Individuals at Risk
Cyber Privacy
Cyberattackers Hit Data of 80K Fertility PatientsP: Fertility Centers of Illinois’ security measures protected electronic medical records, but the attackers still got at extremely intimate data in admin files. ThreatPost, January 7, 2022
Hackers breached Florida health care system: (CNN)Hackers breached the computer networks of a southeast Florida health care system in October and may have accessed sensitive personal and financial information on over 1.3 million people, the health care system announced this week. CNN, January 4, 2022
Cyber Defense
5 ways hackers steal passwords (and how to stop them): From social engineering to looking over your shoulder, here are some of the most common tricks that bad guys use to steal passwords. WeLiveSecurity, January 5, 2022
Instagram and teens: A quick guide for parents to keep their kids safe: How can you help your kids navigate Instagram safely? Here are a few tips to help you protect their privacy on the app. WeLiveSecurity, January 4, 2022
Breaking the habit: Top 10 bad cybersecurity habits to shed in 2022: Be alert, be proactive and break these 10 bad habits to improve your cyber-hygiene in 2022. WeLiveSecurity, January 3, 2022
Cyber Warning
500M Avira Antivirus Users Introduced to Cryptomining: Many readers were surprised to learn recently that the popular Norton 360 antivirus suite now ships with a program which lets customers make money mining virtual currency. But Norton 360 isn’t alone in this dubious endeavor: Avira antivirus — which has built a base of 500 million users worldwide largely by making the product free — was recently bought by the same company that owns Norton 360 and is introducing its customers to a service called Avira Crypto. KrebsOnSecurity, January 8, 2022
Here’s the truth about the crypto miner that comes with Norton Antivirus: Some online accusations aren’t exactly correct, but that doesn’t mean it’s a good deal. TheVerge, January 7, 2022
FBI warns about ongoing Google Voice authentication scams: The Federal Bureau of Investigation (FBI) says Americans who share their phone number online are being targeted by Google Voice authentication scams. BleepingComputer, January 6, 2022
Google Docs Comments Weaponized in New Phishing Campaign: Attackers use the comment feature in Google Docs to email victims and lure them into clicking malicious links. DarkReading, January 6, 2022
Cyber Surveillance
US counterintelligence shares tips to block spyware attacks: The US National Counterintelligence and Security Center (NCSC) and the Department of State have jointly published guidance on defending against attacks using commercial surveillance tools. BleepingComputer, January 7, 2022
Cyber Humor
Cybersecurity in Society
Cyber Crime
FinalSite ransomware attack shuts down thousands of school websites: FinalSite, a leading school website services provider, has suffered a ransomware attack disrupting access to websites for thousands of schools worldwide. BleepingComputer, January 6, 2022
NY AG notifies 17 companies of breaches, says 1.1 million accounts compromised in attacks: New York Attorney General Letitia James released the findings of an investigation into credential stuffing. ZDNet, January 5, 2022
Kronos outage latest: Attackers crippled backup access: The attackers who crippled widely used applications from global HR software company Kronos disabled the company’s “ability to communicate with our back-up environments” owners UKG have confirmed – as the company continues to work on restoring customer data after regaining access to its backups. The Stack, January 5, 2022
Cyber Attack
Hackers Have Been Sending Malware-Filled USB Sticks to U.S. Companies Disguised as Presents: The “malicious USB stick” trick is old but apparently it’s still wildly popular with the crooks. Gizmodo, January 9, 2022
Cyber Surveillance
Polish leader admits country bought powerful Israeli spyware: WARSAW, Poland (AP) — Poland’s most powerful politician has acknowledged that the country bought advanced spyware from the Israeli surveillance software maker NSO Group, but denied that it was being used to target his political opponents. Yahoo, January 7, 2022
Rights group verifies Polish senator was hacked with spyware: WARSAW, Poland (AP) — Amnesty International said Thursday it has independently confirmed that powerful spyware from the Israeli surveillance software maker NSO Group was used to hack a Polish senator multiple times in 2019 when he was running the opposition’s parliamentary election campaign. AP News, January 6, 2022
Know Your Enemy
How ransomware gangs went pro: They’re developing new techniques ‘in every area’ says Darktrace. TheRegister, January 5, 2022
National Cybersecurity
Massive internet outages continue to sow confusion amid Kazakhstan protests: Nation-level internet traffic was cut off in Kazakhstan this week in the latest example of a petrostate trying to use shutdowns to quell protests and sow confusion. TheRecord, January 6, 2022
How the U.S. can be better prepared against cybersecurity threats: NPR’s Adrian Florido speaks with Susan Gordon, former Principal Deputy Director of National Intelligence, about why U.S. cybersecurity infrastructure is lacking and how to fix it. NPR, January 1, 2022
Cyber Regulation
FTC Threatens Action Against Orgs Failing to Mitigate Log4j: Consumer Protection Agency to ‘Use Legal Authority to Pursue Companies’. BankInfoSecurity, January 7, 2022
Disinformation
Sweden launches “Psychological Defence Agency” to combat misinformation: Sweden launched a new agency at the beginning of the year aimed at defending itself against disinformation, propaganda, and “psychological warfare.” TheRecord, January 7, 2022
Cyber Talent
Rethinking Cybersecurity Jobs as a Vocation Instead of a Profession: The prevailing mindset is that security practitioners are professionals, and thus, require a college degree. But there are some flaws in that logic. DarkReading, January 6, 2022
Connecting the dots on diversity in cybersecurity recruitment: Critical thinking and problem-solving are considered vital attributes for the cybersecurity professional — so it’s time our industry applied those capabilities to connect the dots between the skills shortage and lack of diversity. TechCrunch, January 3, 2022
Information Security Management for the Organization
Information Security Management
The Most Important Security Takeaway from the October Facebook Outage: The massive October 4th Facebook outage was not due to a breach and was not classified as a security issue. But the fact that it went down — and was inaccessible for an extended period — is itself a security concern that the enterprise must address. SecurityIntelligence, January 7, 2022
Log4j flaw hunt shows how complicated the software supply chain really is: A new analysis shows why the Log4j flaw for Java web applications will haunt tech people for years. ZDNet, January 6, 2022
NIST Cybersecurity Framework: A Quick Guide for SaaS Security Compliance: When I want to know the most recently published best practices in cyber security, I visit The National Institute of Standards and Technology (NIST). From the latest password requirements (NIST 800-63) to IoT security for manufacturers (NISTIR 8259), NIST is always the starting point. NIST plays a key role as a US standard-setter, due to the organization’s professionalism and the external experts who help to create NIST documents. The Hacker News, January 6, 2022
Active Directory security updates: What you need to know: These Active Directory updates address critical privilege bypass and elevation vulnerabilities. Implement them now if you can. CSO, January 5, 2022
Why CIOs Should Report to CISOs: If the CISO is responsible for the security of the organization, then that same person also should be responsible for both security and IT infrastructure. DarkReading, January 4, 2022
CISOs Plan What to Buy With Funds From the Infrastructure Bill: CISOs welcome the cybersecurity funding allocated under the Infrastructure Investment and Jobs Act, but say it’s not perfect because it doesn’t address a key issue: people. DarkReading, January 3, 2022
