Individuals at Risk
Cyber Privacy
Clubhouse Joins Facebook and LinkedIn as Target of Data Scraping; Cumulative One Billion User Profiles Have Been Leaked: Hot on the heels of high-profile data scraping incidents at Facebook and LinkedIn that compromised hundreds of millions of accounts, the personal information of about 1.3 million users of social media darling Clubhouse has been found posted to a hacker forum. CPO, April 16, 2021
ParkMobile Breach Exposes License Plate Data, Mobile Numbers of 21M Users: Someone is selling account information for 21 million customers of ParkMobile, a mobile parking app that’s popular in North America. The stolen data includes customer email addresses, dates of birth, phone numbers, license plate numbers, hashed passwords and mailing addresses. KrebsOnSecurity, April 12, 2021
No password required: Mobile carrier exposes data for millions of accounts: Q Link Wireless made data available to anyone who knows a customer’s phone number. ars technica, April 9, 2021
Cyber Defense
One in six people use pet’s name as password: Other common and easily hackable password choices include the names of relatives and sports teams, a UK study reveals. WeLiveSecurity, April 15, 2021
Cyber Update
Microsoft Patch Tuesday, April 2021 Edition: Microsoft today released updates to plug at least 110 security holes in its Windows operating systems and other products. The patches include four security fixes for Microsoft Exchange Server — the same systems that have been besieged by attacks on four separate (and zero-day) bugs in the email software over the past month. Redmond also patched a Windows flaw that is actively being exploited in the wild. KrebsOnSecurity, April 13, 2021
Cyber Humor
Information Security Management for the Organization
Cybersecurity in the C-Suite & Board
What Is Information Security Governance and Why Is It Important?: Cyberattacks and threats are among the most vital concerns which affect most organizations worldwide. There is visibly an increase in the number of cyberattacks, and vast volumes of confidential and sensitive data have been compromised as a result. Cybersecurity has often been a misconception being viewed only as a technical problem, but the actual solution is entirely dependent upon good information security governance. Information security governance is the process of how organizations monitor, handles, and controls Information security. EC-Council, April 16, 2021
A Boardroom And CEO Cheat Sheet On Chaos And Systemic Risk: We can all get back to our lives now that the giant container ship blocking the Suez Canal is floating again. There’s a lesson in the Suez Canal story for the boardroom and CEOs that extends well beyond the issue of global trade. Bob Zukis, Digital Directors Network, Forbes, March 30, 2021
Information Security Management
Ransomware Attacks in 2021: Information Meets Emotion: “If you want to go quickly, go alone, but if you want to go far, go together.” SecurityIntelligence, April 16, 2021
Combating Sleeper Threats With MTTD: During the SolarWinds Orion supply chain compromise, threat actors lurked in the victim’s network for more than a year. Discovered by FireEye in December 2020, the earliest traces of a modified SolarWinds Orion go back as early as October 2019. SecurityIntelligence, April 16, 2021
How to Design and Roll Out a Threat Model for Cloud Security: Today’s cloud security requires a new way of looking at threat models. Making a threat model can support your security teams before problems start. It helps them develop a strategy for handling existing risks, instead of detecting incidents at a later stage. Let’s walk through how to create a threat model that works for your cloud landscape. SecurityIntelligence, April 15, 2021
The Evolution of Ransomware: Four Predictions to Shape Your Security Strategy: With ransomware on a trajectory to inflict more than $20B in economic damage in 2021, it’s clear that encrypting and exfiltrating data is a big business. Cybercriminals proved throughout the pandemic that they will go after the most resource-constrained segments of our societal infrastructure to line their wallet. CPO, April 13, 2021
THE CISO AS A CHOICE ARCHITECT: A CONVERSATION WITH MALCOLM HARKINS: Malcolm Harkins is well-known in information security circles. Early in his career at Intel, Harkins held positions in finance and procurement before moving into information security roles. After serving as Intel’s chief information security officer (CISO) for seven years, he became the company’s first Vice President and Chief Security and Privacy Officer (CSPO), responsible for managing the risk, controls, privacy, security, and compliance activities for all of Intel’s information assets, products, and services. Harkins left Intel in 2015, taking the chief security and trust officer position at Cylance. He’s currently the chief security and trust officer for Cymatic, a board member and advisor to other companies, and an executive coach to CISOs and others in information risk roles. The second edition of his book “Managing Risk and Information Security: Protect to Enable” was published in 2016. A frequent speaker and contributor to several publications, Harkins continues to focus on driving security industry accountability and the ethics around technology risk, social responsibility, and the total cost of controls. Rain Capital, August 13, 2021
Secure The Human
Cybersecurity training lags, while hackers capitalize on COVID-19: They say crime doesn’t pay. But when we’re talking about cybercrime, the numbers tell a different story. Damages relating to cybercrime are expected to reach a value of $6 trillion in 2021 alone. And with the rise of remote work due to the COVID-19 pandemic, companies are in hackers’ crosshairs more than ever before. TalentLMS, April 6, 2021
Cyber Insurance
What to consider when shopping for cyber insurance: Cyber insurance is gaining favor in the business world. An expert offers tips on how to get what’s needed for the best price. TechRepublic, April 16, 2021
Cybersecurity in Society
Cyber Crime
How Fraudsters Nearly Stole $17.5 Million via PPE Fraud: 4 Dutch and Nigerian Suspects Accused of Scamming German Health Authority. Bank Info Security, April 14, 2021
Cyber Privacy
Microsoft releases biannual reports on digital trust: The reports reveal an increase in requests from U.S. law enforcement agencies, and that the company received the most requests for content removal from China during this period. TechRepublic, April 16, 2021
Cyber Defense
Cyber nonprofits ask billionaire philanthropists to show them some love: A contingent of leading cybersecurity organizations and nonprofits — including SecureTheVillage — published an open letter on Friday, calling for large philanthropic foundations and internet billionaires to consider donating to their causes, citing a paucity of available grants and funds. SC Magazine, April 16, 2021
Google Project Zero testing 30-day grace period on bug details to boost user patching: After trying to get vendors to produce updates to fix vulnerabilities quicker, Project Zero is trying an explicit patch period. ZDNet, April 16, 2021
The FBI is remotely hacking hundreds of computers to protect them from Hafnium: They went inside unprotected computers to remove the threat The Verge, April 13, 2021
Know Your Enemy
How the Kremlin provides a safe harbor for ransomware: In the U.S. alone last year, ransomware struck more than a hundred federal, state and municipal agencies, upward of 500 hospitals and other health care centers. NBC, April 16, 2021
The Many Faces of Malware: A Tour of Real-World Samples: Most people never come face-to-face with malware, but having tested security software at PCMag for decades, I’m not most people. Let’s take a deep dive into the dark web to see what malware actually looks like. PC Mag, April 16, 2021
National Cybersecurity – Solar Winds
Did Someone at the Commerce Dept. Find a SolarWinds Backdoor in Aug. 2020?: On Aug. 13, 2020, someone uploaded a suspected malicious file to VirusTotal, a service that scans submitted files against more than five dozen antivirus and security products. Last month, Microsoft and FireEye identified that file as a newly-discovered fourth malware backdoor used in the sprawling SolarWinds supply chain hack. An analysis of the malicious file and other submissions by the same VirusTotal user suggest the account that initially flagged the backdoor as suspicious belongs to IT personnel at the National Telecommunications and Information Administration (NTIA), a division of the U.S. Commerce Department that handles telecommunications and Internet policy. KrebsOnSecurity, April 16, 2021
Biden makes good on his promise to punish Russia for the massive SolarWinds hack: America has officially blamed the Russian government for the hack of multiple federal agencies. Vox, April 15, 2021
National Cybersecurity
The SolarWinds Hack Is Just the Beginning: The United States Must Learn to Live With Cyber-Espionage. Foreign Affairs, April 16, 2021
NSA: 5 Security Bugs Under Active Nation-State Cyberattack: Widely deployed platforms from Citrix, Fortinet, Pulse Secure, Synacor and VMware are all in the crosshairs of APT29, bent on stealing credentials and more. ThreatPost, April 16, 2021
Cyber Regulation
Cybersecurity: New DOL Guidance for Retirement Plans: As part of its efforts to protect an estimated $9.3 trillion in retirement plan assets from increasing “internal and external cybersecurity threats,” the Department of Labor (DOL) has issued its first guidance ever concerning cybersecurity and retirement plans. The guidance is intended for three interested groups with a stake in retirement plan administration: the sponsors and fiduciaries of retirement plans; the entities providing administrative and other services to retirement plans; and plan participants and beneficiaries. JD Supra, April 16, 2021
Internet of Things
New Tripwire Survey: IoT Security Still in Shambles, Most Security Pros Struggling To Make Devices Fit Safely Into Business Networks: The “Internet of Things” has been plagued by serious design-level security issues since the term was coined some two decades ago. One would hope that progress was at least being made given that there are now an estimated tens of billions these devices online and billions more are projected to be added each year. Unfortunately, a new report from Tripwire indicates that security is not keeping pace with this growth. The report finds that IoT security is a major issue at nearly every company; 99% of respondents say that their IoT devices pose security challenges, and over 75% report problems fitting these devices into their present security approach. CPO, April 15, 2021
Cyber Enforcement
The FBI wanted to unlock the San Bernardino shooter’s iPhone. It turned to a little-known Australian firm.: Azimuth unlocked the iPhone at the center of an epic legal battle between the FBI and Apple. Now, Apple is suing the company co-founded by one of the hackers behind the unlock. The Washington Post, April 14, 2021
