STE WILLIAMS

On the heels of several headline-grabbing data breaches – and greater emphasis on the importance of disclosure in the lead-up to the May 25 General Data Protection Regulation (GDPR) deadline – the US Securities and Exchange Commission (SEC) recently issued a statement that puts more responsibility on executives for data breaches.

This updated guidance calls for public companies to provide investors with more information on all cybersecurity incidents – even just the existence of potential risks – with minimal delay. The statement goes a step farther in attempting to thwart the potential for the exchange of “insider” information, which was a major concern on the heels of the record-shattering Equifax data breach.

Specifically, corporate officers, directors and “other corporate insiders” are prohibited from trading shares if they have knowledge of any unpublicized security incident within the company.

While the overall intent of this latest statement is clear, the guidance is vague in key areas by design. For instance, the second section of the guidance emphasizes that companies must make “timely disclosure of any related material nonpublic information.” It’s unclear what the SEC explicitly means by “timely disclosure,” as the SEC doesn’t provide a specific time limit that companies must meet. This puts a lot of trust in corporate leaders to put speedy remediation and due diligence at the center of their security policy, which is a bit of a gamble given the track record of executive action during the fallout of the Equifax breach.

The GDPR, on the other hand, is much more prescriptive, giving organizations 72 hours to report an incident related to the personal data of EU citizenry. This isn’t to say that the European Commission has greater distrust for business leaders to make the right call than legislators in the United States, so much as it creates a clear and distinct timetable.

The guidance from the SEC is significant, however, in that it essentially tees up every executive board to make room for or delegate an in-house expert on cybersecurity best practices. It updates a comparably less hawkish stance on the part of the SEC in trying to minimize the occurrence of insiders acting poorly in the time between a major data breach and public disclosure.

Another reason for the vagueness surrounding the actual time limits for disclosure is that the SEC doesn’t want to force businesses to prematurely disclose information that might only publicize vulnerabilities to potential hackers. It’s a delicate balance, as teams want to make sure they are planning their defense thoughtfully before inciting more damage to the company’s data stores – not to mention brand perception.

As part of the GDPR guidance, many data-centric businesses will be required by law to employ a Data Protection Officer (DPO) that acts alongside the network administrators and security teams to enforce best practices and report potential incidents. While this isn’t mandatory for all businesses, companies that aren’t looking to employ cybersecurity experts are doing so at their own risk – especially given this new guidance from the SEC. The cost for not following through on best practices in the event of a breach can be far more significant than putting an in-house expert on the payroll.

While many may view the new SEC guidance and GDPR as onerous red tape, forward-looking organizations should view this as an opportunity to reevaluate their cybersecurity posture and install best practices that should have already been in place. After all, having someone who is tasked with ensuring your organization is secure and protecting its data appropriately is something every organization should embrace.

As president and co-founder of iboss, Peter Martini has played a major role in developing iboss’ innovative technology, and has helped shepherd iboss’ phenomenal growth, since its founding. He has been awarded dozens of patents focused on network and mobile security, and with … View Full Bio

Article source: https://www.darkreading.com/partner-perspectives/iboss/how-to-interpret-the-secs-latest-guidance-on-data-breach-disclosure/a/d-id/1331249?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Two popular applications for medical records management contain hidden user accounts with hard-coded credentials that could be abused by hackers, a researcher has found.

Rapid7 today published a report on the newly discovered security vulnerabilities (CVE-2018-5551 and CVE-2018-5552) in DocuTrac’s electronic medical record (EMR) software QuicDoc and Office Therapy billing software. DocuTrac software runs at some 5,000 healthcare practices, including county and state mental health facilities, employee assistance programs, behavioral health, and other facilities.

Three user accounts are created when the software is installed, and these accounts have high levels of access to the database, according to Rapid7, who handled the vuln disclosure on behalf of the independent researcher who discovered the flaws. The administrator setting up the software is neither warned of these accounts’ existence nor has an option to change the passwords.

In addition, QuickDoc and Office Therapy use a single, hard-coded salt string for encryption. It’s not clear precisely how much of the data stored by the system is encrypted, according to Rapid7, but it is clear that whatever is encrypted is less secure than it should be.

DocuTrac has been notified of the vulnerabilities and has not yet released a patch. In the meantime, Rapid 7 recommends limiting physical access to systems that can be used to log into the applications.

Black Hat Asia returns to Singapore with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier solutions and service providers in the Business Hall. Click for information on the conference and to register.

Curtis Franklin Jr. is executive editor for technical content at InformationWeek. In this role he oversees product and technology coverage for the publication. In addition he acts as executive producer for InformationWeek Radio and Interop Radio where he works with … View Full Bio

Article source: https://www.darkreading.com/endpoint/medical-apps-come-packaged-with-hardcoded-credentials/d/d-id/1331268?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Two popular applications for medical records management contain hidden user accounts with hard-coded credentials that could be abused by hackers, a researcher has found.

Rapid7 today published a report on the newly discovered security vulnerabilities (CVE-2018-5551 and CVE-2018-5552) in DocuTrac’s electronic medical record (EMR) software QuicDoc and Office Therapy billing software. DocuTrac software runs at some 5,000 healthcare practices, including county and state mental health facilities, employee assistance programs, behavioral health, and other facilities.

Three user accounts are created when the software is installed, and these accounts have high levels of access to the database, according to Rapid7, who handled the vuln disclosure on behalf of the independent researcher who discovered the flaws. The administrator setting up the software is neither warned of these accounts’ existence nor has an option to change the passwords.

In addition, QuickDoc and Office Therapy use a single, hard-coded salt string for encryption. It’s not clear precisely how much of the data stored by the system is encrypted, according to Rapid7, but it is clear that whatever is encrypted is less secure than it should be.

DocuTrac has been notified of the vulnerabilities and has not yet released a patch. In the meantime, Rapid 7 recommends limiting physical access to systems that can be used to log into the applications.

Black Hat Asia returns to Singapore with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier solutions and service providers in the Business Hall. Click for information on the conference and to register.

Curtis Franklin Jr. is executive editor for technical content at InformationWeek. In this role he oversees product and technology coverage for the publication. In addition he acts as executive producer for InformationWeek Radio and Interop Radio where he works with … View Full Bio

Article source: https://www.darkreading.com/endpoint/medical-apps-come-packaged-with-hardcoded-credentials/d/d-id/1331268?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Two popular applications for medical records management contain hidden user accounts with hard-coded credentials that could be abused by hackers, a researcher has found.

Rapid7 today published a report on the newly discovered security vulnerabilities (CVE-2018-5551 and CVE-2018-5552) in DocuTrac’s electronic medical record (EMR) software QuicDoc and Office Therapy billing software. DocuTrac software runs at some 5,000 healthcare practices, including county and state mental health facilities, employee assistance programs, behavioral health, and other facilities.

Three user accounts are created when the software is installed, and these accounts have high levels of access to the database, according to Rapid7, who handled the vuln disclosure on behalf of the independent researcher who discovered the flaws. The administrator setting up the software is neither warned of these accounts’ existence nor has an option to change the passwords.

In addition, QuickDoc and Office Therapy use a single, hard-coded salt string for encryption. It’s not clear precisely how much of the data stored by the system is encrypted, according to Rapid7, but it is clear that whatever is encrypted is less secure than it should be.

DocuTrac has been notified of the vulnerabilities and has not yet released a patch. In the meantime, Rapid 7 recommends limiting physical access to systems that can be used to log into the applications.

Black Hat Asia returns to Singapore with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier solutions and service providers in the Business Hall. Click for information on the conference and to register.

Curtis Franklin Jr. is executive editor for technical content at InformationWeek. In this role he oversees product and technology coverage for the publication. In addition he acts as executive producer for InformationWeek Radio and Interop Radio where he works with … View Full Bio

Article source: https://www.darkreading.com/endpoint/medical-apps-come-packaged-with-hardcoded-credentials/d/d-id/1331268?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

NotPetya. BadRabbit. Locky. New forms of ransomware may dominate the headlines and make victims WannaCry, but the majority of cyberattacks result from elementary tactics, such as phishing attacks. A recent Google study even found phishing attacks allow criminals to break into a victim’s account more efficiently than they would with a data breach.

Phishing is a form of social engineering that uses email to steal sensitive user info, such as login credentials or access to customer data. Typically, an attacker poses as a trusted coworker or client — creating an email address with just one missing character, for example — and then dupes the victim into opening an attachment or clicking a malicious link, which can lead to malware installation or identity theft. In this day and age, we all check email on the go while switching between various devices, so most of us don’t think twice about opening an attachment from someone we think we know. The bottom line: phishing is not overly sophisticated, but it is tricky enough to be effective.

According to the Ponemon Institute, phishing campaigns can cost the average U.S. company $3.77 million a year. In 2017 alone, several damaging phishing attacks showed us that we can all be fooled into opening the wrong thing at the wrong time. For example, a cybercriminal group sent “malware laden” emails to Chipotle staff, compromising point-of-sale systems at many locations and stealing customer credit card data from millions of people in the process. Google and Facebook were out $100 million each when an attacker used a phishing email to trick employees into wiring money overseas. And a spear-fishing scam that sent phony information requests to employees for “tax purposes” compromised more than 120,000 people at more than 100 organizations.

These examples only scratch the surface of the number of attacks I’ve seen throughout my 20-year career in information security. No matter how sophisticated attacks get over time, however, I still consider internal phishing testing one of the best ways to teach employees to be more cyber-resilient.

Different Audiences
Phishing testing allows you to assume the role of the attacker and target different audiences at your company to see who takes the bait. From there, you can establish a baseline measurement of employee susceptibility to cyberattacks and provide one-on-one education training to those who continue to get duped by the tests. The point isn’t to call out anyone or embarrass employees for dropping the ball, but rather to help them learn along the way by stimulating personal security awareness. If they fall for your faux-phishing test, you can bet they’ll be a liability when the real thing comes along.

In my current role at endpoint security firm Absolute, I’ve only introduced phishing testing exercises in the past year, but they’ve already paid off. A whaling attempt — that is, a phishing attempt aimed specifically at a high-ranking employee — recently targeted an executive at the company, and our internal training helped him recognize the attack and report it to our IT team right away. He attributed this to the phishing exercises and the internal training we’ve completed.

When developing the phishing test scenario, it’s important to keep the fake email realistic enough to provide a teachable moment, yet not so appealing that it would fool even the cybersecurity nerd who’s always chatting about the latest ransomware at the water cooler. In one of my previous roles, I sent out a phishing email that rewarded employees with gift cards to a coffee shop in our building as part of a made-up company celebration. Not only did a whopping 78% of our employees blindly click on it for a caffeine fix, but the coffee chain also honored the gift cards, with my company having to pay them back! After that experience, I think less about outsmarting employees when building a phishing test and more about re-creating a normal, unremarkable scenario that people will come across on a regular basis to provide a teachable lesson that will stick with them.

Today’s security training programs should reflect the sophistication of modern-day attacks, but we also can’t forget about the basics. Conducting interactive security trainings throughout the year keeps employees on their toes and allows enterprises to spot trends and track processes over time. Your employees won’t remember a snooze-worthy PowerPoint presentation from two years ago, but they may think twice about opening a sketchy attachment after falling for a faux phishing attack.

Related Content:

• 7 Tips to Fight Gmail Phishing Attacks
• Phishing Your Employees for Schooling Security
• Phishing Campaign Underscores Threat from Low Budget, Low Skilled Attackers

Black Hat Asia returns to Singapore with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier solutions and service providers in the Business Hall. Click for information on the conference and to register.

Jo-Ann Smith is an IT security professional who has worked in information technology as both an employee and a consultant for more than 20 years. She currently serves as the Director of Technology Risk Management and Data Privacy at Absolute. Jo-Ann is responsible for … View Full Bio

Article source: https://www.darkreading.com/endpoint/a-secure-enterprise-starts-with-a-cyber-aware-staff/a/d-id/1331220?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

NotPetya. BadRabbit. Locky. New forms of ransomware may dominate the headlines and make victims WannaCry, but the majority of cyberattacks result from elementary tactics, such as phishing attacks. A recent Google study even found phishing attacks allow criminals to break into a victim’s account more efficiently than they would with a data breach.

Phishing is a form of social engineering that uses email to steal sensitive user info, such as login credentials or access to customer data. Typically, an attacker poses as a trusted coworker or client — creating an email address with just one missing character, for example — and then dupes the victim into opening an attachment or clicking a malicious link, which can lead to malware installation or identity theft. In this day and age, we all check email on the go while switching between various devices, so most of us don’t think twice about opening an attachment from someone we think we know. The bottom line: phishing is not overly sophisticated, but it is tricky enough to be effective.

According to the Ponemon Institute, phishing campaigns can cost the average U.S. company $3.77 million a year. In 2017 alone, several damaging phishing attacks showed us that we can all be fooled into opening the wrong thing at the wrong time. For example, a cybercriminal group sent “malware laden” emails to Chipotle staff, compromising point-of-sale systems at many locations and stealing customer credit card data from millions of people in the process. Google and Facebook were out $100 million each when an attacker used a phishing email to trick employees into wiring money overseas. And a spear-fishing scam that sent phony information requests to employees for “tax purposes” compromised more than 120,000 people at more than 100 organizations.

These examples only scratch the surface of the number of attacks I’ve seen throughout my 20-year career in information security. No matter how sophisticated attacks get over time, however, I still consider internal phishing testing one of the best ways to teach employees to be more cyber-resilient.

Different Audiences
Phishing testing allows you to assume the role of the attacker and target different audiences at your company to see who takes the bait. From there, you can establish a baseline measurement of employee susceptibility to cyberattacks and provide one-on-one education training to those who continue to get duped by the tests. The point isn’t to call out anyone or embarrass employees for dropping the ball, but rather to help them learn along the way by stimulating personal security awareness. If they fall for your faux-phishing test, you can bet they’ll be a liability when the real thing comes along.

In my current role at endpoint security firm Absolute, I’ve only introduced phishing testing exercises in the past year, but they’ve already paid off. A whaling attempt — that is, a phishing attempt aimed specifically at a high-ranking employee — recently targeted an executive at the company, and our internal training helped him recognize the attack and report it to our IT team right away. He attributed this to the phishing exercises and the internal training we’ve completed.

When developing the phishing test scenario, it’s important to keep the fake email realistic enough to provide a teachable moment, yet not so appealing that it would fool even the cybersecurity nerd who’s always chatting about the latest ransomware at the water cooler. In one of my previous roles, I sent out a phishing email that rewarded employees with gift cards to a coffee shop in our building as part of a made-up company celebration. Not only did a whopping 78% of our employees blindly click on it for a caffeine fix, but the coffee chain also honored the gift cards, with my company having to pay them back! After that experience, I think less about outsmarting employees when building a phishing test and more about re-creating a normal, unremarkable scenario that people will come across on a regular basis to provide a teachable lesson that will stick with them.

Today’s security training programs should reflect the sophistication of modern-day attacks, but we also can’t forget about the basics. Conducting interactive security trainings throughout the year keeps employees on their toes and allows enterprises to spot trends and track processes over time. Your employees won’t remember a snooze-worthy PowerPoint presentation from two years ago, but they may think twice about opening a sketchy attachment after falling for a faux phishing attack.

Related Content:

• 7 Tips to Fight Gmail Phishing Attacks
• Phishing Your Employees for Schooling Security
• Phishing Campaign Underscores Threat from Low Budget, Low Skilled Attackers

Black Hat Asia returns to Singapore with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier solutions and service providers in the Business Hall. Click for information on the conference and to register.

Jo-Ann Smith is an IT security professional who has worked in information technology as both an employee and a consultant for more than 20 years. She currently serves as the Director of Technology Risk Management and Data Privacy at Absolute. Jo-Ann is responsible for … View Full Bio

Article source: https://www.darkreading.com/endpoint/a-secure-enterprise-starts-with-a-cyber-aware-staff/a/d-id/1331220?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

NotPetya. BadRabbit. Locky. New forms of ransomware may dominate the headlines and make victims WannaCry, but the majority of cyberattacks result from elementary tactics, such as phishing attacks. A recent Google study even found phishing attacks allow criminals to break into a victim’s account more efficiently than they would with a data breach.

Phishing is a form of social engineering that uses email to steal sensitive user info, such as login credentials or access to customer data. Typically, an attacker poses as a trusted coworker or client — creating an email address with just one missing character, for example — and then dupes the victim into opening an attachment or clicking a malicious link, which can lead to malware installation or identity theft. In this day and age, we all check email on the go while switching between various devices, so most of us don’t think twice about opening an attachment from someone we think we know. The bottom line: phishing is not overly sophisticated, but it is tricky enough to be effective.

According to the Ponemon Institute, phishing campaigns can cost the average U.S. company $3.77 million a year. In 2017 alone, several damaging phishing attacks showed us that we can all be fooled into opening the wrong thing at the wrong time. For example, a cybercriminal group sent “malware laden” emails to Chipotle staff, compromising point-of-sale systems at many locations and stealing customer credit card data from millions of people in the process. Google and Facebook were out $100 million each when an attacker used a phishing email to trick employees into wiring money overseas. And a spear-fishing scam that sent phony information requests to employees for “tax purposes” compromised more than 120,000 people at more than 100 organizations.

These examples only scratch the surface of the number of attacks I’ve seen throughout my 20-year career in information security. No matter how sophisticated attacks get over time, however, I still consider internal phishing testing one of the best ways to teach employees to be more cyber-resilient.

Different Audiences
Phishing testing allows you to assume the role of the attacker and target different audiences at your company to see who takes the bait. From there, you can establish a baseline measurement of employee susceptibility to cyberattacks and provide one-on-one education training to those who continue to get duped by the tests. The point isn’t to call out anyone or embarrass employees for dropping the ball, but rather to help them learn along the way by stimulating personal security awareness. If they fall for your faux-phishing test, you can bet they’ll be a liability when the real thing comes along.

In my current role at endpoint security firm Absolute, I’ve only introduced phishing testing exercises in the past year, but they’ve already paid off. A whaling attempt — that is, a phishing attempt aimed specifically at a high-ranking employee — recently targeted an executive at the company, and our internal training helped him recognize the attack and report it to our IT team right away. He attributed this to the phishing exercises and the internal training we’ve completed.

When developing the phishing test scenario, it’s important to keep the fake email realistic enough to provide a teachable moment, yet not so appealing that it would fool even the cybersecurity nerd who’s always chatting about the latest ransomware at the water cooler. In one of my previous roles, I sent out a phishing email that rewarded employees with gift cards to a coffee shop in our building as part of a made-up company celebration. Not only did a whopping 78% of our employees blindly click on it for a caffeine fix, but the coffee chain also honored the gift cards, with my company having to pay them back! After that experience, I think less about outsmarting employees when building a phishing test and more about re-creating a normal, unremarkable scenario that people will come across on a regular basis to provide a teachable lesson that will stick with them.

Today’s security training programs should reflect the sophistication of modern-day attacks, but we also can’t forget about the basics. Conducting interactive security trainings throughout the year keeps employees on their toes and allows enterprises to spot trends and track processes over time. Your employees won’t remember a snooze-worthy PowerPoint presentation from two years ago, but they may think twice about opening a sketchy attachment after falling for a faux phishing attack.

Related Content:

• 7 Tips to Fight Gmail Phishing Attacks
• Phishing Your Employees for Schooling Security
• Phishing Campaign Underscores Threat from Low Budget, Low Skilled Attackers

Black Hat Asia returns to Singapore with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier solutions and service providers in the Business Hall. Click for information on the conference and to register.

Jo-Ann Smith is an IT security professional who has worked in information technology as both an employee and a consultant for more than 20 years. She currently serves as the Director of Technology Risk Management and Data Privacy at Absolute. Jo-Ann is responsible for … View Full Bio

Article source: https://www.darkreading.com/endpoint/a-secure-enterprise-starts-with-a-cyber-aware-staff/a/d-id/1331220?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

A record $2.7 million fine has been levied against an electric utility for vulnerabilities in its IT infrastructure.

The North American Electric Reliability Corporation (NERC) notified the Federal Energy Regulatory Commission (FERC) that it has reached a consent agreement with an unnamed electric utility for the fine over the exposure of information regarding critical infrastructure for at least 70 days. The exposed information includes tidbits like system names and locations, user names, and cryptographic information that could be used to decrypt passwords.

All of the information was in a file that was entirely open to the public, with no user name or password required for access. In this case, there is no allegation that a breach actually occurred because of the vulnerability: the fine is for the vulnerability itself.

The utility’s name was redacted from the public version of the NERC notification, though the filing did include standard language from consent decrees to the effect of, “we didn’t do it the first time and we promise not to do it again.” 

For more, read here.

Black Hat Asia returns to Singapore with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier solutions and service providers in the Business Hall. Click for information on the conference and to register.

Dark Reading’s Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Article source: https://www.darkreading.com/application-security/electric-utility-hit-with-record-fine-for-vulnerabilities/d/d-id/1331271?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

A record $2.7 million fine has been levied against an electric utility for vulnerabilities in its IT infrastructure.

The North American Electric Reliability Corporation (NERC) notified the Federal Energy Regulatory Commission (FERC) that it has reached a consent agreement with an unnamed electric utility for the fine over the exposure of information regarding critical infrastructure for at least 70 days. The exposed information includes tidbits like system names and locations, user names, and cryptographic information that could be used to decrypt passwords.

All of the information was in a file that was entirely open to the public, with no user name or password required for access. In this case, there is no allegation that a breach actually occurred because of the vulnerability: the fine is for the vulnerability itself.

The utility’s name was redacted from the public version of the NERC notification, though the filing did include standard language from consent decrees to the effect of, “we didn’t do it the first time and we promise not to do it again.” 

For more, read here.

Black Hat Asia returns to Singapore with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier solutions and service providers in the Business Hall. Click for information on the conference and to register.

Dark Reading’s Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Article source: https://www.darkreading.com/application-security/electric-utility-hit-with-record-fine-for-vulnerabilities/d/d-id/1331271?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

A record $2.7 million fine has been levied against an electric utility for vulnerabilities in its IT infrastructure.

The North American Electric Reliability Corporation (NERC) notified the Federal Energy Regulatory Commission (FERC) that it has reached a consent agreement with an unnamed electric utility for the fine over the exposure of information regarding critical infrastructure for at least 70 days. The exposed information includes tidbits like system names and locations, user names, and cryptographic information that could be used to decrypt passwords.

All of the information was in a file that was entirely open to the public, with no user name or password required for access. In this case, there is no allegation that a breach actually occurred because of the vulnerability: the fine is for the vulnerability itself.

The utility’s name was redacted from the public version of the NERC notification, though the filing did include standard language from consent decrees to the effect of, “we didn’t do it the first time and we promise not to do it again.” 

For more, read here.

Black Hat Asia returns to Singapore with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier solutions and service providers in the Business Hall. Click for information on the conference and to register.

Dark Reading’s Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Article source: https://www.darkreading.com/application-security/electric-utility-hit-with-record-fine-for-vulnerabilities/d/d-id/1331271?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple