Latest

►

Governance & Risk Management

CCPA Enforcement: What to Expect Now

Anna Delaney  •  July 8, 2020

Attorney Sadia Mirza, offers an update on the July 1 California Consumer Privacy Act enforcement and what security and privacy professionals should expect over the next few months.

Anti-Phishing, DMARC

Microsoft Seizes Domains Used for COVID-19 Phishing Scam

Doug Olenick  •  July 7, 2020

A U.S. federal court has issued an injunction that gives Microsoft permission to seize control of several malicious domains being used to operate a COVID-19-themed phishing scam, according to recently unsealed court documents.

Cybercrime

Russian BEC Gang Targets Hundreds of Multinational Companies

Akshaya Asokan  •  July 7, 2020

A newly uncovered Russia-based business email compromise gang has been targeting hundreds of large, multinational corporations in over 40 countries since 2019, according to the security firm Agari.

Endpoint Security

More Than 1,000 IoT Security Guidelines: Which One to Use?

Jeremy Kirk  •  July 7, 2020

With more than 1,000 IoT security guidelines, recommendations and best practices, which ones should an organization follow? Researchers at Carleton University in Canada say 91 percent of the guides are outcome-based, which are not necessarily easy for manufacturers to follow.

Cybercrime

Purple Fox Malware Targets More Vulnerabilities

Ishita Chigilli Palli  •  July 7, 2020

The developers behind the Purple Fox fileless downloader malware recently upgraded their operation and are now targeting two new vulnerabilities to gain access to networks, according to a report by security firm Proofpoint.

COVID-19

Essential Security Steps During COVID-19 Crisis

Marianne Kolbasuk McGee  •  July 7, 2020

Healthcare provider organizations, pharmaceutical companies and medical device manufacturers all must take critical security steps to avoid becoming victims of data breaches during the COVID-19 pandemic, says technology attorney and former physicist Phil Crowley.

Business Continuity Management / Disaster Recovery

Ransomware + Exfiltration + Leaks = Data Breach

Mathew J. Schwartz  •  July 7, 2020

Ransomware-wielding attackers continue to pummel organizations. But labeling these as being just ransomware attacks often misses how much these incidents involve serious network intrusions, exfiltration of extensive amounts of data, data leaks and, as a result, reportable data breaches.

Cybercrime

Patching Urged as F5 BIG-IP Vulnerability Exploited

Ishita Chigilli Palli  •  July 6, 2020

Security researchers warn that the number of exploit attempts targeting a critical vulnerability in F5 Networks' BIG-IP networking products has steadily increased since the company first announced the flaw late last week. They urge users to immediately apply patches.

►

Identity & Access Management

Progress Report: FIDO's Effort to Eliminate Passwords

Anna Delaney  •  July 6, 2020

Andrew Shikiar, executive director at the FIDO Alliance, offers an update on the group's efforts to reduce reliance on passwords and discusses how to overcome barriers.

Cybercrime

North Korean Hacking Infrastructure Tied to Magecart Hits

Mathew J. Schwartz  •  July 6, 2020

Hackers with apparent ties to North Korea have extended their bag of online attack tricks beyond cryptocurrency mining, online bank heists and ransomware. Now, they're also hitting e-commerce merchants in the U.S. and Europe with Magecart attacks to steal payment card data, security firm Sansec reports.

Account Takeover

Hey Alexa. Is This My Voice Or a Recording?

Jeremy Kirk  •  July 6, 2020

Voice-controlled assistants can be fooled by replaying a recording of someone's voice. But researchers with Australia's Commonwealth Scientific and Industrial Research Organization and Samsung Research say they've developed a lightweight software tool to detect such attempts, which are difficult to defend against.

Fraud Management & Cybercrime

How Ekans Ransomware Targets Industrial Control Systems

Akshaya Asokan  •  July 4, 2020

Researchers with FortiGuard Labs have uncovered two samples of the Ekans ransomware strain that offer some additional insight into how the crypto-locking malware targets industrial control systems, according to a new report. Ekans, also known as Snake, was first spotted earlier this year.