Schneier on Security

JULY 18, 2022

Some sites, including Facebook, add parameters to the web address for tracking purposes. These parameters have no functionality that is relevant to the user, but sites rely on them to track users across pages and properties. Mozilla introduced support for URL stripping in Firefox 102 , which it launched in June 2022. Firefox removes tracking parameters from web addresses automatically, but only in private browsing mode or when the browser’s Tracking Protection feature is set to strict.

Encryption 363

Encryption 363

Krebs on Security

JULY 10, 2022

Twice in the past month KrebsOnSecurity has heard from readers who’ve had their accounts at big-three credit bureau Experian hacked and updated with a new email address that wasn’t theirs. In both cases the readers used password managers to select strong, unique passwords for their Experian accounts. Research suggests identity thieves were able to hijack the accounts simply by signing up for new accounts at Experian using the victim’s personal information and a different email

Passwords 349

Passwords Authentication Accountability Password Management 349

Joseph Steinberg

JULY 21, 2022

The second edition of Cybersecurity For Dummies , Joseph Steinberg’s best-selling introductory-level book about cybersecurity, is now available. Like its first-edition counterpart, CyberSecurity For Dummies: Second Edition is written for general audiences, and can help people of all backgrounds stay cyber-secure, regardless of their technical skillsets.

Cybersecurity 341

Cybersecurity Artificial Intelligence Ransomware Backups 341

Troy Hunt

JULY 6, 2022

11 years now, wow 😲 It's actually 11 and a bit because it was April Fool's Day in 2011 that my first MVP award came through. At the time, I referred to myself as "The Accidental MVP" as I'd no expectation of an award, it just came from me being me. It's the same again today, and the last year has been full of just doing the stuff I love; loads of talks (which, like the one above at AusCERT, are actually starting to happen in front of real live humans again), l

Passwords 312

Passwords 312

Speaker: Erika R. Bales, Esq.

When we talk about “compliance and security," most companies want to ensure that steps are being taken to protect what they value most – people, data, real or personal property, intellectual property, digital assets, or any other number of other things - and it’s more important than ever that safeguards are in place. Let’s step back and focus on the idea that no matter how complicated the compliance and security regime, it should be able to be distilled down to a checklist.

Javvad Malik

JULY 7, 2022

Over here in the UK we’ve had dozens of MPs (members of parliament) tender their resignation over the last day or so. While I’m not interested in politics, seeing so many resignation letters did provide me with the template to create the perfect letter. It consists of a few steps. 1. Yellow paper (not the white one peasants write on). 2.

Authentication 306

Authentication 306

Adam Levin

JULY 6, 2022

A firewall is a network security device or program designed to prevent unauthorized and malicious internet traffic from entering a private network or device. It is a digital safety barrier between public and private internet connections, allowing non-threatening traffic in and keeping malicious traffic out, which in theory includes malware and hackers.

Firewall 298

Firewall Malware Network Security Software 298

Krebs on Security

JULY 21, 2022

U.S. state and federal investigators are being inundated with reports from people who’ve lost hundreds of thousands or millions of dollars in connection with a complex investment scam known as “ pig butchering ,” wherein people are lured by flirtatious strangers online into investing in cryptocurrency trading platforms that eventually seize any funds when victims try to cash out.

Scams 340

Scams Cryptocurrency Marketing Internet 340

Joseph Steinberg

JULY 22, 2022

CyberSecurity. The word may sound simple enough to easily define; but, in reality, it is not. From a practical standpoint, cybersecurity means quite different things to different people in different situations, a phenomenon that leads not only to extremely varied cybersecurity policies, procedures, and practices, but also to different understandings of the word cybersecurity itself.

Cybersecurity 308

Cybersecurity Artificial Intelligence Information Security 308

Troy Hunt

JULY 21, 2022

I broke Yoda's stick! 3D printing woes, and somehow I managed to get through the explanation without reverting to a chorus of My Stick by a Bad Lip Reading (and now you'd got that song stuck in your head). Loads of data breaches this week and whilst "legacy", still managed to demonstrate how bad some practices remain today (hi Shadi.com 👋).

Data breaches 305

Data breaches Media 305

Tech Republic Security

JULY 7, 2022

Cybercriminals found a way into a Shanghai National Police database, in the largest exploit of personal information in the country’s history. The post China suffers massive cybersecurity breach affecting over 1 billion people appeared first on TechRepublic.

Cybersecurity 217

Cybersecurity 217

Speaker: William Hord, Vice President of ERM Services

A well-defined change management process is critical to minimizing the impact that change has on your organization. Leveraging the data that your ERM program already contains is an effective way to help create and manage the overall change management process within your organization. Your ERM program generally assesses and maintains detailed information related to strategy, operations, and the remediation plans needed to mitigate the impact on the organization.

Risk

Bleeping Computer

JULY 16, 2022

Researchers following the activities of advanced persistent (APT) threat groups originating from China, North Korea, Iran, and Turkey say that journalists and media organizations have remained a constant target for state-aligned actors. [.].

Media 145

Media 145

Security Boulevard

JULY 20, 2022

Salt Security today extended its security platform for application programming interfaces (APIs) to include the ability to visually depict API call sequences, create attack simulations before APIs are released into production and gain insights into attacker behaviors and patterns. Elad Koren, chief product officer for Salt Security, said the latest version of the Salt Security.

Cybersecurity 145

Cybersecurity 145

Krebs on Security

JULY 18, 2022

The 911 service as it exists today. For the past seven years, an online service known as 911 has sold access to hundreds of thousands of Microsoft Windows computers daily, allowing customers to route their Internet traffic through PCs in virtually any country or city around the globe — but predominantly in the United States. 911 says its network is made up entirely of users who voluntarily install its “free VPN” software.

VPN 312

VPN Antivirus Computers and Electronics Cybercrime 312

CSO Magazine

JULY 4, 2022

Identity and access issues topped the list of concerns of IT pros in the Cloud Security Alliance's annual Top Threats to Cloud Computing: The Pandemic 11 report released earlier this month. "Data breaches and data loss were the top concerns last year," says CSA Global Vice President of Research John Yeoh. "This year, they weren't even in the top 11.

Data breaches 145

Data breaches 145

Speaker: Ronald Eddings, Cybersecurity Expert and Podcaster

So, you’ve accomplished an organization-wide SaaS adoption. It started slow, and now just a few team members might be responsible for running Salesforce, Slack, and a few others applications that boost productivity, but it’s all finished. Or is it? Through all the benefits offered by SaaS applications, it’s still a necessity to onboard providers as quickly as possible.

Risk

Dark Reading

JULY 14, 2022

Vulnerability will remain a "significant" threat for years to come and highlighted the need for more public and private sector support for open source software ecosystem, Cyber Safety Review Board says.

Cyber threats 144

Cyber threats Software 144

Tech Republic Security

JULY 19, 2022

CSRB has released a report saying that the Log4j exploit is here to stay long-term, meaning businesses should be ready in case of a cyber attack. The post Cyber Safety Review Board classifies Log4j as ‘endemic vulnerability’ appeared first on TechRepublic.

Cyber Attacks 209

Cyber Attacks 209

Bleeping Computer

JULY 7, 2022

While Microsoft announced earlier this year that it would block VBA macros on downloaded documents by default, Redmond said on Thursday that it will roll back this change based on "feedback" until further notice. [.].

145

145

Security Boulevard

JULY 21, 2022

Radware this week revealed it added blockchain technologies to its Bot Manager platform to thwart attacks designed to evade completely automated public Turing tests to tell computers and humans apart—better known as CAPTCHA challenges. Dr. David Aviv, CTO for Radware, said that while a CAPTCHA challenge can be an effective way to determine if an. The post Radware Employs Blockchain Technologies to Thwart Bots appeared first on Security Boulevard.

Technology 145

Technology Network Security Cybersecurity 145

Speaker: Karl Camilleri, Cloud Services Product Manager at phoenixNAP

Did you know that 2021 was a record-breaking year for ransomware? The days of a “once in a while” attack against businesses and organizations are over. Cyberthreats have become a serious issue. With 495.1 million attacks, the threat marked a 148% increase compared to 2020 and was the most expensive year on record! As a result, data protection needs to be a concern for most banks, businesses, and information technology specialists.

Ransomware

SecureList

JULY 25, 2022

Introduction. Rootkits are malware implants which burrow themselves in the deepest corners of the operating system. Although on paper they may seem attractive to attackers, creating them poses significant technical challenges and the slightest programming error has the potential to completely crash the victim machine. In our APT predictions for 2022 , we noted that despite these risks, we expected more attackers to reach the sophistication level required to develop such tools.

Firmware 144

Firmware Malware DNS Internet 144

eSecurity Planet

JULY 11, 2022

Intezer Labs security researchers have identified a sophisticated new malware that targets Linux devices. Dubbed OrBit , the malware can gain persistence quickly, evade detection and hide its presence in network activity by manipulating logs. The module hooks functions called in shared libraries, which is pretty common for malware, but it also implements “advanced evasion techniques” and “remote capabilities over SSH.”.

Malware 143

Malware Antivirus Authentication Architecture 143

Security Affairs

JULY 31, 2022

A vulnerability, tracked as CVE-2022-30563, impacting Dahua IP Camera can allow attackers to seize control of IP cameras. The CVE-2022-30563 vulnerability impacting Dahua IP Camera can allow attackers to seize control of IP cameras. The issue affects Dahua’s implementation of the Open Network Video Interface Forum ( ONVIF ). ONVIF provides and promotes standardized interfaces for effective interoperability of IP-based physical security products.

Surveillance 142

Surveillance Hacking Authentication Telecommunications 142

Tech Republic Security

JULY 18, 2022

Microsoft says a ransomware gang calling itself H0lyGh0st may be sponsored by the North Korean government as a way for the country to offset its struggling economy. The post Why North Korean cybercriminals are targeting businesses with ransomware appeared first on TechRepublic.

Ransomware 204

Ransomware Government 204

Speaker: P. Andrew Sjogren, Sr. Product Marketing Manager at Very Good Security, Matt Doka, Co-Founder and CTO of Fivestars, and Steve Andrews, President & CEO of the Western Bankers Association 

PCI compliance can feel challenging and sometimes the result feels like you are optimizing more for security and compliance than you are for business outcomes. The key is to take the right strategy to PCI compliance that gets you both. In this webinar, we have a great set of panelists who will take you through how Zero Data strategies can be used as part of a well-rounded compliance and security approach, and get you to market much sooner by also allowing for payment optimization.

Marketing

Bleeping Computer

JULY 19, 2022

An Israeli security researcher has demonstrated a novel attack against air-gapped systems by leveraging the SATA cables inside computers as a wireless antenna to emanate data via radio signals. [.].

Wireless 145

Wireless 145

Security Boulevard

JULY 4, 2022

Find out top 10 risks answering why SMB's are doing cyber security wrong. We have also included fixes to help you understand the cybersecurity for SMB. The post The Top 10 SMB cyber security mistakes. Find out how to fix these security risks. appeared first on Cyphere | Securing Your Cyber Sphere. The post The Top 10 SMB cyber security mistakes.

Risk 145

Risk Cybersecurity 145

CSO Magazine

JULY 26, 2022

ISAC and ISAO definition. [Editor's note: This article, originally published on July 3, 2019, has been updated with a directory of ISACs and ISAOs.] An Information Sharing and Analysis Center (ISAC) is an industry-specific organization that gathers and shares information on cyber threats to critical infrastructure. ISACs also facilitate the sharing of data between public and private sector groups. [ Learn what you need to know about defending critical infrastructure. | Get the latest from CSO by

Cyber threats 142

Cyber threats CSO 142

The State of Security

JULY 14, 2022

Microsoft has shared details of a widespread phishing campaign that not only attempted to steal the passwords of targeted organisations, but was also capable of circumventing multi-factor authentication (MFA) defences. Read more in my article on the Tripwire State of Security blog.

Phishing 141

Phishing Authentication Passwords 141

Speaker: Mike Cramer, Director of HIPAA & Data Security at The Word & Brown Companies

The COVID-19 pandemic forced many people into working remotely, opening the floodgates for a host of digital compliance issues. Now that companies are slowly allowing employees to return to work at the office, it's time to re-evaluate your company’s posture towards privacy and security. This is especially vital if your workers were (and still are!) using company equipment from home, or are still working remotely.

Data privacy

We Live Security

JULY 13, 2022

In a world of ever-evolving cyberthreats, collaboration and knowledge exchange are vital for keeping an edge on attackers. The post Collaboration and knowledge sharing key to progress in cybersecurity appeared first on WeLiveSecurity.

Cybersecurity 141

Cybersecurity 141

Tech Republic Security

JULY 14, 2022

Journalists have information that makes them particularly interesting for state-sponsored cyberespionage threat actors. Learn more about these threats now. The post State-sponsored cyberespionage campaigns continue targeting journalists and media appeared first on TechRepublic.

Media 201

Media 201

Bleeping Computer

JULY 29, 2022

The Federal Communications Commission (FCC) warned Americans of an increasing wave of SMS (Short Message Service) phishing attacks attempting to steal their personal information and money. [.].

Phishing 144

Phishing 144

Security Boulevard

JULY 22, 2022

A survey of 503 IT professionals conducted by the market research firm Dimensional Insight on behalf of Broadcom Software highlighted the degree to which organizations are struggling to balance security against customer experience. The survey found more than half of respondents (54%) prioritize security over the end-user experience. However, 46% also conceded they have bypassed.

Software 141

Software Marketing Security Awareness Cybersecurity 141

Speaker: William Hord, Senior VP of Risk & Professional Services

Enterprise Risk Management (ERM) is critical for industry growth in today’s fast-paced and ever-changing risk landscape. When building your ERM program foundation, you need to answer questions like: Do we have robust board and management support? Do we understand and articulate our bank’s risk appetite and how that impacts our business units? How are we measuring and rating our risk impact, likelihood, and controls to mitigate our risk?

Banking