The Hack the DTS bug bounty program uncovered dozens of vulnerabilities in the Defense Travel System serving the Department of Defense. On 30 May, vulnerability coordination platform HackerOne revealed the results of Hack the DTS. Nineteen trusted security researchers participated in the 29-day program and submitted 100 vulnerability reports over...

The world is full of first responders. You may not realize it, but you will know someone who is a first responder. Typically, one would associate a first responder with the three main emergency professions: Ambulance, Police and Fire. Within the Ambulance profession, that person who is first on the scene to deliver medical assistance to a poorly...

Tripwire's May 2018 Patch Priority Index (PPI) brings together the top vulnerabilities from Microsoft and Adobe. First on the patch priority list this month are patches for Microsoft Browsers and Scripting Engine. The patches for Internet Explorer resolve a security feature bypass vulnerability and the patches for Edge resolve memory corruption,...

An insurance software provider exposed clients' sensitive data that it had stored on an Amazon Simple Storage Solution (S3) bucket. Andrew Lech, founder of AgentRun, confirmed the breach in an email sent out to the insurance agency management software company's clients. As quoted by ZDNet: We were migrating to this bucket during an application...

It's been a full year since the new administration issued its first cyber executive order, “Presidential Executive Order (EO) on Strengthening the Cybersecurity of Federal Networks and Critical Infrastructure,” with an emphasis on leadership accountability and a risk management approach to cybersecurity strategies, policies and practices. The EO...

As blockchain technology becomes an increasingly popular option for companies searching for secure business solutions, we’re seeing more use cases for the network and smart contracts. A smart contract is a computer protocol that is used to digitally facilitate, verify and enforce the performance of credible transactions without the need for a third...

Fraudsters contacted two Canadian banks claiming they stole tens of thousands of customers' personal and account information. Simplii Financial, the direct banking brand for the Canadian Imperial Bank of Commerce (CIBC), disclosed on 28 May that fraudsters had contacted CIBC a day earlier and claimed...

Last time, I had the honor of speaking with Veronica of DFIRLABS. She’s a self-described cyborg who got into cybersecurity early and has a passion for reverse engineering code. This time, I got to speak with Anna Westelius. Not only is she a web security specialist; she also has experience with Linux driver development. What do Anna and I have in...

I had the opportunity to attend the Knowledge18 conference this past week, and from the registration to closing, I’ve never been to a show that's had so much energy. Knowledge18 staff would start the morning with a DJ playing music and with the staff energetically greeting attendees/sponsors while moving to the music. The Tripwire booth also had...

At least half a million routers and storage devices in dozens of countries around the world have been infected by a sophisticated botnet, in preparation for an alleged planned cyber attack on Ukraine. The botnet, which has been given the rather unglamorous name of VPNFilter, is believed to be likely to be controlled by a state-sponsored hacking...

Mozilla announced the rollout of two-step verification (2SV) as an optional security feature for all Firefox user accounts. The engineers at Mozilla Foundation designed the feature without support for SMS-based codes. They likely did so for the same reasons as Twitter when it moved away from this form of verification in December 2017. Criminals...

If breaches to electronic health record systems continue at their current pace, each and every American can expect their private medical data to be compromised at least once by 2024. Once adversaries obtain a patient’s health information (PHI), they can sell it to the highest bidder—leaving targets vulnerable to all manner of fraud and theft....

Regular readers of The State of Security should now have a general understanding of why organizations need security for their containers. But they still might be a bit fuzzy on the specifics. In particular, they might still be unclear on the types of threats they need to address as well as the container areas that are most at risk. This knowledge is...

The Information Commissioner's Office (ICO) fined the University of Greenwich £120,000 for a "serious" security breach of personal data. On 21 May, the United Kingdom's Information Commissioner announced the fine. It's the first time the ICO has levied such a penalty against a university under the...

According to the Mayo Clinic, plaque in your arteries and inflammation are usually to blame for coronary artery disease. Left unchecked, plaque buildup narrows arteries, decreasing blood flow to your heart and eventually causing chest pain (angina) and other symptoms. Because this develops over decades, you might not notice a problem until you have a...

Last time, I got to speak with Leila Powell. She went from astrophysics to an exciting career as a security data scientist. This time, I have the pleasure of speaking with Veronica Schmitt of DFIRLABS, otherwise known as @M4lw4r3z_G1rl. She enjoys reverse engineering code, and she considers herself to be a cyborg! Kim Crawley: Please tell me about...

The Payment Card Industry Security Standards Council (PCI SSC) published a minor revision to version 3.2 of its Data Security Standard (PCI DSS). On 17 May, PCI SSC published PCI DSS version 3.2.1. The purpose of the update was to clarify organizations' use of the Standard and when they would need to upgrade their use of common cryptographic...

The latest revision to PCI DSS, PCI 3.2, provides specific security guidance on the handling, processing, transmitting and storing of credit card data. PCI 3.2 presents an opportunity for retail, healthcare, finance and hospitality organizations to minimize the theft, exposure and leakage of their customer’s personal and financial credit information...

When transitioning to a DevOps model, organizations must remember that people are essential to a successful switchover. It's people who must learn new workflows, collaboration techniques, and tools during the move. This process will cause at least some disruption over a period as long as two years. Needless to say, they will need patience and ample...