Facebook's headquarters in Menlo Park, California (Photo: Facebook)

Facebook Eyes Spammers for Mega-Breach

Mathew J. Schwartz • October 18, 2018

Facebook is eyeing spammers as being the culprits behind its recently disclosed mega-breach, The Wall Street Journal reports. Preliminary findings from Facebook's internal investigation suggest that the attackers were not affiliated with a nation-state, but rather part of a known spam ring, the newspaper reports.

Blockchain & Cryptocurrency

Review Shows Glaring Flaws In Xiongmai IoT Devices

Latest

Cybercrime

Anthem Mega-Breach: Record $16 Million HIPAA Settlement

Marianne Kolbasuk McGee • October 16, 2018

Federal regulators have smacked health insurer Anthem with a record $16 million HIPAA settlement in the wake of a cyberattack revealed in 2015, which impacted nearly 79 million individuals. What missteps does the settlement highlight?

Cybercrime

US Voter Records for Sale on Hacker Forum

Jeremy Kirk • October 16, 2018

A batch of U.S. voter registration records from 20 states has appeared for sale online in what appears to be an illegitimate offering. While it's far from the largest-ever seen leak of voter data, the incident again highlights the lax controls too often applied to voter records.

Encryption & Key Management

Tech Companies Bristle at Australia's Crypto Legislation

Jeremy Kirk • October 15, 2018

The disagreements continue over Australia's efforts to pass legislation that would help law enforcement counter encryption. Technology companies and civil liberties organizations contend the latest draft of legislation would allow for too much secrecy and imperil privacy and security.

Governance

Update: NIST Preparing Privacy Framework

Nick Holland • October 15, 2018

Building on the success of the NIST Cybersecurity Framework, the National Institute of Standards and Technology is in the early stages of developing a privacy framework. The effort will kick off with a workshop Tuesday in Austin, Texas, explains Naomi Lefkovitz, who is leading the project.

Cybersecurity

RSA President on the Case for a Risk-Based Security Model

Geetha Nandikotkur • October 15, 2018

CISOs and other security practitioners are embracing the idea of a business-driven security model that takes a risk-oriented approach, says Rohit Ghai, president of RSA. "Cybersecurity conversations are becoming business conversations rather than technology conversations."

Business Continuity/Disaster Recovery

Safeguarding Critical Infrastructure From Cyberattacks

Nick Holland • October 12, 2018

The biggest challenge for any critical infrastructure facing potential cyberattacks is devising ways to maintain business continuity, says cybersecurity specialist Prashant Pillai, who calls for building resilience into network design. He'll be a speaker at ISMG's Security Summit: London, to be held Oct. 23.

An Assessment of Google's Data Leak

Nick Holland • October 12, 2018

An in-depth report on the exposure of personal details for 500,00 Google+ accounts leads the latest edition of the ISMG Security Report. Also featured: an update on mitigating the risk of business email compromises and tips for protecting critical infrastructure.

Governance

Network vs. Endpoint Security: Striking the Right Balance

Varun Haran • October 12, 2018

With so much focus on endpoint security, it's important not to overlook the importance of network-level security controls, says Lawrence Orans, research vice president at Gartner.

Anti-Malware

GandCrab Ransomware Partners With Crypter Service

Mathew J. Schwartz • October 11, 2018

The notorious GandCrab ransomware-as-a-service gang has released the latest version of its crypto-locking malware, backed by crypter service and exploit toolkit partnerships. But the gang's marketing savvy belies shoddy code-development practices, security firm McAfee finds.

Anti-Malware

Magecart Card-Stealing Gang Hits 'Shopper Approved' Plug-In

Mathew J. Schwartz • October 10, 2018

A notorious group of payment card-stealing gangs called Magecart has been tied to another series of online attacks, this time against Shopper Approved, an e-commerce service used by thousands of sites to gather reviews from customers.

Business Email Compromise (BEC)

Defending Against Business Email Compromise Attacks

Nick Holland • October 10, 2018

What can organizations do to thwart business email compromise attacks? In an interview, David Stubley, CEO of the consultancy 7 Elements, outlines several key steps. He'll be a featured speaker at Information Security Media Group's Security Summit: London, to be held Sept. 23.

Cybercrime

Suspected NASA Hacker Busted After Boasting About Exploits

Mathew J. Schwartz • October 10, 2018

Memo to hackers: Boasting about your exploits on social media channels is a good way to get caught. Indeed, Italian police say they busted a suspected hacker after he bragged not only about defacing the NASA home page but also about being part of a group calling itself "Master Italian Hackers Team."