Cyberattacks remain a critical security threat for healthcare sector entities and a danger to patient safety, some experts warn.

Federal Authorities, Patient Safety Experts Warn of Risks

Marianne Kolbasuk McGee • January 21, 2022

Cyberattacks remain a critical security concern - and a top patient safety hazard - for the healthcare and public health sector in 2022, federal authorities and other experts warned this week. Will recent takedowns of ransomware criminal gang members by law enforcement agencies help?

3rd Party Risk Management

Clinic Breach Affecting 200,000 Tied to Vendor's 2020 Attack

Latest

Application Security

Twitter: Head of Security Reportedly Fired; CISO to Leave

Prajeet Nair • January 22, 2022

Twitter has said it is firing Peiter "Mudge" Zatko, the network security expert it hired in November 2020 as head of security. The security team changes - the CISO is also set to depart - follow "an assessment of how the organization was being led," according to a corporate memo shared with The New York Times.

Application Security

ISMG Editors: Will Ransomware Kill Cyber Insurance?

Anna Delaney • January 21, 2022

In the latest weekly update, four ISMG editors discuss the state of cyber insurance today and why its future is uncertain; applying a security-by-design reliability model to analyze vulnerabilities; and how Russia takes down members of the REvil ransomware group as cyber aggressions in Ukraine rise.

3rd Party Risk Management

From the Trenches: Remediating Widespread Apache Log4j Flaw

Mathew J. Schwartz • January 21, 2022

Although flaws in Apache Log4j software that need remediating remain widespread in organizations, "some of them are aware of the issue, some of them aren't aware of the issue, and likely this issue is going to be persisting with us for many, many years," says Jeff Macko, an offensive security expert at Kroll.

Application Security

Ukraine Cyber Attacks: A Case of Hacktivism?

Anna Delaney • January 21, 2022

The latest edition of the ISMG Security Report features an analysis of whether the cyberattacks that hit Ukraine's government agencies last week are attributable to any group or nation-state along with updates to the cybersecurity executive order and illicit cryptocurrency trends.

Endpoint Security

Israeli Officials Deny Claims of Improper Spyware Use

Dan Gunderman • January 20, 2022

New developments have emerged in the case of the Israel Police allegedly using the flagship spyware of NSO Group, Pegasus, on its own citizens, with reported targets including critics of former Prime Minister Benjamin Netanyahu, among others. Following a bombshell local report, high-ranking Israeli officials have...

Cloud Security

Biden Memo Orders Cybersecurity Improvements

Dan Gunderman • January 20, 2022

U.S. President Joe Biden today signed a National Security Memorandum that aims to improve the cybersecurity of national security systems. The memo gives new powers to the NSA to oversee cybersecurity improvements such as the use of the multifactor authentication, encryption and endpoint detection services.

Application Security

Log4Shell Update: VMware Horizon Targeted

Prajeet Nair • January 19, 2022

Attackers have been actively targeting Log4j vulnerabilities, or Log4Shell, vulnerabilities in the servers of virtualization solution VMware Horizon to establish persistent access via web shells, according to an alert by the U.K. National Health Service.

Endpoint Protection Platforms (EPP)

McAfee Enterprise and FireEye Products Rebrand as Trellix

Mathew J. Schwartz • January 19, 2022

Endpoint detection and response software news: The entity formerly known as McAfee Enterprise and FireEye Products has a new name: Trellix. Think of a "security trellis to businesses across the globe, giving them support they need to keep them safe," says CEO Bryan Palma. Will customers and prospects buy in?

General Data Protection Regulation (GDPR)

Privacy Fines: GDPR Sanctions in 2021 Exceeded $1 Billion

Mathew J. Schwartz • January 18, 2022

Privacy regulators in Europe last year imposed known fines totaling more than $1.2 billion under the EU's General Data Protection Regulation, including two record-breaking sanctions, law firm DLA Piper finds. The total value of fines in 2021 was nearly a sevenfold increase from that seen in 2020.

Fraud Management & Cybercrime

NSO Group Spyware Reportedly Used by Israeli Police Force

Dan Gunderman • January 18, 2022

Spyware from controversial Israeli firm NSO Group was reportedly used by the nation's civilian police force, according to a new report from an Israeli business publication. Its findings allege that the Israel Police conducted warrantless phone taps on Israeli politicians and activists, among others.

Cyberwarfare / Nation-State Attacks

New Chinese Threat Group Deals in Espionage and Theft

Mihir Bagwe • January 18, 2022

A new threat group linked to China, dubbed "Earth Lusca" by researchers, is not only running cyberespionage campaigns against governments around the globe, but also seeking financial gain.

Cyberwarfare / Nation-State Attacks

EU's Cyber Rapid Response Team on Standby for Ukraine

Prajeet Nair • January 18, 2022

After the defacement of multiple Ukrainian government websites last week and subsequent deployment of destructive malware against Ukraine over the weekend, Lithuanian officials have offered to deploy the EU's Cyber Rapid Response Team to help Ukraine deal with cyberattacks.