In June this year, Fifth Domain ran a ten-day cyberwar course for 21 participants. The course provided participants with both red-team (offensive) and blue-team (defensive) cyber operations exercises. During the first eight days, participants learned a number of principles, frameworks and technical skills that were then put into practice during the...

Many problems in information security are both perennial and intractable. Audits expose them year after year. Breach after breach occurs because of them. Information security managers are fired as a result of the inevitable breaches, and the deck chairs are rearranged again each time. And yet, the attack surface rarely changes. It’s a revolving door...

A new report released by Europol's European Cybercrime Center (EC3) warns of the eight main cybercrime trends that investigators have seen impact a growing number of citizens and businesses this year. The 2016 Internet Organised Crime Threat Assessment (IOCTA) found that the volume, scope and...

In a previous blog post, ICS: Next Frontier For Cyber Attacks blog, I spoke about the cybersecurity posture of industrial control systems (ICS) and the enormous implications for such attacks. For industrial organizations, it means downtime and lost business. For individuals, it means potential safety issues and lost services. For society, it means...

In its 2016 Breach Detection Study, Tripwire evaluated the confidence and efficacy of 763 information security professionals in implementing seven key security controls: PCI DSS, SOX, NERC CIP, MAS TRM, NIST 800-53, CIS Top 20 and IRS 1075. Those resources, which align with the United States Computer Emergency Readiness Team (US-CERT) recommendations...

We all know information drives social media. It's fairly obvious. A social media post communicates content, which allows members to engage other users. Simple, right? Well… there's more to it than that. Social media posts aren't just communicative. They're performative. Status updates, tweets, and even funny dog videos reveal something deeper about...

AVG security researcher Jakub Kroustek has recently discovered tracks of the Cerber 3 ransomware virus marking encrypted files with the .cerber3 file extension. Unlike previous variants of Cerber, for which decryptors have been already developed, this variant contains fixes that prevent malware researchers from decrypting the files. Since this virus...

“Should we fear hackers? Intention is at the heart of this discussion.” – Kevin Mitnick In cybercrime, truth is in the eye of the beholder. And if in any other research or business field it is somehow easy to define cause and consequence, in cybercrime it is not. Perhaps it is due to its complexity and multi-layered character that cybercrime has...

When we traditionally think of the benefits of 'automation,' we think of 'improved quality and efficiency; and savings in time, cost and energy.' One often overlooked benefit that can be achieved from this is the mitigation of risk and the enhanced security. According to a recent study by AlgoSec (State of Automation in Security, Spring 2016), over...

The French underground has posted a job ad for a dark web content "cleaner" who will be paid for their efforts in stolen goods. Trend Micro threat researcher Cedric Pernet came across the posting (which is written in French) after making other discoveries in a series of French underground marketplaces. According to the ad, the dark web marketplace...

I remember when I first learned about some of the powerful spy satellites orbiting the earth. Some of the rumors stated the cameras on these machines were so accurate that they could read a car license plate from space. The idea that such technology existed back then was amazing. Now, some of the newer satellites are putting those early spy rumors...

Crowd-sourced review service Yelp says it will award researchers up to 15,000 USD for reporting exploits as part of its newly public bug bounty program. The company successfully ran a private bug-bounty program for the past two years, during which it worked with private researchers and bug bounty hunters to fix as many as 100 vulnerabilities. But to...

Hackers associated with the Russian government infiltrated the Democratic National Convention's computer network and stole opposition research on Republican presidential nominee Donald Trump. The DNC said no financial, donor, or personal information was compromised in the breach, reports The Washington Post. Instead the intrusion appears to be a...

In a previous article, we discussed building a deeper understanding of distributed denial-of-service (DDoS) attacks, what they do, who’s behind them, and what they all come down to. To follow, here’s how to prepare your website for DDoS attack. According to the results of a study conducted by Kaspersky Lab and B2B International, a DDoS attack can...

Now that you know how to plan for, select and deploy an endpoint detection and response (EDR) solution, there are just a few things you need to remember about EDR going forward. These are as follows: 1. Discovery and Inventory of Endpoints Are Key To effectively secure your organization's endpoints, you need to understand the contextual details of...

I was there when the bubble burst in ’99. If you are too young to know the reference to the bubble of 1999, or if you are so old that you have forgotten it, 1999 was the year that the "internet bubble" burst. What was it that caused this bursting effect? The internet wasn’t the problem. The internet is still here. The problem was driven by the...

Suppose you get a call from a college classmate with the following pitch: "David, I want to give you the opportunity of a lifetime. We started up our business last year called 'Super Duper Application.' We tested it, and we put it on the Apple App Store. It has done resoundingly well since then. We now have thousands of customers who love the...

The Anti-Phishing Working Group (APWG) says it observed a record-breaking 250 percent surge in phishing attacks between October 2015 and March 2016. According to its latest report, the number of unique phishing websites detected in Q1 totaled 289,371, with more than 123,000 of those sites being discovered in March 2016 alone. APWG says the findings...

Fancy a career as a blackmailing cybercriminal but don't have the technical nous? Don't worry, you can easily find people all too willing to help you embark on your life in cybercrime via popular freelance-hiring websites. And, it seems, you may only need to pay five dollars to get a hacker to launch a debilitating denial-of-service attack against...

Dropbox has responded to security concerns regarding one of its new technology's abilities to obtain kernel access. Back in April, the secure file sharing and storage service announced "Project Infinite," an initiative which will help revolutionize the way Dropbox interfaces with a user's computer. Dropbox software engineer Damien Deville provides...