SecureTheVillage Calendar
Invitational Cybersecurity Workforce Workshop — Linking Supply & Demand December 15 @ 10:00 am – 12:00 pm PST
Insurance Brokers Cybersecurity Roundtable: : Help Your Customers Better Understand Information Security Management…A Key to Increased Cyber Insurance Sales Dr. Stan Stahl, PhD. December 15 @ 2:00 pm – 3:00 pm PST
Financial Services Cybersecurity Roundtable: A Conversation on Cyber Crime with Deputy D.A. Ryan Tracy. December 2020 December 18 @ 8:00 am – 10:00 am PST
Dr. Steve Krantz Webinar: Personal Cybersecurity January 12, 2021 @ 1:00 pm – 3:00 pm PST
Dr. Steve Krantz Webinar: Become A CyberGuardian January 14, 2021 @ 12:30 pm – 2:00 pm PST
Information Security Management Webinar: Ask the Lawyer: Updates on the Evolving Security and Privacy Legal Landscape with Jordan Fischer. January 14, 2021 @ 10:00 am – 11:00 am PST
Individuals at Risk
Cyber Warning
Microsoft Warns Of New Malware That Wants To Infect Your Browser: Security experts at Microsoft have been tracking a new malware campaign that’s targeting Windows computers. It’s already claimed tens of thousands of victims and hijacked their web browsers. Forbes, December 11, 2020
Cyber Update
Patch Tuesday, Good Riddance 2020 Edition: Microsoft today issued its final batch of security updates for Windows PCs in 2020, ending the year with a relatively light patch load. Nine of the 58 security vulnerabilities addressed this month earned Microsoft’s most-dire “critical” label, meaning they can be abused by malware or miscreants to seize remote control over PCs without any help from users. KrebsOnSecurity, December 8, 2020
Cyber Humor
Information Security Management for the Organization
Information Security Management
Stop Wasting Money On Cybersecurity: This challenging and remarkable year is nearly over, and it’s time to get serious about 2021 security planning. Meaningful shifts in user access and technologies away from the on-premises infrastructure due to widespread remote working has accelerated cloud and SaaS adoption. An environment of unpredictability is also causing financial teams to tighten their belts to prepare for the unknowns of the year ahead. Forbes, December 11, 2020
Lessons for Crisis PR from Breach of CyberSecurity Firm FireEye: The news this week of FireEye’s security breach was the talk of Twitter, especially among national and information security experts. FireEye is one of the largest cybersecurity companies in the U.S. Its client roster includes some of the nation’s most prominent companies and government agencies. But unlike the hot takes and shaming normally found on social media after a breach, overriding sentiment in FireEye’s case was drastically different. Experts commended the company’s empathetic and transparent response. Moreover, this positive development was not surprising. PR Newswire, December 11, 2020
Following FireEye Hack, Ensure These 16 Bugs Are Patched: Hunters Could Become the Hunted After Theft of Cybersecurity Firm’s Hacking Tools. BankInfoSecurity, December 10, 2020
Cyber Warning
This new ransomware is growing in strength and could become a major threat warn researchers: The group behind MountLocker ransomware are “clearly just warming up”, say researchers. ZDNet, December 11, 2020
Cyber Insurance
As Ransomware Booms, Are Cyber Insurers Getting Cold Feet?: Expect to See Extortion and Social Engineering Attacks Excluded From More Policies. BankInfoSecurity, December 8, 2020
Cybersecurity in Society
Cyber Crime
EU Vaccine Agency Victim of Cyberattack: The head of the European Union’s medical agency confirmed Friday it had been the subject of a cyberattack for the past two weeks but said it will not impact its ongoing evaluation of COVID-19 vaccines. Voice of America, December 11. 2020
Payment Processing Giant TSYS: Ransomware Incident “Immaterial” to Company: Payment card processing giant TSYS suffered a ransomware attack earlier this month. Since then reams of data stolen from the company have been posted online, with the attackers promising to publish more in the coming days. But the company says the malware did not jeopardize card data, and that the incident was limited to administrative areas of its business. KrebsOnSecurity, December 10, 2020
Vendor ransomware attack disrupts DSW’s inventory management: DSW’s e-commerce site lost access to store inventories when a software vendor suffered a ransomware attack during the last two weeks of Q3, Roger Rawlins, CEO of the retailer’s parent company Designer Brands, said on a Wednesday earnings call. Supply Chain Dive, December 10, 2020
Hackers accessed vaccine documents in cyber-attack on EMA: Papers relating to Pfizer/BioNTech vaccine reportedly targeted in attack on European Medicines Agency. The Guardian, December 10, 2020
Misery of Ransomware Hits Hospitals the Hardest: Ransomware attacks targeting hospitals have exacted a human cost as well as financial. ThreatPost, December 10, 2020
PLEASE_READ_ME Ransomware Attacks 85K MySQL Servers: Ransomware actors behind the attack have breached at least 85,000 MySQL servers, and are currently selling at least compromised 250,000 databases. ThreatPost, December 10, 2020
NetGain takes data centers offline following ransomware attack: Data centers have been taken down as a ‘protective measure’. DataCenter Dynamics, December 9, 2020
FireEye, a Top Cybersecurity Firm, Says It Was Hacked by a Nation-State: The Silicon Valley company said hackers — almost certainly Russian — made off with tools that could be used to mount new attacks around the world. The New York Times, December 8, 2020
Data breach at Finnish psychotherapy center takes a darker turn with extortion attempts: The response to a data breach at a prominent Finnish psychotherapy practice intensified over the weekend after cybercriminals reportedly posted batches of patient information on the dark web and claimed that individual people could protect their data by directly paying a ransom. CyberScoop, October 26, 2020
Cyber Surveillence
Huawei worked on several surveillance systems promoted to identify ethnicity. Documents show the tech giant has worked with others to build products touted as capable of identifying ethnicity: Huawei has worked with dozens of security contractors to develop surveillance products, some of which were touted as being able to identify a person’s ethnicity or to help suppress potential protests, according to company marketing documents that shed light on a little-publicized corner of one of China’s most valuable tech empires. The Washington Post, December 12, 2020
Cyber Privacy
The Smoking Gun in the Facebook Antitrust Case: The government wants to break up the world’s biggest social network. Internal company emails show why. Wired, December 9, 2020
Cyber Defense
Facebook links APT32, Vietnam’s primary hacking group, to local IT firm: Facebook suspends accounts linked to APT32, says the group used its platform to spread malware. ZDNet, December 11, 2020
Unprecedented study details state of cybersecurity preparedness in Indiana: BLOOMINGTON, Ind. — According to a new survey of more than 300 public and private organizations across Indiana, nearly one-fifth said they had experienced a cyberattack in the past three years. Indiana University, December 8, 2020
Cyber Freedom
Top election security official to leave federal cybersecurity agency: Matthew Masterson, the senior election security advisor at the Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency (CISA), will depart the agency, a move that comes just weeks after President Trump fired the agency’s director. TheHill, December 10, 2020
Former Cybersecurity Chief Sues Trump Campaign and Others, Charging Defamation: Christopher Krebs, who was fired by President Trump last month after asserting the recent presidential election was “the most secure in American history,” filed suit Tuesday against the Trump campaign, attorney Joseph diGenova and the cable channel Newsmax. NPR, December 8, 2020
A National Cybersecurity Agenda for Resilient Digital Infrastructure: In 1858, a public health crisis gripped the city of London. Successive cholera outbreaks spread by contaminated water were killing thousands. The river Thames was so polluted that Parliament refused to meet. As London’s population exploded, no one had invested in the basic wastewater infrastructure necessary to manage the consequences of cramming millions of people into one of the world’s first metropolises. After decades of failing to safeguard access to clean water, the government finally embarked on an unprecedented civil works project to retrofit the entire city with its first sewer system. Aspen Institute, 2020
National Cybersecurity
A better kind of cybersecurity strategy … New model shows why countries that retaliate too much against online attacks make things worse for themselves: During the opening ceremonies of the 2018 Winter Olympics, held in PyeongChang, South Korea, Russian hackers launched a cyberattack that disrupted television and internet systems at the games. The incident was resolved quickly, but because Russia used North Korean IP addresses for the attack, the source of the disruption was unclear in the event’s immediate aftermath. MIT, December 10, 2020
Cyber Regulation
How Facebook Tried to Make Itself Antitrust-Proof: The company has been preparing for war with regulators for years. Slate, December 9, 2020
HIPAA
HHS floats major changes to HIPAA Privacy Rule: The new proposed rule would “break down barriers that have stood in the way of commonsense care coordination and value-based arrangements for far too long,” says HHS Secretary Alex Azar. HealthCareITNews, December 10, 2020
Cyber Warning
CISA and FBI warn of rise in ransomware attacks targeting K-12 schools: The percentage of ransomware attacks against K-12 schools increased at the beginning of the 2020 school year. ZDNet, December 11, 2020
Cyber Talent
SIGNAL Kids Magazine Explores Cybersecurity: Fairfax, VA, Dec. 11, 2020 (GLOBE NEWSWIRE) — Strengthening the future technical workforce depends on motivating children at a young age to follow a science, technology, engineering and technology (STEM) learning path. This year, efforts to encourage future innovators and entrepreneurs especially is important as more children ages 8 to 12 find themselves in virtual classrooms. GlobalNewswire, December 11, 2020
Cyber Misc
Zodiac ‘340 Cipher’ cracked by code experts 51 years after it was sent to the S.F. Chronicle: The solution to what’s known as the 340 Cipher, one of the most vexing mysteries of the Zodiac Killer’s murderous saga, has been found by a code-breaking team from the United States, Australia and Belgium. SF Chronicle, December 11, 2020
