Last time, I had fun speaking with my friend, red team-minded student/teacher Alana Staszczyszyn. This time, I had the privilege of speaking with cybersecurity and intelligence industry veteran Theresa Payton. She’s always had tons of responsibility. She went from the White House to start her own private sector firm, Fortalice Solutions. Kim Crawley...

A dating app geared towards connecting supporters of U.S. President Donald Trump exposed members' personal and account information. On 15 October, security researcher Baptiste Robert (who also goes by the name "Elliot Alderson") discovered security weaknesses in the Donald Daters dating app that exposed several pieces of users' information. https:/...

Online criminals have frequently distributed their malware attacks as fake updates for Adobe Flash. Security-savvy computer users haven't found such attacks difficult to spot and know to only get updates to Adobe Flash Player from the company's own website. A new wave of attacks, however, has added a twist to the traditional malware attack disguised...

Since 2010, the U.S. Executive Office has been encouraging agencies to leverage the cloud to improve citizen services. Now, according to the new “Cloud Smart” strategy, a group of federal agencies are taking the lead to identify the best way to make that happen. Relying on input from industry and the broader federal IT community, OMB, DHS, GSA and...

The Scottish Ambulance Service suffered a data breach in which it exposed its staff members' personal information online. On 12 October, the NHS Ambulance Services Trust, which is part of NHS Scotland, sent an email to its staff in which it disclosed the data breach. As quoted by BBC News:For a time, the names and telephone numbers of staff, as they...

Another National Cyber Security Awareness Month is upon us, and although I have recently wished for its demise through better automated protections, there are some things that cannot be automated. One such area of manual interaction is all the social networks that we use. Unless you are a celebrity with a public relations team behind your every post...

A new sextortionist scam is using spoofing techniques to trick users into thinking that digital attackers have compromised their email accounts. As reported by Bleeping Computer, an attack email belonging to this ploy attempts to lure in a user with the subject line "[email address] + 48 hours to pay," where [email address] is their actual email...

Identity theft is on the rise. According to a report from Javelin Strategies, 16.7 million Americans fell victim to identity fraud schemes in 2017 – that’s up eight percent over the previous year. Thieves made off with $16.8 billion from US consumers. Residents of some states are at higher risk of becoming identity theft victims, according to...

The healthcare industry is one of the largest industries in the United States and potentially the most vulnerable. The healthcare sector is twice as likely to be the target of a cyberattack as other sectors, resulting in countless breaches and millions of compromised patients per year. Advancements in the techniques and technology of hackers and...

An effective container security strategy consists of many parts. Organizations should first secure the build environment using secure code control along with build tools and controllers. Next, they should secure the contents of their containers using container validation, code analysis and security unit tests. Finally, they should develop a plan to...

A Chinese intelligence officer has been extradited to the United States after being charged with conspiracy to commit economic espionage against certain U.S. firms. Logo of the Ministry of State Security. (Source: Wikipedia) On 10 October, the U.S. government unsealed an indictment filed by a federal...

In a recent article about U.S federal policy concerning IoT security, Justin Sherman identified several gaps in both cybersecurity and privacy policies. As Sherman has highlighted: The United States federal government, like the rest of the world, is increasingly using IoT devices to improve or enhance its existing processes or to develop new...

Today’s VERT Alert addresses Microsoft’s October 2018 Security Updates. VERT is actively working on coverage for these vulnerabilities and expects to ship ASPL-800 on Wednesday, October 10th. In-The-Wild & Disclosed CVEs CVE-2018-8453 This vulnerability, a privilege escalation in Win32k’s handling of objects in memory, has been exploited in the...

The Information Commissioner's Office (ICO) issued a fine of £120,000 to Heathrow Airport Limited (HAL) following a data security incident that occurred in 2017. On 8 October, ICO announced the penalty under section 55A of the 1998 Data Protection Act (DPA). Under that piece of legislation, the ICO...

A recent report found that data breaches compromised a total of more than 4.5 billion records in the first half of 2018. In its report "2018: Data Privacy and New Regulations Take Center Stage," Gemalto wrote that its Breach Level Index (BLI) system tracked 4,553,172,708 breached data records during...

Last time, I had the privilege of speaking with web security specialist Pam Armstrong. This time I got to chat with Alana Staszczyszyn, someone whom I’ve had the pleasure of meeting in person. She’s very active in Toronto’s cybersecurity scene. She’s currently a student, but she has so much to teach people in our industry about evolving cyber...

The first article in this series examined configuration hardening, essentially looking at ports, processes and services as the “doors, gates and windows” into a network where security configuration management (SCM) becomes the job of determining which of these gateways should be open, closed, or locked at any given time. Now it’s time to look at...

If you’re in your 40s or 50s, you probably remember a TV series called The Twilight Zone. (Millennials, think Netflix’s Black Mirror). Every show was its own stand-alone story that took viewers into an alternate reality where things got weird in a hurry followed by twists and turns culminating in a surprise ending. These types of winding plots aren...

Everyone responsible for securing organisations today recognises the significant growth in BEC (Business Email Compromise) attacks, also sometimes known as "Whaling" or "CEO fraud". BEC scammers trick accounting and finance departments into wiring considerable amounts of money into bank accounts under their control, posing as genuine suppliers...