The upcoming GDPR compliance deadline of May 2018 affects any organization across the world that collects, processes, or stores data on citizens of the European Union. The intent behind the GDPR is to better protect the privacy of EU citizens, and the mechanism to do so is through harmonizing the existing data privacy laws across Europe. “The six...

The cybersecurity industry can be made stronger if we attract more women and non-males. I've had the pleasure of interviewing some in my series. I spoke to Dr. Jessica Barker, who advises organizations on information security and maintains a blog at Cyber.uk. Then I spoke to Emily Crose, a network threat hunter. Most recently, I had the opportunity...

In any conflict, humans are impacted. In conflict, the best scenario is that the individual leaves unscathed and perhaps even unaware of what could have been their misfortune, whereas in the worst of cases – such as kinetic warfare – the impact can be the ultimate price: loss of life. There is also a cruel truth of conflict that often gets looked...

A man used a business email compromise (BEC) scam to defraud two internet companies based in the United States out of 100 million dollars. On 21 March, the FBI along with the U.S. Attorney’s Office for the Southern District of New York announced criminal charges against Evaldas Rimasauskas, 48, of Vilnius, Lithuania. Lithuanian authorities arrested...

At some point in your career, you will make mistakes—small mistakes, big mistakes, even career-defining mistakes. I am writing this in retrospect because during the course of my job duties, I recently made a mistake. The details are irrelevant, but I wanted to share my experience with making mistakes in the professional world. Mistakes and human...

Over the weekend, I became immersed in a discussion on Twitter centered around getting more people involved in InfoSec conferences. Here’s the original post by @hacks4pancakes: Lesley’s initial point led to many great responses relating to the value of attending conferences and the process of...

Over the past few weeks I have been seeing quite a few news articles around fileless malware infecting companies around the world. The article from Ars Technica specifically states that the goal of fileless malware is to reside in memory in order to remain nearly invisible. Besides residing in memory, the second aspect of fileless malware is the...

Digital attackers have many different strategies for infiltrating a target organization. That even goes for companies with robust perimeter defenses. Bad actors simply need to find a soft target they can exploit. Oftentimes, they find what they're looking for along a target's supply chain. We can best understand the supply chain as a network of...

The Internet of Things (IoT) embodies great promise and risk. On the one hand, ordinary users view IoT as a means of streamlining their activities across billions of "smart" devices. They hope such connectivity will ultimately translate into better and easier lives. On the other hand, IoT devices aren't always designed with security in mind. This lack...

CAPTCHAs – these things: A human creation built to foil robots. However, as is ever so common these days, the robots are winning. But! it doesn’t have to be that way. The first CAPTCHAs were created in 2000, and most every CAPTCHA since has remained virtually the same. This becomes problematic...

No matter how well-designed it is, a security program will never prevent every digital attack. But an assault need not escalate into a data breach. Organizations can reduce the likelihood of a major incident by investing in key security controls. One such fundamental security component is FIM. Short for "file integrity monitoring," FIM helps...

A new survey revealed that only one in four utility companies (28 percent) have plans to execute a major security project in the next two years. BRIDGE Energy Group released the findings of its 2017 BRIDGE Index Grid Operations survey, which polled over 20,000 utility employees across North America, uncovering alarming statistics that suggest...

“If you know the enemy and know yourself, you need not fear the result of a hundred battles. If you know yourself but not the enemy, for every victory gained you will also suffer a defeat. If you know neither the enemy nor yourself and, you will succumb in every battle.” –Sun Tzu, “Attack by Stratagem” #18 Art of WarCybersecurity media is awash with...

Do you own an internet-connected DVR, CCTV or IP camera? You may want to check who manufactured it, as proof-of-concept code has been released capable of automating attacks against devices made by Dahua Technology. The firm has issued a security bulletin after a vulnerability researcher claimed that he had uncovered what he believed to be a backdoor...

Information security, cybersecurity, IT security, and computer security are all terms that we often use interchangeably. I know that I do. I've written a lot about those areas for the past several years. I notice that sometimes I switch between the terms in an article simply to avoid repeating the same phrases over and over again in my prose. Very...

NextGEN Gallery is an extraordinarily popular plugin for self-hosted WordPress websites, having been downloaded over 16.5 million times. The software's widespread popularity (it claims to have been "the industry's standard WordPress gallery plugin" since 2007) makes it an seemingly obvious choice for website owners looking to add image galleries to...

Holiday shoppers who use Amazon.com to purchase gifts will want to look out for a new scam claiming their order can't ship. Around the beginning of December, users first caught wind of a scam that's dampening the holiday cheer for users in the United Kingdom and Australia. The bogus emails state "Your Amazon.com Order Cannot Be Shipped" in the...

Point-of-sale (POS) malware activity, specifically network traffic for data exfiltration, quadrupled over Thanksgiving weekend. For their ongoing threat analysis, researchers at Proofpoint use network sensors deployed by its Emerging Threats group to track POS malware contact with command and control (C&C) servers. They had expected increased...

A man has received five years in prison for hacking into the email accounts of a number of celebrities and athletes. On 6 December, the Federal District Court in Manhattan passed down the sentence to Alonzo Knowles, 24, who gained unauthorized access to celebrities' email accounts and stole sensitive data. Back in December 2015, an undercover agent...

Research on quantum networking is well under way. In April 2012, Gerhard Rempe and other researchers at the Max Planck Institute of Quantum Optics in Germany announced their first working quantum network to the world. Then, just this year, Wolfgang Tittel and his researchers at the University of Calgary transported a light particle's properties...