🕴 Cyber Readiness Institute Launches New Program for SMBs 🕴

Program seeks to raise employee cyber awareness at small and midsize businesses and give their owners the tools to make a difference.

📖 Read

via "Dark Reading: ".

❌ U.S. Ballistic Missile Defense System Rife with Security Holes ❌

Widespread, unpatched vulnerabilities are just one set of problems uncovered by a Department of Defense audit.

📖 Read

via "Threatpost | The first stop for security news".

⚠ Sneaky phishing campaign beats two-factor authentication ⚠

Protecting an account with multi-factor authentication (MFA) is a no-brainer, but that doesn’t mean every method for doing this is equally secure.

📖 Read

via "Naked Security".

⚠ Twitter fixes bug that lets unauthorized apps get access to DMs ⚠

"You authorise it - whereupon it promptly leaks to the world all your sexts, inappropriate jokes, and dank memes. Tragic!" said the researcher.

📖 Read

via "Naked Security".

⚠ Logitech flaw fixed after Project Zero disclosure ⚠

The flaw offered attackers a way of executing keystroke injection to take control of a Windows PC running Logitech Options.

📖 Read

via "Naked Security".

⚠ Facebook photo API bug exposed users’ unpublished photos ⚠

It affected up to 6.8 million users and up to 1,500 apps. “We're sorry this happened,” said Facebook with what must be acute apology fatigue.

📖 Read

via "Naked Security".

🕴 8 Security Tips to Gift Your Loved Ones For the Holidays 🕴

Before the wrapping paper starts flying, here's some welcome cybersecurity advice to share with friends and family.

📖 Read

via "Dark Reading: ".

❌ Newsmaker Interview: Troy Mursch on Top Botnet Trends ❌

MikroTik, Hadoop clusters, legislation and more will mark the botnet space in 2019.

📖 Read

via "Threatpost | The first stop for security news".

🔐 Why 2019 will introduce stricter privacy regulation 🔐

Privacy regulation is a complex topic with ever-changing parameters and requirements. Read some predictions for what's coming in 2019.

📖 Read

via "Security on TechRepublic".

❌ WSJ Webpage Defaced to Support PewDiePie ❌

The hack comes on the heels of the PewDiePie-supporting printer attacks over the weekend.

📖 Read

via "Threatpost | The first stop for security news".

🔐 Why cryptojacking will become an even larger problem in 2019 🔐

Cryptojacking was the runaway security problem in 2018, damaging devices in cybercriminals' pursuit of profits. As cryptocurrency prices fall, 2019 could see more attacks.

📖 Read

via "Security on TechRepublic".

🕴 How to Engage Your Cyber Enemies 🕴

Having the right mix of tools, automation, and intelligence is key to staying ahead of new threats and protecting your organization.

📖 Read

via "Dark Reading: ".

❌ Hidden Code in Memes Instruct Malware via Twitter ❌

Analysts discover malicious code embedded in tweeted images.

📖 Read

via "Threatpost | The first stop for security news".

❌ WordPress Targeted with Clever SEO Injection Malware ❌

The malware does its best to obfuscate SEO injection in WordPress and evade notice from web admins.

📖 Read

via "Threatpost | The first stop for security news".

🕴 Cryptographic Erasure: Moving Beyond Hard Drive Destruction 🕴

In the good old days, incinerating backup tapes or shredding a few hard drives would have solved the problem. Today, we have a bigger challenge.

📖 Read

via "Dark Reading: ".

⚠ After SamSam, Ryuk shows targeted ransomware is still evolving ⚠

Devastating, targeted ransomware attacks didn't start with SamSam and they didn't end with it either.

📖 Read

via "Naked Security".

🕴 Trend Micro Finds Major Flaws in HolaVPN 🕴

A popular free VPN is found to have a very high cost for users.

📖 Read

via "Dark Reading: ".

🕴 Twitter Hack May Have State-Sponsored Ties 🕴

A data leak was disclosed after attackers targeted a support form, which had "unusual activity."

📖 Read

via "Dark Reading: ".

<b>&#9000; A Chief Security Concern for Executive Teams &#9000;</b>

<code>Virtually all companies like to say they take their customers’ privacy and security seriously, make it a top priority, blah blah. But you’d be forgiven if you couldn’t tell this by studying the executive leadership page of each company’s Web site. That’s because very few of the world’s biggest companies list any security executives in their highest ranks. Even among top tech firms, less than half list a chief technology officer (CTO). This post explores some reasons why this is the case, and why it can’t change fast enough.</code><code>KrebsOnSecurity reviewed the Web sites for the global top 100 companies by market value, and found just five percent of top 100 firms listed a chief information security officer (CISO) or chief security officer (CSO). Only a little more than a third even listed a CTO in their executive leadership pages.</code><code>The reality among high-tech firms that make up the top 50 companies in the NASDAQ market was even more striking: Fewer than half listed a CTO in their executive ranks, and I could find only three that featured a person with a security title.</code><code>Nobody’s saying these companies don’t have CISOs and/or CSOs and CTOs in their employ. A review of these companies via LinkedIn suggests that most of them in fact do have people in those roles (although I suspect the few that aren’t present or easily findable on LinkedIn have made a personal and/or professional decision not to be listed as such).</code><code>But it is interesting to note which roles companies consider worthwhile publishing in their executive leadership pages. For example, 73 percent of the top 100 companies listed a chief of human resources (or “chief people officer”), and about one-third included a chief marketing officer.</code><code>Not that these roles are somehow more or less important than that of a CISO/CSO within the organization. Nor is the average pay hugely different among all three roles. Yet, considering how much marketing (think consumer/customer data) and human resources (think employee personal/financial data) are impacted by your average data breach, it’s somewhat remarkable that more companies don’t list their chief security personnel among their top ranks.</code><code>Media</code><code>Julie Conroy, research director at the market analyst firm Aite Group, said she initially hypothesized that companies with a regulatory mandate for strong cybersecurity controls (e.g. banks) would have this role in their executive leadership team.</code><code>“But a quick look at Bank of America and Chase’s websites proved me wrong,” Conroy said. “It looks like the CISO in those firms is one layer down, reporting to the executive leadership.”</code><code>Conroy says this dynamic reflects the fact that revenue centers like human capital and the ability to drum up new business are still prioritized and valued by businesses more than cost centers — including loss prevention and cybersecurity.</code><code>“Marketing and digital strategy roles drive top line revenue for firms—the latter is particularly important in retail and banking businesses as so much commerce moves online,” Conroy said. “While you and I know that cybersecurity and loss prevention are critical functions for all types of businesses, I don’t think that reality is reflected in the organizational structure of many businesses still. A common theme in my discussions with executives in cost center roles is how difficult it is for them to get budget to fund the tech they need for loss prevention initiatives.”</code><code>EXHIBIT A: EQUIFAX</code><code>Common or not, the dominant reporting structure in corporations runs the risk of having security concerns take a backseat when they get in the way of productivity, and often leaves the security team without someone to advocate for the proper budget.</code><code>Take the mega breach at Equifax last year that exposed the personal and financial…

❌ Russia-Linked Sofacy Debuts Fresh Zebrocy Malware Variant ❌

The group continues to evolve its custom malware in an effort to evade detection.

📖 Read

via "Threatpost | The first stop for security news".

🕴 Memes on Twitter Used to Communicate With Malware 🕴

Steganography via tweet images gave attackers a way to pass on malicious instructions to Trojan, researchers say.

📖 Read

via "Dark Reading: ".