From PivotPoint Security:
3 Reasons Why TheDarkOverlord Loves Vendor Data Breaches
As you may well have heard by now, TDO made headlines recently when they posted most of the new, unreleased episodes of the hit Netflix original “Orange is the New Black” online when Netflix refused to pay a ransom."
From Sophos Naked Security:
Are you encrypting your documents? Here’s what happens when you don’t
"In June 2015, someone connected to Plymouth University accidentally sent a spreadsheet containing the salaries, pensions and allowances of 245 senior staff to the wrong email address.
The error was reported to the UK’s Information Commissioner (ICO), and the file was said to have been deleted by the recipient. Until, that is, the same file turned up last week in the inbox of a local newspaper from an anonymous source."
From Sophos Naked Security:
Dating site users spammed with smut after ‘third-party’ data leak
"Users of the Guardian’s Soulmates dating site have been getting spammed with smut after the site leaked their contact information.
The UK-based Guardian newspaper’s publisher, which runs the service, is blaming “human error” and a third-party technology provider for the leak, which has now been fixed. According to the BBC, the site — which charges users up to £32 ($41.50) per month — said that only email addresses and user IDs had been exposed directly. But that information can be used to dig out more from public profiles, said the company, including photos, relationship preferences and physical descriptions."
From Newsmax:
French Cybersecurity Agency to Probe Macron Hacking Attack
"France's election campaign commission said Saturday "a significant amount of data" — and some fake information — has been leaked on social networks following a hacking attack on centrist Emmanuel Macron's presidential campaign. It urged citizens not to relay the data on social media to protect the integrity of the French vote."
From SecurityWeek:
Travel Tech Giant Sabre Investigating Data Breach
"Travel technology giant Sabre revealed that it has launched an investigation after detecting unauthorized access to sensitive information processed through one of its systems.
Southlake, Texas-based Sabre said in an SEC filing this week that it’s “investigating an incident involving unauthorized access to payment information contained in a subset of hotel reservations processed through the Sabre Hospitality Solutions SynXis Central Reservation system.”
From Dark Reading:
Healthcare Breaches Hit All-Time High in 2016
"More than 300 healthcare businesses reported data breaches in 2016, but a drop in leaked records put fewer Americans at risk.
A record-breaking 328 healthcare businesses reported data breaches in 2016, surpassing the record of 268 set one year prior. Healthcare records of about 16.6 million Americans were exposed due to hacks, lost or stolen devices, unauthorized disclosure, and other activity."
From Dark Reading:
Verizon DBIR Shows Attack Patterns Vary Widely By Industry
"It's not always the newest or the most sophisticated threat you need to worry about, Verizon's breach and security incident data for 2016 shows.
Among the many key takeaways in the 2017 edition Verizon’s annual Data Breach Investigations Report (DBIR), released Thursday, is that there are significant differences in why and how organizations across different industries are attacked."
From McClatchy:
Hacking is now so common that even small nations are doing it
"Russian state hackers get the headlines, but nations across the globe are pouring money into cyber espionage units, a development, security experts say, that is allowing smaller nations to close the espionage gap without the satellites or tech muscle of big nations.
“It’s very inexpensive. It’s very efficient,” said John Hultquist, a cyber espionage analyst who’s studied the growth of hacking among smaller nations for iSight Partners, a division of FireEye, a Milpitas, California, cybersecurity firm."
From McClatchy:
Hack of new season of ‘Orange is the New Black’ portends a looming TV crisis
"After stealing and releasing 10 episodes of the fifth season of the Netflix series “Orange is the New Black” a month before its official premiere, a shadowy hacking group now is threatening to release shows by four other networks unless the networks’ pay a ransom.
It’s a sign of things to come. The future is being hacked, and there’s no certainty where it might end. In today’s digital world, hackers can steal an ever-growing number of secrets."
From Dark Reading:
10 Cybercrime Myths that Could Cost You Millions
"Don't let a cybersecurity fantasy stop you from building the effective countermeasures you need to protect your organization from attack.
Cybercrime is all over the place, with damages, according to one estimate by Cybersecurity Ventures, expected to double from $3 trillion in 2015 to $6 trillion by 2021. In a prominent 2016 ransom attack, according to the 2016 McAfee Threat Report, a criminal was supposedly able to pocket $121 million within just six months, netting $94 million after expenses. Still, too often people believe in myths that prevent them from building effective countermeasures. Here are some examples:"
From Dark Reading:
New OWASP Top 10 Reveals Critical Weakness in Application Defenses
"It's time to move from a dependence on the flawed process of vulnerability identification and remediation to a two-pronged approach that also protects organizations from attacks.
When I wrote the first OWASP Top 10 list in 2002, the application security industry was shrouded in darkness. The insight that a few other engineers and I had gained through hand-to-hand combat with a wide variety of applications lived only within us. We recognized that for the industry to have a future, we had to make our knowledge public."
This is a basic tenant of cybersecurity & I cannot stress how important this is to any size organization. Yes, user audits are painful & tedious but they need to be performed at least annually. Depending on the size of your organization & its turnover it may even be something to perform on a quarterly basis.
From Security Week:
Organizations Fail to Maintain Principle of Least Privilege
"Security requires that confidential commercial data is protected; compliance requires the same for personal information. The difficulty for business is the sheer volume of data generated makes it difficult to know where all the data resides, and who has access to it. A new report shows that 47% of analyzed organizations in 2016 had at least 1,000 sensitive files open to every employee; and 22% had 12,000 or more.
These figures come from the Varonis 2016 Data Risk Assessments report. Each year Varonis conducts more than 1,000 risk assessments for both existing and potential customers. For its latest analysis of data risk, it has selected, at random, 80 of these assessments. They cover 33 industries in 12 different countries. Forty-two of the organizations have fewer than 1000 employees, and 38 have 1001 or more employees."
From Dark Reading:
HHS Hits CardioNet with $2.5M HIPAA Settlement Fee
"The US Department of Health and Human Services slapped the mobile cardiac monitoring service with fee after breach of customer health data."
From SecurityWeek:
Chipotle Investigating Payment Card Breach
"Fast-casual restaurant chain Chipotle Mexican Grill, which has more than 2,000 locations in the United States and other countries, informed customers on Tuesday that its payment processing systems have been breached.
Chipotle said it recently detected unauthorized activity on the network that supports payment processing for its restaurants. The company’s investigation into the incident is ongoing and only limited information has been made public for now."
From Data Breach Today:
Healthcare Hacker Attacks: The Impact
The recent string of major hacker attacks in the healthcare sector, including the cyber-attack on UCLA Health, calls attention to the urgent need for organizations to step up their security programs.
Security experts say healthcare organizations need to carefully reassess their risks and then take appropriate security measures, which, in many cases, will include implementing multifactor authentication; improving breach monitoring and detection; and ramping up staff security education, among other steps.
From Help Net Security:
600TB of data exposed due to misconfigured MongoDB instances
Shodan, the search engine that lets users find devices connected to the Internet, can be used for a number of different things. As its creator, John Matherly, pointed out, it's a means to measure things that couldn't be measured before, and gain new and very muh needed insights.
The latest of these is that there are nearly 30,000 instances of MongoDB on the Internet that don't have any authorization enabled, i.e. are easily accessible to unauthorized users.
