Creating a thorough and effective security program is difficult enough when your data is stored on-premises. But most organizations and agencies straddle hybridized on-prem and cloud environments—or they’re cloud-native entirely. This complicates the role of cybersecurity teams who now need tools that can traverse multiple environments without missing...

On 11 May 2017, President Trump issued the Executive Order, Strengthening the Cybersecurity of Federal Networks and Critical Infrastructure. This directive, among other things, identified agency heads as those who are ultimately responsible for managing cybersecurity risk within executive departments. In service of that purpose, the White House...

South Korean cryptocurrency exchange Coinrail said it's cooperating with law enforcement after suffering a hacking attempt. In a statement posted to its website, Coinrail revealed it was working with police to investigate an incident that might have exposed 30 percent of the total number of coins traded on the exchange. It placed the remaining 70...

For the better part of a decade, I have spent a good amount of time analyzing security and compliance frameworks. There is beauty to be found in every one of them. Some are very high level and leave the organization to interpret how to implement the various controls, such as the CIS Critical Security Controls. Others are incredibly prescriptive and...

I’m pleased to announce that next month, I will be offering the two-day training series A Guided Tour of Embedded Software Hacks at Shakacon X as well as at Black Hat USA in August. As a reminder, I will also be back at SecTor with reloaded material for a one-day Brainwashing Embedded Systems advanced class aimed at students who have already...

While stories of international espionage and government-sponsored hack attacks may captivate public attention, cyber security threats that originate from inside an organization pose a remarkably large threat. In fact, research suggests that insider threats account for anywhere from 60 to 75 percent of data breaches. Insider threats can range from...

Fraudsters contacted two Canadian banks claiming they stole tens of thousands of customers' personal and account information. Simplii Financial, the direct banking brand for the Canadian Imperial Bank of Commerce (CIBC), disclosed on 28 May that fraudsters had contacted CIBC a day earlier and claimed...

I had the opportunity to attend the Knowledge18 conference this past week, and from the registration to closing, I’ve never been to a show that's had so much energy. Knowledge18 staff would start the morning with a DJ playing music and with the staff energetically greeting attendees/sponsors while moving to the music. The Tripwire booth also had...

If breaches to electronic health record systems continue at their current pace, each and every American can expect their private medical data to be compromised at least once by 2024. Once adversaries obtain a patient’s health information (PHI), they can sell it to the highest bidder—leaving targets vulnerable to all manner of fraud and theft....

September 2017 was comparatively slow in terms of ransomware. Perhaps the extortionists kept struggling to bridge the money laundering gap after the FBI took down the BTC-e Bitcoin trading platform in late July. Some of the noteworthy events include the emergence of Locky’s new persona called Ykcol, failed experiments of GlobeImposter ransomware...

In the information security world, we always use the buzzword “Defense in Depth.” Though the concept is simple, it is difficult to implement. Organizations that carry out a proper risk analysis have a clearer picture in terms of cost/benefit analysis. In this article, we shall discuss how a FIM solution can supplement anti-malware solutions and...

If you are one of those enthusiastic and adventurous entrepreneurs who are on the verge of launching your own online business, here's an important question for you: have you secured your start-up enough so that it can battle the security threats of today? If you haven't, now is the time to do so. In this blog, let's take a look at some of the...

The demand for security auditing has shown its ugly head and now demands respect. Recent, well-documented events provide an image of why security auditing is necessary. If security audits had been carried out, and management had confirmed the results and taken action, some of these organizations might not be in the current predicament they are in....

Last week, I spoke with Candy Alexander. An attack by the famous Kevin Mitnick started her cybersecurity career! This time, I had the pleasure of interviewing Kim Wong. She recently started in a cybersecurity role in the UK's financial services industry. Kim Crawley: Tell me a bit about what you do. Kim Wong: I’m a security analyst in the cyber...

The Payment Card Industry Data Security Standard (PCI DSS) was introduced to provide a minimum degree of security when it comes to handling customer card information. While the Standard has been around for over a decade, penetration testing has only recently been officially incorporated into the process. There’s a lot to cover in a PCI DSS...

If you have read any of my posts or attended my webinars about security awareness, training, compliance, or other IT risk management items, you will notice a recurring theme: expecting technology to do all of the work in preventing a security or risk-related event is not the correct mindset. Rather, creating a culture of risk management is the key....

A malvertising campaign is distributing code that mines different cryptocurrencies inside an unsuspecting user's web browser. For the operation, computer criminals are targeting mainly visitors to video streaming and in-browser gaming sites based in Russia and Ukraine. They abuse an online advertising network to display ads containing custom...

A data breach might have exposed the personal information belonging to approximately one million users of the Canoe.ca portal. On 2 September, the news and entertainment gateway learned of a security incident that involved some of its databases containing records it collected between 1996 and 2008. The company, operated by MediaQMI Inc. and owned by...

"Cloud computing" is not a buzz phrase anymore, but it is essential for most businesses looking to achieve sound business continuity alternatives combined with a comprehensive security model. Cloud Computing What is cloud computing, and what does it do? Very simply, for the end-user, a cloud computing experience is no different than using a...