Resources

Blog

Should Security Researchers Protect Organizations by Any Means Necessary?

Responsible disclosure is the gold standard for fixing security vulnerabilities. But as we all know, sometimes at least one stakeholder doesn't hold up their end of the agreement. Parties violate a responsible disclosure timeline for many reasons. Take the Zero Day Initiative, for instance. One of its security researchers discovered a vulnerability...
Blog

Half of Organizations Fail to Maintain PCI Compliance, Finds New Report

Nearly half of organizations that store, process or transmit card data are still failing to maintain PCI DSS compliance from year to year, reveal new statistics. According to the 2017 Verizon Payment Security Report, the number of enterprises becoming fully compliant is on an upward trend—growing almost five-fold since 2012. Last year, 55.4 percent...
Blog

Trojan Using Infected USBs to Help Spread Fileless Malware

A trojan is leveraging infected USB flash disks to help spread fileless malware that abuses legitimate functions on a compromised system. The baddy, which Trend Micro detects as "TROJ_ANDROM.SVN," conceals itself within two malicious files on an infected USB. These files are called "addddddadadaaddaaddaaaadadddddaddadaaaaadaddaa...
Blog

How to Safeguard Your Online Banking Information

10 years ago, people used to enter a bank physically to complete any kind of transaction. The situation has changed a lot today. With the introduction of online banking, people are able to make all types of transactions with the click or touch of a button. Last year, a survey from Bank of America revealed that 62 percent of Americans now utilize...
Blog

One in 10 UK Companies Lack an Incident Response Plan, Says Survey

The damage wrought by the WannaCry and NotPetya malware outbreaks highlights the importance of organizations taking steps to strengthen their digital security defenses. But in the shadow of such high-profile attacks, the state of organizations' security postures remains unclear. Do most companies understand the importance of their information and...
Blog

“Cyber” Is Not an Appropriate Risk Category

“Cyber” is not an appropriate category of risk. Often cited in 10-K reports, discussed by board directors and C-suite executives, and referenced by Enterprise Risk Management (ERM) or Governance, Risk and Compliance (GRC) professionals, the category merely perpetuates ambiguity and lack of understanding related to all things “cyber.” Because of this...
Blog

Stackoverflowin: The Story of How IoT Broke the Internet

Recently, an incident commonly referred to as “stackoverflowin” swept social media. On February 4, 2017, a 17-year-old hacker from the UK using the alias ‘stackoverflowin’ decided on a whim to do some printing. He printed quite a bit. In fact, he printed so much that it started to trend on Twitter. That’s because he printed to every open printer on...
Blog

Android Trojan Targeting South Korean Users via Smishing Campaign

An Android trojan is using SMS phishing texts (or "smishing" messages) to prey upon unsuspecting South Korean mobile users. In July 2017, users uploaded to South Korean websites screenshots of texts asking them to click on suspicious shortened links. One message warns recipients that someone might have leaked a private picture of them to the web....
Blog

Highs & Lows of Cyber Security in Healthcare

Cyber security is a relatively new concern to the healthcare sector. Most organizations began looking into it in just the past five years. Given this still-nascent focus, there have been some real lows for healthcare and highs for cyber attackers. Good News to Start There's some good news to share with respect to healthcare providers (acute and...
Blog

Cyber Security Recruiting: Win Top Candidates with These Tips

Your cyber security department has some big hurdles when it comes to hiring. In IT, 10 percent of all job postings are in cyber, and the growth rate is 2x faster than other IT jobs. There will be 1.5-2 million unfilled cyber jobs by 2019. Currently, cyber job postings take 24 percent longer to fill than other IT jobs and 35 percent longer to fill...
Blog

Android Ransomware Development Made a Cinch by TDK Mobile Apps

Wannabe computer criminals can now easily create Android ransomware thanks to what are known as trojan development kits (TDKs). TDKs automate the process of developing new mobile malware by leveraging a version of the computer-aided software engineering (CASE) tool model. These device-aided malware engineering (DAME) utilities enable an actor to...
Blog

Malware Using Facebook Messenger to Serve up Multi-Platform Threats

Malware is spreading via Facebook Messenger as part of an attack campaign designed to infect users with multi-platform digital threats. In early August, Kaspersky Lab senior security researcher David Jacoby received a curious message via Facebook's messenger service. The message originated from one of his friends with whom he rarely speaks on the...
Blog

Defend Your Hospitals Crown Jewels: EHR

Electronic Health Record (EHR) systems have been around for over 40 years. The adoption surge came in the United States with an Executive Order for nationwide deployment in 2014. Today, they are the heart for most healthcare providers. The value of EHRs has been well-documented, offering improved patient care while improving organizational...
Blog

LinkedIn Messenger Flaws Enabled Attackers to Spread Malicious Files

Bad actors commonly abuse LinkedIn to launch digital attacks. With over 500 million members spread across 200 countries, the professional networking site contains crucial information that nefarious individuals can use to attack nearly any organization and its corporate data. They just need to establish an initial foothold in the company. Most of the...
Blog

California City Stops Online Utility Bill Payment System amid Breach Fears

A California city has temporarily shut down its online utility bill payment system amid fears that the portal suffered a breach. On 22 August 2017, the City Manager's Office of Oceanside, CA announced a possible security incident affecting its online bill payment system that residents can use to pay their utility (water, sewer, and trash) bills. As...
Blog

NHS Cyber Attack Allegedly Exposes Personal Data of 1.2 Million Patients

The UK’s National Health Service (NHS) has reportedly fallen victim to another massive cyber-attack, exposing the confidential records of up to 1.2 million patients. According to reports, an unknown hacker claimed to exploit a weakness in the NHS’ appointment booking system, SwiftQueue. The vendor is contracted by eight NHS trusts to manage booked...
Blog

Identity Thieves Porting Mobile Numbers to Hijack Victims' Web Accounts

Identity thieves are porting users' mobile phone numbers to devices under their control in order to hijack their web accounts. This type of attack begin when hackers call up a mobile service provider. Using a bit of social engineering, the bad actors convince an agent at the provider to transfer control of a target mobile phone number to a device...