A data protection breach at Thomson, a British travel firm, has led to the accidental exposure of more than 450 customers’ personal information. Passenger details, including home addresses, telephone numbers, names and flight information, were unintentionally disclosed in an email, which the company said it quickly recalled. Thomson released a statement apologizing for the “genuine error.” However...

Rutgers University has hired three security firms to test its network for vulnerabilities following a series of targeted attacks during the 2014-2015 academic year. According to The Washington Times , FishNet Security , Level 3 Communications, and Imperva will be working with Rutgers to enhance the university's security as classes resume for the 2015 fall semester. Rutgers officials have also...

Earlier this month, security professionals from all over the world flooded to Las Vegas, Nevada, for Black Hat USA and DEF CON . As two of the largest and most respected events in information security, it is no surprise that they are a preferred choice for security experts and product vendors alike, year after year. Those conferences are indeed popular, but it is important to note that they were...

Every network security manager fights an escalating and asymmetric war against adversaries aiming to penetrate networks or disrupt services hosted there. Symantec reported that major attacker-caused data breaches rose almost 25 percent last year, while Verisign reported almost a 300 percent increase in average DDoS attack size. Asymmetries abound: automated attacks move embarrassingly faster than...

Our security roundup series covers the week’s trending topics in the world of InfoSec. In this quick read summary, we’ll let you know of the latest reports and controversies that the industry has been talking about recently. Here’s what you don’t want to miss from the week of August 17 th , 2015: The Ashley Madison hack went from bad to worse after the data that was stolen from the site’s 37...

The UK data protection watchdog has stated Google must remove all links to articles which were initially removed from search results under the ‘right to be forgotten’ ruling. The Information Commissioner's Office issued the order on August 18 , and has given Google 35 days to remove the links. However, Google has the right to appeal the notice to the General Regulatory Chamber, if they wish...

From phishing attacks to ransomware to malicious advertisements, fraudster's methods for obtaining and exploiting our information are varied and, for the most part, well-known among today’s avid Internet users. Even among the less avid Internet users, security is now more of a concern than it used to be after the numerous giant hacks that have happened recently, which compromised the information...

Organizations spend so much time defending against external attackers that they sometimes neglect to address insider threats. This oversight may reflect the extent to which some organizations trust that their employees will respect their intellectual property and sensitive information, among other factors. Such a mindset is well intentioned. However, it misinterprets the realities of data security...

Imagine a circumstance where a significant investment has been made into a data loss prevention (DLP) solution in which it paves the way for a lip-service approach towards cyber security, with the very real-world association of unknown exposures. As amazing as it may seem, here is such a case in history that may leave you with two opinions, which are, in the first instance – ‘amazement’ followed...

In early August, Tripwire security analyst Travis Smith conducted a presentation at Black Hat USA on combining open source and commercial security tools to correlate and build context on security events. As part of his presentation, Travis introduced Tripwire’s Automated Reconnaissance and Deep Inspection System (TARDIS), a framework that ties together a wide variety of threat feed data and log...

In part one of this article, we reviewed how the Nigerian Prince scam is no longer the primary email scam in use, being replaced by more clever and devious methods. The article also examined some of the emotional and personal aspects of the second most popular Internet scam, known as the “urgent wire-transfer” scam, as reported by the FBI’s Internet Crime Complaint Center . This article examines...

If Microsoft calls a vulnerability "critical," warns that it affects all versions of Windows, and is prepared to issue a patch outside of its normal Patch Tuesday monthly schedule, you should sit up and listen. Today, Microsoft has issued an advisory about a zero-day vulnerability, dubbed CVE-2015-2502 , that could allow an attacker to hijack control of your computer via Internet Explorer – just...

Hacker Eric Croker has been charged with helping to illegally gain access to more than 77,000 computers through an online hacking forum, Darkode. Crocker, 39, of New York, who pleaded guilty on Monday in a U.S. District Court , was among 12 people charged in July when the hacker forum known as “The best malware marketplace on the net” was taken down by a US-European sting operation involving over...

This two-part article will examine the two most popular Internet scams today, and the motivators that make them work. At a recent Cyber Security Symposium hosted by the District Attorney’s office in New Haven, Connecticut, an FBI Agent from the Internet Crime Complaint Center (IC3) gave a presentation in which he revealed the top two Internet crimes reported to IC3. You will be happy to know that...

A June 2015 report reveals that perceptions on the impact of 50 different security issues are worsening across the board. This is one of the latest reports released by the Index of Cyber Security , a sentiment-based measure which helps evaluate the level of risk posed by a number of security threat areas to corporations, governments, and other organizations. Founded by risk professionals Dan Geer...

Adobe has now settled claims for its 2013 data breach in which 38 million users had been affected. On August 13, 2015, it was reported that they have paid an undisclosed sum to users and faced $1.1 million in legal fees. The breach was first confirmed back in October 2013 when Adobe had been the victim of a long-term network breach that exposed consumer data, including passwords and credit card...

Nine individuals have been charged by the United States Department of Justice (DOJ) with hacking into three separate newswires, stealing yet-to-be-published press releases, and passing this stolen information to approximately two dozen individuals who then traded on the bulletins before their public release. The Securities and Exchange Commission (SEC) is investigating all 32 individuals who are...

It's a matter of fact that incidents will happen, and now more than ever, organizations have to be prepared to avoid being held liable. Small- and medium-size organizations (SME), however, cannot and will not spend too much money on Business Continuity Management (BCM) and Incident Management. The majority of SMEs that experience a serious incident, and were ill-prepared to respond to it, go out...

Like more than a few others, I experienced the infosec outrage against Mary Ann Davidson , Oracle's Chief Security Officer, before I actually read the now-redacted blog post. After taking the time to read what she actually wrote ( still available through Google's web cache ), I think there’s more discussion to be had than I’ve seen so far. First, it seems clear to me that the reaction is as much...

Security researchers have found a cross-site scripting (XSS) vulnerability on the Salesforce website, that could be exploited by malicious hackers to conduct phishing attacks and hijack the accounts of users. The researchers at Elastica report that they uncovered the weakness on one of Salesforce's subdomains, admin.salesforce.com. Specifically, the issue was brought to light when they noticed...