Search

The article discusses the major information security vulnerabilities that chip makers and computer software manufacturers had struggled to address possible security breach. Topics include the effort of Microsoft Corp. and Google Inc. to contain the flaw called Speculative Store Bypass, the fix made by Intel Corp. to its Intel Management Engine, and the protection made to address vulnerabilities to the trusted platform module (TPM) by Microsoft Corp.

The article focuses on an alert published by the U.S. Department of Homeland Security and the Federal Bureau of Investigation, highlighting attackers were using spear-phishing emails and watering-hole attacks to compromise victims' computers and potential impact of cyber-attack. it mentions ransomware attacks such as WannaCry and NotPetya, caused losses to international businesses. it also mentions attackers used phishing emails to gain access to operational systems at a steel mill in Germany.

The article discusses data-collection by analytics companies and government for political gains, examining how they can reveal things about individuals through social networks. Topics discussed include use of film ratings in revealing characteristics of the critics, determination of political affiliations, and detection of emotions by Apple, Google, Facebook, and Affectiva.

The article offers information on the corporate information technology (IT) systems with known vulnerabilities are often missed or overlooked which has happened to the company Equifax that led to hundreds of millions of dollars in losses. Discussed are the five ways in which companies need to pay more attention including to carefully inventory the software, to track down non-traditional technology and to secure legacy apps with known vulnerabilities.

The article offers information for information technology and security administrators and business enterprises about recommended steps in securing mixed cloud environments. Other information related to the adoption and implementation of a hybrid cloud environment as well as the concept of pragmatic hybrid cloud is presented.

The article offers information on the collaboration between Internet infrastructure firm Level 3 Communications, owned by CenturyLink, with internet service providers (ISPs) and security firms such as 360 Netlab to shutdown Satori, an Internet of Things (IoT) malware that affected a number of IoT devices in Latin American and Egypt. It mentions insight from Level 3 chief security strategist Dale Drew regarding the development of a number of botnet by the worm that result into denial-of-service.

The article offers information on online attack on a critical-infrastructure network by deploying malware. Topics discussed include attackers not identified by security firm FireEye, Iran's nuclear processing capability hobbled by Israel with the Stuxnet attack that caused damage to the critical centrifuges, and cyber-security expert Phil Neray's views on cyber attack.

The article focuses on several predictions related to DevOps (software development and software operation) in 2018 including an expected increase in the use of artificial intelligence among DevOps according to Robert Reeves, co-founder of Datical. It mentions that organizations are expected to embrace cloud and DevSecOps. It also mentions that chief information officers (CIOs) are expected to accelerate plans for digital transformation with containers and DevOps.

The article discusses FireEye and ClearSky has warned that Iranian hackers are having a great deal of success in their operations, and the U.S. needs to track them. It mentions about cyber-attacks in November 2017 which attributed to Iranian agents which exploited an Microsoft (MS) Office vulnerability after it was patched by Microsoft. It also mentions that hacking group APT34 has conducted a variety of operations in Middle East targeting industries like energy, chemical and telecommunication.

The article reports on the delay in the release of the vulnerable informations that are useful for evaluating the security flaws, by China intelligence officials in 2017.

The article discusses the move of Microsoft Corp. in issuing an advisory on the exploitation of its Dynamic Data Exchange (DDE) protocol by online attackers in installing and downloading malware. Topics mentioned include the analysis of internet security firm Zscale ThreatLabz on the attacks, the statement of researcher Mohd Sadique on the use of the framework in retrieving sensitive information and the acknowledgement of Microsoft on the attacks.

The article reports on the plans of U.S. states to use statistical auditing known as risk-limiting audits (RLA) to verify election results following Russia's hacking of the 2016 presidential election. Topics include the statewide RLAs adopted in Colorado effective November 15, 2017, the capability of the RLAs to detect possible ballot fraud and the goal of the state to provide transparency in the election process.

The article discusses the findings of a survey conducted by authentication firm Duo Security about the use of two-factor authentication (2FA) in the U.S. Among the findings mentioned include the less percentage of users who used another method in distinguishing themselves on their online accounts, the less interest of women and older people in using any form of technology and the insufficiency of passwords in safeguarding online accounts.

The article reports that according to Kaspersky Lab Inc., security firm, the malware urge security application to have secret data. It focuses on the U.S. government agencies and congressional investigation, for allegedly protecting Russian intelligence. It focuses on the incident where source code for the “Equation” espionage platform has been detected and sent to the server of the company.

The article reports that remote desktop protocol (RDP) servers have been compromised by hackers who use them as a way of anonymizing cyber-attacks. It mentions the views of Olivia Rowley, intelligence analyst at Flashpoint, on data stolen via compromised RDPs. It states that the compromised remote desktop protocol (RDP) servers allow the dark-web group to offer anonymization services and access to any information on the servers.

The article discusses two U.S. representatives have introduced legislation that aims to give companies the legal protection needed to pursue and identify hackers over the Internet. It mentions the Active Cyber Defense Certainty Act (ACDC) is the brainchild of representative Thomas Graves. It also mentions that representative Kyrsten Sinema have cited the Equifax breach as an indication of how bad the problem of cyber-attacks has become for average U.S. citizens.

The article informs that security firm Cylance has announced that one Chinese group has revived a decade-old remote access Trojan known as "Hacker's Door," and begun using it in espionage operations. it also security services firm Secure Works has said intellectual property and confidential data from Japanese companies.

The article discusses the announcements of the U.S. Securities and Exchange Commission (SEC) regarding the hacking of their agency online filing system in 2016. It states that the hacking occurred in the EDGAR public-records system and resulted in access to nonpublic information. It mentions that SEC is investigating the incident and prosecuted insider traders that used information from the public records system.

The article discusses the attack of the popular system-cleaning program CCleaner of security firm Avast. It states that the system cleaning program has been compromised during development of computer software that affects the users' systems with malicious code. It adds that developers and insecure development processes are the most vulnerable on the latest targets of the attackers. The need to boost security checkpoints on the development process is also emphasized.

The article informs that the U.S. Department of Homeland Security (DHS) has banned federal agencies from using security products made by Russian-owned security firm Kaspersky Lab citing reasons related to cybersecurity. It mentions that Elaine Duke, acting secretary of DHS, provided federal agencies 30 days to identify use of Kaspersky products. It also reveals that earlier General Services Administration (GSA) removed Kaspersky Lab from lists of vendors for information-technology services.

The article reports on the relevance of identity verification process in ensuring personal information security. Topics discussed the concern of data vulnerabilities of online and offline services, and recommendations in improving the security measures and prevent fraudulent activities through documentation as proof of identity and device-based identity check.

The article focuses on the partnership between Amazon.com Inc. and Microsoft Corp. to enable their virtual assistant technologies Cortana and Alexa to talk to one another in 2017. Other topics include the benefits of opening the artificial intelligence (AI) and communication channels between the two platforms, limitations of voice-enabled assistants, and impact of the collaboration on the electronic commerce space.

The article reports that Unity game platform is vulnerable to remote compromise due to a flaw in the operating system Windows game. It mentions that Unity advised game developers for upgredation, who use the Windows version of its editor and states that users of the operating system Mac version of the editor are not affected. It also presents the views of Amanda Taggart, head of global communications at Unity, regarding the same.

The article offers information on products of Industrial control systems and the Internet-of-Things consits vulnerabilities. Topics discussed include use of fuzz testing which sends data to devices and systems with the goal of causing errors in a targeted network protocol; the views of Jonathan Knudsen, security strategist with Synopsys, on healthcare systems; product having security flaw which could cause reputation damage.

The article discusses hackers are using Secure Sockets Layer encryption to conceal device infections and shroud data exfiltration according to cloud security firm Zscaler. It mentions an increase in SSL encryption need to prompt firms to focus on inspecting SSL traffic. It also mentions security firm Kaspersky Lab published an analysis of current trends in steganography on August 2017 and devices connected to Internet of Things are vulnerable to cyberattack.

The article offers information on a presentation at the Black Hat conference on July 27, 2017 by two cybersecurity researchers focusing on the use of cloud sandboxes by antivirus software and its negative aspects. Topics discussed include the researchers Amit Klein and Itzik Kotler of security services firm SafeBreach, the risk of data exploitation by malware, and the use of operating-system and software updates to infect systems by cyber-attackers.

The article offers information on Cisco Systems Inc.'s Midyear Cybersecurity Report which identified business email compromise, ransom-seeking criminals and questionable programs that collect information as three of the major threats facing companies in 2017.

The article focuses on the survey conducted by Arlington Research and commissioned by OneLogin which examines the challenges facing many companies that experienced data breach from former employees. Topics include the need for human resource (HR) and information technology (IT) departments to work together to solve the issue, the legal penalties for terminated employees, and the importance of de-provisioning employees after they leave the company and automating the monitoring of data access.

The article offers information on the annual report from web security firm WhiteHat Security concerning flaws of corporate web apps. It mentions that data combines both dynamic application security testing (DAST) and static application security testing (SAST). Moreover, WhiteHat's vice president Ryan O'Leary states companies focus on easiest-to-fix vulnerabilities.

The article reports on the investigative findings by two separate European security authorities, concluding that the widespread Petya ransomware attack, also known as NonPetya, was not about money, but rather an assault conducted by a nation-state. The Ukrainian government blamed the Russian Federation, while NATO experts believed that the said cyber attack is linked to a nation-state.

The article discusses the findings of a report by European companies and government agencies concerning the widespread attack by Petya ransomware program affecting information systems of companies and end-users in European countries. The report mentions that the ransomware program attack arrives in an email and uses a leaked exploit to infect its users system. Affected companies include the advertising and public relations firm WPP PLC, power company Ukrenergo and oil producer Rosneft.

The article explores the vulnerability of web applications to cyber-attacks. According to data collected by application-security firm tCell, developers are leaving behind unused code and working with vulnerable third-party libraries. The firm also revealed the amount of risk posed by legacy and third-party code to web applications.

The article reports that computer security firm Trend Micro Inc. investigated several online fake news distribution services tells how they work and provides guidance on counter measures. Cloud services that allow anyone to propagate fake news to gain a following for provocative posts have multiplied over the past year.

The article discusses the alleged hacking of Russian intelligence into American voter-registration software vendor VR Systems. Topics covered include the reported phishing attacks made by the Russian General Staff Main Intelligence Directorate (GRU) according to an article published in "The Intercept" on June 5, 2017, the arrest of federal contractor Reality Leigh Winner, and the consequences of transmitting classified information to an unauthorized person according to U.S. laws.

The article reports on the addition of anti-phishing capability in Gmail for improving protection against phishing emails, malicious links and malware by Google.

The article reports that e number of published software flaws rose by 30 percent, and while breaches rose only moderately. The average incident involved fewer than 10,000 records, the top-10 largest breaches accounted for 3.2 billion records, the vast majority of the data put at risk in the first quarter.

The article reports on the global spread of the WannaCry ransomware program in May 2017 that infected at least 200,000 devices in several countries around the world.

The article;e reports on an analysis published by security firm Kaspersky Lab in April 2017 which showed that a botnet called Hajime has successfully infected more than 300,000 Internet of Things devices. Hajime can exploits devices with weak passwords and a protocol used by Internet service providers to remotely manage devices. Most of the affected devices appear to be digital video recorders and Internet-connected video systems.

The article reports that information technology software Shadow IT is presenting a problem as the average number of cloud services in use per enterprise rose to 1,071. More than 37 percent of malware detected in the cloud were some form of backdoor. While another 14 percent was adware. Ransomeware , which has become a major threat to many businesses.

The article reports that according to code management firm Black Duck, almost seventy percent of applications with open-source components are known to have software vulnerabilities,

The article discusses review of quarter one of 2017, security incidents by security firm Rapid7 revealing that attackers are more likely to use credentials to hack systems. Topics discussed include use of domain credentials to move in a network or attempt to access a service, comments from Rebekah Brown of the firm, on previous breaches and use of stolen credentials category documented in the Verizon Breach Investigations Report.

The article focuses on an analysis published by FireEye Inc. on April 12, 2017 including the use of the same zero-day attack exploiting a vulnerability in Microsoft Word by intelligence operatives targeting Ukrainian rebels and cyber-criminals targeting businesses. Comments of researchers Ben Read and Jonathan Leathery regarding the attacks are also given.

The article reports that macro malware and other cybersecurity threats like open source scripting language PHP: Hypertext Preprocessor (PHP) and the Microsoft Slammer computer worm continue to pose threat as of March 31, 2017.

The article mentions the files allegedly stolen from the U.S. Central Intelligence Agency (CIA) and published on March 7, 2017 by Wikileaks, dubbed "Vault 7" containing code and descriptions of cyber-operations. Topics discussed include comments from Rick Hanson of Skyport Systems on the public and private infrastructure risk from the leak, concerns that Wikileaks is acting as a proxy for Russia, and claims that an unnamed source leaked the files to start a public debate about cyber-weapons.

The article provides information on comparison of security given by cloud services and do-it-yourself security. Topics discussed include "Black Swans" term for the cloud-related security incidents and significant fall in data security of firms; incidents of CloudBleed and TicketBleed; and views of Robert Vamosi, security strategist for security firm Synopsys Inc. on the same.

The article reports that the U.S. National Association of Secretaries of States adopted a resolution focused on oppose the designation of election systems as the critical infrastructure from the U.S. Department of Homeland Security. It mentions that the NASS adopted a resolution that oppose the critical infrastructure.

The article focuses on the vulnerability of the health care industry to cyber attacks due to great profits in the sales of electronic health records (EHRs) and ransomware. Topics include Trend Micro security firm collecting data from underground markets such as AlphaBay, Python Market and Silk Road about the price of medical insurance cards at one dollar each. Also cited are dataset breaches as to the 2016 Verizon Date Breach Investigations Report and the CryptoWall ransomware program.

The article focuses on the need for state and local governments in the U.S. to focus on cyber-security.

The article reports on managed security provider SecureWorks Inc.'s recommendation that the dupe is regularly played by some companies to hackers which make their crimes less lucrative and causes them more pain. It is noted that the company has called the approach offense-in-depth, which increases the attackers' risk and their effort.

The article discusses the RSA Conference 2017 related to cybersecurity that was held in San Francisco, California as of Feburary 2017. It mentions the increase in threats of ransomware to cybersecurity, and states the development of security strategy for businesses for protecting it from cyber-criminals. It also presents the views of Gal Shpantzer, chief executive officer at Security Outliers, regarding the same.