Loading the searchable article library…
Browse published articles attributed to Michael Peters, with full-archive search.
Clothing retailer Forever 21 suffered a POS system breach in an undisclosed number of stores from March to October 2017, the company announced last week. The Forever 21 breach was discovered by a third party and involved hackers taking advantage of POS systems that were not encrypted.
The years-long Marriott Starwood database breach was almost certainly the work of nation-state hackers sponsored by China, likely as part of a larger campaign by Chinese hackers to breach health insurers and government security clearance files, The New York Times reports. Why would foreign spies be so interested in the contents of a hotel’s guest database?
Noting that cyber security is “the responsibility of every health care professional, from data entry specialists to physicians to board members,” the U.S.
The Yahoo hack demonstrates that cyber security has become a fundamental part of M&A transactions.
Cyber criminals don’t care who they hurt. This was made obvious during the rash of ransomware attacks on healthcare facilities this year, where hackers locked down electronic health records systems, putting patients at grave risk. There is great conce that the proliferation of Internet of Things (IoT) medical devices, such as smart insulin pumps, will enable hackers to go after patients directly, demanding that they pay a ransom to keep their lifesaving devices working.
As Califo ia goes, so does the rest of the country. While the Califo ia Consumer Privacy Act (CCPA), which was passed this summer and goes into effect in 2020, falls short of being an “American GDPR,” it clearly tore many pages from the far-reaching European data privacy law. Similar to the GDPR, the CCPA defines personal identifying information rather broadly, encompassing not just names and Social Security Numbers but things like IP addresses and browser cookies.
Doxware Leaks Your Private Data if You Don’t Pay the Ransom
The Marriott Starwood breach, which exposed the personal data of 500 million guests, was not the largest data breach in terms of size; Yahoo still holds that dubious honor. However, because of the nature of the data stolen, it has the potential for a very long reach and highlights multiple cyber security and data privacy issues. The importance of cyber security due diligence in M&A transactions
Online shopping is booming, but customers will shun ecommerce if they do not feel their data is secure.
U.S. federal government agencies are required to use the email security protocol DMARC to prevent email spoofing, but the overwhelming majority of federal contractors either don’t have it installed or don’t have it set up properly. NextGov reports:
By following these best practices, organizations can enjoy the benefits of outsourcing their enterprise cyber security, minimize the risks, and build fruitful, long-term relationships with trusted providers. With the cyber security skills gap making it extremely difficult or even impossible for companies to find the security talent they need – and they need it yesterday – more and more firms are outsourcing their enterprise cyber security.
New York State Cyber Security Regulations for Financial Institutions Could Be Model for Other States The first phase of the New York state cyber security regulations, which apply to insurance companies, banks, and other financial institutions operating within the state, finally went into effect on March 1.
FISMA, FedRAMP, NIST, DFARS, CJIS, HIPAA … Government compliance standards can seem like a veritable alphabet soup. Making matters even worse, a lot of them overlap, and many organizations aren’t certain which standards they need to comply with.
Department of Defense contractors and their subcontractors have until December 31 to obtai DFARS compliance
With an estimated 90% of cyber attacks caused by human error or behavior, it’s important to understand the most common cyber security mistakes your employees are probably making and know how to mitigate them. Becoming victims of phishing schemes
Healthcare data security is under attack from the inside. While insider threats—due to employee error, carelessness, or malicious intent—are a problem in every industry, they are a particular pox on healthcare data security. Two recent reports illustrate the gravity of the situation.
A guide to advanced persistent threats (APTs), a highly sophisticated, highly destructive form of cyber attack. What is an Advanced Persistent Threat (APT)?
The NotPetya attacks weren’t as bad as WannaCry; they were worse, and we all need to start cooperating to prevent the next attack. It’s looking more and more like last week’s NotPetya malware attacks, which infected computers around the world but hit Ukraine particularly hard, were designed to cause widespread damage and disruption, not make money.
Once a luxury item, free public WiFi has morphed into a standard service that consumers expect when patronizing everything from restaurants and retail stores to airports and hotels. Free WiFi users aren’t just checking Facebook or posting vacation photos to Instagram, either; all of us have sat down on a train or in a coffee shop and seen business people tapping away on their laptops, taking advantage of public WiFi to work on the go. However, public WiFi networks open users up to numerous cyber attacks, especially if anetwork is unsecured. These include:
Think about a time when you had a single credit card lost or stolen, and how much of a pain that experience was. Now imagine if your entire wallet was lost or stolen and the exponential magnitude of pain in the patootie that would be for you. Run Over by the Bus
PCI DSS compliance is mandatory for any organization that accepts or processes payment cards, yet shockingly, a recent study by SecurityScorecard found that over 90% of U.S. retailers fail to meet four or more PCI DSS requirements.
The Federal Risk and Authorization Management Program, or FedRAMP, was designed to support the federal government’s “cloud-first” initiative by making it easier for federal agencies to contract with vendors that provide SaaS solutions and other cloud services. Unlike FISMA, which requires service providers to seek an Authority to Operate (ATO) from each individual agency they want to do business with, a FedRAMP ATO qualifies a provider to work with any federal agency.
Cryptocurrencies such as Bitcoin and Ethereum have gone mainstream; it seems like everybody and their brother is looking to buy some crypto and get their piece of the digital currency gold rush. Hackers want a piece of it, too. In addition to hacking ICO’s and cryptocurrency exchanges, they’re using crypto-mining malware to “mine” their own “coins.”
“ClearEnergy” May Have Been Fake News, But Threats Against ICS / SCADA Security Are Quite Real Accusations of “fake news” rocked the cyber security industry last week after infosec provider CRITIFENCE implied that it had detected a brand-new “in the wild” ransomware variant called ClearEnergy that posed a clear and present danger to ICS and SCADA security. Bleeping Computer reports:
Hacks in the City: Latest in String of Attacks at HBO Targets Company’s Social Media Accounts
Hacks do not happen in a vacuum; if one computer on a network is compromised, all machines on that network are at risk. For this reason, both enterprises and individuals have a responsibility to implement cyber security best practices – and this does not mean installing anti-virus software and a firewall and calling it a day. While it’s important to run anti-virus software and properly configure firewalls, viruses aren’t the only threat to your system; what if your email login credentials are stolen, or someone hacks your router or your smart TV?
K-12 schools, colleges, and universities are attractive targets for hackers. Their networks contain an enormous amount of identifying information on staff members, students, and students’ families, including names, birth dates, addresses, Social Security numbers, and even health records. Additionally, educational institutions are frequently connected to each other and to government agencies for information-sharing purposes, which means that hackers may use a school’s network as a “back door” into their real target.
Over several months last year, an international group of cyber bank robbers, possibly funded by the North Korean government, stole nearly $100 million, threw the integrity of a decades-old banking industry messaging system into question, and remained at large. Sound like the plot of the latest James Bond blockbuster?
Despite the availability of modern GRC software, many organizations still use spreadsheets to conduct IT compliance audits and other GRC activities. While spreadsheets are highly useful for many business functions, especially accounting, they are not GRC tools. Depending on spreadsheets to manage GRC processes is time-consuming, costly, and inefficient at best, dangerous to your GRC and cyber security efforts at worst. Here are six reasons why your enterprise should stop using spreadsheets as GRC tools. They Aren’t Databases
Ransomware isn’t a new threat. It first rose to prominence back in 2016, when Hollywood Presbyterian Medical Center shelled out $17,000 in bitcoin after an attack took the hospital offline. Since then, ransomware has only become more popular, especially for hackers targeting the healthcare industry or government organizations. Used to be, launching a ransomware attack required at least some technical prowess; at a minimum, hackers had to possess sufficient coding skills to write a ransomware program. Then, ransomware-as-a-service (RaaS) came on the scene and changed the game.
Why Your Employees Keep Clicking on Phishing Emails, and How You Can Stop It
Don’t want your company to be the next Yahoo, Equifax, Deloitte, or SEC? Don’t ignore cyber risk management.
Email marketing is big business. MarTech Advisor reports that it is the best-performing channel for a company’s ROI, and 61% of consumers prefer to receive offers via email, as opposed to only 5% who prefer social media offers. However, many organizations are conce ed about how the GDPR, the European Union’s new, sweeping data privacy law, will impact their email marketing programs.
Internet-connected smart toys, a popular holiday gift item, have vulnerabilities that put both children and parents at risk of data breaches and identity theft.
Tax season is stressful enough without having to worry about becoming the victim of a cyber crime. Here are three different tax phishing scams targeting employers, individuals, and even tax preparers that are currently making the rounds. Employers: W-2 Phishing Emails
Yahoo is trying to pass the buck, but data breach responsibility starts at the top.
There are more connected devices than there are humans on Earth. Organizations have been as quick to embrace the Internet of Things as consumers have, and the healthcare industry is no exception. Medical IoT devices have exploded in popularity and grown in complexity. Smart medical devices allow physicians to make more accurate diagnoses and better monitor their patients, leading to better quality of care. However, the proliferation of medical IoT has given hackers a much broader attack surface on which to target healthcare organizations.
Des Moines-based Voya Financial Advisors (VFA) has agreed to pay the U.S. Securities and Exchange Commission a $1 million penalty in the wake of an April 2016 breach that affected several thousand VFA customers. The SEC cyber enforcement action charged VFA with not having sufficient written policies and procedures in place to protect customer information, as well as not having a writte Identity Theft Prevention Program as required under the Identity Theft Red Flags Rule.
The Mirai botnet DDoS attacks were the largest on record – and they were likely masterminded by teenagers.
ATMs were designed to protect their cash vaults, not their computer components, which leaves them vulnerable to “jackpotting” cyber attacks.
Now that the year is coming to an end, all eyes are on what’s possibly around the corner. More attacks on cryptocurrencies? An escalation in attacks by state-sponsored cyber criminals? Chaos as the EU’s GDPR is implemented? In cyber security, only one thing is certain: It’s a continuous game of Spy vs. Spy. As soon as one hole is plugged, hackers find another way in, and with every new technology comes a brand-new set of risks.
Organizations have until May 25, 2018, to comply with the EU’s new General Data Protection Regulation (GDPR). Arguably the most comprehensive, far-reaching data privacy law passed to date, the GDPR grants European consumers numerous new data privacy rights and places new data governance responsibilities on organizations.
New Anthem breach underscores the need to manage cyber risk throughout the enterprise ecosystem
Last week’s data leak at Exactis, a Florida-based marketing and data aggregation firm, has cyber security experts and data privacy advocates up in arms. WIRED reports:
The cyber security skills gap is real and growing; there simply aren’t enough cyber security employees to go around.
New PCI DSS Ecommerce Best Practices Replace Previous Guidelines Issued in 2013
As 2016 comes to an end, we look back at six of the year’s worst data breaches and what went wrong. It seems like not a day went by this year without reports of yet another major data breach, or two or three data breaches. From healthcare to fast food to adult entertainment, no industry was spared the wrath of hackers. Even the U.S. presidential election ended up being impacted by cyber security conce s, both real and perceived. Here, we review six of 2016’s worst offenders and what went wrong. 1. The Yahoo Data Breaches
Cloud computing has opened up a world of opportunities for businesses, but it has also resulted in new cyber security threats. Some of these mirror the threats organizations have been combating on premises for years, while others are unique to the cloud. What are the top cloud security threats organizations face in 2018? Recently, the Cloud Security Alliance (CSA) released its “Treacherous 12” report to answer this question.
Businesses tend to gloss over social media cyber security, thinking that it’s more of an issue in their employees’ personal lives than a threat to workplace cyber security. However, one in eight enterprises have suffered a security breach that was traced back to a cyber attack on social media. Here are the top social media cyber security threats to organizations and how to avoid them. Social Media Cyber Security Threats to Enterprises
We’re down to the wire now; the GDPR compliance deadline is next Friday, May 25. As organizations scramble to get ready for the most far-reaching data privacy law ever put on the books, consumers’ email inboxes are being inundated with notices of privacy policy updates. In addition to fundamentally transforming their data governance, most companies will need to update their website’s privacy policy to meet GDPR standards. Following are six tips for writing a GDPR-compliant privacy policy. Use Clear, Plain Language