The instant a device is connected to the internet, it gets scanned and interrogated for open ports, software versions, and default passwords. Who conducts these scans and why? When you connect to the internet, what kind of attacks will you immediately see? The days of mass exploitation are upon us and encouraged, in part, by the rise of the Internet...

It’s the fifth requirement in CIS Control 1: Use a passive asset discovery tool. Sounds simple enough. But what does it mean? And what, specifically, makes it so important that it became one of the first five requirements of the widely applied CIS Controls used by so many organizations to establish their most basic levels of cyber hygiene? The...

A data security incident at a pediatric hospital affected more than 100,000 individuals including patients and employees. On 20 July, the Boys Town National Research Hospital published a "Notice of Data Security Incident" on its website. According to this statement, the Omaha-based medical...

On the heels of last month’s White House reorganization plan, the state of cybersecurity careers within the government is changing. In part, this plan aims to address several pressing issues in the job category within the context of government employment and to attract top talent to otherwise staling roles. Over the past few years, government...

Last time, I got the opportunity to speak with Jessica Hebenstreit. Not only is she a senior security consultant who has had a lot of different roles; she’s also the chief Operating Officer of the Diana Initiative. I learned a lot from our discussion. This time, I got to speak with Monica Jain, co-founder of LogicHub Inc. It takes a lot of hard work...

In the age of DevOps, application security is an increasing concern for organizations. But attention on application-specific security bugs is comparatively low. We have extensive online security scanners for testing online threats, but they are not so effective for detecting security vulnerabilities that are application-specific in Python, Node.js...

According to a new report, popular smartphone games such as "Clash of Clans" are being used to launder hundreds of thousands of dollars on behalf of credit card thieves. Researchers at Kromtech Security describe how they first came across the money-laundering ring in mid-June when they analyzed an unsecured MongoDB database. The database, which was...

What does a human need to survive? Typically, the first two items are food and water followed by a place live. Most of us take for granted that our water supply is always safe and drinkable. As such a vital resource, one would think that the critical infrastructure that purifies and monitors water must be completely secure at all times....

Four healthcare IT companies warned that a primary health organization (PHO) put up to 800,000 patients' medical data at risk. On 17 July, New Zealand and Australian healthcare companies HealthLink, Medtech Global, myPractice and Best Practice Software New Zealand sent a letter to New Zealand's...

Ukrainian law enforcement personnel thwarted a digital attack that targeted equipment owned and operated by a chlorine station. The Security Service of Ukraine According to Interfax, the Security Service of Ukraine (SUB) detected an attempt to attack the LLC Aulska chlorine station. Located in the...

So, you recognize that insider threats are a considerable risk inside your company? Just imagine how serious those threats are for a business that designs mobile spyware for helping law enforcement and intelligence agencies spy on "people of interest." NSO Group is a firm that, in its own words, provides "authorized governments with technology that...

Tripwire's June 2018 Patch Priority Index (PPI) brings together the top vulnerabilities from Microsoft and Adobe. First on the patch priority list this month are patches for Adobe Flash Player for Windows, Macintosh, Linux and Chrome OS. These Adobe Flash patches address type confusion, integer overflow, out-of-bounds read and stack-based buffer...

Facebook announced it is notifying more than 800,000 affected users after a bug temporarily reset certain account privacy settings. The social media giant said the bug allowed users who had been previously blocked on both Facebook and Messenger to become unblocked. In a statement, the company said the bug was live for about a week – between May 29...

As we all know by now, the human factor is crucial to enterprise security. Cyber attacks routinely exploit vulnerable human behaviors to gain entry, since organizations must trust their own people—or at least some of them—with access to critical systems. Humans make decisions on risk tradeoffs, funding for security programs, adherence to policies, and...

Multinational apparel design and manufacturing corporation Adidas alerted customers of an incident that possibly affected the security of their data. On 28 June, Adidas' headquarters located in Herzogenaurach, Germany posted a statement about the incident to its website. The notice revealed that Adidas first learned about the issue two days earlier...

An American restaurant chain revealed it suffered a data breach affecting customers' payment card details at most of its locations. On 22 June, PDQ issued a statement explaining that a malicious attacker obtained unauthorized access to its computer system and acquired the names, credit card numbers,...

Healthcare organizations continue to face relentless cyberattacks owing to the immense value placed on patient health information on the dark web. Patient records have almost everything the attacker needs to carry out sophisticated insurance fraud schemes, purchase medical supplies or drugs, or commit other types of fraud including outright identity...

Computer security experts have discovered an unusual attack targeting users of Android devices. As researchers Yonathan Klijnsma and Aaron Inness explain on the RIskIQ blog, the attack starts with a relatively pedestrian fake warning message that popped-up on some Android users' devices as they browsed the web. The warning message is customized to...

The State of Security's countdown of the FBI’s 10 most-wanted black-hat hackers is nearly over. Just two criminals remain. At number two is Evgeniy Mikhailovich Bogachev, the leader of a cybercrime ring responsible for writing and promulgating Gameover Zeus. On 22 August 2012, a federal grand jury in Nebraska indicted Bogachev on several charges,...

Mobile platforms and the internet have brought about massive potential and real value to many companies. This evolution has made mobile enterprise systems an essential business function, becoming a top priority for any company serious about its growth. The ability of mobile technology to improve productivity and efficiency and drive greater ROI is...