News & Commentary
Content posted in September 2018
|
4 Traits of a Cyber-Resilient Culture
Companies with a solid track record of cybersecurity share these practices and characteristics.
'Torii' Breaks New Ground For IoT Malware
Stealth, persistence mechanism and ability to infect a wide swath of devices make malware dangerous and very different from the usual Mirai knockoffs, Avast says.
FBI IC3 Warns of RDP Vulnerability
Government agencies remind users that RDP can be used for malicious purposes by criminal actors.
Facebook Hacked, 50 Million Users Affected
A vulnerability in Facebook's "View As" feature let attackers steal security tokens linked to 50 million accounts, the company confirms.
How Data Security Improves When You Engage Employees in the Process
When it comes to protecting information, we can all do better. But encouraging a can-do attitude goes a long way toward discouraging users' risky behaviors.
7 Most Prevalent Phishing Subject Lines
The most popular subject lines crafted to trick targets into opening malicious messages, gleaned from thousands of phishing emails.
Russia's Sednit Deploys First Firmware-Level Rootkit in the Wild
The advanced persistent threat group's LoJax can install malware capable of surviving both OS reinstallation and hard disk replacement.
Ransomware Attack Hits Port of San Diego
The attack began Monday and continues to have an impact on services at the port.
How to Keep Up Security in a Bug-Infested World
Good digital hygiene will lower your risk, and these six tips can help.
Twitter Bug May Have Exposed Millions of DMs
The year-long bug could have compromised interactions between customers and businesses, the social media firm reports.
Security Flaw Found in Apple Mobile Device Enrollment Program
Authentication weakness in Apple's DEP could open a window of opportunity for attackers.
Alphabet's Chronicle Releases VirusTotal Enterprise
Chronicle, the cybersecurity business under Alphabet, releases a major update to VirusTotal geared toward corporate threat hunters.
Managing Data the Way We Manage Money
In the data-driven enterprise, myriad types of data have become a new form and flow of currency. Why, then, hasn't the CISO achieved parity with the CFO?
Google to Let Users Disable Automatic Login to Chrome
The decision comes days after security researcher had blasted company for jeopardizing user privacy with browser update.
Critical Linux Kernel Flaw Gives Root Access to Attackers
All versions of Red Hat Enterprise Linux, CentOS vulnerable to 'Mutagen Astronomy' flaw, according to Qualys.
Inside Microsoft Azure Sphere
Microsoft engineer details how the company's IoT security solution operates - at multiple layers starting with the microcontroller.
Uber Agrees to Pay $148 Million in Nationwide Settlement
Ride-sharing company settles legal cases with 50 states and the District of Columbia for its handling of 2016 data breach.
VPNFilter Evolving to Be a More Dangerous Threat
VPNFilter malware is adding capabilities to become a more fully-featured tool for threat actors.
SEC Slams Firm with $1M Fine for Weak Security Policies
This is the first SEC enforcement cracking down on violation of the Identity Theft Red Flags Rule, intended to protect confidential data.
A 'Cyber Resilience' Report Card for the Public Sector
Government agencies are making great strides in defending themselves against cyberattacks, according to new research from Accenture. But technology alone won't solve the problem.
Owning Security in the Industrial Internet of Things
Why IIoT leaders from both information technology and line-of-business operations need to join forces to develop robust cybersecurity techniques that go beyond reflexive patching.
Mirai Authors Escape Jail Time – But Here Are 7 Other Criminal Hackers Who Didn't
Courts are getting tougher on the cybercrooks than some might realize.
USB Drives Remain Critical Cyberthreat
USB thumb drives may be used less frequently than before, but they are still commonly used as infection vectors for a wide variety of malware.
Ex-NSA Developer Gets 5 1/2-Year Prison Sentence
Nghia Hoang Pho, who illegally took home classified NSA information, also sentenced to three years of supervised release after prison term.
The Cyber Kill Chain Gets a Makeover
A new report demonstrates how the cyber kill chain is consolidating as criminals find ways to accelerate the spread of their targeted cyberattacks.
Cryptomining Malware Continues Rapid Growth: Report
Cryptomining malware is the fastest-growing category of malicious software, according to a new report.
The Cloud Security Conundrum: Assets vs. Infrastructure
The issue for cloud adopters is no longer where your data sits in AWS, on-premises, Azure, Salesforce, or what have you. The important questions are: Who has access to it, and how is it protected?
Payment Security Compliance Takes a Turn for the Worse
This is the first time in six years that Verizon's "Payment Security Report" shows a downward trend, leaving cardholders vulnerable.
The Human Factor in Social Media Risk
Your employees need help recognizing the warning signs and understanding how to protect themselves online.
Fault-Tolerant Method Used for Security Purposes in New Framework
A young company has a new patent for using fault tolerance techniques to protect against malware infection in applications.
In Quiet Change, Google Now Automatically Logging Users Into Chrome
The change is a complete departure from Google's previous practice of keeping sign-in for Chrome separate from sign-ins to any Google service.
Microsoft Deletes Passwords for Azure Active Directory Applications
At Ignite 2018, security took center stage as Microsoft rolled out new security services and promised an end to passwords for online apps.
6 Dark Web Pricing Trends
For cybercriminals, the Dark Web grows more profitable every day.
'Scan4you' Operator Gets 14-Year Sentence
The counter antivirus service, which was shut down in 2016, caused a total loss amount of $20.5 billion, according to the DoJ.
Hacking Back: Simply a Bad Idea
While the concept may sound appealing, it's rife with drawbacks and dangers.
The 'Opsec Fail' That Helped Unmask a North Korean State Hacker
How Park Jin Hyok – charged by the US government for alleged computer crimes for the Sony, Bank of Bangladesh, WannaCry cyberattacks – inadvertently blew his cover via email accounts.
Romanian Hacker Pleads Guilty for Role in Inauguration Surveillance Ransomware
Attack against the Metropolitan Police Department was disrupted before malware could be sent to additional systems.
6 Security Training Hacks to Increase Cyber IQ Org-Wide
Move beyond generic, annual security awareness training with these important tips.
US Approves Cyber Weapons Against Foreign Enemies
The White House is changing the rules on its use of digital weapons to fight adversaries targeting US networks.
Data Manipulation: How Security Pros Can Respond to an Emerging Threat
Industry leaders are scrambling to address the issue, which will take new thinking to overcome.
Executive Branch Makes Significant Progress As DMARC Deadline Nears
The DHS directive on email security has an approaching deadline that most departments in the executive branch might actually meet.
Think Like An Attacker: How a Red Team Operates
Seasoned red teamers explain the value-add of a red team, how it operates, and how to maximize its effectiveness.
Retail Sector Second-Worst Performer on Application Security
A "point-in-time" approach to PCI compliance could be one reason why so many retailers appear to be having a hard time.
Account Takeover Attacks Become a Phishing Fave
More than three-quarters of ATOs resulted in a phishing email, a new report shows.
3 Drivers Behind the Increasing Frequency of DDoS Attacks
What's causing the uptick? Motivation, opportunity, and new capabilities.
Japanese Cryptocurrency Exchange Hit with $60M Theft
The incident highlights a broader problem of poor security in cryptocurrency exchanges throughout the country.
Turn the NIST Cybersecurity Framework into Reality: 5 Steps
Actionable advice for tailoring the National Institute of Standards and Technology's security road map to your company's business needs.
NSS Labs Files Antitrust Suit Against Symantec, CrowdStrike, ESET, AMTSO
Suit underscores longtime battle between vendors and labs over control of security testing protocols.
Cryptojackers Grow Dramatically on Enterprise Networks
A new report shows that illicit cryptomining malware is growing by leaps and bounds on the networks of unsuspecting victims.
As Tech Drives the Business, So Do CISOs
Security leaders are evolving from technicians to business executives as tech drives enterprise projects, applications, and goals.
|
White Papers
Video
1 Comments
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: Could you pass the hash, I really have to use the bathroom!
Latest Comment: Could you pass the hash, I really have to use the bathroom!
Current Issue
Building and Managing an IT Security Operations ProgramAs cyber threats grow, many organizations are building security operations centers (SOCs) to improve their defenses. In this Tech Digest you will learn tips on how to get the most out of a SOC in your organization - and what to do if you can't afford to build one.
Flash Poll
How Enterprises Are Developing Secure Applications
IT security and application development are disparate processes that are increasingly coming together. Here's a look at how that's happening.
Twitter Feed
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database CVE-2019-6513
PUBLISHED: 2019-05-21
PUBLISHED: 2019-05-21
PUBLISHED: 2019-05-21
PUBLISHED: 2019-05-21
PUBLISHED: 2019-05-21
From DHS/US-CERT's National Vulnerability Database CVE-2019-6513
PUBLISHED: 2019-05-21
An issue was discovered in WSO2 API Manager 2.6.0. It is possible for a logged-in user to upload, as API documentation, any type of file by changing the extension to an allowed one.
CVE-2019-12270PUBLISHED: 2019-05-21
OpenText Brava! Enterprise and Brava! Server 7.5 through 16.4 configure excessive permissions by default on Windows. During installation, a displaylistcache file share is created on the Windows server with full read and write permissions for the Everyone group at both the NTFS and Share levels. The ...
CVE-2019-12269PUBLISHED: 2019-05-21
Enigmail before 2.0.11 allows PGP signature spoofing: for an inline PGP message, an attacker can cause the product to display a "correctly signed" message indication, but display different unauthenticated text.
CVE-2019-12189PUBLISHED: 2019-05-21
An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3. There is XSS via the SearchN.do search field.
CVE-2019-12190PUBLISHED: 2019-05-21
XSS was discovered in CentOS-WebPanel.com (aka CWP) CentOS Web Panel through 0.9.8.747 via the testacc/fileManager2.php fm_current_dir or filename parameter.
- Terms of Service
- Privacy Statement
- Legal Entities
- Copyright © 2019 UBM, All rights reserved
Tweet This