Latest

General Data Protection Regulation (GDPR)

Fresh Privacy Legislation Would Jail CEOs for Violations

Suparna Goswami  •  October 18, 2019

New legislation introduced by Sen. Ron Wyden, D-Ore., would "bring meaningful punishments for companies that violate people's data privacy, including larger fines and potential jail time for CEOs," he says. But can Congress agree on a privacy law?

Fraud Management & Cybercrime

Healthcare E-Commerce Site Breach Undetected for Years

Marianne Kolbasuk McGee  •  October 18, 2019

A North Carolina-based healthcare organization has reportedly discovered that malicious code had been contained on its e-commerce site for three years, sending consumers' payment information to unauthorized individuals.

Fraud Management & Cybercrime

Russia-Linked Cyber Espionage Group APT29 Remains Active

Apurva Venkat  •  October 18, 2019

While the Russian-linked hacking group known as The Dukes, Cozy Bear and APT29 in recent years appeared to have gone somewhat quiet, researchers from ESET report that the hackers have been targeting various European embassies and ministries as part of what the security firm dubs "Operation Ghost."

Cybercrime

Darknet Markets: As Police Crack Down, Cybercriminals Adapt

Nick Holland  •  October 18, 2019

The latest edition of the ISMG Security Report discusses the shutdown of DeepDotWeb. Plus, dealing with breach fatigue and the Pitney Bowes ransomware attack.

Cybercrime

Phorpiex Botnet Behind Large-Scale 'Sextortion' Campaign

Apurva Venkat  •  October 17, 2019

Scammers are using the notorious Phorpiex botnet as part of an ongoing "sextortion" scheme, according to Check Point researchers. At one point, the botnet was sending out over 30,000 spam emails an hour and the attackers made about $110,000 in five months, researchers say.

Fraud Management & Cybercrime

Domain 'Typosquatting' Hits 2020 US Elections

Jeffrey Burt  •  October 17, 2019

At least 550 fraudulent domains have been aimed at users who accidentally mistype the URL for a political candidate or election-related group, warn researchers at Digital Shadows. While many of these "typosquatting" domains appear to be relatively harmless, some could be more nefarious.

3rd Party Risk Management

Robotic Process Automation: Security Essentials

Suparna Goswami  •  October 17, 2019

Robotic process automation aims to use machine learning to create bots that automate high-volume, repeatable tasks. But as organizations tap RPA, they must ensure they take steps to maintain data security, says Deloitte's Ashish Sharma.

Application Security

How 'Zero Trust' Better Secures Applications and Access

Jeremy Kirk  •  October 17, 2019

Organizations are accepting that the network perimeter no longer serves as the "ultimate defense" and thus adapting zero-trust principles, including least privilege, based on the understanding that they may already have been compromised, says Darran Rolls of SailPoint.

Business Continuity Management / Disaster Recovery

Ransomware Attacks: STOP, Dharma, Phobos Dominate

Mathew J. Schwartz  •  October 16, 2019

Ransomware is once again the most common illicit profit-making tool in online attackers' arsenal, police warn. Security firm Emsisoft says the most-seen strains in recent months include STOP, Dharma .cezar, Phobos, GlobeImposter 2.0 and Sodinokibi. Less widely seen Ryuk also continues to generate big profits.

Cybercrime

'Silent Librarian' Revamps Phishing Campaign: Proofpoint

Apurva Venkat  •  October 16, 2019

"Silent Librarian," a hacking group with apparent ties to the Iranian government, is continuing to revamp and refine its phishing techniques as it targets research universities in the U.S. and Europe in an attempt to steal intellectual property, according to the security firm Proofpoint.

Blockchain & Cryptocurrency

Phony Company Used to Plant macOS Malware: Report

Apurva Venkat  •  October 16, 2019

Security researchers have found that a hacking group, which may have North Korean ties, recently created a phony company offering a cryptocurrency exchange platform as a step toward planting malware on the macOS devices of employees of cryptocurrency exchanges.

CISO Trainings

The Ultimate Missing Link in Cyber: Continuous Compromise Assessment

Information Security Media Group  •  October 16, 2019

According to Ricardo Villadiego, Lumu Technologies' Founder and CEO, organizations are "sitting on a gold mine: their own data". Under the single premise that organizations should assume they are compromised and prove otherwise, Lumu seeks to empower enterprises to answer the most basic question: Is your organization...