SecureTheVillage Calendar
TownHallWebinar: Cybersecurity & Content Protection Virtual Summit from CDSA (Content Delivery & Security Association). May 12 @ 10:00 am – 1:00 pm PDT
TownHallWebinar: Ransomware: To Pay or Not to Pay from the Cyber Readiness Institute. May 13 @ 11:00 am – 12:00 pm EDT
TownHallWebinar: The Law on ESI Spoliation Sanctions, Complimentary CLE Webinar from Leadership Council Member Driven. May 13 @ 2:00 pm – 3:00 pm
TownHallWebinar: Securing Your Home and Family (Part 1). May 14 @ 10:00 am – 11:00 am
TownHallWebinar: Tips and Tools for Securing a Remote Workforce from the Cyber Readiness Institute. May 14 @ 8:00 pm – 9:00 pm EDT
Personal Cyber Security with Dr. Steve Krantz, May 26 @ 1:00 pm – 2:30 pm Calabasas Senior Center Calabasas, CA
Financial Services Cybersecurity Roundtable: Current Financial Services Threat Landscape. June 19 @ 8:00 am – 10:00 am
Individuals at Risk
Identity Theft
Meant to Combat ID Theft, Unemployment Benefits Letter Prompts ID Theft Worries: Millions of Americans now filing for unemployment will receive benefits via a prepaid card issued by U.S. Bank, a Minnesota-based financial institution that handles unemployment payments for more than a dozen U.S. states. Some of these unemployment applications will trigger an automatic letter from U.S. Bank to the applicant. The letters are intended to prevent identity theft, but many people are mistaking these vague missives for a notification that someone has hijacked their identity. KrebsOnSecurity, May 8, 2020
Cyber Danger
Samsung Confirms Critical Security Issue For Millions: Every Galaxy After 2014 Affected: The monthly security updates from Samsung have started rolling out. If you own a Samsung smartphone that was sold from late 2014 onward, you’d better hope that update hits your device soon. Why so? Only the small matter of a “perfect 10” critical security vulnerability that can enable arbitrary remote code execution (RCE) if exploited. Oh yes, and that arbitrary RCE can happen without any user interaction needed, as this is a “zero-click” vulnerability. And if you think that sounds pretty serious, and it is, there’s more to come: the vulnerability affects every Galaxy smartphone that Samsung has made from late 2014 onward. Forbes, May 7, 2020
Tech Support Scam Uses Child Porn Warning: A new email scam is making the rounds, warning recipients that someone using their Internet address has been caught viewing child pornography. The message claims to have been sent from Microsoft Support, and says the recipient’s Windows license will be suspended unless they call an “MS Support” number to reinstate the license, but the number goes to a phony tech support scam that tries to trick callers into giving fraudsters direct access to their PCs. KrebsOnSecurity, May 7, 2020
Malicious Bots Infiltrate Online Food Delivery … With grocery delivery in higher demand than ever, new add-ons have emerged to secure slots for consumers, presenting a new pathway for bad bots to wreak havoc: In the strange new era of COVID-19, securing a grocery delivery slot can sometimes feel like hitting the lottery. You almost have to blink to believe it’s real when you get a slot. DarkReading, May 7, 2020
Cyber Defense
Next round of Zoom updates targets consumer security: Casual consumer users of Zoom will get additional protections in an update to be released over the long weekend. ComputerWeekly, May 7, 2020
World Password Day: Review Your Defense and Revamp Your Passwords: Today is World Password Day. A day meant to remind everyone about the importance of protecting themselves through strong passwords. World Password Day is an annual observance that falls on the first Thursday of every May, also meant to commemorate the 2005 book by Security researcher Mark Burnett, “Perfect Password: Selection, Protection, Authentication,” where he encouraged people to not only have safe and smart passwords but to also have a password day. His tips were taken up by Intel Security, which took the initiative to declare the first Thursday in May as World Password Day, in May 2013, following which the Registrar of National Day Calendar formally designated it. CISO Mag, May 7, 2020
Research: Women Are Better at Cybersecurity Than Men. … NordPass survey reveals that women do more to protect themselves online: May 6, 2020. Women are better at cybersecurity and protecting themselves online, new research by NordPass suggests. The survey revealed that women are more concerned about the potential harm of their personal online accounts being hacked. They also tend to use unique passwords more often than men. DarkReading, May 6, 2020
Cyber Humor
Information Security Management for the Organization
Information Security Management and Governance
Cybersecurity: Half of businesses have had remote working security scares: The rapid move to remote working has left many businesses more vulnerable to cybersecurity threats, with nearly half saying they’ve encountered at least one scare as a direct result of the shift. TechRepublic, May 6, 2020
2020 NIST ransomware recovery guide: What you need to know: Over the past decade, a destructive piece of malware has grown from a novel concept into a digital epidemic. Now ransomware is causing a serious impact on organizations’ assets. This malware type is growing in popularity amongst attackers as a way to quickly extort money from its victims, which may include individuals, organizations and even governments. InfosecInstitute, May 6, 2020
Cyber Defense
How to combat cyberattacks that exploit Microsoft’s Remote Desktop Protocol: Hackers who gain access to a remote system can launch malware, spread spam, and perform identity theft, according to McAfee. TechRepublic, May 7, 2020
NSA Publishes Guide “Selecting and Safely Using Collaboration Services for Telework:” During a global pandemic or other crisis contingency scenarios, many United States Government (USG) personnel must operate from home while continuing to perform critical national functions and support continuity of government services. With limited access to government furnished equipment (GFE) such as laptops and secure smartphones, the use of (not typically approved) commercial collaboration services on personal devices for limited government official use becomes necessary and unavoidable. NSA, April 24, 2020
Cyber Warning
B2B, B2C SMBs Hit Hard by Ransomware Crews … Nearly half of small businesses (SMBs) have been victimized by ransomware hijackers and almost 75 percent of those have paid up, a recent survey of 500 C-suite executives found: Despite the high numbers, more than 25 percent of the SMBs in the study said their organization lacked a plan to mitigate a ransomware attack and nearly 20 percent said their organization wasn’t prepared should an attack hit them. “It is shocking that during a time in which the world should be coming together in the fight against COVID-19, criminals are preying on unsuspecting people and organizations for personal, usually financial, gain,” said Russell Reeder, chief executive of Infrascale, a cloud-based provider of back-up and disaster recovery solutions. MMSP Alert, May 6, 2020
Ransomware is now the biggest online menace you need to worry about – here’s why: Ransomware attacks have overtaken credit card theft as the top form of cybercrime according to new data. ZDNet, April 22, 2020
Attacks on WordPress Sites Surge: Defiant says it observed a 30-fold increase in attacks in just the past few days. DarkReading, May 6, 2020
Cyber Law
Cybersecurity Legal Market Still Thriving During Pandemic: Law360 (May 8, 2020, 10:02 PM EDT) — As the coronavirus pandemic prompts law firms to cut costs and causes some attorneys to worry about the viability of their practice areas, cybersecurity and privacy lawyers appear to be more in demand than ever. Law360, May 8, 2020
Cyber Insurance
Ransomware continues to dominate cyber discussion: Aon: Ransomware continues to dominate the cyber insurance discussion according to broker Aon, with total ransomware incidents up 135% last year and carriers steadily fielding more claims emanating from these attacks. Reinsurance News, May 8, 2020
Cyber Talent
76% Security Professionals Face Cybersecurity Skills Shortage: Report: A report from cybersecurity research firm Stott and May revealed that most of the cybersecurity leaders are struggling with skills shortage. The research report “Cybersecurity in Focus 2020” highlighted that 76% of respondents believe there is a shortage of cybersecurity skills in their organization, which represents an improvement when compared to 2019 (88%). Nearly 72% of organizations are still struggling to procure cybersecurity talent with no improvement from 2019. CISO, May 7, 2020
Cybersecurity in Society
Cyber Privacy
CCPA 2.0 Announces Key Signature Threshold for Ballot Initiative: The organization known as Californians for Consumer Privacy announced yesterday that it successfully secured enough signatures to qualify adding the California Privacy Rights Act (“CPRA”) to the state’s November 2020 ballot. The group’s founder Alastair Mactaggart is a well-know public figure who was the driving force behind the infamous California Consumer Privacy Act of 2018 (the “CCPA”), which just went into effect in January. We previously reported on the latest CCPA developments and litigation trends at length here. JDSupra, May 7, 2020
MIT Floats Health Certifications, Digital Identity Tracking to Open up Economies; How Feasible Are These Ideas?: The month of May is bringing an ease to coronavirus pandemic “stay at home” measures in many parts of the world. Though stay-at-home orders appear to have been broadly successful in most places, nearly a month-and-a-half of a global economy on life support has necessitated some level of risk of a second wave of the virus. Local governments are attempting to control this risk by keeping various social distancing requirements in place as a limited amount of businesses and public services open their doors. Various technology proposals are also on the table, including anonymized digital identity tracking and the use of health certifications to determine who can safely return to work. CPO, May 7, 2020
WeChat surveils international accounts to decide what to censor for Chinese users, study says: WeChat, the Chinese messaging app, is systematically monitoring the content sent by international users to build up its censorship algorithms applied against accounts registered in China, a new study has found. SCMP, May 7, 2020
National Security Warning Labels May Be Coming Soon to Apps: Jim Banks, the Republican Party’s Indiana representative, is pushing forward a piece of legislation that would see consumers being slapped with warning labels before downloading apps that originate from countries considered to be U.S. national security risks. CPO, May 7,
The NYC Department of Education is reversing its ban on Zoom after the company addresses its security and privacy concerns: New York City schools are once again allowed to use Zoom for online learning, the videoconferencing company and NYC Department of Education both said on Wednesday. The school district banned the use of Zoom for online education on April 4 over privacy and security concerns involved in using the app. BusinessInsider, May 6, 2020
Cyber Crime
Hackers Threaten to Release Legal Secrets of World’s Biggest Stars … A ransomware gang is threatening to release almost 1TB of private legal secrets from the world’s biggest music and movie stars: The private legal affairs of dozens of the world’s biggest music and movie stars — Lady Gaga, Elton John, Robert DeNiro, and Madonna among them — are at risk of exposure following a ransomware attack on a high profile New York entertainment law firm. CoinTelegraph, May 8, 2020
Cognizant expects to lose between $50m and $70m following ransomware attack: Cognizant says April ransomware incident will negatively impact Q2 revenue. ZDNet, May 8, 2020
Logistics giant Toll Group hit by ransomware for the second time in three months: Toll says that it has no intention of bowing to blackmail. ZDNet, May 6
Cyber Espionage
China’s Military Is Tied to Debilitating New Cyberattack Tool: An Israeli security company said the hacking software, called Aria-body, had been deployed against governments and state-owned companies in Australia and Southeast Asia. The New York Times, May 7, 2020
Cyber Freedom
The Cybersecurity 202: Coronavirus has upended election security training with just months before November: Russian hackers could target election officials working from home. Adversaries could spread rumors about coronavirus outbreaks at polling sites to deter people from showing up on Election Day. Or they could launch disinformation campaigns claiming elections have been delayed or canceled entirely because of the virus. Washington Post, May 8, 2020
Fair Elections Depend on Information Assurance … To truly ensure the principle of one person, one vote, the American electoral infrastructure should adopt security protocols similar to those used in the cybersecurity industry: Electoral management should be conducted using variations on the techniques employed for financial systems and national security data. Unfortunately, today’s U.S. voting mechanisms at all levels as well as national policy would not pass even the most rudimentary information assurance audit. AFCEA, May 1, 2020
Cyber Law
Cybersecurity Lobbying Spending Mounts as Privacy, Security Laws Take Shape: Efforts range from traditional advocacy on specific bills to advising lawmakers on the security dimensions of current events, including the coronavirus pandemic. Wall Street Journal, May 4, 2020
