hacking – Page 11 – STE WILLIAMS

FBI Warns of Fake CDC Emails in COVID-19 Phishing Alert

library
crime | hacking | security

Fraudsters exploit concerns by claiming to offer virus-related information or promising stimulus checks.

Cybercriminals are capitalizing on the spread of COVID-19 with new phishing emails that pretend to offer information about the virus or request money or data from concerned victims.

The FBI Internet Crime Complaint Center (IC3) issued an alert late last week to warn people of fake emails claiming to be from the Centers for Disease Control and Prevention (CDC) or other healthcare organizations, pretending to share information about the virus. Officials advise not to open attachments or click links in these emails, and to be wary of websites and apps that claim to track COVID-19 cases. Criminals are using such websites to infect and lock computers.

Some of these emails ask victims to verify personal data so they can receive an economic stimulus check from the government, the FBI says. It emphasizes that while these checks have been mentioned in the news cycle, government agencies are not sending out unsolicited emails asking for private information. Other phishing campaigns may mention charity contributions, airline carrier refunds, fake cures and vaccines, and fake COVID-19 testing kits, officials note.

People are also urged to be on alert for attackers selling products that aim to prevent or treat COVID-19, as well as counterfeit sanitizing products and personal protective equipment (PPE). More information on PPE can be found via the CDC, FDA, and EPA.

538 Million Weibo Users’ Info for Sale on Dark Web

library
crime | hacking | security

The user data, which does not include passwords, purportedly comes from a mid-2019 breach.

Hackers have placed the personal information of more than 538 million Weibo users for sale online. The hacker claims to have breached the Chinese social network in mid-2019.

According to the ad offering the database for sale, the information includes names, Weibo usernames, gender, location, and, in some cases, phone numbers. The breach does not include passwords or payment information.

The data is being offered for $250 in its entirety, an amount likely kept low by the lack of passwords.

Three Ways Your BEC Defense Is Failing & How to Do Better

library
crime | hacking | security

Business email compromises cost the economy billions of dollars. Experts have advice on how to stop them from hitting you for millions at a pop.

According to the FBI, business email compromises (BECs) were the most economically damaging cyber crimes of 2019, responsible for more than $1.7 billion in losses. And companies may feel a very keen sting indeed from just one BEC: just in the past six months, Toyota lost $37 million, Nikkei lost $29 million, and even a Texas school district was smacked with $2.3 million.

While some of the attacks use server or account exploits as a vector, most depend on a human being on the victim’s side to open the door for the criminal to enter.

The human factor means that there are multiple things to consider when it comes to defense plans. The question, for many organizations, is just how to balance human factors and technology when trying to figure out how best to allocate dollars to cyber defense.

You can start by avoiding these common mistakes.

Underestimating the Challenges at the Front Line
The front line in the BEC battle is in front of the keyboard. “Staff need to be educated against the threat of BEC scams and have practiced using a defined process to respond to suspected BEC scams and other social engineering attempts,” says Richard Gold, head of security engineering at Digital Shadows.

“The employee remains the last measure of protection or the last stand against BEC attacks for many organizations when all other security measures fail,” says Mark Chaplin, principal at the Information Security Forum.

And that last measure is under attack from more than just criminal organizations. “Work deadlines, family commitments, and personal biases represent just some of the factors that can prevent an individual from applying the necessary caution before acting on a contaminated email,” Chaplin explains. The stresses he mentions, and many others, are concerning because criminals have developed considerable expertise in exploiting their victims’ weaknesses.

“Criminals have become more sophisticated by considering the psychological aspects of an attack,” Gold says, adding, “This has resulted in the most skilled, qualified, and security-aware employees falling for a well-crafted, targeted attack.”

That attack increasingly will use a vector that too many organizations fail to address in training.

Overlooking a Key Attack Vector
“While many organizations have implemented cybersecurity training with an emphasis on email – training users to identify phishing attacks – most efforts focus entirely on desktop email clients where users can easily check for phishing indicators,” says Chris Hazelton, director of security solutions at Lookout. “It’s with mobile email where this training falls short, both in focus and application.” He says that most of the indicators of phishing don’t really exist on mobile email clients, which tend to obscure full email addresses and limit the ability to preview hyperlinks.

These training gaps and technology weaknesses are allowing attackers to use BECs as the front end of attacks that have economic repercussions now and later. “We’re seeing the attackers gain access to the mail system and then wait. They’re inside the system and the dwell times we’re seeing is a minimum of six to seven months before they actually initiate the attack,” says Tom Arnold, co-founder, vice president and head of Forensics at Payment Software Company, part of NCC Group. “They’re actually mapping out what this organization looks like and they’re looking at the internal organization much the same way you or I would map networks and figure out which machines do what,” he explains.

Insufficient Authentication Measures
BEC attacks can take several forms, but for many cybersecurity experts there’s a single point at which many can be stopped: authenticating the user or process that tries to access network assets.

“BEC scams, similar to identity theft scams, rest on insufficient authentication of the people or organizations involved in a financial transaction. Any financial transactions that involve large sums must use strong authentication mechanisms in order to prevent losses,” says Gold. For Gold, as for many others, enhanced authentication is one of the technological foundations of anti-BEC strategy.

Multi-factor authentication could help companies defend against the very carefully crafted attacks that many criminals use as springboards to comprehensive campaigns. “The majority of the attacks we’ve seen have been attacks to try to obtain credentials, and once they have credentials, they log in and begin masquerading as users. And to a large extent, they log in and just monitor what’s going on to figure out how to craft their continuing attacks,” says Arnold.

And while multifactor authentication can add friction to every transaction in which it’s employed, not every employee transaction is equally sensitive. “Add multifactor authentication to critical and sensitive financial applications to prevent unauthorized access by criminal groups,” says James McQuiggan, security awareness advocate at KnowBe4, continuing, “At a process level, add multilevel or tiered authorization requirements for various dollar amounts before allowing employees to send money.”

The additional authorization with multifactor authentication can prevent, he says, a single person from approving or sending large amounts to a vendor (or criminal).

“A lot of people would sort of yawn at BECs — they’re not sophisticated,” says Arnold. “It’s not like an APT group coming in from China or something like that. It’s really not super-sophisticated, but then again, it’s very, very lucrative.”

Related content:

Curtis Franklin Jr. is Senior Editor at Dark Reading. In this role he focuses on product and technology coverage for the publication. In addition he works on audio and video programming for Dark Reading and contributes to activities at Interop ITX, Black Hat, INsecurity, and … View Full Bio

Article source: https://www.darkreading.com/theedge/three-ways-your-bec-defense-is-failing-and-how-to-do-better/b/d-id/1337385?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Firefox is dropping FTP support

library
crime | hacking | security

Heads up, Firefox users who rely on FTP: the browser is eliminating support for this venerable protocol.

First written in 1971, the file transfer protocol predates TCP/IP, the protocol stack that underpins the modern internet. In its original form, the protocol is insecure. For example, it transmits login credentials in plain text. In 1999, the IETF published a draft RFC listing its various shortcomings. These included everything from problems in the way it responded to invalid login attempts through to an inability to segment file permissions when using anonymous FTP (which doesn’t require user credentials at all).

Now, Mozilla is planning to turn off FTP by default in version 77 of Firefox, which will ship this June. Users will be able to turn it on again temporarily so that they can carry on using FTP from within the browser. Firefox Extended Support Release (ESR) will continue to have FTP turned on by default in ESR version 78.

The real crunch will come at the start of next year, when Michal Novotny, a software consultant at Mozilla, said that the Foundation will remove FTP code from the browser altogether. He added:

We’re doing this for security reasons. FTP is an insecure protocol and there are no reasons to prefer it over HTTPS for downloading resources.

Also, a part of the FTP code is very old, unsafe and hard to maintain and we found a lot of security bugs in it in the past.

There are more secure versions of FTP available. SSH FTP uses the secure shell protocol for FTP sessions, which is encrypted. FTP over TLS (FTPS) runs the protocol over SSL/TLS. However, Mozilla seems uninterested in supporting these.

Its reasons may be the same as Google’s, which is also deprecating FTP in Chrome. In a status report on its support for FTP, Google said that so few people use FTP in the browser that it isn’t worth the effort to improve the client.

Google announced its intent to remove the protocol from the browser in August 2019. According to its status report, it had already turned off the ability to render top-level FTP resources directly in Chrome. This means you can’t click on a picture in an FTP directory and have it appear in Chrome – instead, it downloads the image instead.

The advertising giant set a flag for controlling FTP support in version 80, leaving it enabled by default. Version 81 will see that flag set to off by default, and then version 82 will eliminate the FTP code entirely.

What should you do if you’re unwilling to abandon FTP? One option is to use a dedicated FTP client, such as the free FileZilla program, which also supports SFTP.

Latest Naked Security podcast

LISTEN NOW

Click-and-drag on the soundwaves below to skip to any point in the podcast. You can also listen directly on Soundcloud.

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/Sf6G9aa0Ljk/

Stolen data of company that refused REvil ransom payment now on sale

library
crime | hacking | security

Operators of the Sodinokibi (aka Sodin or REvil) Ransomware as a Service (RaaS) recently published over 12GB of data that allegedly belongs to one of its victims – Brooks International – that refused to pay ransom.

As if that weren’t bad enough, cyber-intelligence firm Cyble told BleepingComputer that it’s seen the data up for sale on hacking forums.

RaaS is the malware for lazy crooks who just want to launch attacks at the press of a button: it enables novice cybercriminals to build automated campaigns using third-party kits sold on the dark web. They don’t have to break a sweat by learning about malware, teaching themselves how encryption works, writing ransomware code, running an anonymous webserver on Tor to collect the loot, distributing decryption keys, or otherwise getting their hands dirty with technical details.

Sodinokibi – a GandCrab derivative blamed for numerous attacks that took place last year – is a prime example of RaaS.

BleepingComputer shared a screengrab of one such hacker forum post that showed a member advertising a link to the stolen data for 8 credits: that’s worth about €2 (USD $2.15, £1.72).

Brooks International is a global professional services firm that says it’s got clients in all industries and sectors. The data dump, if it proves legitimate, will prove highly valuable to cybercrooks, as it contains usernames and passwords, credit card statements, alleged tax information, and far more, according to BleepingComputer.

Does this data belong to employees or clients? One assumes clients, given that it allegedly contains credit card statements, but that’s just an assumption. Given that it also purportedly contains W-2 forms, it could well be a combination of employee and client data, all rolled into one very valuable database. At any rate, whoever the data belongs to should be worried, given that 1) purported purchasers are cackling with glee, and 2) Brooks hadn’t returned media inquiries as of Friday.

BleepingComputer quoted a number of comments left by purchasers on the forums:

It even has credit card number a password. lol !!

To bad these W2 forms weren’t Donald Trump’s taxes. lol !!

Thank you for being the hero we may not deserve, but need.

BleepingComputer tried to get in touch with Brooks to give the firm a heads-up about their data being sold. Lawrence Abrams, writing for the media outlet, said that even though editorial staff spoke with somebody, nobody returned BleepingComputer’s call with responses to questions. I left a message on Friday night but hadn’t heard back by the time this story published.

In lieu of official guidance from Brooks for clients or employees (at least, we haven’t heard of any such notification), those connected to Brooks might want to play it safe by checking their credit report and credit card statements, and consider putting a security freeze on their credit account.

As for organizations that want to stay out of the clutches of ransomware RaaSers, please do read on for our advice:

How to protect yourself from ransomware

Pick strong passwords. And don’t re-use passwords, ever.
Make regular backups. They could be your last line of defense against a six-figure ransom demand. Be sure to keep them offsite where attackers can’t find them.
Patch early, patch often. REvil isn’t the only ransomware that pried open unpatched systems – Pulse Secure VPNs, to be precise – to break into company networks. Ransomware like WannaCry and NotPetya likewise relied on unpatched vulnerabilities to spread around the globe.
Lock down RDP. Criminal gangs exploit weak RDP credentials to launch targeted ransomware attacks. Turn off Remote Desktop Protocol (RDP) if you don’t need it, and use rate limiting, two-factor authentication (2FA) or a virtual private network (VPN) if you do.
Use anti-ransomware protection. Sophos Intercept X and XG Firewall are designed to work hand in hand to combat ransomware and its effects. Individuals can protect themselves with Sophos Home.

For information about how targeted ransomware attacks work and how to defeat them, check out the SophosLabs 2019 Threat Report.

For more advice, please check out our END OF RANSOMWARE page.

Latest Naked Security podcast

LISTEN NOW

Click-and-drag on the soundwaves below to skip to any point in the podcast. You can also listen directly on Soundcloud.

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/-El5NCvRDwQ/

Tour guide/Chinese spy gets four years for SD card dead drops

library
crime | hacking | security

A naturalized US citizen who was working as a tour guide in San Francisco has been sentenced to four years in prison for being a Chinese spy.

Last Tuesday, 56-year-old Xuehua (Edward) Peng, also known as Edward Peng, was sentenced in US District Court in San Francisco and ordered to pay a $30,000 fine for acting as an agent of the People’s Republic of China’s Ministry of State Security (MSS).

The MSS instructed an agent – a double agent working for the FBI, as it turns out – to dead-drop SD cards full of classified data at various hotels. (“Dead drop” is spy-speak for techniques to pass information or items between two individuals using a secret location, so they never meet, to thereby keep the lid on the operation.)

What classified information was on those cards, and from what government agency, private business or government contractor was it copied? The US isn’t saying.

According to the criminal complaint, Peng’s undoing started in March 2015, when the FBI planted its double agent in the MSS. The double agent met with MSS intelligence officers and handed over classified information relating to US national security, for which he was paid.

At one point, the spy bosses told the double agent that they had a new way to pass classified information: on an SD card, stuck in a book, wrapped in a bag addressed to “Ed”, and left at the front desk of a hotel in Newark, California.

Ed’s reliable, he’s got family in China, and he’s had business dealings in China, the MSS agents told the FBI mole.

Peng pleaded guilty in November 2019. According to his plea agreement, Peng, who lives in Hayward, California, admitted that in March 2015, a Chinese official introduced himself while Peng was on a business trip to China. The official – whom Peng eventually figured out was working for the MSS – asked Peng to use his citizenship in the US to assist the official with “matters of interest” to the PRC.

After that, Peng admitted, he got paid at least $30,000 for running data over to China over the course of about 3.5 years.

This is how the dead drops went down, according to the complaint:

On October 24, 2015, Peng goes to the hotel [in Newark, California] and retrieves a package that was left for him there. The package contains a secure digital (SD) memory card. The next day, Peng drives to San Francisco International Airport and flies directly to Beijing, China. In Beijing, Peng meets with agents of the Ministry of State Security (MSS), including the People’s Republic of China (PRC) official with whom Peng had been communicating, and delivers the SD card to MSS.

A PRC official uses coded language to tell Peng that another dead drop will occur on April 23, 2016. The official directs Peng to book a hotel room where he will conduct the exchange. The PRC official directed Peng to leave $20,000 cash in the hotel room and that Peng be will be reimbursed for the payment. The PRC official instructs Peng to return to the PRC on April 24, and to fly directly to Beijing, Shanghai, or Guangdong. Peng is informed that the PRC official with whom he is communicating would meet Peng when he landed.

Peng complied with the instructions. On April 23, 2016, Peng drives to an Oakland hotel, reserves a room, and leaves a key to the room at the front desk. Peng leaves $20,000 concealed on the underside of a dresser in the room. Hours later, Peng returns, observes that the money had been retrieved and determines that a cigarette pack with an SD card inside of it has been left for him in place of the money. Peng travels on a direct flight from San Francisco to Beijing the next day where he meets with agents of the MSS, including the PRC official.

Between June 2015 and July 2018, Pen pulled off six dead drops at hotels in California and Georgia. He was on his way to pull off a seventh dead drop when he was busted at his home on 27 September 2019.

According to the FBI, Peng first came to the US on a temporary business visitor visa before he petitioned to be a non-immigrant worker in June 2001. After he married, he became a lawful permanent resident in February 2006 and was naturalized in September 2012.

According to his immigration file, Peng has a degree in mechanical engineering and is trained in traditional Chinese medicine. I don’t know how much tour guides or traditional Chinese medicine practitioners make in San Francisco, but Peng, apparently, wasn’t doing bad.

At least, that’s what one might surmise from the FBI’s telling of the investigation: after agents traced the cars used to pick up the SD card packages, they found a Lexus, a Fiat and a Mercedes parked at Peng’s house and registered to him and/or his wife.

Crime sure does pay. Well, at least in the short term. In the long term, the US promises that it’s determined to thwart the Chinese government’s “multi-faceted espionage efforts”. Peng’s conviction serves as a warning to other potential spies that “we will find you and ensure you are punished,” in the words of Assistant Attorney General for National Security John C. Demers.

Here’s Attorney David L. Anderson:

Today Xuehua Peng suffers the consequences of acting in the United States at the direction of a foreign government. This day of reckoning comes from Peng’s decision to execute dead drops, deliver payments, and personally carry to Beijing, China, secure digital cards containing classified information related to the national security of the United States. Peng will now spend years in prison for compromising the security of the United States.

Latest Naked Security podcast

LISTEN NOW

Click-and-drag on the soundwaves below to skip to any point in the podcast. You can also listen directly on Soundcloud.

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/-B205f_8nM4/

Cisco issues urgent fixes for SD-WAN router flaws

library
crime | hacking | security

Cisco has patched a clutch of high-priority vulnerabilities in its SD-WAN routes and their management software that admins will want to apply as soon as possible.

SD-WAN is a technology that allows large companies to manage different types of Wide Area Network (WAN) communications links such as carrier MPLS, conventional broadband, and mobile 4G as a single virtual entity.

Making SD-WAN work requires specific routers that support it, spread out across the WAN, as well as management software to interact with this infrastructure. It is this software that is vulnerable.

There are five CVEs in total, three of which are rated high, including one, CVE-2020-3266, given a CVSS severity score of 7.8.

The latter is a privilege escalation vulnerability in the SD-WAN management software used with a range of Cisco routers, including the vEdge 100 Series, 1000 Series, 2000 Series, 5000 Series, and Cloud Router.

Also affected are the vBond Orchestrator, vManage Network Management System, and vSmart Controller software.

The other four CVEs are:

CVE-2020-3264, a buffer overflow affecting the same products, rated high priority.
CVE-2020-3265, another privilege escalation issue affecting the same products, rated high that could allow a “local attacker to elevate privileges to root on the underlying operating system.”
CVE-2019-16010, a cross-site scripting (XSS) issue affecting the vManage user interface exploitable by persuading a user to click on a malicious link.
CVE-2019-16012, a SQL injection flaw affecting vManage which could allow an attacker to send malicious SQL queries to an unpatched system.

What to do

There are no workarounds for any of these – all must be patched to address the vulnerabilities. So far, none are being exploited in the wild.

For all products, the solution is to upgrade to vManage version 19.2.2, although how this is done varies slightly from router to router.

The fixes follow a big round from earlier this month affecting Cisco’s WebEx conferencing software that admins won’t want to skip given the increased demand for this service right now.

Latest Naked Security podcast

LISTEN NOW

Click-and-drag on the soundwaves below to skip to any point in the podcast. You can also listen directly on Soundcloud.

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/B5FgaeP0ZK4/

It’s time to track people’s smartphones to ensure they self-isolate during this global pandemic, says WHO boffin

library
crime | hacking | security

Tracking and limiting the movements of overseas travelers, and others suspected to be COVID-19 coronavirus carriers, has proved an essential tool in controlling the pandemic.

That’s according to Professor Marylouise McLaws, a technical adviser to the World Health Organization’s Infection Prevention and Control Global Unit.

McLaws – a professor at the University of New South Wales’ School of Public Health and Community Medicine in Australia, and a member of European, US and UK epidemiology and infection control bodies – told The Register tracking played a key role in nations that were able to flatten the exponential curve of COVID-19 cases – particularly Singapore, Taiwan and South Korea.

Singapore, an air travel hub in the Asia-Pacific region, has 455 confirmed COVID-19 cases and two deaths as of the weekend. Taiwan has just 195, and also two deaths.

Professor McLaws said that, in Singapore, those who may have been exposed to the novel coronavirus – particularly those returning from overseas – were subject to “stay-home notices” that required them to self-isolate for 14 days. Confirmed patients were hospitalized, we note.

Tech won’t save you from lockdown disaster: How to manage family and free time while working from home

To enforce the stay-at-home notices, officials told people to enable location services on their smartphones and periodically click on a link sent by SMS. That link reported their location, confirming they were in fact staying at home. Messages must be responded to in a short period of time to prevent people cheating by leaving their phones behind while they ventured outside.

Visits were also made to confirm the location of those under lockdown orders.

McLaws is happy with this approach because the data she’s seen suggests the majority of COVID-19 cases can be traced to international travelers, or those who have come into contact with international travelers. Ensuring those people stay away from the general population for two weeks would stem the further spread of the virus.

“I like technology, and I am surprised that we are not using it on the group who are at highest risk – international travelers – and who are not being checked that they are actually self-isolating,” she told us today.

“It is all very well and good to say self-isolate, now is the time to say it must be done. And now that mild confirmed cases are being told to stay at home, we need to make sure they are not out shopping.”

She also feels that using technology to track the COVID-19 pandemic may be less damaging to the social fabric than other means.

“Let’s not turn into police,” she advised. “Reporting people you see puts you at odds with the people we live with. Electronic monitoring is much kinder.” ®

Sponsored:
Webcast: Why you need managed detection and response

Article source: https://go.theregister.co.uk/feed/www.theregister.co.uk/2020/03/23/track_phones_coronavirus_who/

From Zero to Hero: CISO Edition

library
crime | hacking | security

It’s time for organizations to realize that an empowered CISO can effectively manage enterprise risk and even grow the business along the way.

Traditionally, CISOs have borne the brunt of blame for cyber events that affect an organization. Because CISOs are the leaders in charge of data security, any breach has been seen as a mistake on their part and consequences doled out accordingly. However, as companies’ understanding of cybersecurity has evolved, this is starting to change in fundamental ways; today’s CISO faces an unprecedented opportunity to be hailed as a hero, rather than condemned as a villain, in the aftermath of a cyberattack.

Case in point: A few years ago, a security event erupted inside a security vendor’s own internal network. The internal security team was using the company’s own products, and the CISO had been granted access and permissions to modify the products’ code locally along with other resources to adapt them to his own use. When the attack occurred, the modifications he and his team had made were the difference between a large-scale, publicly reportable event and a significantly smaller incident that was entirely manageable.

During the incident, the security teams responded alongside product development teams and explained to developers how the attack worked, along with the modifications they’d made that helped stop the attack. In tandem, the CISO was briefing the C-suite and board regularly, including how the depth and breadth of product modifications made by the security team made a difference. Specifically, he explained how the company’s products were modified to block attacker communications and how the products were made to interface with security products from other companies to enhance the speed of the blocks.

Rather than blame, second-guess, or threaten the CISO with his job, development executives praised the security team’s product innovations to those in the C-suite, who then pulled the CISO into a larger product development role that ultimately increased business.

What It Takes to Be a Modern CISO
While this template may not necessarily be repeatable across industry sectors, it helps illustrate some important shifts in how companies behave after a major security incident

With new attacks forming faster than the technologies to fight them, holding CISOs to an entirely unrealistic standard doesn’t actually serve anyone. The truth is that no matter how many technologies are deployed or how good the security posture is, 100% protection from cyberattacks is simply not possible. Perhaps senior leadership and boards of directors are finally starting to acknowledge this fact, or perhaps they’re starting to realize that a successful response to an attack, along with actions by other parts of the organization, contribute to the ultimate scale and scope of the event.

CISOs are uniquely capable of gauging cyber-risk and how to reduce it. Experienced CISOs understand the threats their companies face and know how to deploy the optimal mix of people, processes, and technologies, weighed against threats, to provide the best possible level of protection. Organizations that understand this are leading the charge in shifting the perception of the CISO from technical manager to strategic risk leader.

Given this shift in industry and perception, it’s only a matter of time before CISOs’ skills and expertise — along with their well-managed team — will be needed to prevent disaster. When that moment occurs, however, the difference between success and failure lies in the degree to which they’ve been empowered by the organization to take the necessary steps — before, during, and after an attack.

What Do Empowered CISOs Look Like?
First, they have strong social support within their organizations. They are involved in decision-making that affects overall security across the enterprise.

Second, they have authority over the cyber-risk management budget, including insurance, as well as overseeing response and recovery efforts. CISOs typically have to coordinate many parties when an attack hits, including outside counsel, insurance providers, incident response contractors, and infrastructure recovery contractors. Having responsibility without budget or authority is a recipe for failure at a critical time.

Finally, the board and senior leadership recognize that no solution for cyber threats is perfect, and an increase in attack frequency means that eventually one will succeed. They understand that blaming the CISO after a cyber incident is unfair and deprives the organization of an opportunity to learn from the experience, with a professional who is best positioned to make the company safer in the future.

As the tide of perception continues to shift in favor of today’s CISO, it’s important to remember that empowering the role with support, authority, and resources can make all the difference to your organization’s unsung CISO hero.

Related Content:

Mike Convertino is the chief security officer at Arceo.ai, a leading data analytics company using AI to dynamically assess risk for the cyber insurance industry. He is an experienced executive, leading both information security and product development at multiple leading … View Full Bio

Article source: https://www.darkreading.com/careers-and-people/from-zero-to-hero-ciso-edition/a/d-id/1337312?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

8 Infosec Page-Turners for Days Spent Indoors

library
crime | hacking | security

Stuck inside and looking for a new read? Check out these titles written by security practitioners and reporters across the industry.

(Image: Roman Motizov – stock.adobe.com)

If you’ve been feeling a little restless these days, you’re not alone. People around the world are spending more time indoors in an attempt to stop the spread of the novel coronavirus – and that means we all have some extra free time on our hands.

COVID-19 has transformed the way security practitioners live and work. Businesses have had to put continuity plans into action and encourage employees to begin working from home, even if they never previously supported a remote workforce. This transition, done to protect employee health, has also widened the attack surface and forced everyone to get used to a new normal.

Security pros aren’t the only ones busier as the crisis surrounding coronavirus continues to spread. In recent weeks, security researchers have spotted an increasing number of malicious activities linked to COVID-19 as attackers capitalize on the virus. The risk is rising for businesses in all industries, especially those in law enforcement and healthcare, as attackers deploy phishing campaigns with virus-themed lures to get victims to click malicious attachments.

In times like these, it helps to unwind with a good read. Here, we’ve rounded up some recommendations for infosec books that have appeared on shelves in the past couple of years. This weekend, we suggest you use some of that downtime to dive into one of these reads.

Of course, we’re always looking to add more titles to collections like these. If you have a favorite security book we didn’t list, we welcome your recommendations in the Comments section, below.

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance Technology, where she covered financial … View Full Bio

Article source: https://www.darkreading.com/attacks-breaches/8-infosec-page-turners-for-days-spent-indoors/d/d-id/1337375?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple