Resources

Blog

Special Olympics NY's Email Server Abused to Send Phishing Emails

Digital attackers compromised an email server owned by Special Olympics NY and then abused it to target donors with phishing emails. The attack emails told recipients that an automatic donation transaction of $1,942.49 would register on their accounts within the next two hours. The email then asked recipients to review a PDF statement to confirm...
Blog

The Top 10 State of Security Blog Posts from 2019

It’s been another fantastic year on The State of Security blog. With over 350 blogs published from all walks of the security community, we like to think of the blog as more of an industry resource that caters to not only experienced security professionals but also to those who are new to the community. To finish the year off, I wanted to look back...
Blog

Honeypots: A Guide To Increasing Security

Honeypots are not a new idea. They have been part of the cybersecurity world for decades and have frequently gone in and out of "fashion" over that period. Recently, though, they have become an increasingly important part of vulnerability management. That's for a couple of reasons. Honeypots offer real-world data on the types of threats that...
Blog

AWS vs. Azure vs. Google – What’s the Difference from a Cloud Security Standpoint?

When mainstream cloud computing first began to appear on the horizon, (Amazon launched its Elastic Compute Cloud product in 2006.) many organizations were initially hesitant to entrust their most valuable data and processes to a technological innovation named after something that appears so delicate. Oh, how times have changed. Today, an estimated 96% of organizations use cloud computing, with...
Blog

Over 100 Android Apps Used 'Soraka' Package to Perform Ad Fraud

Researchers identified more than 100 apps that used a common code package named "Soraka" to perform ad fraud on users' Android devices. The White Ops Threat Intelligence team observed that many of the apps did not have a suspicious reputation at the time of discovery. For instance, the "Best Fortune Explorer" registered no red flags with anti-virus...
Blog

TikTok Lawsuits Show The Need For Increased Scrutiny of Apps

TikTok, the popular video posting app, has come under increased scrutiny. Recently, two lawsuits filed against the platform accused TikTok of privacy violations. According to a report from Reuters, a plaintiff accused TikTok of creating an account without her knowledge or consent in one lawsuit filed in California. The lawsuit accused TikTok of...
Blog

Start the Year Right with a Security and Privacy Check Up

At some point in the past, I began making new year’s resolutions for doing a bit of personal privacy and security maintenance on New Year’s Day or thereabouts. I would usually have a bit of downtime to finally get around to doing the things I’d been putting off all year. It’s become a fun habit that I wanted to share. Changing Passwords One of my...
Blog

Signs of Phishing: Protecting Yourself During the Holidays

I recently wrote about phishing around the holidays and while I was working on the piece, I noticed a couple of friends posting recent emails on Facebook. I thought it might be fun to dig a bit deeper into those emails and look at the telltale signs that indicate these are phishing attempts. Signs of Phishing - Example #1 ...
Blog

Farewell, Mr. Robot

This is the third and last blog I will write for State of Security on the topic of the groundbreaking, maverick TV series ‘Mr Robot.’ As this week, the credits rolled one final time on the show's mind bending and utterly bizarre (even by its own standards) conclusion. A lot has changed since the first season aired, both for cybersecurity and the...
Blog

PayPal Phishing Scam Tries to Steal Much More than Login Credentials

A newly discovered PayPal phishing scam attempts to steal much more than just a user's login credentials for the online payments service. Slovakian security firm ESET observed that the scam began by targeting users with an attack email warning them of unusual activity involving their account. The email urged recipients to click on an embedded link...
Blog

Is Your Company Suffering from Supplier Stockholm Syndrome?

That phrase came to me many years ago when working on a multi-million pound IT outsourcing deal. We were up to our necks in the finer points of platform-wide and stack-deep security, and I realised we were fighting amongst ourselves more than challenging the final competing vendors. This infighting was partly due to the large amount of IT staff in...
Blog

Top Cloud Security Resources: Certifications, Events and Social Media

Context setting: In my first article on cloud security, I talked about the journey to cloud migration. What are the things you need to consider when planning the big move? To realize the full value of this post, you must have already identified the motivations for migration and the locations of some resources you can use to enhance your security...
Blog

Worst Passwords List Reveals "123456" to Still Be Top Offender

A list of some of the worst passwords for 2019 revealed that users continue to turn to "123456" above all of the other ill-advised combinations. In total, TeamsID published 50 of the worst passwords used during the past year. The top 15 of these are presented below: 123456 123456789 qwerty password 1234567 12345678 12345 iloveyou 111111 ...
Blog

Looking to Drive down the Cost of Doing Business? Use Managed Services

Businesses are always looking for ways to control and reduce the cost of doing business as well as gain a competitive advantage over their respective competitors. The constant pressure of doing more with less has introduced many offerings designed to reduce the cost and complexity of the IT/OT infrastructures that support the business. Let’s take a...
Blog

Navigating ICS Security: The Threat Landscape

Whilst working for a management consultancy, I learned a lot more about industrial control systems (ICS) than I ever imagined I would. In many cases, this wasn’t from working on them directly; it was from simply speaking to the technicians and reading documentation. Oftentimes, we have the false belief that our systems are safe from compromise...
Blog

Poison Frog Malware Samples Reveal OilRig's Sloppiness

An analysis of a new backdoor called "Poison Frog" revealed that the OilRig threat group was sloppy in its development of the malware. Kaspersky Lab came across Poison Frog while scanning its archives using its YARA rule to hunt for new and old malware samples employed by OilRig. It launched this investigatory effort shortly after crackers operating...