"Digital storage detection police dogs" Rob (left) and Tweed were used to search suspects' homes for hidden storage devices, police say. (Photos: Devon & Cornwall Police)

Police Arrest 6 in $28 Million Cryptocurrency Fraud Probe

Mathew J. Schwartz • June 26, 2019

Six suspects have been arrested as part of a 14-month international police probe into the theft of at least $28 million worth of bitcoin cryptocurrency from more than 4,000 victims in at least 12 countries. Investigators say attackers appear to have "typosquatted" legitimate bitcoin exchange sites.

Governance

GAO: After Equifax Breach, KBA No Longer Effective

Latest

Cybercrime

Insurer: Breach Undetected for Nine Years

Marianne Kolbasuk McGee • June 26, 2019

A dental and vision insurer's revelation that it recently discovered a 9-year-old data security incident offers an extreme example of the difficulty some organizations have in detecting data breaches.

Business Continuity Management / Disaster Recovery

Second Florida City Pays Up Following Ransomware Attack

Scott Ferguson • June 26, 2019

A second small city in Florida is paying off cybercriminals to recover from a ransomware attack that crippled the municipality's local network. How much did Lake City agree to pay, and how much of that was covered by insurance?

Encryption & Key Management

Sen. Wyden Asks NIST to Develop Secure File Sharing Standards

Scott Ferguson • June 25, 2019

U.S. Sen. Ron Wyden, D-Ore., is urging the National Institute of Standards and Technology to create new standards and guidelines for individuals and organizations to securely share sensitive documents online. He contends current security measures are inadequate.

General Data Protection Regulation (GDPR)

GDPR: Where Do We Go From Here?

Mathew J. Schwartz • June 25, 2019

Even though the EU's General Data Protection Regulation has been in effect for more than a year, it's no privacy panacea, says (TL)2 Security founder Thom Langford. While GDPR has reframed the global privacy discussion, room for improvement remains, he explains in this interview.

Application Security

Reinventing Application Security

Nick Holland • June 25, 2019

Bob Egner of Outpost24 discusses the challenges involved in improving application security and whether DevSecOps is a "silver bullet."

Governance

Risk and Resilience: Finding the Right Balance

Mathew J. Schwartz • June 25, 2019

Finding the right balance between risk and resilience is a challenge for every cybersecurity project - especially in the aerospace, space and defense sectors - and that's why such efforts must be driven by CISOs and CIOs, says Leonardo's Nik Beecher.

Breach Notification

Identity as a Game-Changing Breach Defense

Information Security Media Group • June 25, 2019

Often in breach response, security professionals focus on the technical aspects of the attack. Yet, the non-technical aspects are often more insidious, says Teju Shyamsundar of Okta. And Identity can be a powerful tool to bolster defenses.

Cybercrime

Alleged AlphaBay Moderator Faces Racketeering Charge

Scott Ferguson • June 24, 2019

An alleged moderator of the AlphaBay underground marketplace has been indicted for facilitating sales on the darknet site before law enforcement shut it down.

3rd Party Risk Management

Developing a Robust Third-Party Risk Management Program

Suparna Goswami • June 24, 2019

Too many organizations around the world take a "bare minimum" approach to third-party risk management, says Jonathan Ehret, founder of the Third Party Risk Association, who offers risk mitigation insights.

Cybercrime

Hacked With Words: Email Attack Sophistication Surges

Mathew J. Schwartz • June 21, 2019

The early days of email attacks - so much noise in the form of malware, spam and links - have given way to attacks that often rely on little more than words, and email gateways often struggle to arrest social engineering ploys, says Michael Flouton of Barracuda Networks.

Fraud Management & Cybercrime

Life Beyond Blocking: Adopting Behavior-Based Cybersecurity

Mathew J. Schwartz • June 21, 2019

Many cybersecurity tools are designed to block or allow specific activities based on prescribed rules, but with insider breaches continuing, enterprise protection also requires real-time reaction to actual user behavior, says Carl Leonard of Forcepoint.

Privileged Access Management

Privileged Attack Vectors: Key Defenses

Mathew J. Schwartz • June 21, 2019

Attackers crave insider-level access to IT infrastructure and regularly target insiders - and especially administrators- to steal their credentials, says BeyondTrust's Karl Lankford, who advises organizations to ensure they manage, monitor and audit all privileged access.