Latest

Endpoint Security

Feds Warn Healthcare Entities of 'Evernote' Phishing Scheme

Marianne Kolbasuk McGee  •  August 12, 2022

A "secure message-themed" phishing campaign targeting healthcare providers aims to lure recipients to an Evernote notepad website in an attempt by hackers to harvest security credentials, federal authorities warn, saying the scheme puts entities at risk for potential data security compromises.

►

Anti-Money Laundering (AML)

ISMG Editors: Analyzing the Twilio Breach

Anna Delaney  •  August 12, 2022

In the latest weekly update, four ISMG editors discuss the breach of customer engagement platform Twilio, a cyberattack on the U.K.'s NHS that has reignited concerns about supply chain security in the healthcare sector, and the U.S. Treasury clamping down on shady cryptocurrency mixers.

Cybercrime

Ransomware Groups Refine Shakedown and Monetization Models

Mathew J. Schwartz  •  August 12, 2022

Ransomware-wielding attackers continue to seek new ways to maximize profits with minimal effort. Top tactics spotted recently by experts include continuing to partner with initial access brokers and botnet operators and testing new monetization models, such as "mediation as a service."

►

Governance & Risk Management

Zero Trust: Incorporate Critical, Systems, Design Thinking

Tom Field  •  August 12, 2022

Enterprises spend a lot of time on what zero trust is, but too little time on design thinking - and why cybersecurity solutions need that element baked in from the start. Brian Barnier and Prachee Kale of ThinkDesignCyber and CyberTheory Institute give an overview of their zero trust strategy.

►

Cybercrime

Cyber Insurance: A Helping Hand But Premiums Are Rising

Jeremy Kirk  •  August 12, 2022

Cyber insurance can defray costs associated with data breaches and ransomware attacks. But Kelly Butler of the advisory firm Marsh & McLennan Companies says insurers are tightening their requirements for policies due to rising costs associated with increasingly severe incidents.

Attack Surface Management

Black Hat: Incident Recovery, Threat Hunts & Blockchain Woes

Michael Novinson  •  August 12, 2022

Security executives at Black Hat USA 2022 discuss the latest cybersecurity trends from confidential computing and unified threat hunting languages to attack surface management and recovery services, social engineering campaigns and blockchain vulnerabilities.

►

Training & Security Leadership

Profiles in Leadership: Bruce Phillips

Tom Field  •  August 11, 2022

As CISO of West, a Williston Financial Group company, Bruce Phillips recognizes that cybersecurity is not the enterprise's core business. But what, then, is the right level of cybersecurity to bring to a nonsecurity business? He discusses this and other leadership challenges.

Governance & Risk Management

FTC Initiates Privacy and Data Security Rule-Making

David Perera  •  August 11, 2022

U.S. companies could see new cybersecurity rules and restrictions on consumer data collection under a rule-making process initiated by the FTC. No regulatory outcome is guaranteed, but today's advanced notice of proposed rule-making is a first step to new data security and privacy regulations.

Cyberwarfare / Nation-State Attacks

Cyber Operations Keep Affecting Civilians as War Continues

Anna Delaney  •  August 11, 2022

The ISMG Security Report discusses how cyberattacks and operations tied to the Russia-Ukraine war have been affecting civilians since the start of Russia's invasion, whether a practicing cardiologist living in Venezuela is also a ransomware mastermind and effective bot management tooling strategies.

Application Security

Secrets in the Code: Open-Source API Security Risks

Steve King  •  August 11, 2022

In this episode of "Cybersecurity Unplugged," Apiiro's Moshe Zioni, vice president of security research, discusses the company's "Secrets Insights 2022" report on the real-world risks of hardcoded secrets across the software supply chain and how to mitigate the potential damage they can cause.

Black Hat

Krebs to Vendors at Black Hat: No More 'Band-Aid' Approach

Michael Novinson  •  August 11, 2022

Black Hat USA 2022 opened with somber warnings from Chris Krebs about why application developers, vendors and the government need to solve major industry challenges. Key security executives also discussed DNS visibility, cloud security, patch management, APT strategies and supply chain woes.

Fraud Management & Cybercrime

Hardware MFA Stops Attack on Cloudflare

Mihir Bagwe  •  August 10, 2022

Cloudflare credits hardware multifactor authentication with preventing bad actors behind a targeted phishing campaign from gaining access to its internal systems. Although attackers siphoned employee credentials, the hard key authentication requirement stopped attackers from snatching a soft token.