Companies that focus on the immediate breach remediation costs may be missing the big picture, and could be under-investing in security as a result.Several studies have come out recently trying to get a handle on the total costs of a data breach, wi…
Yahoo shows that breach impacts can go far beyond remediation expenses Read More »
Bad guys use common techniques to steal data, while companies focus too much on sophisticated attacks, according to the second annual Hacker’s Playbook, based on an analysis of nearly 4 million breach methods.Security professionals are figuring out …
Millions of IoT devices are misconfigured so that they can forward messages — which, combined with default admin settings, allows them to be used to attack e-commerce and other websites, a new report says.The problem is well known and has been arou…
Leaky IoT devices help hackers attack e-commerce sites Read More »
Shodan is a search engine that looks for internet-connected devices. Hackers use it to find unsecured ports and companies use it to make sure that their infrastructure is locked down. This summer, it was also used by security researchers and law en…
How Shodan helped bring down a ransomware botnet Read More »
Most of the recent data breaches involve customer information such as user names and passwords, credit card numbers, and medical histories. The companies hacked are hurt — they have to contact victims, pay for credit monitoring services and fines, …
Data leaks evolving into weapons of business destruction Read More »
Even smaller criminal groups are using smart business tactics to help insulate them from risk, such as the Vendetta World online shop, which sells credit card numbers.
According to a report released today by FireEye, the two criminals behind this o…
Diversified supply chain helps ‘Vendetta Brothers’ succeed in criminal business Read More »
Seventy-three percent of companies are using vulnerable, end-of-life networking equipment, up from 60 percent last year, according to a new analysis of more than 212,000 Cisco networking devices at 350 organizations across North America.”It’s amazin…
73% of companies using vulnerable end-of-life networking devices Read More »
Next week, New York State will begin a 45-day public comment period on its new financial industry cybersecurity regulation — and, so far, security experts have a favorable view of the proposal.Under the new regulations, banks and insurance companie…
NY regulation aims to raise bank security standards Read More »
Retailers were supposed to start accepting chip cards last October, but a year past the start of the EMV liability shift, two-thirds still haven’t done so.Only 2 million merchants, representing 33 percent of the industry, are actively accepting chip…
As migration anniversary approaches, only a third of retailers accept chip cards Read More »
The technology is there for companies to inspect the SSL traffic going in and out of their networks, but performance, management and privacy concerns combine to hinder its adoption — allowing cyberattackers to hide their malicious activity in the e…
A single ransomware author and distributor was able to collect $121 million in ransomware payments during the first half of this year, netting $94 million after expenses, according to a report released today.”Ransomware has grown over the years, and…
A single ransomware network has pulled in $121 million Read More »
Distributed denial of service attacks that take advantage of misconfigured NTP servers were up 276 percent last quarter compared to the same time last year, reaching a new record high, according to a new report.
Part of the reason for the increase …
NTP reflection attacks hit record high Read More »
Cloud-based filesharing, collaboration and social networking applications are common vectors for malware infections, a large portion of of which are ransomware delivery vehicles, according to a report released today.Javascript exploits and droppers,…
Ransomware prevalent in cloud-based malware Read More »
Cross-site scripting and SQL injection attacks are well-known threats for public-facing Web applications, but internal systems can be attacked as well. For example, about half of network management systems studied had these vulnerabilities, accordin…
Half of network management systems vulnerable to injection attacks Read More »
A CEO said that his controller had just received an email, ostensibly from him, asking her to process an urgent outgoing payment.Everything about the letter looked legit.”It has my display name, spelled correctly,” said Kevin O’Brien, co-founder and…
New tech can help catch spearphishing attacks Read More »
