FDA Calls for 'Cybersecurity Bill of Materials' for Devices

Marianne Kolbasuk McGee • October 19, 2018

Before marketing their medical devices, manufacturers should prepare a "cybersecurity bill of materials" that lists components that could be susceptible to vulnerabilities, according to a draft of updated FDA premarket guidance.

Blockchain & Cryptocurrency

Medtronic Cardiac Devices Recalled Due to Cyber Concerns

Latest

Authentication

Heads-Up: Patch 'Comically Bad' libSSH Flaw Now

Jeremy Kirk • October 19, 2018

Attention admins: If you use libSSH - one of the open-source flavors of Secure Shell, or SSH - patch now. The advice follows the disclosure of a vulnerability that one expert, Paul Ducklin of Sophos, terms "comically bad."

Cybersecurity

UK Cyberattack Investigations: An Analysis

Nick Holland • October 19, 2018

The latest edition of the ISMG Security Report features an analysis of the results of over 1,000 cyberattack investigations in the U.K. Also: an update on the proposed NIST privacy framework and a report on voter registration information for sale on the dark web.

Cybercrime

Facebook Eyes Spammers for Mega-Breach

Mathew J. Schwartz • October 18, 2018

Facebook is eyeing spammers as being the culprits behind its recently disclosed mega-breach, The Wall Street Journal reports. Preliminary findings from Facebook's internal investigation suggest that the attackers were not affiliated with a nation-state, but rather part of a known spam ring, the newspaper reports.

Blockchain & Cryptocurrency

Report: Cryptocurrency Exchanges Lost $882 Million to Hackers

Jeremy Kirk • October 18, 2018

An analysis of attacks against cryptocurrency exchanges over nearly two years shows hackers have inflicted $882 million in damages, according to the Russian security firm Group-IB. The tally of losses is likely to grow next year, the company warns.

Cybercrime

US Voter Records for Sale on Hacker Forum

Jeremy Kirk • October 16, 2018

A batch of U.S. voter registration records from 20 states has appeared for sale online in what appears to be an illegitimate offering. While it's far from the largest-ever seen leak of voter data, the incident again highlights the lax controls too often applied to voter records.

Anti-Phishing, DMARC

10 Cyberattacks Investigated Weekly by UK

Mathew J. Schwartz • October 16, 2018

The U.K.'s National Cyber Security Center incident response teams have investigated more than 1,000 significant incidents in the past two years, the majority of which trace to nation-state attackers, officials say.

Breach Notification

Pentagon Travel Provider Data Breach Counts 30,000 Victims

Mathew J. Schwartz • October 15, 2018

The Pentagon is warning that a data breach at a third-party travel management service provider exposed records for an estimated 30,000 civilian and military personnel. The breach alert follows a recent GAO report warning of serious cybersecurity shortcomings in U.S. weapon systems.

Governance

Update: NIST Preparing Privacy Framework

Nick Holland • October 15, 2018

Building on the success of the NIST Cybersecurity Framework, the National Institute of Standards and Technology is in the early stages of developing a privacy framework. The effort will kick off with a workshop Tuesday in Austin, Texas, explains Naomi Lefkovitz, who is leading the project.

Cybersecurity

RSA President on the Case for a Risk-Based Security Model

Geetha Nandikotkur • October 15, 2018

CISOs and other security practitioners are embracing the idea of a business-driven security model that takes a risk-oriented approach, says Rohit Ghai, president of RSA. "Cybersecurity conversations are becoming business conversations rather than technology conversations."

Breach Response

Facebook Clarifies Extent of Data Breach

Howard Anderson • October 12, 2018

Facebook now says that 20 million fewer accounts were breached than it originally believed, but the attackers accessed extensive sensitive personal information on nearly half of those affected.

Cybercrime

Criminals' Cryptocurrency Addiction Continues

Mathew J. Schwartz • October 12, 2018

Cryptojacking - the hidden mining of virtual currencies - continues to be a focus for online attackers. As the detection of cryptocurrency mining malware continues to rise, Europol warns that cryptojacking will remain "a regular, low-risk revenue stream for cybercriminals."

Endpoint Security

Review Shows Glaring Flaws In Xiongmai IoT Devices

Jeremy Kirk • October 12, 2018

Millions of internet-of-things devices made by the Chinese company Xiongmai and sold in stores such as Home Depot and Wal-Mart still have glaring security problems, a security consultancy warns. The findings come two years after the Mirai botnet targeted Xiongmai devices.