May 2017 shaped up to be the busiest ransomware month to date. The bare statistics speak for themselves: a total of 79 new strains came out and 38 existing ones received updates. Extortion-based cybercrime is obviously more prolific and ubiquitous than ever. Last month, the world confronted the unprecedented WannaCry ransomware epidemic employing NSA...

In the first part of this article, we discussed the popularity, average number and ratio of attacks on web applications. Let's now focus on some examples and sources. Examples of Attacks An example of detecting a Path Traversal attack The attacker intended to go to the root directory of the server and access the /etc/passwd file, which contains a...

Many businesses live in fear of having their systems hacked. After all, who wants their customers' data to spill out onto the internet or have their confidential plans and intellectual property stolen by online criminals? But more and more organizations like Google, Facebook, and Amazon are actually welcoming attempts to test their security in the...

News of the Google Docs phishing scam is not the first time that shared cloud-based resources have hit the headlines for all the wrong reasons. Many popular collaboration and IT management tools, such as Teamviewer and Slack, have had their time in the spotlight for compromises and breaches. The truth is these systems unwittingly provide an easy...

Public web applications are an attractive target for hackers. Attacks on web applications open up wide opportunities, including access to internal resources of the company, sensitive information, disruption of the application, and circumvention of business logic. Virtually any attack can bring financial benefits to the attacker and losses, both...

Understandably, a few eyebrows raise up when I suggest today’s cybersecurity challenges started nearly 370 years ago, some 300 years before the invention of ENIAC (the world’s first digital computer). But I stand by this observation because of the unintended clash of two systems: the nation-state and the Internet. Many of the institutions, social...

Cybersecurity isn't just for guys! It's crucial to highlight the important work that women and non-males are doing in the information security field. Previously I spoke with Thais, a Brazillian woman in Germany who's doing some intriguing malware research. This time, I've had the honor of speaking to Kelly Shortridge. She went from high finance to...

A hacker compromised more than 600,000 users' accounts when they stole a database operated by the font sharing site DaFont. In early May 2017, the currently unnamed hacker stole a site database containing 699,464 usernames, email addresses, and hashed passwords after hearing of other attacks launched against it. As they told ZDNet in an interview: ...

The summer of 2016 was a tumultuous ride for those of us in the security community. Less than a year ago, nobody had ever heard of The Shadow Brokers or Anna-Senpai but the same month (August 2016), these two – as yet unidentified persons or groups – made it clear that we are in the midst of a massive paradigm shift regarding threats to our society....

According to a recent survey, about 1 in 10 PC users (9.8 percent) in the US ran unpatched Windows operating systems in the first quarter of 2017 – up from 6.8 percent the previous year. The findings come from Flexera Software’s latest Personal Software Inspector Country Report, which aims to highlight the state of security among PC users in the US...

Social engineering is the exploitation of human error to deceive end users. Ransomware is a type of malware (malicious software) often used in social engineering attacks. When attacked with ransomware, businesses are literally held for ransom while being denied the ability to carry out their usual business operations. The UK Government has recently...

This post was updated on May 17, 2017, at 12:20 PM PDT. Over the past few days, there has been a lot of buzz around the WannaCry ransomware campaign. For those in the trenches dealing with how to address wave after wave of attacks, it's not as simple as the unhelpful motto of "patch your systems." Most medium and enterprise businesses cannot trust...

The past few months have accelerated the struggle between cybercriminals and those that defend against them. It seems that once again we are back on the defensive—as fast as law enforcement can arrest the bad guys, more and increasingly vicious cyber-attacks are unleashed. It’s been ugly, heartbreaking, and in some cases demoralizing. Even though...

Patients turned away. Ambulances diverted. Doctors and nurses locked out of patient files and unable to deliver care. On Friday, 45 National Health Service (NHS) organizations in the UK and Scotland and over 200,000 other victims in 150 countries fell prey to the WannaCry ransomware. The threat spread quickly, infecting vulnerable Microsoft systems...

As a woman who works in cybersecurity, I know that there are many amazing women in my field. Last time, I had the pleasure of speaking with Cheryl Biswas, who works as a corporate cybersecurity consultant. This time, I spoke to Thaís. She's been educated on two different continents in both physics and computer science! Now she's doing some pretty...

While May 11 saw the release of the long-awaited Trump Administration Cybersecurity Executive Order, Strengthening the Cybersecurity of Federal Networks and Critical Infrastructure, May 1 saw the less public release of an important companion document called Establishment of the American Technology Council. Focused on IT modernization and the upgrade...

Each year, the United Nations observes the International Day of Families on May 15. It's a day that focuses on the role families play in cultivating education and lifelong learning. By emphasizing the importance of caregivers, the International Day of Families encourages parents to teach their children about sustainable development, human rights,...

In a previous article, I discussed how organizations are working to protect their industrial control systems (ICS) against intentional and accidental security threats. One of their biggest challenges is figuring out whether their information technology (IT) or operational technology (OT) teams are responsible for ensuring ICS security. Given the...

Today’s VERT Alert addresses the Microsoft May 2017 Security Updates. VERT is actively working on coverage for these vulnerabilities and expects to ship ASPL-724 on Wednesday, May 10th. In-The-Wild & Disclosed CVEs CVE-2017-0290 Also known as Microsoft Security Advisory 4022344, this is a code execution in the Microsoft Malware Protection Engine...

In previous articles on understanding big data, the need for AI, using encryption and tokenization (including the drawbacks of encryption), and the series on human vulnerabilities, we laid down just some of the building blocks necessary to create a robust cybersecurity strategy. Yet there is a larger problem we often experience: losing the trees for...