Organizations around the world are taking a more innovative approach to managing threats in today’s digital era, reveals the 19th annual Global State of Information Security Survey (GSISS). This year’s study – produced by PwC in conjunction with CIO and CSO – includes the responses of more than 10,000 business and IT security executives from over...

Hackers stole nuclear research data and personal information off of a computer at the University of Toyama’s Hydrogen Isotope Research Center. According to university officials, the hackers posed as a Tokyo university student to deliver a malware-laden document to a teaching member at the center, which conducts research on hydrogen, deuterium, and...

Last week, I had the opportunity to travel to Tokyo, Japan to visit the Tripwire Japan office. I also had time to tour the city a bit with my colleague Lane Thames and his wife Linda. While the flights were long, the experience was absolutely worth it. The subway system, while pretty crazy to look at via map, was easy to navigate with the help of...

Android users are being reminded to only install apps from the official Google Play store or trusted third parties, after new research has revealed an alarming number of devices continue to be infected by a notorious family of malware. Security researchers at Cheetah Mobile Security claim that it is responsible for most of the Android infections...

Some people hate the red team. They think of them as the adversary, and at the extreme, people worry that their jobs are on the line. If any holes are found, network defenders worry it could be a mark on their competency. However, this should not be the case. Although it does not come across this way initially, the red team is leveraged to help the...

It's no secret that some computer crime can generate a lot of money. For example, the author of Cerber ransomware relies on an affiliate system to distribute their creation. The malware developer collects only a fraction of the ransom payments, the average value of which usually amounts to around one Bitcoin. But even with just 0.3 percent of...

At least 58 million people have had their personal information published on the internet - including their names, dates of birth, email and postal addresses, job titles, phone numbers, vehicle data, and IP addresses - after a hacker stole a massive unsecured database. And, if you think that sounds bad, there may be yet more hacked data still to be...

Vera Bradley has notified its customers that a point-of-sale (POS) malware infection at some of its retail store locations caused a data breach. The American handbag design company says the incident affected some payment cards used at several of its retail store locations between 25 July 2016 and 23 September 2016. There's no evidence to suggest the...

The chief of the International Atomic Energy Agency (IAEA) has confirmed a targeted attack caused "some disruption" at a nuclear power plant. Yukiya Amano, director of the IAEA, said the attack was not destructive, a term which some have used to describe the 2014 Sony hack because actors destroyed corporate data and denied employees access to some...

Bad actors are continuously looking for ways to prey upon web users. Sometimes they turn to ransomware and other malicious software like remote access trojans to extort victims. Other times, they leverage the web's great wealth of information to hone in on a particular target, stalk their digital presence, and endeavor to make their lives a living...

Information security is a growing problem even in the protected, static environment of the business office. The challenges of securely accessing and storing data while traveling, however, are particularly acute, but they are manageable with (1) a high-level of awareness coupled with (2) a few good habits. Awareness Forget about hackers in the...

Today’s VERT Alert addresses 10 new Microsoft Security Bulletins. VERT is actively working on coverage for these bulletins in order to meet our 24-hour SLA and expects to ship ASPL-693 on Wednesday, October 12th. EASE OF USE (PUBLISHED EXPLOITS) TO RISK TABLE Automated Exploit Easy ...

Crypto ransomware authors were really busy coining new samples, updating the existing ones and adopting novel techniques in September, just as they did in August and the months before it. Some of them opted for the use of pop culture themes in their victim interaction modules. Others started leveraging ‘autopilot’ offline encryption mode with no...

In the information age, an organization is nothing without its critical endpoints. Those network systems function as the cornerstones of a corporate IT network and, as such, are crucial to maintaining smooth business flow. Without them, a company could suffer fiscal and/or operational consequences. Critical endpoints come in many shapes and sizes....

What is the first question you ask when something goes wrong in your environment? A system goes down? Service isn’t performing as it should? You flip the switch but nothing happens? In November of 1988, something happened that forever changed IT security and exponentially increased the need to ask this question. That is when the Morris worm was...

SSL is a primary layer of defense on the Internet that makes it possible to have authenticated private conversations even over an untrusted network. Implementing a robust and secure SSL stack, however, is not trivial. Mistakes can lead to large attack surfaces, such as what we witnessed with OpenSSL when “Heartbleed” was discovered. In the wake of ...

The Mirai botnet has made plenty of headlines recently after launching record-breaking distributed denial-of-service (DDoS) attacks against the website of well-known security journalist Brian Krebs. Earlier this month, hackers publicly released the source code of the Internet of Things (IoT) botnet powered by easily hacked routers, IP cameras and...

A Facebook Messenger trojan known as "Eko" is targeting French users of the social networking site via private message (PM) scams. The malware takes the form of a common Facebook scam type: a fake video of the recipient captured by one of their social media friends. It even uses the recipient's profile picture and name to add a sense of plausibility...

One of my tasks here at Tripwire is to capture, understand and track security issues in our software products. Generally, I think of this as a kind of "technical debt" called "security debt." Like any kind of debt, the first step to managing and reducing it is identifying it. In my mind, this is something that is essential for a company producing...

We at The State of Security kicked off National Cyber Security Awareness Month (NCSAM) 2016 with a review of how companies can defend against common IT security threats. In one guide, we discussed how organizations can leverage their people, processes and technologies to protect against the likes of phishing and other risks. We then crafted...