Verizon, Trump Hotels, and the RNC are Among the Recent Victims of Third-Party Breaches
Even if your own cyber security is up to snuff, your organization could be at risk of third-party breaches if your business partners are not as diligent as you are. Verizon just learned this lesson the ... Views: 958
As cyber threats present greater risks to enterprises of all sizes and in all industries, more are requiring that their SaaS providers and other cloud services vendors have an SOC 2 certification. Let’s examine what an SOC 2 certification is and why your cloud services business should get ... Views: 957
Ensure a secure cloud migration with these simple, proactive cyber security tips
Enterprises have much to gain by migrating to the cloud, which is why the U.S. government has adopted a “cloud-first” initiative. Cost savings and the ability to scale up and down quickly as organizational needs ... Views: 956
Cyber criminals upped their game in 2017, launching everything from cryptocurrency thefts to international ransomware attacks. Here, we examine seven of the worst cyber attacks of 2017.
1. The Equifax Breach
Any list of the worst cyber attacks of 2017 would be remiss if it did not include ... Views: 956
HBO Hack Targeted Valuable Intellectual Property and Company Secrets
Corporate espionage and the theft of intellectual property and company secrets have gone cyber. The latest victim is cable network HBO and its flagship series Game of Thrones. The HBO hack, perpetrated by a hacker or group ... Views: 955
We’re down to the wire now; the GDPR compliance deadline is next Friday, May 25. As organizations scramble to get ready for the most far-reaching data privacy law ever put on the books, consumers’ email inboxes are being inundated with notices of privacy policy updates.
In addition to ... Views: 951
Global losses from business email compromise scams, a highly sophisticated form of phishing, grew by 136% between December 2016 and May 2018 and now exceed $12 billion, according to a public service announcement released by the FBI.
What Is a Business Email Compromise Scam?
A business ... Views: 950
A new report by Synopsys and the Ponemon Institute finds that medical device security is plagued by a lack of standards, testing, and accountability.
Healthcare organizations tend to focus their cyber security efforts on HIPAA compliance, protecting patient data, and defending against ... Views: 944
Governance, risk, and compliance should be at the heart of AWS security procedures
Another day, another AWS security breach, and this one is particularly bad because of the extraordinarily sensitive nature of the data that was compromised: Over 9,000 documents containing personal data on job ... Views: 944
The next time you buy a burger at McDonald’s or Wendy’s, a computer may be the one asking, “Would you like fries with that?” After decades of depending on human workers to take orders – and payments – American fast food chains are finally moving into the computer age, driven by rising minimum ... Views: 940
The Healthcare Industry Cybersecurity Task Force’s report on healthcare cyber security echoes a similar study on medical device security issued by Synopsys and the Ponemon Institute.
On the heels of a damning study by Synopsys and the Ponemon Institute, which provides a blow-by-blow ... Views: 939
The SEC hack has pitched the international finance world into turmoil as Wall Street's top regulator admits to not having secured its own systems.
Move over, Equifax; the SEC hack may have just stolen your thunder. Less than two weeks after Equifax disclosed that it had been breached, ... Views: 936
According to the Wi-Fi Alliance, there are now more IoT devices than there are humans on Earth, and over 50% of internet traffic travels through wireless networks. As people’s dependence on connected devices has grown, free public WiFi has become insanely popular, but it’s also insanely ... Views: 933
If your company is part of the federal supply chain, you likely need to comply with NIST 800–171. NIST 800–171 compliance applies to contractors for the DoD, GSA, NASA, and other federal and state agencies; universities and research institutions that accept federal grants; consulting firms with ... Views: 932
Shadow IT is a very serious and growing threat to IT compliance and cyber security, and most organizations have no idea how common it really is. This article will examine some of the risks of shadow IT and discuss ways in which organizations can curb it.
What Is Shadow IT?
Shadow IT refers ... Views: 930
With just over three weeks to go until the May 25, 2018, deadline, many U.S. companies are woefully unprepared for the EU’s new General Data Protection Regulation, or GDPR. In fact, quite a few of them don’t yet realize they have to achieve GDPR compliance. A new survey by CompTIA found that “A ... Views: 927
Confused about HIPAA and whether your business must comply with it? This article will explain HIPAA and the importance of complying with this complex federal law.
What is HIPAA?
HIPAA is the Health Insurance Portability and Accountability Act of 1996, which was signed into law by President ... Views: 927
The #MeToo movement, which was birthed in the wake of sexual abuse allegations against Hollywood mogul Harvey Weinstein, has shined a spotlight on the epidemic of sexual harassment and discrimination in the U.S. According to a nationwide survey by Stop Street Harassment, a staggering 81% of ... Views: 924
Thousands of websites, including government sites in the United States, the U.K., and Australia, were ensnared in an international cryptojacking scheme, The Register reports:
The affected sites all use a fairly popular plugin called Browsealoud, made by Brit biz Texthelp, which reads out ... Views: 922
SEC cyber security enforcement is set to intensify in light of recent global attacks and new enforcement chiefs
Public companies and firms operating in regulated industries, especially finance, should expect more SEC cyber security enforcement in the wake of new and emerging threats, like ... Views: 921
The NSA isn’t the only Washington organization being embarrassed by a data breach. The sorry state of cyber security in America has taken center stage in this year’s presidential election. In June, it was discovered that Russian cyber criminals had managed to hack the Democratic National ... Views: 918
For Years, Yahoo Put Usability Ahead of Cyber Security
The massive Yahoo data breach, which compromised 500 million user accounts and put its acquisition by Verizon at risk, happened because the company repeatedly put product user experience ahead of security, the New York Times ... Views: 915
Citing the success of its cybersecurity framework and the advent of IoT devices, artificial intelligence, and other technologies that are making it more challenging than ever for enterprises to protect their customers’ privacy, NIST has launched a collaborative project to develop a voluntary ... Views: 914
We are living in a cloud-first world; cloud services, including storage services and SaaS providers, are wildly popular. Unfortunately, third-party vendor breaches are at epidemic levels, and new regulations such as the EU GDPR are seeking to hold organizations accountable if third-party ... Views: 910
The recent WannaCry ransomware attacks put cyber security on the front page of every newspaper in the world. Now, everyone knows what ransomware is and how destructive it can be, but will anything change? Following are four critical lessons that both organizations and individuals should take ... Views: 910
Social Media Security Matters; Just Look at the Trump Twitter Account Debacle
Last week’s Trump Twitter account incident – where the president’s Twitter feed was deactivated for 11 minutes – was fodder for many late-night television jokes. All kidding aside, though, enterprise social media ... Views: 906
IoT manufacturers should take heed from the recent Mirai DDoS attacks.
Late last year, a widespread attack on Dyn DNS “Managed DNS” infrastructure wreaked havoc across the internet and brought down a number of major websites, including PayPal, Twitter, Amazon, Netflix, GitHub, and Reddit. ... Views: 900
K-12 school systems, colleges, and universities are being increasingly targeted by hackers, yet education cyber security is as woefully lacking as other industries, as these recent incidents illustrate:
• In November 2016, Columbia County School District in Georgia admitted to a breach of ... Views: 897
How RegTech Simplifies Governance, Risk, and Compliance
Complying with standards such as HIPAA, PCI DSS, FISMA, and SSAE 16 SOC reporting is complex, costly, and time-consuming, especially for organizations that must comply with multiple standards. You may have heard the term “RegTech” ... Views: 897
Confused about PCI DSS compliance and what your business needs to do to comply with it? This article will explain PCI DSS and the importance of complying with this important information security standard.
What is PCI DSS?
PCI DSS stands for the Payment Card Industry (PCI) Data Security ... Views: 892
The U.S. Securities and Exchange Commission plans to update its six-year-old guidelines regarding data breach notification and cyber risk disclosure, Bank Info Security reports:
The agency has indicated that it expects to refine guidance around how businesses disclose cybersecurity risks to ... Views: 888
State officials expressed grave concerns about election hacking the day after Special Counsel Robert Mueller handed down indictments of 13 Russian nationals on charges of interfering with the 2016 presidential election. The Washington Post reports:
At a conference of state secretaries of ... Views: 888
The rise of ecommerce, particularly mobile ecommerce, has fundamentally altered both consumer and business buying habits. Organizations are embracing digital transformation in an effort to appease modern buyers and enhance the customer experience while cutting costs and improving efficiency. The ... Views: 887
Last week, the NIST Small Business Cybersecurity Act (S. 770) passed the U.S. Senate and was sent to the White House, where the president is expected to sign it into law shortly. The bipartisan measure directs NIST to provide resources to small businesses to help them implement the NIST ... Views: 886
Both brick-and-mortar and ecommerce retail stores make attractive targets for hackers, especially during the holidays.
Retail stores are favorite targets of cyber criminals, especially during the holiday shopping season, when brick-and-mortar and ecommerce stores are flooded with customers, ... Views: 885
In a new report, UC Berkeley’s Center for Long-Term Cybersecurity offers suggestions to President Elect Trump.
Now that the election is over, the nation’s attention has turned to President Elect Donald Trump and what a Trump Administration will mean for cyber security. Notably, information ... Views: 872
No organization wants to think that one of its own trusted employees is out to get the firm. However, a study by Intel found that 43% of data losses are the result of “internal actors” – and about half of these incidents were due to the intentional acts of malicious insiders, not accidents or ... Views: 871
The Uber breach, which compromised the data of 57 million drivers and customers worldwide, has just gone from bad to worse. Not only did the company wait for a year to disclose the hack, it scrambled to cover it up by forking over $100,000 in hush money to the hackers – which it funneled through ... Views: 871
In a heated political climate, even the appearance of vote hacking could threaten our nation’s democracy.
The most contentious issue this election season may not be immigration or minimum wage laws but cyber security; specifically, the specter of vote hacking. Shortly after the discovery that ... Views: 870
The WannaCry ransomware attack was the end result of years of ignorance on the part of governments, private-sector firms, and the public regarding how serious cyber threats have become.
The 2016 Shadow Brokers NSA hack came home to roost in a big way last week, when a code execution ... Views: 870
Healthcare is one of the most regulated industries in the U.S. HIPAA, or the Health Insurance Portability and Accountability Act of 1996, requires healthcare organizations and their third-party service providers, such as labs and billing companies, to have data security measures in place protect ... Views: 868
What will the state of cyber security look like under a Donald Trump administration?
The election is over, the votes have been counted, and thankfully, other than a few isolated reports of malfunctioning voting machines, Election Night was unremarkable from a cyber security perspective. Now, ... Views: 868
Phishing attacks are big business. The FBI estimates that business email compromise, a highly targeted form of phishing, costs U.S. businesses half a billion dollars a year, and the Verizon 2018 Data Breach Investigations Report found that 90% of cyber attacks began with a phishing ... Views: 866
The deadline for compliance with the EU’s General Data Protection Regulation (GDPR) is fast approaching, and an astounding number of organizations are woefully unprepared to meet it. A new survey of IT decision-makers by Crowd Research Partners found that a whopping 60% of organizations will ... Views: 865
There has never been a power outage in the U.S. due to a cyber attack, but it happened in Ukraine over the Christmas holidays in 2015, and there have been attempts to breach U.S. power companies and hack the power grid.
In March, the U.S. Department of Homeland Security issued an alert ... Views: 862
Don’t let your business get caught on a spear phisher’s hook.
Like regular phishing, spear phishing involves sending legitimate-looking but fraudulent emails asking users to provide sensitive information and/or initiate wire transfers. However, while regular phishing emails are sent out en ... Views: 862
In the hit USA Network series Mr. Robot, a rogue group of hacktivists target major corporations and the government. In a recent episode, the group enlists the help of a malicious insider to hack the FBI. Sound far-fetched? Maybe not: Around the same time this episode aired, an anonymous group of ... Views: 862
The difference between penetration tests and vulnerability scans is a common source of confusion. While both are important tools for cyber risk analysis and are mandated under PCI DSS, HIPAA, and other security standards and frameworks, they are quite different. Let’s examine the similarities ... Views: 860
Cyber security is a continuous game of Spy vs. Spy. Every time a new technology is introduced, the potential attack surface expands. The moment one vulnerability is patched, hackers find another way in. Keeping up can feel overwhelming, even for security professionals.
In no particular order, ... Views: 851
The deadline for GDPR compliance is right around the corner; is your company ready? Here’s what you need to know about this important new data protection law and what your organization must do to prepare for it.
What is GDPR?
The General Data Protection Regulation, or GDPR, was adopted by ... Views: 849