In the course of working with our clients to improve their security posture, I have come across several common themes that often limit a business's ability to assess and mitigate cyber security risk. Let's take a look at some of these themes and real-world examples of how they apply. You can't secure it if... You Don't Know It's There As wireless...

In the past, Osiris was mostly known as an Egyptian god of the afterlife, the underworld, and the dead. Now it's known as the latest extension of the Locky ransomware menace, as its creators decided to switch from a Norse mythology theme to an Egyptian one. .osiris Locky Gets Better at Avoiding Detection No user wants to see the .osiris file...

User Behavior Analytics. Network threat detection. The increasing focus on using security data analytics to extract insight and find or predict ‘bad’ has brought with it an influx of marketing promising close-to-magical results. Among the offenders are those machine learning products suggesting data can be thrown at an algorithm and – voila! –...

IT professionals are instrumental to strengthening an organization's digital security. They must fulfill a variety of duties to work towards that end. One of their most important responsibilities is helping their company detect and respond to data breaches. But there's a problem. Most information security personnel are overconfident in their...

Today’s VERT Alert addresses 12 new Microsoft Security Bulletins. VERT is actively working on coverage for these bulletins in order to meet our 24-hour SLA and expects to ship ASPL-703 on Wednesday, December 14th. Ease of Use (published exploits) to Risk Table Automated Exploit Easy ...

Kentucky Fried Chicken (KFC) has told members of its Colonel's Club to change their passwords following an attack against its website. The fast food giant confirmed that the attack affected only Colonel's Club users. The loyalty program allows its 1.2 million registered members to collect Chicken Stamps and exchange them for rewards like meals. KFC...

It’s that most wonderful time of the year again – for cyber-criminals and all manner of online miscreants, that is. Whilst next-gen malware samples may be finding new and inventive ways of delivering their payloads, the tried and tested phishing scam isn’t going anywhere just yet. Especially during this distracting and emotive season when even the...

Protecting the company’s servers and online presence is a task that requires a lot of effort. As a result, the reality of securing the online environment is hitting companies hard because hackers and malware constantly find new ways to compromise their online security and privacy. Following a hack or breach, days, months and even years of work could...

When it comes to home security, technology provides us with plenty of solutions for all needs and budgets. The problem is the same technology also provides burglars and perpetrators with the similar means of bypassing your fancy security systems. Long gone are the days when burglars would brutally force their way into your home with a lever. Now...

Nothing says the holidays like spending time with friends and family. To celebrate this special time of year, many of us purchase gifts for our loved ones. Doing so can become quite expensive, especially if we have large social circles. For that reason, we go through the holidays looking for sales on items we think our dear ones will love. But don't...

Holiday shoppers who use Amazon.com to purchase gifts will want to look out for a new scam claiming their order can't ship. Around the beginning of December, users first caught wind of a scam that's dampening the holiday cheer for users in the United Kingdom and Australia. The bogus emails state "Your Amazon.com Order Cannot Be Shipped" in the...

Hackers stole technical trade secrets from some of the business areas of ThyssenKrupp Steel in a "professional attack." On 8 December, the German industrial group published a statement confirming the incident: "thyssenkrupp has been the target of a cyber-attack. It has been a professional attack, apparently from the Southeast Asian region....

Ransomware authors kept trying to break new ground with their attacks last month, just like they did in October. One of the cybercriminal rings blatantly compromised San Francisco Municipal Transit Agency, demonstrating that critical infrastructure isn’t much of a moving target. Also, a slew of low-impact screen lockers and .NET-based ransomware...

The overwhelming majority of NHS hospital trusts in England are continuing to use Microsoft’s unsupported Windows XP operating system, putting patients and their organizations at risk. According to new research conducted by software company Citrix, nine out of ten NHS trusts questioned confirmed they still have PCs running the outdated software....

Point-of-sale (POS) malware activity, specifically network traffic for data exfiltration, quadrupled over Thanksgiving weekend. For their ongoing threat analysis, researchers at Proofpoint use network sensors deployed by its Emerging Threats group to track POS malware contact with command and control (C&C) servers. They had expected increased...

If you have a Sony network-connected CCTV camera, you may have a security problem. Researchers at SEC Consult uncovered a backdoor in Sony IP cameras that could allow a hacker to remotely execute malicious code, spy on users, brick devices, or recruit them into a DDoS botnet. As the vandal-resistant Sony IPELA Engine IP cameras at the centre of the...

Earlier this year, Tripwire commissioned Dimensional Research to ask 500 IT security professionals about their organizations’ key challenges in their cyber security and compliance programs. Tripwire's 2016 Security Challenges Survey covered various areas of interest for infosec folks. For instance, it gauged respondents’ thoughts on the lack of...

The fact that you're reading this blog means that you're probably familiar with the EU GDPR, the possible impact it may have on your business, and the consequences should you find yourself on the wrong side of non-compliance – especially if that non-compliance is highlighted as the result of a breach in which identifiable personal data is...

A man has received five years in prison for hacking into the email accounts of a number of celebrities and athletes. On 6 December, the Federal District Court in Manhattan passed down the sentence to Alonzo Knowles, 24, who gained unauthorized access to celebrities' email accounts and stole sensitive data. Back in December 2015, an undercover agent...

Compliance is a concern for every organization that handles customers' data. Unfortunately, it's not always easy for companies to meet the security requirements of frameworks like PCI DSS. Each organization faces technological and/or business constraints; factors which shape its security decisions and sometimes rule out the implementation of certain...