As we introduced in part 1 of this “word crimes” series, cybersecurity terminology is important. Cybersecurity, IT professionals and legal professionals routinely abuse the terms “policy” and “standard” as if these words were synonymous. In reality, these terms have quite different implications, and those differences should be kept in mind since the...

For as long as I can remember, members of the public have been losing money to scammers, as they've been tricked into sending their hard-earned cash via Western Union. Scammers prey on the vulnerable and gullible, tricking them into wiring money via Western Union with the promise that it will help with medical bills, pay for for a new internet...

With the rise in popularity of containers, development and DevOps paradigms are experiencing a massive shift while security admins are left struggling to figure out how to secure this new class of assets and the environments they reside in. While containers do increase the complexity of the ecosystem that security admins are responsible for securing...

Last time, I had fun talking with Victoria Walberg. She really understands cloud and IoT cybersecurity. This time, I got to speak to Beth Cornils. She has a pretty cool job that involves making IoT cars safe! Kim Crawley: Hi, Beth! Tell me about what you do. Beth Cornils: I am a product manager for an autonomous vehicle company. Prior to that, I was...

Unless you’ve been living in Slab City or off the grid for a while, you’ve probably heard this year’s omnipresent buzzword ‘blockchain.’ But perhaps you're a bit clueless as to what this newer technology entails. In a recent HSBC survey of 12,000 respondents in 11 countries, 80 percent of people could not explain how blockchain works. Don’t worry,...

Security researchers have discovered a new banking Trojan that is actively targeting U.S. financial institutions. Dubbed IcedID, the malware is believed to have emerged in the wild back in September 2017, when its first test campaigns were launched. According to IBM X-Force, IcedID was developed with “modular malicious code and modern capabilities”...

A cryptocurrency miner has earned its place on a list of the top 10 most wanted malware for the month of October 2017. The browser-mining service in question goes by the name "CoinHive." It's a piece of JavaScript that site owners can embed into their websites. Whenever a user visits their domain thereafter, CoinHive will activate and begin mining for...

Yes, Apple is toughening up the security of iPhones with iOS 12. Yes, the steps Apple is taking will make it harder for law enforcement agencies to thwart iPhone security. But no, that's not the reason Apple is doing it. To understand better, let's take a little history lesson. Back in 2016, Apple CEO Tim Cook opposed court requests that his company...

If you’ve been in information security for a while, you’ve likely had some experience with file integrity monitoring (FIM). It’s a capability with a long history, going back to the original open-source Tripwire tool for monitoring file hashes. And FIM has staying power. It’s still around, and there are still new deployments. There aren’t a lot of...

Last time, I got the opportunity to speak with Diana Initiative founder Virginia Robbins, otherwise known as fl3uryz. She deserves all the kudos for her hard work in promoting women in our industry. This time, I had the pleasure of speaking with Avi. They’re not a woman, but they certainly know what it’s like to be a gender minority in tech. Avi has...

A provider of HR software said that a malware infection might have exposed user data including personal and account information. According to a statement posted on its website, PageUp observed unusual activity on its IT infrastructure and subsequently launched an investigation on 23 May. Five days...

Last time, I had the honor of speaking with Veronica of DFIRLABS. She’s a self-described cyborg who got into cybersecurity early and has a passion for reverse engineering code. This time, I got to speak with Anna Westelius. Not only is she a web security specialist; she also has experience with Linux driver development. What do Anna and I have in...

At least half a million routers and storage devices in dozens of countries around the world have been infected by a sophisticated botnet, in preparation for an alleged planned cyber attack on Ukraine. The botnet, which has been given the rather unglamorous name of VPNFilter, is believed to be likely to be controlled by a state-sponsored hacking...

Mozilla announced the rollout of two-step verification (2SV) as an optional security feature for all Firefox user accounts. The engineers at Mozilla Foundation designed the feature without support for SMS-based codes. They likely did so for the same reasons as Twitter when it moved away from this form of verification in December 2017. Criminals...

The Payment Card Industry Security Standards Council (PCI SSC) published a minor revision to version 3.2 of its Data Security Standard (PCI DSS). On 17 May, PCI SSC published PCI DSS version 3.2.1. The purpose of the update was to clarify organizations' use of the Standard and when they would need to upgrade their use of common cryptographic...

Ransomware is a problem on the rise, a simple threat with some very large business implications. Statistics show it has reached new levels of menace, and it's growing at a remarkable rate: 6000% in 2016, an IBM study found, and a triple-digit increase into 2018. Although a very real and present danger (as shown by some very high profile infections...

Today’s VERT Alert addresses the Microsoft December 2017 Security Updates. VERT is actively working on coverage for these vulnerabilities and expects to ship ASPL-756 on Wednesday, December 13th. In-The-Wild & Disclosed CVEs This month, no Microsoft vulnerabilities have been publicly disclosed or are being actively exploited. There are, however, a...

As part of a three-part series on incorporating security into the container environment, I've talked all about containers and how to inject security into the pipeline. Let's now discuss tips on how to secure the container stack. What Do I Mean by "Stack"? What I’m calling the stack, in this case, refers to all of the layers or components involved...