from Raytheon Technologies.
Two-Thirds of Employees Don’t Consider Security Whilst Home Working (Infosecurity Magazine, Jan 12 2021)
Lack of awareness over security impact of home working
How to Boost Executive Buy-In for Security Investments (Dark Reading, Jan 12 2021)
Linking security budgets to breach-protection outcomes helps executives balance spending against risk and earns CISOs greater respect in the C-suite.
Data industry trends to watch in 2021 (Help Net Security, Jan 13 2021)
Okera researchers revealed five pivotal data industry trends and predictions expected to emerge in 2021. “The COVID-19 pandemic forced companies across the board to accelerate their digital transformation strategies and rethink their approach to data security due to remote working and increased data breaches.
SOC analysts overloaded, but role more important than ever (Help Net Security, Jan 12 2021)
Organizations are spending more to account for widespread security operation center (SOC) challenges including growing security management complexity, increasing analyst salaries, security engineering and management outsourcing costs, yet are still dissatisfied with the outcomes, Ponemon Institute and FireEye reveal.
SolarWinds: What Hit Us Could Hit Others (Krebs on Security, Jan 12 2021)
New research into the malware that set the stage for the megabreach at IT vendor SolarWinds shows the perpetrators spent months inside the company’s software development labs honing their attack before inserting malicious code into updates that SolarWinds then shipped to thousands of customers.
How security pros can prepare for a tsunami of new financial industry regs in 2021 (SC Media, Jan 14 2021)
Financial sector companies can expect to see a wave of new regulations and the restoration of Obama-era regs as the Biden administration takes office next week. Today’s columnist, Michael Magrath of OneSpan, pinpoints which regs security pros should focus on in the months ahead.
With insured losses at $90 billion, did cyber insurance firms dodge financial calamity? (SC Media, Jan 14 2021)
The number of SolarWinds victims will likely grow in the upcoming months, but direct insured costs should remain close to the current estimate since many of the organizations hit – particularly federal agencies – do not carry insurance against cyber risks.