Hyatt Hotels has launched an investigation after discovering malicious activity on its payment processing systems. Stephanie Sheppard, a spokeswoman for Hyatt, announced the investigation in an email to Hyatt guests on Wednesday:"Hyatt Hotels Corporation (NYSE: H) today announced that it recently identified malware on computers that operate the...

Earlier this year, the FBI stated that the second most prominent scam on the internet is the wire fraud scam, whereby a CFO is sent a phishing message that is supposed to appear to come from the CEO, requesting an urgent transfer of funds. These attacks that are targeted toward the “big fish” in a company, usually the Chief Financial Officer, are...

A recent article by The Financial Times argues that boards should be looking to employ younger directors to tackle the cyber security “problem." Meanwhile, the EU has unveiled the proposed Network and Information Security Directive. Think about the psychology here, really… The more we raise the bar and levels of expectations, given the volume of...

It is my privilege to have joined Tripwire as the company's Vice President of Sales for Europe, Middle East, and Africa (EMEA) earlier this Autumn. At this time, I would like to explain why ongoing developments in the security world influenced my decision to come aboard. So, let's jump right in. Why did I join Tripwire? First of all, EMEA – my area of...

UK law enforcement has announced the arrest of an individual as part of its ongoing investigation into the hack against VTech, a provider of electronic learning products. On Tuesday, officers from the South East Regional Organized Crime Unit (SEROCU) published a statement in which they explain the status of their investigation. "A 21-year-old man...

File Integrity Monitoring (FIM) has been around for a long time. In fact, Tripwire has been a pioneer in FIM since the early 1990s when Gene Kim released the first version of Tripwire. Monitoring for change enables you to know what changes were made, who made the changes, and the changes that occurred. This allows you to easily roll back to a known...

I’ve been enjoying Bob Covello’s recent posts on passwords and password managers – A LastPass Hack with a Happy Ending shows how idiot simple it can be to find someone’s “hidden” password list. A surprising interchange on passwords came up in November, during a Chertoff Group Security Series panel entitled “Enough with Getting Pwned Through...

A former employee of the U.S. State Department has been sentenced to close to five years in prison for an online sextortion scheme targeting young women. On Monday, U.S. District Judge Eleanor Ross sentenced 36-year-old Michael C. Ford to 57 months in prison followed by three years of supervised release, reports the Washington Times. ...

Researchers have tied the propagation of a new type of ransomware to a TeamViewer user. TeamViewer is a cross-platform service that enables remote computer access for tech support calls, meetings, and other purposes. It has been installed on more than a billion devices, which makes its potential attack surface quite extensive. On March 9th, someone...

A hacker has been charged with illegally accessing the nude photos of several celebrities in the "Fappening" or "Celebgate" scandal. On Tuesday, Ryan Collins, 36, of Lancaster, Pennsylvania signed an agreement in which he agreed to plea guilty to a federal violation of the Computer Fraud and Abuse...

Recently, there has been a lot of publicity regarding the new national cyber security plan and the billions of dollars pledged to its various parts, including the appointment of the United States' first ever federal chief information security officer (CISO). We understand in large part that the monies “pledged” are goals and aspirations. They are...

A typo helped prevent a group of hackers from successfully stealing one billion dollars during a bank heist that occurred last month. In the heist, a group of attackers infiltrated Bangladesh Bank's systems and made off with the credentials necessary for making payment transfers, reports Reuters. ...

As a security professional, I attend many conferences and networking events. I often overhear people at these events use the following exit line: “It was great meeting you. I’ll be sure to add you on LinkedIn.” Many people use LinkedIn as a virtual business card or an online resume. While LinkedIn is a great networking tool, it can also be used for...

A telephone scam has conned a woman out of £8,000, half of which was set aside to help pay for her daughter's wedding. The Courier reports that Sylvia Bentley, 65, a Coupar Angus pensioner, was recently contacted by con artists who claimed they were employees of her TV provider. Those scammers, in turn, tricked Bentley into granting them remote...

Tripwire isn't a patch management company, so why we conducted an extensive survey on patch fatigue is a worthwhile question to ask. The fact is, we spend a lot of time talking about and working with patches, even though we never actually deploy one for a customer. We spend so much time on patching because we're a vulnerability management vendor....

In a world where we must assume our enterprises have already been breached, monitoring the perimeter is too little, too late. Continuous monitoring, a la CDM, tells you where you are vulnerable and what to fix, but not where you are already bleeding. In my post on why change detection is so important, I talked about the growing importance of change...

Yesterday, we at The State of Security offered a recap of some of the notable presentations that have occurred at RSA Conference USA 2016. We now continue our coverage of this week's event with Part 2 of our RSA Conference 2016 Takeaways series. Dreaming of IoCs: Adding Time Context to Threat Intelligence Speaker: Travis Smith (@MrTrav), Senior...

Content loading...More than half (55 percent) of information security professionals anticipate cybersecurity will factor as a key issue in the 2016 U.S. Presidential race. Last month, as part of Black Hat USA 2015, Tripwire conducted a survey of 210 information security professionals. Of those respondents, more than a third (39 percent) revealed their...

All too often, I find that vendors discount the risks associated with attack vectors involving cross-site request forgery (CSRF). Naturally, remediation of vulnerabilities involving user-interaction should generally take a back seat to those that are exposed to completely remote/unauthenticated exploitation, but that doesn’t mean it is OK to simply...

Today’s VERT Alert addresses 12 new Microsoft Security Bulletins. VERT is actively working on coverage for these bulletins in order to meet our 24-hour SLA and expects to ship ASPL-632 on Wednesday, September 9th. Ease of Use (published exploits) to Risk Table Automated Exploit Easy...