There are roughly 200 requirements and sub-requirements in NERC CIP, and to satisfy each one requires performance-based compliance evidence that produces the comprehensive documentation that proves each requirement and sub-requirement was met for all activities that fall under it. That by itself is no mean feat. Of those 200 requirements, baseline...

By now, unless you have been living in a cave with no electricity, you are aware that the FBI successfully unlocked the infamous San Bernadino iPhone. While there is plenty of speculation about the company that assisted in the unlocking of the device, the FBI made it clear very early in the process that encryption was the main roadblock to gaining...

The United States and Canada have issued a joint alert on ransomware and the threat it poses to both individuals and businesses. In their bulletin, the Canadian Cyber Incident Response Centre (CCIRC) and the United States Computer Emergency Readiness Team (US-CERT), which operates under the Department of Homeland Security (DHS), provide an overview...

The risk of sophisticated malware, especially of ransomware, has grown exponentially over the years. This means we need to evolve our techniques for mitigation, detection and monitoring of malicious behavior on our assets. It's a wise move given the durability of this threat. Indeed, ransomware, which attempts to scare users and organizations into...

Stingrays (also known as IMSI Catchers) are devices that are used to spy on cellphones and their owners. A Stingray mimics the operation of a legitimate cellphone base station to reveal the movements, communications and personal information of the cellphones that attach to them. Some illicit IMSI Catchers have been discovered attached to the light...

A massive database allegedly containing the personal information of more than 49 million Turkish citizens has been published online. The leaked data was reportedly found to contain names, addresses, national identifier numbers and dates of birth, among other personally identifiable information. Published anonymously at http://185.100.87.84/, the...

Millions of users are open to attacks that can quietly compromise machines by exploiting a weakness in some of Firefox's most popular browser extensions. On Thursday, Boston University PhD Ahmet Buyukkayhan and Northeastern University Professor William Robertson presented their research on the attacks at Black Hat Asia in Singapore. Black Hat Asia...

Transport Layer Security (TLS) is the unsung champion and defender of all good citizens of the Internet. Rather like some invisible, altruistic Marvel superhero, it works tirelessly behind the scenes each and every day helping to protect the things we need and like to do online. Along with its now atrophied predecessor Secure Sockets Layer (SSL), it...

I’ve been following the FBI vs. Apple case, and now that it seems it's tentatively over, I find myself keeping up with the conversations around who won and who lost. In my opinion, the software industry should strive to provide the strongest possible protections for users' individual privacy and security. Apple has done just that – so well, in fact,...

Security experts have discovered vulnerabilities in a database where the U.S. State Department stores visa information. Reuters writes that the State Department first learned of the security flaws following an internal review of its computer systems several months ago. In a report, security experts...

It’s been a month since Hollywood Presbyterian Medical Center joined the ranks of Premera Blue Cross, Anthem, CareFirst BCBS, and a considerable number of other healthcare institutions that have experienced recent hacks where personal patient data might have been exposed. While it may have played out like the plot of a bad "cyber"-thriller movie,...

The Federal Bureau of Investigations is investigating a series of hacks against some of the United States' most prestigious law firms. On Tuesday, the FBI disclosed its investigation into data breaches affecting Cravath Swaine & Moore LLP, Weil Gotshal & Manges LLP, and a number of other high-profile New York-based law firms. Cravath Swaine & Moore...

If there is one truth about today's threat landscape, it is that nothing remains the same. Such dynamism rests partially with the sheer volume of threats circulating the web. Multiple reports indicate that bad actors are developing as many if not more threats than security personnel have time to remediate. Indeed, in the second quarter of 2015 alone...

Information Security conferences should form part of the front line when it comes to tackling cybercrime. Unless we learn to share information as an industry, we are always going to be on the back foot. I’m spending a little down time with my family after the relentless pace of the Can Sec West conference in Vancouver, where I had the pleasure of...

Authorities are warning users to be on the lookout for a speeding ticket scam that attempts to extort money from victims using fake email citations. Earlier in March, the Tredyffrin Police Department wrote a post on the web portal for Chester County, Pennsylvania in which it explains how it came across the spam campaign. "A local corporation...

Six people have been charged with manipulating terminals to produce more winning tickets for the 5 Card Cash lottery game. Back in November of 2015, Connecticut lottery officials suspended 5 Card Cash after they noticed that it was producing more winning tickets than expected. The lottery game consists of tickets on which five playing cards are...

“The man who grasps principles can successfully select his own methods. The man who tries methods, ignoring principles, is sure to have trouble.” – Ralph Waldo Emerson. Why and how do cyber adversaries – criminals, spies, competitors, activists – continue to find success in fraud, extortion, espionage and sabotage? Governments, corporations and...

I work daily with organizations regulated by NERC CIP, and it always helps to place things into perspective. One of those challenges is security event monitoring. Security event monitoring involves the identification of observable events that may or do represent unauthorized access attempts into a secure environment. One of the most important...

Verizon Enterprise Solutions – a B2B division of the telecommunications company that provides data breach response services – is reportedly facing a breach of its own. According to a report by investigative journalist Brian Krebs, a database containing the contact information of approximately 1.5...

Seven Iranian hackers have been indicted for launching distributed denial of service (DDoS) attacks against dozens of U.S. financial institutions as well as accessing the computer systems at a NY dam. On Thursday, U.S. Attorney General Loretta Lynch publicly accused Ahmad Fathi, Hamid Firoozi, Amin Shokohi, Sadegh Ahmadzadegan, Omid Ghaffarinia,...