Resources

Blog

5 Ways Attackers Are Targeting the Healthcare Industry

The healthcare industry is one of the largest industries in the United States and potentially the most vulnerable. The healthcare sector is twice as likely to be the target of a cyberattack as other sectors, resulting in countless breaches and millions of compromised patients per year. Advancements in the techniques and technology of hackers and...
Blog

The Gap Between U.S Federal and State Policies for IoT Security

In a recent article about U.S federal policy concerning IoT security, Justin Sherman identified several gaps in both cybersecurity and privacy policies. As Sherman has highlighted: The United States federal government, like the rest of the world, is increasingly using IoT devices to improve or enhance its existing processes or to develop new...
Blog

Proactive System Hardening: Continuous Hardening’s Coming of Age

The first article in this series examined configuration hardening—essentially looking at ports, processes and services where security configuration management (SCM) is key. The second article looked at application and version hardening strategies. This third installment will discuss the role of automation in the coming of age of what’s called “continuous hardening.” Known Vulnerabilities vs....
Blog

VERT Threat Alert: October 2018 Patch Tuesday Analysis

Today’s VERT Alert addresses Microsoft’s October 2018 Security Updates. VERT is actively working on coverage for these vulnerabilities and expects to ship ASPL-800 on Wednesday, October 10th. In-The-Wild & Disclosed CVEs CVE-2018-8453 This vulnerability, a privilege escalation in Win32k’s handling of objects in memory, has been exploited in the...
Blog

Over 4.5 Billion Records Breached in H1 2018, Finds Report

A recent report found that data breaches compromised a total of more than 4.5 billion records in the first half of 2018. In its report "2018: Data Privacy and New Regulations Take Center Stage," Gemalto wrote that its Breach Level Index (BLI) system tracked 4,553,172,708 breached data records during...
Blog

Women in Information Security: Alana Staszczyszyn

Last time, I had the privilege of speaking with web security specialist Pam Armstrong. This time I got to chat with Alana Staszczyszyn, someone whom I’ve had the pleasure of meeting in person. She’s very active in Toronto’s cybersecurity scene. She’s currently a student, but she has so much to teach people in our industry about evolving cyber...
Blog

Proactively Hardening Systems: Application and Version Hardening

The first article in this series examined configuration hardening, essentially looking at ports, processes and services as the “doors, gates and windows” into a network where security configuration management (SCM) becomes the job of determining which of these gateways should be open, closed, or locked at any given time. Now it’s time to look at...
Blog

BEC-as-a-service offers hacked business accounts for as little as $150

Everyone responsible for securing organisations today recognises the significant growth in BEC (Business Email Compromise) attacks, also sometimes known as "Whaling" or "CEO fraud". BEC scammers trick accounting and finance departments into wiring considerable amounts of money into bank accounts under their control, posing as genuine suppliers...
Blog

Net Neutrality Regulation – Does the Past Predict the Future?

The debate over the degree of regulation of broadband Internet providers in the U.S. has been going on almost as long as broadband Internet service has been available. In 2004, the U.S. Federal Trade Commission (FTC) first described a set of non-discrimination principles to ensure that users had access to content on an equal basis. In 2008, the FCC...
Blog

Criminals Holding Hijacked Instagram Influencers' Accounts for Ransom

Criminals are hijacking Instagram influencers' accounts and demanding that victims pay a ransom in bitcoin to regain access. Kevin Kreider, a Los Angeles-based Instagrammer who's known for his following around fitness-related topics, told Motherboard that extortionists first targeted him when someone named Lana reached out with a fake business...
Blog

A Practical Guide to CCPA for U.S. Businesses

Inspired by Europe’s General Data Protection Regulation (GDPR), the State of California has set a new precedent with the passage of the California Consumer Privacy Act (CCPA). The major data incidents last year have driven citizens into a frenzy about securing their data, and states have rushed to developing and passing policies and legislation....
Blog

Network Outage at Some Recipe Unlimited Locations Caused by Malware

A malware outbreak was responsible for a network outage that affected a limited number of Recipe Unlimited restaurant locations. On 1 October, Recipe Unlimited announced a malware attack of which it learned at the end of September. The Canadian restaurant chain owner and food distributor said in a statement that it responded by taking certain...
Blog

The Verizon PHIDBR: A Wake-Up Call for Healthcare Organizations

The healthcare industry continues to be challenged with securing patient health information. According to the Verizon Protected Health Information Data Breach Report (PHIDBR), 58 percent of all security incidents involved insiders, ransomware accounts for 70 percent of all malicious code, and alarmingly, basic security hygiene is still lacking at...
Blog

Women in Information Security: Pam Armstrong

Last time, I spoke with Sharka. She’s a pentester who knows how to hack a glucose meter. She also taught me a few things about physical security. Now I get to talk with Pam Armstrong. Web development eventually led her to healthcare security. Kim Crawley: Please tell me about what you do. Pam Armstrong: I work for a large healthcare system on the...
Blog

DanaBot Observed in Large Campaign Targeting U.S. Organizations

Researchers observed the distribution of the DanaBot banking trojan in a large attack campaign targeting U.S. organizations. On 26 September, Proofpoint detected a campaign consisting of hundreds of thousands of emails intended for U.S. recipients. Each of these attack messages masqueraded as an eFax and used a "Download Fax" link to download a...