In 2014, the FBI warned that healthcare systems, including medical devices, were at an increased risk of cyber-attacks due to the unfortunate coupling of poor cybersecurity practices in the healthcare industry with patient health information (PHI) that commands high value on the dark web. This warning has largely been realized. The cost and frequency...

A new, “highly prevalent” strain of Android malware was found infecting several Minecraft-related apps on the Google Play store, adding compromised devices into a botnet. According to security researchers at Symantec, at least eight mobile apps – with an install base ranging from 600,000 to 2.6 million devices – were infected with Sockbot. “The...

On 16 October, news first emerged of what's known as "KRACKs." These malicious techniques exploit vulnerabilities that affect a protocol used for securing Wi-Fi networks. Bad actors could therefore leverage KRAcks to potentially expose encrypted information exchanged over otherwise secure wireless connections. As of this writing, the computer...

As part of this ongoing series (previous parts, in order, here, here, here and here), I have been trying to make the case that differing interests make cooperation on cybersecurity issues virtually impossible. This is not criticism. It’s just reality. And while it would be easy to look at Brexit or Eastern European and American politics as a push...

If you've read a security blog anytime in the last year, you haven't escaped mention of the dreaded skills gap for cybersecurity professionals. There seems to be consensus that it's getting harder to hire skilled security staff, though the reason for that is up for debate – some say we're just going about it the wrong way, while others claim it is an...

Today’s VERT Alert addresses the Microsoft October 2017 Security Updates. VERT is actively working on coverage for these vulnerabilities and expects to ship ASPL-746 on Wednesday, October 11th. In-The-Wild & Disclosed CVEs CVE-2017-8703 This CVE describes a publicly disclosed denial of service vulnerability which impacts the Windows Subsystem for...

Do you go fishing? You may or may not, but we see far too much phishing going on in the Internet ocean, and it scares us. The risk of over-phishing is not necessarily our concern. Our concern rests in that phishing is so easy, and big fat phish of this Internet ocean are getting gobbled up. And that’s not good for us because many of us don't really...

Apple has released an update that is designed to better protect passwords for encrypted APFS volumes on machines running macOS High Sierra. APFS is short for Apple File System. The Cupertino-based tech giant created it to fix some issues involving Mac OS Extended. Apple File System is meant for computers with flash or solid-state drive (SSD) storage...

Last time, I spoke with Kim Wong, a woman who recently acquired a cybersecurity role in Britain's financial services industry. This time, I'm honored to speak with Keren Elazari. Not only has she given TED talks but also founded BSidesTLV in Tel Aviv, Israel. We had a wonderful chat! Kimberly Crawley: Please tell me a bit about what you do. KE: I'm...

Walk into almost any health care facility in America, and chances are, you’ll find a variety of new technologies that didn’t exist even a decade ago. All of your personal information is now digitized, allowing you to move doctors with little to no delay, the treatment you receive is now faster and more efficient, and even payment options can be done...

If you are one of those enthusiastic and adventurous entrepreneurs who are on the verge of launching your own online business, here's an important question for you: have you secured your start-up enough so that it can battle the security threats of today? If you haven't, now is the time to do so. In this blog, let's take a look at some of the...

When I got an email giving me the opportunity to work as an intern for Tripwire, I jumped at the chance. I have always been intrigued by the world of cybersecurity and ethical hacking, so this internship truly struck home. The internship started with going through the 2017 Verizon Data Breach Investigation Report (DBIR) over the summer. The goal was...

Europol, the European Union's police agency, has warned of the significantly rising threat posed by ransomware. As Associated Press reports, delegates at an international conference were told by Europol Executive Director Rob Wainwright that ransomware had taken the cybercrime threat to "another level." An 80-page report published by the agency...

BULLETIN CVE S2-052 Apache Struts REST Plugin Java Deserialization Vulnerability CVE-2017-9805 Oracle Security Alert Advisory - CVE-2017-9805 CVE-2017-9805 Microsoft 2017-September Developer Tools Vulnerabilities CVE-2017-8759 Microsoft 2017-September Browser Vulnerabilities CVE-2017...

It’s not about whether you implement foundational controls but about how well you do it. Only when excellence in the essentials of security and compliance are achieved, will an organization be able to have confidence that it is able to mitigate most cyber threats. We as cyber-defenders have an embarrassing problem. We are routinely susceptible to...

The Security Exchange Commission (SEC) announced on Wednesday that its EDGAR database was compromised in 2016. This database stores non-public information on businesses, such as quarterly earnings, and statements on merger and acquisition dealings. According to the agency, the compromise was due to a software vulnerability being exploited on its...

In September 2017, I created a list of 10 essential bug bounty programs for 2017. Readers with a keen eye for detail might have noticed that nearly half of the companies included in that catalog host their vulnerability research programs, otherwise known as vulnerability disclosure programs and responsible disclosure programs, through HackerOne. A...

In my previous post about Tripwire's latest skills gap survey, I noted that over the past couple years, it has become more challenging to hire adequately skills cybersecurity professional. In this post, I'll share Tripwire's second set of findings. These results cover which technical skills are most needed and what organizations plan to do about...

While false detections should be eliminated as much as possible, these are an inherent part of any vulnerability assessment tool. Possible reasons for false detections include rapid changes in vendor-specific patches/updates, zero-day vulnerabilities, access restrictions, and network glitches. The goal is to have the fewest vulnerabilities detected in...

The Payment Card Industry Data Security Standard (PCI DSS) was introduced to provide a minimum degree of security when it comes to handling customer card information. While the Standard has been around for over a decade, penetration testing has only recently been officially incorporated into the process. There’s a lot to cover in a PCI DSS...