CSO Magazine

OCTOBER 4, 2021

The damage from executive email account takeovers can run into millions of dollars, as recent examples show. The recent SolarWinds attack was bad enough, and now Nobelium, the group responsible, has since launched a campaign of email attacks appearing to originate from USAID after its Constant Contact email account was compromised.

CSO 131

CSO Phishing Accountability 131

CSO Magazine

MAY 17, 2023

Researchers from security firm Proofpoint investigated how attackers could abuse access to a Teams account and found some interesting attack vectors that could allow hackers to move laterally by launching further phishing attacks or getting users to download malicious files. To read this article in full, please click here

Accountability 105

Accountability Phishing Risk 105

CSO Magazine

MAY 27, 2021

Credential stuffing is the automated use of collected usernames and passwords to gain fraudulent access to user accounts. These credentials fuel the underground economy and are used for everything from spam to phishing and account takeovers. Get the latest from CSO by signing up for our newsletters. ]

CSO 119

CSO Passwords Data breaches Accountability 119

CSO Magazine

JULY 26, 2022

Helsinki-based cybersecurity vendor WithSecure (formerly F-Secure Business) says it has discovered an operation, dubbed “DUCKTAIL,” that uses social media-based spear phishing attacks to gain access to Facebook Business accounts. Previous attacks targeting Facebook did not target Facebook Business accounts in particular.

Accountability 80

Accountability Malware Media Phishing 80

CSO Magazine

DECEMBER 19, 2022

The organizations with the best chance of minimizing threats are those that build and sustain a culture of awareness and accountability. Here are some ways to do that: To read this article in full, please click here

Accountability 111

Accountability Cybersecurity Phishing Technology 111

CSO Magazine

JANUARY 13, 2022

Credential stuffing is a cyberattack in which exposed usernames and passwords are used to gain fraudulent access to user accounts through large-scale, automated login requests. To read this article in full, please click here Attackers are asking: What does it look like to make a legitimate request? How can we emulate that?

CSO 130

CSO Data breaches Passwords Accountability 130

CSO Magazine

DECEMBER 14, 2022

Microsoft suspended several accounts on its hardware developer program that signed malicious drivers used by a ransomware group called Cuba to disable endpoint security tools. To read this article in full, please click here In recent attacks, some threat actors have turned to the use of Windows drivers to disable security products."

Accountability 106

Accountability Ransomware Software 106

CSO Magazine

AUGUST 3, 2021

The US General Accountability Office (GAO) issued the 19-page report , “Cybersecurity and Information Technology: Federal Agencies need to Strengthen Efforts to Address High-Risk Areas” on July 29. Sign up for CSO newsletters. ]. To read this article in full, please click here

CSO 142

CSO Cybersecurity Government Accountability 142

CSO Magazine

NOVEMBER 28, 2022

Customer identity and access management (CIAM), a subset of identity access management (IAM), is used to manage authentication and authorization of account creation and login process for public facing applications. To read this article in full, please click here Marketers want to collect data about customers and their devices.

CSO 80

CSO Data collection Marketing Accountability 80

CSO Magazine

AUGUST 30, 2021

Enterprise-class password managers have become one of the easiest and most cost-effective ways to help employees lock down their online accounts. Sign up for CSO newsletters. ]. Sign up for CSO newsletters. ]. To read this article in full, please click here

Password Management 145

Password Management Passwords CSO Accountability 145

CSO Magazine

JANUARY 5, 2023

The operation is highly automated using CI/CD processes and involves the creation of tens of thousands of fake accounts and the use of stolen or fake credit cards to activate time-limited trials. To read this article in full, please click here

Accountability 87

Accountability 87

CSO Magazine

MAY 3, 2022

When CISOs fail to maintain positive working relationships with their security vendors they will often see their vendor provide less of a priority on their needs and overall responsiveness can be delayed, and in worst cases they may be flagged as a toxic account that no sales representative wants to be assigned,” he says.

CISO 128

CISO CSO Cybersecurity Accountability 128

CSO Magazine

APRIL 13, 2022

Sign up for CSO newsletters. ]. Murphy, manager of cybersecurity at Schneider Downs, a certified public accounting and business advisory firm, says he once investigated the root cause of a ransomware attack at a company and traced the incident back to a worker who had clicked on an invoice for pickles.

Penetration Testing 95

Penetration Testing CSO Phishing Passwords 95

CSO Magazine

JUNE 8, 2021

In December 2020, the US Government Accounting Office (GAO) made 145 recommendations to 23 federal agencies relating to supply chain risks. Get the latest from CSO by signing up for our newsletters. ]. Get the latest from CSO by signing up for our newsletters. ]. To read this article in full, please click here

Government 121

Government CSO Risk Accountability 121

CSO Magazine

MARCH 2, 2023

Booking.com, one of the world's largest online travel agencies, recently patched a vulnerability in its implementation of the OAuth protocol that could have allowed attackers to gain access to customer accounts by simply tricking them into clicking a link. To read this article in full, please click here

Accountability 66

Accountability Risk 66

CSO Magazine

MAY 19, 2022

Users of Strapi, a popular headless content management system written entirely in JavaScript and focused on API development, should update their installations as soon as possible to fix two vulnerabilities that could lead to administrative accounts being compromised. To read this article in full, please click here

Accountability 65

Accountability Phishing Passwords Cybersecurity 65

CSO Magazine

MAY 6, 2021

Over the next few days, over 30,000 organizations in the US were attacked as hackers used several Exchange vulnerabilities to gain access to email accounts and install web shell malware , giving the cybercriminals ongoing administrative access to the victims' servers. To read this article in full, please click here

Hacking 116

Hacking CSO Accountability Malware 116

Duo's Security Blog

NOVEMBER 20, 2023

“It took nearly 11 months (328 days) to identity and contain data breaches resulting from stolen or compromised credentials.” – IBM’s Cost of Data Breach Report 2023 I recently came across a 2012 article from CSO Online , and realized that it has been more than 11 years since the phrase “Identity is the new perimeter” was coined!

Threat Detection 134

Threat Detection Authentication Accountability Data breaches 134

Security Boulevard

DECEMBER 5, 2022

A report released by Meta’s security team describes the company’s shutdown of a network of Facebook and Instagram accounts participating in what it calls coordinated inauthentic behavior, and linking some of those accounts to the US military. To read this article in full, please click here. Leer más CSO Online.

Media 96

Media CSO Accountability 96

CSO Magazine

JUNE 21, 2021

. | Sign up for CSO newsletters. ]. Can you, the CISO, or your team in charge of the ITAD, describe how each device provisioned and issued within the company is tracked, the data on the device is accounted for, and when and how that device is removed from the company ecosystem in a way the company and its customers’ data is protected?

CISO 116

CISO Risk CSO Accountability 116

CSO Magazine

MAY 28, 2021

These efforts recently escalated with an attack launched from a hijacked email marketing account belonging to USAID and targeted around 3,000 people across over 150 organizations in 24 countries. Sign up for CSO newsletters. ]. To read this article in full, please click here

CSO 105

CSO Government Marketing Hacking 105

CSO Magazine

APRIL 7, 2021

If the KRBTGT account password hash is stolen or broken with an attack, the attackers can then grant themselves full access to your network with the necessary authentication. To read this article in full, please click here (Insider Story) Active Directory (AD) uses the KRBTGT in the AD domain for Kerberos tickets.

Passwords 90

Passwords Accountability Authentication 90

CSO Magazine

JUNE 7, 2021

To read this article in full, please click here (Insider Story) Researchers from cloud security firm Lightspin identified quirks in S3 bucket permissions that appear to be a common source of confusion among administrators.

Accountability 97

Accountability 97

CSO Magazine

MAY 4, 2023

Since March, Meta has discovered about 10 malware families using AI themes to compromise business accounts across the internet — including social media business accounts — and blocked over 1,000 unique ChatGPT-themed malicious URLs from being shared on its platforms. To read this article in full, please click here

Malware 106

Malware Media Accountability Internet 106

CSO Magazine

NOVEMBER 23, 2022

A report released by Meta’s security team describes the company’s shutdown of a network of Facebook and Instagram accounts participating in what it calls coordinated inauthentic behavior, and linking some of those accounts to the US military. To read this article in full, please click here

Media 118

Media Accountability 118

CSO Magazine

MAY 21, 2021

In early May, fitness company Peloton announced that it had exposed customer account data on the internet. Anyone could access users’ account data from Peloton’s servers, even if the users set their account profiles as private. To read this article in full, please click here (Insider Story)

Accountability 135

Accountability Internet Internet 135

CSO Magazine

MAY 17, 2023

Financially motivated threat actor UNC3944 is using phishing and SIM swapping attacks to take over Microsoft Azure admin accounts and gain access to virtual machines (VM), according to cybersecurity firm Mandiant. To read this article in full, please click here UNC3944 has been active since May 2022.

Accountability 100

Accountability Phishing Software Cybersecurity 100

Security Boulevard

NOVEMBER 24, 2022

Hopefully that was not the last time I suggested you change it, back in April of 2021, when I urged you to do a regular reset of the KRBTGT account password. To read this article in full, please click here. Leer más CSO Online. read this article in full, please click here. read this article in full, please click here.

Passwords 52

Passwords CSO Authentication Accountability 52

Security Boulevard

NOVEMBER 24, 2022

With the holiday shopping season in full swing, retail websites can expect a spike in account takeover fraud, DDoS, and other attacks, including attacks via APIs, which now represent almost half of e-commerce traffic. To read this article in full, please click here. Leer más CSO Online.

Retail 52

Retail DDOS CSO Marketing 52

CSO Magazine

JUNE 3, 2021

As Roger Grimes wrote in this article about two-factor hacks three years ago, when MFA is done well it can be effective, but when IT managers take shortcuts it can be a disaster. of compromised accounts did not use MFA at all and only 11% of enterprise accounts are protected by some MFA method.

Hacking 122

Hacking Accountability Authentication 122

CSO Magazine

MAY 19, 2023

"The infection turns these devices into mobile proxies, tools for stealing and selling SMS messages, social media and online messaging accounts and monetization via advertisements and click fraud," Trend Micro researchers said in a report presented at the BlackHat Asia conference this week. To read this article in full, please click here

Malware 119

Malware Cybercrime Mobile Advertising 119

CSO Magazine

FEBRUARY 21, 2023

It consists of sites that are not indexed by popular search engines such as Google, and the dark web includes marketplaces for data usually obtained as a result of a cyberattack such as compromised user accounts, identity information, or other confidential corporate information. To read this article in full, please click here

CISO 107

CISO Engineering Accountability 107

CSO Magazine

JANUARY 31, 2023

Guardz automatically enrolls all user accounts upon activation, and monitors risk posture, performs threat detection on all monitored accounts and devices, and offers one-click remediation for some threats. To read this article in full, please click here

Small Business 99

Small Business Cybersecurity Threat Detection Accountability 99

CSO Magazine

JUNE 5, 2023

The five most significant losses account for $17 million. To read this article in full, please click here Think it could surpass $50m. Keep finding more and more victims sadly,” said ZachXBT, in a tweet.

Hacking 96

Hacking Accountability 96

CSO Magazine

APRIL 19, 2023

Use cases for the Darwinium platform include account security, scam detection, account takeover, fraudulent new accounts, synthetic identities, and bot intelligence. To read this article in full, please click here

B2C 82

B2C eCommerce Scams Cybercrime 82

CSO Magazine

SEPTEMBER 22, 2022

While enabling MFA for all accounts is highly encouraged and a best practice, the implementation details matter because attackers are finding ways around it. To read this article in full, please click here It's a simple yet effective technique that has become known as MFA fatigue and was also used in the recent Uber breach.

Authentication 141

Authentication Network Security Accountability 141

CSO Magazine

JUNE 8, 2023

According to Google Cybersecurity Action Team (GCAT) September 2022 Threat Horizons Report , threat actors frequently targeted weak and default passwords to access Google Cloud accounts. Once inside the compromised cloud accounts, they performed cryptomining 65% of the time. To read this article in full, please click here

Accountability 83

Accountability Passwords Cybersecurity 83