Schneier on Security

JANUARY 29, 2018

It's really hard to estimate the cost of an insecure Internet. Studies are all over the map. A methodical study by RAND is the best work I've seen at trying to put a number on this. The results are, well, all over the map: " Estimating the Global Cost of Cyber Risk: Methodology and Examples ": Abstract : There is marked variability from study to study in the estimated direct and systemic costs of cyber incidents, which is further complicated by the considerable variation in cyber risk in differe

Internet 214

Internet Internet Cyber Risk Risk 214

Troy Hunt

JANUARY 31, 2018

This is probably the most self-explanatory blog post title I've ever written! But be that as it may, it deserves some explanation as to how I've arrived at this point and like many great ideas, it began over some beers. I've just arrived home to the Gold Coast in Australia which I frequently describe to people as "the sunny part of the sunny country" I'm literally sitting on a beach writing this blog post and frankly, I'd like to spend more time here.

Hacking 189

Hacking Media 189

Thales Cloud Protection & Licensing

JANUARY 31, 2018

Data breaches are the new normal. According to our 2018 Global Data Threat Report , 67% of enterprises have been breached, with that percentage rate growing every year. Regardless of the security measures and efforts put in place, organizations need to act as if a successful cyberattack is not a question of “if” but “when.”. As organizations continue to embrace digital transformation, greater amounts of sensitive data is created, stored and transferred in digital form putting more data at risk.

Digital transformation 130

Digital transformation Data breaches Encryption Cloud Migration 130

WIRED Threat Level

JANUARY 30, 2018

US regulators and Facebook are finally coming for bogus ICOs.

Cryptocurrency 111

Cryptocurrency Scams 111

Speaker: Erroll Amacker

Automation is transforming finance but without strong financial oversight it can introduce more risk than reward. From missed discrepancies to strained vendor relationships, accounts payable automation needs a human touch to deliver lasting value. This session is your playbook to get automation right. We’ll explore how to balance speed with control, boost decision-making through human-machine collaboration, and unlock ROI with fewer errors, stronger fraud prevention, and smoother operations.

Risk

Schneier on Security

JANUARY 31, 2018

According to this story (non-paywall English version here ), Israeli scientists released some information to the public they shouldn't have. Defense establishment officials are now trying to erase any trace of the secret information from the web, but they have run into difficulties because the information was copied and is found on a number of platforms.

Internet 205

Internet Internet 205

Troy Hunt

FEBRUARY 1, 2018

I've long been a proponent of Content Security Policies (CSPs). I've used them to fix mixed content warnings on this blog after Disqus made a little mistake , you'll see one adorning Have I Been Pwned (HIBP) and I even wrote a dedicated Pluralsight course on browser security headers. I'm a fan (which is why I also recently joined Report URI ), and if you're running a website, you should be too.

142

142

WIRED Threat Level

JANUARY 31, 2018

The "jackpotting" ATM attack drained tens of millions of dollars worldwide before landing in the United States.

Hacking 110

Hacking 110

Schneier on Security

JANUARY 29, 2018

In November, the company Strava released an anonymous data-visualization map showing all the fitness activity by everyone using the app. Over this weekend, someone realized that it could be used to locate secret military bases: just look for repeated fitness activity in the middle of nowhere. News article.

189

189

Troy Hunt

JANUARY 27, 2018

I'm in Denmark! Well I'm just in Denmark, I'm about to head out the hotel door and into 30 hours of travel which isn't exactly fun, but that's the nature of living on the other side of the world to pretty much everything. This week's update is a little late as my Friday was absolutely non-stop in Denmark. I talk about that below including the preceding days involving some pretty full on sledding in Norway, workshops, talks, ice, slush and snow.

InfoSec 138

InfoSec Password Management Passwords 138

Dark Reading

FEBRUARY 1, 2018

The numbers show career opportunities for cyber defenders.

Cybersecurity 74

Cybersecurity 74

Advertisement

Many cybersecurity awareness platforms offer massive content libraries, yet they fail to enhance employees’ cyber resilience. Without structured, engaging, and personalized training, employees struggle to retain and apply key cybersecurity principles. Phished.io explains why organizations should focus on interactive, scenario-based learning rather than overwhelming employees with excessive content.

Cyber threats

WIRED Threat Level

JANUARY 30, 2018

While helpful and creative, Chrome extensions have also become a new playground for hackers intent on stealing your data.

Malware 110

Malware 110

Schneier on Security

FEBRUARY 2, 2018

Stuxnet famously used legitimate digital certificates to sign its malware. A research paper from last year found that the practice is much more common than previously thought. Now, researchers have presented proof that digitally signed malware is much more common than previously believed. What's more, it predated Stuxnet, with the first known instance occurring in 2003.

Malware 187

Malware Antivirus Software Accountability 187

Troy Hunt

FEBRUARY 2, 2018

I'm home! It's nice being home ??. This week I start by getting a couple of things off my chest, namely some pretty wacky reactions to my suggesting that we're never going to see a coders' hippocratic oath and how I feel when media outlets say "the dark web" Plus, I've got news around running workshops in Europe with Scott Helme and me finally getting a content security policy on this blog.

Media 127

Media Hacking 127

Dark Reading

JANUARY 31, 2018

IoT devices are a botherder's dream attack-vector.

IoT 72

IoT 72

Advertisement

The DHS compliance audit clock is ticking on Zero Trust. Government agencies can no longer ignore or delay their Zero Trust initiatives. During this virtual panel discussion—featuring Kelly Fuller Gordon, Founder and CEO of RisX, Chris Wild, Zero Trust subject matter expert at Zermount, Inc., and Principal of Cybersecurity Practice at Eliassen Group, Trey Gannon—you’ll gain a detailed understanding of the Federal Zero Trust mandate, its requirements, milestones, and deadlines.

Cybersecurity

WIRED Threat Level

JANUARY 29, 2018

The US military is reexamining security policies after fitness tracker data shared on social media revealed bases and patrol routes.

Media 110

Media 110

Schneier on Security

JANUARY 30, 2018

Local residents are opposing adding an elevator to a subway station because terrorists might use it to detonate a bomb. No, really. There's no actual threat analysis, only fear: "The idea that people can then ride in on the subway with a bomb or whatever and come straight up in an elevator is awful to me," said Claudia Ward, who lives in 15 Broad Street and was among a group of neighbors who denounced the plan at a recent meeting of the local community board.

175

175

Threatpost

JANUARY 29, 2018

ATM maker NCR Corp. is warning that cyber criminals are hacking U.S. cash machines with malware that can drain machines dry of cash.

Malware 68

Malware Hacking 68

Dark Reading

JANUARY 30, 2018

For just over $1,000, a phishing operation successfully spied on members of the Tibetan community for 19 months, Toronto University's Citizen Lab found.

Phishing 68

Phishing 68

Advertisement

Keeper Security is transforming cybersecurity for people and organizations around the world. Keeper’s affordable and easy-to-use solutions are built on a foundation of zero-trust and zero-knowledge security to protect every user on every device. Our next-generation privileged access management solution deploys in minutes and seamlessly integrates with any tech stack to prevent breaches, reduce help desk costs and ensure compliance.

Passwords

WIRED Threat Level

FEBRUARY 1, 2018

Two state-sponsored hacking operations are plaguing Pyeongchang, with murky motivations and no clear endgame.

Hacking 110

Hacking 110

Schneier on Security

FEBRUARY 1, 2018

Brian Krebs is reporting sophisticated jackpotting attacks against US ATMs. The attacker gains physical access to the ATM, plants malware using specialized electronics, and then later returns and forces the machine to dispense all the cash it has inside. The Secret Service alert explains that the attackers typically use an endoscope -- a slender, flexible instrument traditionally used in medicine to give physicians a look inside the human body -- to locate the internal portion of the cash machin

Computers and Electronics 168

Computers and Electronics Malware 168

Thales Cloud Protection & Licensing

JANUARY 30, 2018

The UK Ministry of Defence’s (MoD) DEFCON 658 aims to protect the defence supply chain from cyber threats. Impacting directly the MoD’s suppliers – or indeed would-be suppliers – it applies to any contract containing sensitive departmental information. As of April 2017, its introduction has ratcheted up pressure on those suppliers wishing to partake in lucrative government contracts, thus ensuring that any cyber risks are handled and mitigated appropriately.

Cyber Risk 63

Cyber Risk Government Cyber threats Accountability 63

Dark Reading

FEBRUARY 2, 2018

As APIs grow in prominence, top security concerns include bots and authentication.

Risk 61

Risk Authentication 61

Speaker: Sierre Lindgren

Fraud is a battle that every organization must face – it’s no longer a question of “if” but “when.” Every organization is a potential target for fraud, and the finance department is often the bullseye. From cleverly disguised emails to fraudulent payment requests, the tactics of cybercriminals are advancing rapidly. Drawing insights from real-world cases and industry expertise, we’ll explore the vulnerabilities in your processes and how to fortify them effectively.

Scams

WIRED Threat Level

FEBRUARY 2, 2018

The Devin Nunes memo that purports to show improper surveillance practices is out—and national security experts say it falls far short of the hype.

Surveillance 110

Surveillance 110

Kali Linux

JANUARY 29, 2018

“Whether you’re new to the fight, or a seasoned pro, don’t stop training…” This statement, like the video that introduced it, has real punch. We did this on purpose to get you fired up, excited about your training, and to kickstart your journey. If it worked, and you’re in the fight, welcome aboard! If you haven’t jumped in for whatever reason, we want to introduce you to the plethora of resources we’ve made available to help you master Kali Linux

Penetration Testing 52

Penetration Testing Encryption Firewall Social Engineering 52

Threatpost

FEBRUARY 1, 2018

A zero-day exploit targeting Adobe Flash Players has been reported by the South Korean Computer Emergency Response Team and confirmed by Adobe.

Malware 51

Malware Hacking 51

Dark Reading

FEBRUARY 1, 2018

The term is one of 1,100 new entries added to the Oxford English Dictionary this week.

Ransomware 59

Ransomware 59

Advertisement

Many software teams have migrated their testing and production workloads to the cloud, yet development environments often remain tied to outdated local setups, limiting efficiency and growth. This is where Coder comes in. In our 101 Coder webinar, you’ll explore how cloud-based development environments can unlock new levels of productivity. Discover how to transition from local setups to a secure, cloud-powered ecosystem with ease.

Software

WIRED Threat Level

JANUARY 27, 2018

The Doomsday Clock, #ReleaseTheMemo, and more of the week's top security news.

101

101

Spinone

FEBRUARY 2, 2018

Today, mobile devices, mostly tablets and smartphones, are widely expanding and becoming an integral part of our daily life. Users are increasingly storing their personal data on the devices, which they practically do not let out of their hands. It’s practical and useful, but at the same time, it gives rise to new problems. Easily accessible valuable information increases the risk of online threats.

Ransomware 40

Ransomware Malware Mobile Encryption 40

Threatpost

JANUARY 31, 2018

In 2017 Google removed apps that violated the Google Play policies because they were malicious, purposely copied a more popular app or served up inappropriate content.

Mobile 49

Mobile Malware 49

Dark Reading

FEBRUARY 1, 2018

Attackers looking to hijack systems for illegally mining digital currencies have begun eyeing business systems, security vendors say.

59

59

Advertisement

After a year of sporadic hiring and uncertain investment areas, tech leaders are scrambling to figure out what’s next. This whitepaper reveals how tech leaders are hiring and investing for the future. Download today to learn more!