Week in review: Crafty Office 365 phishing, how DNS firewalls can burn security teams
Here’s an overview of some of last week’s most interesting news and articles:
Phishers targeting Office 365 admins have a new trick up their sleeve
Phishers targeting Office 365 admins have a new trick up their sleeve: they are checking the credentials entered into the spoofed login page in real-time and, if they are valid, the victims are redirected to their real Office 365 inbox.
Healthcare’s blind spot: Unmanaged IoT and medical devices
Depending on who you ask, in the U.S. there are, on average, either a handful or between 10 to 15 connected devices per bed, and keeping an eye on them is a difficult.
How DNS firewalls can burn security teams
If, as a technology leader, you want to proactively protect your organization, you need to be leveraging DNS in a more intelligent way.
Securing modern web apps: A case for framework-aware SAST
Frameworks are software that has been architected to ease, automate, and structure one or more aspects of application development. Just as there are varied subsystems and functions in a web application, there are frameworks that provide cookie-cutter implementations of those subsystems, which the application developer need not write.
Security or compliance? Stop choosing between them
Compliance can be one tactical execution of a great security strategy or potentially a bureaucratic check-the-box effort. While security and compliance share similar goals, IT too often meets specific requirements for system compliance but misses the underlying security needs of the whole organization.
Tricking attackers through the art of deception
In cybersecurity, deception is redundant if it cannot fulfill its critical aim – to misdirect, confuse, and lure attackers into traps and dead-ends. It is the art of tricking attackers into overextending and exposing themselves. To deceive attackers, an organization’s security team must see things from the adversary’s perspective.
Data breach fallout haunts companies long after the fact
Data breaches have become a priority in most business’ cybersecurity agenda. The series of breaches that companies experienced in 2018 emphasized what security experts have warned about – that threats are ever present and persistent.
Released: PoC for RCE flaw in Palo Alto Networks firewalls, gateways
Palo Alto Networks has silently patched a critical remote code execution vulnerability in its enterprise GlobalProtect SSL VPN, which runs on Palo Alto Networks’ firewall devices.
How AI can improve user experience and security for the finance industry
For the last 50 years, the fundamental and largely unchanged model for identifying and authenticating users has been based on the combination of a username and password, sometimes augmented with “second factor” techniques.
Ransomware attack leaves Johannesburg residents without electricity
A ransomware attack aimed at City Power, the electricity provider for Johannesburg (aka Joburg), South Africa, has resulted in some residents temporarily without power.
What you should know about the Equifax data breach settlement
Equifax has agreed to pay at least $575 million, and potentially up to $700 million, as part of a global settlement with the Federal Trade Commission, the Consumer Financial Protection Bureau (CFPB), and 50 U.S. states and territories.
The need for scalable OT security
Recent incidents such as the attack against Norsk Hydro have proven yet again that any OT network, whether operating a manufacturing plant, critical infrastructure, or a smart building, can be the next victim of a cyberattack. Asset owners need to protect themselves.
Cyberthreats targeting municipalities are on the rise
Through the first half of 2019, a growing number of municipalities across the US were hit with crippling ransomware attacks, while several large companies disclosed data breaches that exposed more than 625 million records.
Thwart the pressing threat of RDP password attacks
How long does it takes for Internet-facing, RDP-enabled computers to come under attack? In some cases, a few minutes. In most, less than 24 hours.
If you’re struggling with Windows 10 migration, updates will be an even bigger challenge
With the end of Windows 7 support on the horizon, many companies remain significantly behind in completing their Windows 10 migration, new data from 1E shows.
Average data breach cost has risen to $3.92 million
The cost of a data breach has risen 12% over the past 5 years and now costs $3.92 million on average, according to IBM. These rising expenses are representative of the multiyear financial impact of breaches, increased regulation and the complex process of resolving criminal attacks.
FTC wants Facebook to boost accountability and transparency, imposes $5 billion penalty
Facebook has to pay a $5 billion penalty and submit to new restrictions and a modified corporate structure that will hold the company accountable for the decisions it makes about its users’ privacy, to settle Federal Trade Commission charges that the company violated a 2012 FTC order by deceiving users about their ability to control the privacy of their personal information.
Most SMBs have not identified and documented cybersecurity threats
A majority of small and medium-sized businesses (SMBs) do not have cybersecurity protection at the top of their agenda and are highly prone to risks and vulnerabilities, according to ConnectWise.
50% of organizations believe attackers can infiltrate their networks each time they try
According to the CyberArk Global Advanced Threat Landscape 2019 Report, less than half of organizations have a privileged access security strategy in place for DevOps, IoT, RPA and other technologies that are foundational to digital initiatives.
How to improve the hiring and retaining of infosec professionals?
The cybersecurity staffing and skills shortage is a well-known reality and the situation is predicted to get worse in the coming years.
Current methods for anonymizing data leave individuals at risk of being re-identified
With the first large fines for breaching GDPR upon us, even anonymized datasets can be traced back to individuals using machine learning, researchers from University of Louvain and Imperial College London have shown.
New infosec products of the week: July 26, 2019
A rundown of infosec products released last week.