Latest

Cybercrime

US Voter Records for Sale on Hacker Forum

Jeremy Kirk  •  October 16, 2018

A batch of U.S. voter registration records from 20 states has appeared for sale online in what appears to be an illegitimate offering. While it's far from the largest-ever seen leak of voter data, the incident again highlights the lax controls too often applied to voter records.

Anti-Phishing, DMARC

10 Cyberattacks Investigated Weekly by UK

Mathew J. Schwartz  •  October 16, 2018

The U.K.'s National Cyber Security Center incident response teams have investigated more than 1,000 significant incidents in the past two years, the majority of which trace to nation-state attackers, officials say.

Governance

Update: NIST Preparing Privacy Framework

Nick Holland  •  October 15, 2018

Building on the success of the NIST Cybersecurity Framework, the National Institute of Standards and Technology is in the early stages of developing a privacy framework. The effort will kick off with a workshop Tuesday in Austin, Texas, explains Naomi Lefkovitz, who is leading the project.

Cybersecurity

RSA President on the Case for a Risk-Based Security Model

Geetha Nandikotkur  •  October 15, 2018

CISOs and other security practitioners are embracing the idea of a business-driven security model that takes a risk-oriented approach, says Rohit Ghai, president of RSA. "Cybersecurity conversations are becoming business conversations rather than technology conversations."

Breach Response

Facebook Clarifies Extent of Data Breach

Howard Anderson  •  October 12, 2018

Facebook now says that 20 million fewer accounts were breached than it originally believed, but the attackers accessed extensive sensitive personal information on nearly half of those affected.

Endpoint Security

Review Shows Glaring Flaws In Xiongmai IoT Devices

Jeremy Kirk  •  October 12, 2018

Millions of internet-of-things devices made by the Chinese company Xiongmai and sold in stores such as Home Depot and Wal-Mart still have glaring security problems, a security consultancy warns. The findings come two years after the Mirai botnet targeted Xiongmai devices.

An Assessment of Google's Data Leak

Nick Holland  •  October 12, 2018

An in-depth report on the exposure of personal details for 500,00 Google+ accounts leads the latest edition of the ISMG Security Report. Also featured: an update on mitigating the risk of business email compromises and tips for protecting critical infrastructure.

Governance

Network vs. Endpoint Security: Striking the Right Balance

Varun Haran  •  October 12, 2018

With so much focus on endpoint security, it's important not to overlook the importance of network-level security controls, says Lawrence Orans, research vice president at Gartner.

Data Breach

Google Forced to Reveal Exposure of Private Data

Jeremy Kirk  •  October 9, 2018

Google blames a bug in an API for its Google+ social networking service for exposing personal details of about 500,000 users' accounts, but says it doesn't believe the information was misused. The company was forced to acknowledge the March incident after it was reported by The Wall Street Journal.

Business Email Compromise (BEC)

CEO Fraud: Barriers to Entry Falling, Security Firm Warns

Jeremy Kirk  •  October 8, 2018

Barriers to getting into the business email compromise - aka CEO fraud - game continue to fall, with security vendor Digital Shadows finding that compromised email accounts for a company's finance department can typically be purchased via the black market for just $150 to $500.

Cybercrime

Dutch and British Governments Slam Russia for Cyberattacks

Mathew J. Schwartz  •  October 5, 2018

The British and Dutch governments have issued a strong rebuke to the Russian government over an ongoing series of "Fancy Bear" hack attacks that they say were launched by Russia's military intelligence agency Russian Main Intelligence Directorate, aka the GRU.

Cyberwarfare / Nation-state attacks

Report: Chinese Spy Chip Backdoored US Defense, Tech Firms

Jeremy Kirk  •  October 5, 2018

Did the Chinese government pull off one of the most secretive hardware hacks of all time? That's what information security experts are pondering after a Bloomberg report described an espionage operation that purportedly planted a tiny spying chip on widely distributed server motherboards.