Should we use AI in cybersecurity? Yes, but with caution and human help
Tech Republic Security
JULY 21, 2021
Artificial intelligence is a powerful tool, and an expert says we had better ensure it stays just that—a useful tool.
Sat.Jul 17, 2021 - Fri.Jul 23, 2021
218 
Don’t Wanna Pay Ransom Gangs? Test Your Backups.
Krebs on Security
JULY 19, 2021
Browse the comments on virtually any story about a ransomware attack and you will almost surely encounter the view that the victim organization could have avoided paying their extortionists if only they’d had proper data backups. But the ugly truth is there are many non-obvious reasons why victims end up paying even when they have done nearly everything right from a data backup perspective.
Join 28,000+
Insiders
Sign Up for our Newsletter
This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.
Dead Drops and Security Through Obscurity
Daniel Miessler
JULY 23, 2021
There’s massive confusion in the security community around Security Through Obscurity. In general, most people know it’s bad, but they can’t say exactly why. And because of this, people tend to think the “Obscurity” in “Security Through Obscurity” equates to secrecy , meaning if you hide anything, it’s Security Through Obscurity.
Your Work Email Address is Your Work's Email Address
Troy Hunt
JULY 21, 2021
When the Ashley Madison data breach occurred in 2015, it made headline news around the world. Not just infosec headlines or tech headlines, but the headlines of major consumer media the likes my mum and dad would read. What was deemed especially newsworthy was the presence of email addresses in the breach which really shouldn't have been there; let me list off some headlines to illustrate the point: Ashley Madison Hack: 10,000 Gov’t Officials’ Email Addresses on Leaked Ashley
Why Giant Content Libraries Do Nothing for Your Employees’ Cyber Resilience
Advertisement
Many cybersecurity awareness platforms offer massive content libraries, yet they fail to enhance employees’ cyber resilience. Without structured, engaging, and personalized training, employees struggle to retain and apply key cybersecurity principles. Phished.io explains why organizations should focus on interactive, scenario-based learning rather than overwhelming employees with excessive content.
Commercial Location Data Used to Out Priest
Schneier on Security
JULY 23, 2021
A Catholic priest was outed through commercially available surveillance data. Vice has a good analysis : The news starkly demonstrates not only the inherent power of location data, but how the chance to wield that power has trickled down from corporations and intelligence agencies to essentially any sort of disgruntled, unscrupulous, or dangerous individual.
As Ransomware Surge Continues, Where Next for Government?
Lohrman on Security
JULY 18, 2021
Global leaders want to carve out specific areas of critical infrastructure to be protected under international agreements from cyber attacks. But where does that leave others?
Sign up to get articles personalized to your interests!
Cyber Security Informer brings together the best content for cyber security professionals from the widest variety of industry thought leaders.
|
More Trending
Serial Swatter Who Caused Death Gets Five Years in Prison
Krebs on Security
JULY 21, 2021
A 18-year-old Tennessee man who helped set in motion a fraudulent distress call to police that led to the death of a 60-year-old grandfather in 2020 was sentenced to 60 months in prison today. 60-year-old Mark Herring died of a heart attack after police surrounded his home in response to a swatting attack. Shane Sonderman , of Lauderdale County, Tenn. admitted to conspiring with a group of criminals that’s been “swatting” and harassing people for months in a bid to coerce targe
NSO Group Hacked
Schneier on Security
JULY 20, 2021
NSO Group, the Israeli cyberweapons arms manufacturer behind the Pegasus spyware — used by authoritarian regimes around the world to spy on dissidents, journalists, human rights workers, and others — was hacked. Or, at least, an enormous trove of documents was leaked to journalists. There’s a lot to read out there. Amnesty International has a report.
Weekly Update 253
Troy Hunt
JULY 23, 2021
This week, by popular demand, it's Charlotte! Oh - and Scott. People had been asking for Charlotte for a while, so we finally decided to do a weekly update together on how she's been transitioning from Mac to PC. Plus, she has to put up with all my IoT shenanigans so that made for some fun conversation, along with how our respective homelands are dealing with the current pandemic (less fun, but very important).
NEW TECH: DigiCert Document Signing Manager leverages PKI to advance electronic signatures
The Last Watchdog
JULY 21, 2021
Most of us, by now, take electronic signatures for granted. Related: Why PKI will endure as the Internet’s secure core. Popular services, like DocuSign and Adobe Sign, have established themselves as convenient, familiar tools to conduct daily commerce, exclusively online. Yet electronic signatures do have their security limitations. That’s why “wet” signatures, i.e. signing in the presence of a notary, remains a requirement for some transactions involving high dollars or very sensitive rec
Zero Trust Mandate: The Realities, Requirements and Roadmap
Advertisement
The DHS compliance audit clock is ticking on Zero Trust. Government agencies can no longer ignore or delay their Zero Trust initiatives. During this virtual panel discussion—featuring Kelly Fuller Gordon, Founder and CEO of RisX, Chris Wild, Zero Trust subject matter expert at Zermount, Inc., and Principal of Cybersecurity Practice at Eliassen Group, Trey Gannon—you’ll gain a detailed understanding of the Federal Zero Trust mandate, its requirements, milestones, and deadlines.
Spam Kingpin Peter Levashov Gets Time Served
Krebs on Security
JULY 20, 2021
Peter Levashov, appearing via Zoom at his sentencing hearing today. A federal judge in Connecticut today handed down a sentence of time served to spam kingpin Peter “Severa” Levashov , a prolific purveyor of malicious and junk email, and the creator of malware strains that infected millions of Microsoft computers globally. Levashov has been in federal custody since his extradition to the United States and guilty plea in 2018, and was facing up to 12 more years in prison.
Nasty Printer Driver Vulnerability
Schneier on Security
JULY 22, 2021
From SentinelLabs , a critical vulnerability in HP printer drivers: Researchers have released technical details on a high-severity privilege-escalation flaw in HP printer drivers (also used by Samsung and Xerox), which impacts hundreds of millions of Windows machines. If exploited, cyberattackers could bypass security products; install programs; view, change, encrypt or delete data; or create new accounts with more extensive user rights.
CyberSecurity and Basketball: Seemingly Unrelated, Yet Similarly Illustrating The Dangers Of Unseen Threats
Joseph Steinberg
JULY 22, 2021
I recently came across the following interesting infographic (reproduced with permission), comparing unseen cybersecurity threats to the threats faced by basketball teams that do not fully recognize and appreciate the offensive capabilities of one or more opposing players. While professional sports and cybersecurity may seem like two completely unrelated disciplines, the reality is that professionals working in both fields face similar prospects of suffering serious failures if they fail to both
How DuckDuckGo makes money selling search, not privacy
Tech Republic Security
JULY 23, 2021
Commentary: DuckDuckGo is small by Google's standards, but the company is proving it's very possible to make a lot of money with just a bit more privacy.
Prevent Data Breaches With Zero-Trust Enterprise Password Management
Advertisement
Keeper Security is transforming cybersecurity for people and organizations around the world. Keeper’s affordable and easy-to-use solutions are built on a foundation of zero-trust and zero-knowledge security to protect every user on every device. Our next-generation privileged access management solution deploys in minutes and seamlessly integrates with any tech stack to prevent breaches, reduce help desk costs and ensure compliance.
Simplify VPN with Cisco Secure Managed Remote Access
Cisco Security
JULY 23, 2021
Bringing focus back to organizations’ IT, and empowering security heroes. Esports are becoming massively popular, and you’ll commonly hear about how a player “carried the team on their back,” a phrase often used when a teammate perseveres through adversity, contributes more than their fair share, and ultimately delivers a win. Over the last year and a half, IT and security heroes globally have adapted and met the needs of their workforces that had to rapidly pivot to remote work.
Fake Windows 11 installers now used to infect you with malware
Bleeping Computer
JULY 23, 2021
Scammers are already taking advantage of the hype surrounding Microsoft's next Windows release to push fake Windows 11 installers riddled with malware, adware, and other malicious tools. [.].
Nasty macOS Malware XCSSET Now Targets Google Chrome, Telegram Software
The Hacker News
JULY 23, 2021
A malware known for targeting macOS operating system has been updated once again to add more features to its toolset that allows it to amass and exfiltrate sensitive data stored in a variety of apps, including apps such as Google Chrome and Telegram, as part of further "refinements in its tactics.
How cyberattacks exploit known security vulnerabilities
Tech Republic Security
JULY 22, 2021
Knowing that many organizations fail to patch known flaws, attackers continually scan for security holes that they can exploit, says Barracuda.
Optimizing The Modern Developer Experience with Coder
Advertisement
Many software teams have migrated their testing and production workloads to the cloud, yet development environments often remain tied to outdated local setups, limiting efficiency and growth. This is where Coder comes in. In our 101 Coder webinar, you’ll explore how cloud-based development environments can unlock new levels of productivity. Discover how to transition from local setups to a secure, cloud-powered ecosystem with ease.
Beef up your ransomware defense with Cisco Secure Choice
Cisco Security
JULY 22, 2021
Ransomware. Certainly not a new form of cybercrime, but one that has dominated mainstream headlines in recent months. High-profile cyberattacks on critical infrastructure and sectors in the global economy, such as government agencies, a major U.S. fuel pipeline, and one of the world’s largest meat processing plants have put a giant spotlight on ransomware.
New PetitPotam attack allows take over of Windows domains
Bleeping Computer
JULY 23, 2021
A new NTLM relay attack called PetitPotam has been discovered that allows threat actors to take over a domain controller, and thus an entire Windows domain. [.].
Millions of Windows machines affected by ancient printer vulnerability
Malwarebytes
JULY 22, 2021
A very serious security flaw in immensely popular printer drivers has been disclosed and it could affect many millions of Windows systems. The printer driver was issued by HP, but it’s also in use by Samsung and Xerox. All the affected printers are laser printers. The most surprising about this find is probably that the vulnerability apparently has existed since 2005 and was only found 16 years later.
Companies are losing the war against phishing as attacks increase in number and sophistication
Tech Republic Security
JULY 20, 2021
A new report finds that 74% of companies have been the victim of phishing in the last year. Staff shortages, a lack of security training and an increase in mobile device usage for work are factors.
The Importance of User Roles and Permissions in Cybersecurity Software
Advertisement
How many people would you trust with your house keys? Chances are, you have a handful of trusted friends and family members who have an emergency copy, but you definitely wouldn’t hand those out too freely. You have stuff that’s worth protecting—and the more people that have access to your belongings, the higher the odds that something will go missing.
Security and Culture are Key to Digital Transformation
Security Boulevard
JULY 21, 2021
With digital business initiatives accelerating across nearly every industry, Gartner projects worldwide IT spending to reach a whopping $4.1 trillion by the end of the year. This data reflects something every forward-looking business leader already knows–digital transformation (DX) is the key to remaining competitive in 2021 and beyond. However, to fully reap the benefits of digital transformation, organizations must.
Cybercriminals may target 2020 Tokyo Olympics, FBI warns
We Live Security
JULY 21, 2021
Cybercriminals may target the popular event with ransomware, phishing, or DDoS attacks in a bid to increase their notoriety or make money. The post Cybercriminals may target 2020 Tokyo Olympics, FBI warns appeared first on WeLiveSecurity.
HiveNightmare zero-day lets anyone be SYSTEM on Windows 10 and 11
Malwarebytes
JULY 21, 2021
Users with low privileges can access sensitive Registry database files on Windows 10 and Windows 11, leaving them vulnerable to a local elevation of privilege vulnerability known as SeriousSAM or HiveNightmare. Doesn’t sound serious? Reassured that users must already have access to the system and be able to execute code on said system to use this vulnerability?
Windows "HiveNightmare" bug could expose system files to non-admin users
Tech Republic Security
JULY 22, 2021
An attacker who exploits this flaw could use system privileges to install programs, view or delete data, and create accounts with full user rights.
The Tumultuous IT Landscape Is Making Hiring More Difficult
Advertisement
After a year of sporadic hiring and uncertain investment areas, tech leaders are scrambling to figure out what’s next. This whitepaper reveals how tech leaders are hiring and investing for the future. Download today to learn more!
New Windows 10 vulnerability allows anyone to get admin privileges
Bleeping Computer
JULY 20, 2021
Windows 10 and Windows 11 are vulnerable to a local elevation of privilege vulnerability after discovering that users with low privileges can access sensitive Registry database files. [.].
Some URL shortener services distribute Android malware, including banking or SMS trojans
We Live Security
JULY 20, 2021
On iOS we have seen link shortener services pushing spam calendar files to victims’ devices. The post Some URL shortener services distribute Android malware, including banking or SMS trojans appeared first on WeLiveSecurity.
Hackers Exploit the COVID-19 Pandemic for Cyber Scams
Security Boulevard
JULY 23, 2021
Cyber criminals are taking advantage of the global crisis coronavirus pandemic (COVID-19) to attempt cyber scams! The Wave of Coronavirus Cyber Scams While the world is busy fighting with the coronavirus pandemic (COVID-19), cyber attackers are misusing this global crisis for their malicious use. The outbreak of newly discovered endangering infectious disease coronavirus (COVID-19) has […].
Cybersecurity lags behind as IoT devices proliferate, according to a new report
Tech Republic Security
JULY 21, 2021
About one-quarter of respondents do not incorporate any of the listed measures to protect these devices and many feel as though consumers are not responsible for smart and IoT device security.
IDC Analyst Report: The Open Source Blind Spot Putting Businesses at Risk
Advertiser: Revenera
In a recent study, IDC found that 64% of organizations said they were already using open source in software development with a further 25% planning to in the next year. Most organizations are unaware of just how much open-source code is used and underestimate their dependency on it. As enterprises grow the use of open-source software, they face a new challenge: understanding the scope of open-source software that's being used throughout the organization and the corresponding exposure.
Let's personalize your content