Search

Cybersecurity in Education (K-12) with the CIS Controls
Blog

Cybersecurity in Education (K-12) with the CIS Controls

By Editorial Staff on Mon, 04/13/2020
Why is cybersecurity important to Education? Acknowledging recent reports of ransomware targeting educational institutions, it is no wonder that there have also been articles that attempt to lure in readers with “free” tools. What is disappointing is that these “free” tools are little more than marketing pieces that direct you to click on readily...
Cybersecurity
Compliance
CIS Controls
The MITRE ATT&CK Framework: Persistence
Blog

The MITRE ATT&CK Framework: Persistence

By Tripwire Researcher on Thu, 04/09/2020
When I first started researching ATT&CK last year, Persistence was the tactic which made me fall in love. Even though I have been in the industry for some time, I learned more from digging into the various techniques here than any other tactic. While I knew about fun tricks like replacing sethc.exe with cmd.exe and hitting the shift key a bunch of...
Tripwire Patch Priority Index for August 2022
Blog

Tripwire Patch Priority Index for March 2020

By Lane Thames on Mon, 04/06/2020
Tripwire's March 2020 Patch Priority Index (PPI) brings together important vulnerabilities from Microsoft and Adobe. Up first on the patch priority list this month are patches for Microsoft Browsers and Scripting Engine. These patches resolve information disclosure, remote code execution, and memory corruption vulnerabilities. Next on the list are...
COVID-19 Scam Roundup – April 6, 2020
Blog

COVID-19 Scam Roundup – April 6, 2020

By David Bisson on Mon, 04/06/2020
Digital fraudsters have seized upon coronavirus 2019 (COVID-19) as a lure for their new scams and attack campaigns. Together, these malicious operations constitute nothing short of a deluge. Barracuda revealed that it spotted 9,116 coronavirus-themed spear-phishing emails between March 1 and March 23, 2020—a 667% increase over the 1,188 attacks...
Results Speak Louder Than Words: A Guide to Evaluating ICS Security Tools
Blog

Results Speak Louder Than Words: A Guide to Evaluating ICS Security Tools

By Editorial Staff on Sun, 04/05/2020
Why leveraging live environment simulations and putting ICS tools to the test is the best way to evaluate their fitness. Track and field was one of my favorite sports growing up. I didn’t begin competitively participating until I was a teenager, but I was instantly hooked once I started. Why? Because the clock didn’t lie. The tape measure didn’t lie....
Industrial Control Systems
New Microsoft Spear-Phishing Attack Uses Exact Domain Spoofing Tactic
Blog

Nearly Half of Employees Don't Know What to Do When Ransomware Hits

By David Bisson on Thu, 04/02/2020
A survey revealed that approximately half of employees didn't know how to respond in the event their organization suffered a ransomware infection. In its survey of North American business employees, Kaspersky found that 45% of respondents overall did not know the proper steps they should take in response to a ransomware attack. Respondents whose...
Blog

Are You Ready for the Remote Work’s Toll on Corporate Security?

By David Henderson on Mon, 03/30/2020
Given the situation that many companies, organizations and government agencies have been forced into working remotely due to COVID-19, it is imperative to give some thought about corporate security. Using a VPN for New Stay-at-Home Workers Millions of employees are now working from the confines of their own homes in an effort to keep businesses running smoothly. In most situations, employees are...
PLEASE_READ_ME Ransomware Campaign Targeting MySQL Servers
Blog

Tupperware Website Compromised with Credit Card Skimmer

By David Bisson on Fri, 03/27/2020
Digital attackers compromised the website of kitchen and household products manufacturer Tupperware with a credit card skimmer. On March 20, researchers at Malwarebytes observed that attackers had compromised tupperware[.]com by hiding malicious code within an image file. This code activated when a user attempted to check out and complete their...
COVID-19 Scam Roundup – Week of 3/16/20
Blog

COVID-19 Scam Roundup – Week of 3/16/20

By David Bisson on Mon, 03/23/2020
Malicious actors are increasingly leveraging COVID-19 as a theme for new digital fraud attacks. In February 2020, for instance, Action Fraud received 21 reports of fraud relating to the coronavirus. This number of reports more than doubled to 46 between March 1 and March 13, 2020. Between March 14 and March 18, 2020, the United Kingdom's national...
The MITRE ATT&CK Framework: Initial Access
Blog

The MITRE ATT&CK Framework: Initial Access

By Tripwire Researcher on Mon, 03/23/2020
Although ATT&CK is not laid out in any linear order, Initial Access will be the point at which an attacker gains a foothold in your environment. This tactic is a nice transition point from PRE-ATT&CK to ATT&CK for Enterprise. What is different about the techniques within Initial Access is that they are more high-level than some of the other techniques...
Phorpiex Botnet Named "Most Wanted Malware" in November 2020
Blog

Food Delivery Website in Germany Targeted by DDoS Attackers

By David Bisson on Thu, 03/19/2020
Malicious individuals targeted a food delivery website located in Germany with a distributed denial-of-service (DDoS) attack. Jitse Groen, founder and CEO of the Germany-based food delivery service Takeaway (Lieferando.de), announced on March 18 that his company had suffered a DDoS attack. https://twitter.com/jitsegroen/status/1240332307262832642 In...
How Organizations Can Achieve Security Availability
Blog

How Organizations Can Achieve Security Availability

By Chris Hudson on Tue, 03/17/2020
We have seen great strides in improving security tooling and processes over the past ten years. Via constantly maturing security models, security teams have become increasingly dependent upon an ever-more complex toolchain of products and services. But what happens when these systems fail. How much effort are we putting into planning and maintaining...
Blog

The State of the Cybersecurity Market: Where We’ve Come, Where We’re Going

By Irfahn Khimji on Mon, 03/16/2020
There’s an interesting trend that I have personally noticed over the past few years: organizations are starting to take cybersecurity more seriously. With the multitude of high-profile data breaches, organizations are starting to realize that cybersecurity is a significant risk to the business. This allows CISOs and other similar titles with leadership responsibilities to have a larger budget for...
What is NERC? Everything you need to know
Blog

What is NERC? Everything you need to know

By Michael Betti on Tue, 10/03/2023
What is NERC?NERC stands for North American Electric Reliability Corporation. It is the organization behind ensuring the security and reliability of electric grids, and the NERC Critical Infrastructure Protection (CIP) reliability standard is the tool that provides responsible entities with the processes to achieve a crucial mandate: secure the...
Compliance
NERC CIP
Industrial Control Systems
New Microsoft Spear-Phishing Attack Uses Exact Domain Spoofing Tactic
Blog

Fraudsters Used Phishing Emails to Target Hotels in North America

By David Bisson on Wed, 08/14/2019
Fraudsters launched an attack campaign that distributed phishing emails designed to target the hotel industry in North America. In summer 2019, researchers at 360 Security Center discovered that bad actors had sent attack emails to financial personnel working at various hotels throughout North America. These emails informed recipients that their...
Tripwire Patch Priority Index for August 2022
Blog

Tripwire Patch Priority Index for July 2019

By Lane Thames on Tue, 08/13/2019
Tripwire's July 2019 Patch Priority Index (PPI) brings together important vulnerabilities from Microsoft and Oracle. First on the list for July are patches for Microsoft's Browser and Scripting Engine. These patches resolve 11 vulnerabilities including fixes for Memory Corruption weaknesses. Next on the list are patches for Microsoft Excel and...
Blog

CEO Cyber Quiz: What’s Your IT Security IQ?

By Guest Authors on Mon, 08/12/2019
Every business leader understands that, when it comes to cybersecurity, the stakes are extraordinarily high. CEOs tend to take notice when they read headlines about yet another big-name company being victimized by a massive data breach or about industry forecasts suggesting that the annual cost of crime losses and damage will hit $6 trillion by 2021. However, does that mean top business leaders...
Living the 7 Habits of Highly Effective Cybersecurity
Blog

Living the 7 Habits of Highly Effective Cybersecurity

By Guest Authors on Wed, 08/07/2019
The recent Tripwire blog ‘7 Habits of highly effective Vulnerability Management’ by Tim Erlin was a great read with some sage advice on the always relevant security topic of VM. I noticed, however, that although the seven points themselves were all Tim’s own, the title snappily paraphrased Steven Covey’s classic management book. This made me think....
New Microsoft Spear-Phishing Attack Uses Exact Domain Spoofing Tactic
Blog

Murfreesboro Discloses Security Incident Involving Water Resources Portal

By David Bisson on Mon, 08/05/2019
The City of Murfreesboro has disclosed a security incident involving the online portal for its Water Resources Customer webpage. In early August, IT personnel for the Rutherford County municipality detected some security issues affecting the online portal for the Water Resources Customer webpage. Tennessean reported that they decided to shut down...