Microsoft: Patching 'Wormable' Windows Server Flaw Is Urgent

Ishita Chigilli Palli • July 15, 2020

Microsoft is urging its customers to patch a "wormable" vulnerability affecting the Windows Server operating system that could allow an attacker to exploit an organization's entire infrastructure.

►

Business Email Compromise (BEC)

5 Billion Unique Credentials Circulating on Darknet

Latest

Fraud Management & Cybercrime

Phishing Campaign Used Chase Fraud Alert as Lure

Doug Olenick • July 15, 2020

Fraudsters used phishing emails purporting to be a warning from Chase Bank about "unusual activity" on credit cards in an attempt to steal consumers' account credentials, according to Mariana Pereira of the security firm Darktrace.

Next-Generation Technologies & Secure Development

How to Make the Most of Cyber Intelligence

Anna Delaney • July 15, 2020

Creating a cyber intelligence strategy involves operational and tactical measures as well as technical approaches, says Jeff Bardin, chief intelligence officer at Treadstone 71.

3rd Party Risk Management

Britain's 5G Policy Failure: No Ideal Alternative to Huawei

Mathew J. Schwartz • July 15, 2020

Britain's U-turn on Huawei, announcing that it will now ban the manufacturer's gear from its 5G networks, highlights this as yet unresolved problem: Years of underinvestment and policy failures have left Britain and its allies with no inexpensive, trusted alternative.

Cyberwarfare / Nation-State Attacks

UK Reverses Course, Bans Huawei Gear From 5G Networks

Doug Olenick • July 14, 2020

The British government has officially reversed course and will now ban Huawei's telecom gear from its 5G networks. The ban on use of the Chinese firm's equipment, based in part on U.S. sanctions against the manufacturer, goes into effect at year's end.

Cyberwarfare / Nation-State Attacks

Israeli Court Dismisses Complaint Against NSO Group

Akshaya Asokan • July 14, 2020

An Israeli court has dismissed a petition filed by Amnesty International that sought to revoke the security export license of NSO Group, a tech firm that's been accused of selling hacking tools to governments for targeting dissidents, journalists and lawyers.

Cybercrime

Yet Again, Vulnerabilities Found in a Router

Jeremy Kirk • July 14, 2020

It's common for security researchers to be ignored when reporting a software vulnerability. The latest example - vulnerabilities found by Independent Security Evaluators in a router made by China-based Tenda.

Fraud Management & Cybercrime

Leveraging Analytics for Fraud Audits

Suparna Goswami • July 14, 2020

Data analytics can help auditors identify high-risk areas - a far better approach than relying on random samples, says forensics expert Vincent Walden.

Endpoint Security

IoT in the Enterprise: Managing Risk and Control

Jeremy Kirk • July 14, 2020

Enterprises want to make greater use of connected devices to develop new services and gain efficiencies, but security is a paramount concern. Piers Hogarth-Scott and Katherine Robins of KPMG break down the risks and the challenges around IoT security.

Application Security

Ensuring Connected Devices Are Secure

Jeremy Kirk • July 14, 2020

The lessons of the Mirai botnet's abuse of internet-connected devices four years ago have been taken to heart, says Aaron Guzman of OWASP, which is working with others to improve security benchmarks and testing for connected devices.

Endpoint Security

Product Labels Could Make IoT Risks More Transparent

Jeremy Kirk • July 14, 2020

Manufacturers are increasingly adding connectivity to everyday devices, but it's not always evident how privacy and security is managed. Detailed technical labels could give purchasers more insight, says Pardis Emami-Naeini, a post-doctoral scholar at Carnegie Mellon University.

Cyberwarfare / Nation-State Attacks

Wells Fargo Bans TikTok App on Company Devices

Ishita Chigilli Palli • July 13, 2020

Wells Fargo, the fourth largest bank in the U.S., has directed employees to remove the TikTok social media app from their company-issued devices, citing security concerns. The news comes after Amazon sent mixed signals to its employees about use of the social media app.

Cybercrime

Russian Found Guilty of Hacking LinkedIn, Dropbox

Prajeet Nair • July 13, 2020

A Russian national has been found guilty of hacking LinkedIn, Dropbox and the now defunct Formspring to steal millions of user credentials, some of which were later sold on underground markets.