Week in review: EasyJet breach, shadow IT risks, phishers bypassing Office 365 MFA
Here’s an overview of some of last week’s most interesting news and articles:
The dark web is flooded with offers to purchase corporate network access
In Q1 2020, the number of postings advertising access to these networks increased by 69 percent compared to the previous quarter. This may pose a significant risk to corporate infrastructure, especially now that many employees are working remotely.
EasyJet data breach: 9 million customers affected
British low-cost airline group EasyJet has revealed that it “has been the target of an attack from a highly sophisticated source” and that it has suffered a data breach.
Phishers are trying to bypass Office 365 MFA via rogue apps
Phishers are trying to bypass the multi-factor authentication (MFA) protection on users’ Office 365 accounts by tricking them into granting permissions to a rogue application.
Review: Kill Chain: The Cyber War on America’s Elections
Kill Chain is an HBO documentary made and produced by Simon Arizzone, Russell Michaels and Sarah Teale.
Over half of security leaders still rely on spreadsheets
Senior security leaders within financial services companies are being challenged with a lack of trusted data to make effective security decisions and reduce their risk from cyber incidents, according to Panaseer.
With increased DevOps adoption, roles in software development teams are changing
Roles across software development teams have changed as more teams adopt DevOps, according to GitLab.
Security threats associated with shadow IT
As cyber threats and remote working challenges linked to COVID-19 continue to rise, IT teams are increasingly pressured to keep organizations’ security posture intact. When it comes to remote working, one of the major issues facing enterprises is shadow IT.
Beware of phishing emails urging for a LogMeIn security update
LogMeIn users are being targeted with fake security update requests, which lead to a spoofed phishing page.
Mental Health Awareness Week: Coping with cybersecurity pressures amidst a global pandemic
In light of Mental Health Awareness Week, and as the discussion around employee wellbeing becomes louder and louder amidst the COVID-19 pandemic, we spoke with five cybersecurity experts to get their thoughts on how organisations can minimise the negative mental and physical impacts on newly-remote employees.
Security and the rapidly growing importance of mobile apps
Organizations are under more pressure than ever before to rapidly produce both new apps and updates to existing apps, not only because it’s essentially the only way they can interact with their customers, but also because there will be a flood of new users who previously relied on physical locations to conduct their business.
Chrome 83: Enhanced Safe Browsing, Secure DNS, a Safety Check
Google has released version 83 of it’s popular Chrome web browser, which includes new security and privacy features and fixes for security issues.
CEOs and CISOs disagree on cyber strategies
There are growing disparities in how CEOs and CISOs view the most effective cybersecurity path forward, according to Forcepoint.
Money is still the root of most breaches
Verizon has released its annual Data Breach Investigations Report (DBIR), which offers an overview of the cyber security incidents and data breaches that happened in/were discovered in the past year.
The missing link in your SOC: Secure the mainframe
How confident are you that your security visibility covers every critical corner of your infrastructure? A good SIEM solution will pull data across firewalls, servers, routers, and endpoint devices. But what if there is even one gap—one piece of equipment that can’t be monitored but contains business critical data?
Vulnerability in Qmail mail transport agent allows RCE
Qualys researchers have found a way to exploit an previously known (and very old) vulnerability in Qmail, a secure mail transport agent, to achieve both remote code execution (RCE) and local code execution.
Redefining business for a digital world with smart security decisions
Kurt John is Chief Cybersecurity Officer of Siemens USA, where he is responsible for the information security strategy, governance and implementation for the company’s largest market with ~$23B in annual revenues. In this interview with Help Net Security, he explores a variety of smart security decisions.
Identity-related breaches on the rise, prevention still a work in progress
The number of workforce identities in the enterprise is growing dramatically, largely driven by DevOps, automation, and an increase in enterprise connected devices, which will only continue to accelerate identity growth, an IDSA survey of 502 IT security and identity decision makers reveals.
Shifting responsibility is causing uncertainty and more security breaches
Data security is creating fear and trust issues for IT professionals, according to a new Oracle and KPMG report.
How secure are open source libraries?
Seven in 10 applications have a security flaw in an open source library, highlighting how use of open source can introduce flaws, increase risk, and add to security debt, a Veracode research reveals.
How a good user experience brings the pieces of the enterprise IT jigsaw together
Have you ever done a jigsaw puzzle with pieces missing? Or tried to do a complicated one with only part of the picture showing on the box lid? If so, you will know how it feels to be the folks working to create secure, robust, and seamless enterprise IT systems.
CISOs are critical to thriving companies: Here’s how to support their efforts
COVID-19 and the ensuing remote work requirements have made the problem worse. It’s clear that companies could be facing an existential crisis to their data security and that their best defenders are struggling to stay in the fight.
What do IGA solutions have in common with listening to music anywhere?
History clearly shows that the iPod and a few of its competitors were very successful in driving revenue and taking market share away from the legacy Personal Music Players. History also shows that the reign of these devices was short-lived. Just a decade after the release of MP3 players, they were almost entirely replaced by personal music player technology on a smart phone. Why did this happen?
Integrating a SIEM solution in a large enterprise with disparate global centers
Given the magnitude and complexity of the tasks performed by an SIEM solution, integrating it into the existing information security architecture of an enterprise can be daunting, especially when it comes to a large enterprise with multiple, disparate centers spread across the globe.
Create a safe haven for your customers to build loyalty
Financial institutions have been on the lookout for fraudulent transactions in hopes of preventing customers from falling victim to illegal fund withdrawal since the dawn of the digital age. Things like usernames and passwords have become less of a proof of identity and ownership in a world of endless data breaches.
Signal fixes location-revealing flaw, introduces Signal PINs
Signal has fixed a vulnerability affecting its popular eponymous secure communications app that allowed bad actors to discover and track a user’s location.
Less than a quarter of Americans use a password manager
A large percentage of Americans currently do not take the necessary steps to protect their passwords and logins online, FICO reveals.