LastPass breach fallout spreads to expose customer data

The Latest

• 

  FCC bans imports of telecom gear from China-based companies

  The latest in a series of orders aligns the agency’s equipment authorization process with national security policies.

  Policy & Regulation

• 

  As companies tighten tech spend, demand for cybersecurity services grows

  Managed service providers can help fill talent needs and tame costs, but that strategy may require additional risk mitigation.

  Strategy

• 

  Growing Mastodon security community grapples with CISA impersonators

  An infosec.exchange account impersonating CISA Director Jen Easterly was suspended by the Mastodon instance administrator Monday, as the security community searches for a Twitter alternative.

  Strategy

• 

  ‘Tis the season for shopping and scams, CISA warns

  Adversaries exploit individuals hunting for the best deals online during the holiday shopping season. If a deal looks too good to be true, trust your instincts — it's not.

  Threats

• 

  Defense Department launches zero trust, phasing out perimeter defense strategy

  Private sector partners say the rollout will raise the security bar to better protect the entire defense industry ecosystem.

  Strategy

• 

  Security awareness training needs a revamp

  Too often security training is seen as a negative experience and a time to reprimand those who make security gaffes. But old strategies aren’t working. It’s time for a redo. 

  Strategy

• 

  Three-quarters of retail, hospitality applications have security flaws

  Nearly 1 in 5 vulnerabilities in the retail and hospitality industry are considered high severity, Veracode found, creating considerable risks to the organization. 

  Vulnerability

• 

  Where will the security community turn, if not Twitter?

  A consistent stream of credibility hits could cause lasting damage for cybersecurity and those who flock there.

  Strategy

• 

  Palo Alto Networks reports strong fiscal Q1 as security needs outpace economic fears

  The security firm also agreed to buy Cider Security, boosting its software supply chain security business.

  Strategy

• 

  Offshore oil and gas at risk of potentially catastrophic cyberattack: GAO

  A report warns the industry could see an attack that rivals the deadly 2010 Deepwater Horizon disaster and urges Interior Department officials to stand up safeguards.

  Policy & Regulation

• 

  Tech sector execs see potential recession as a business opportunity

  Technology company leaders are preparing for economic downturn by investing selectively in the workforce and new technologies, according to EY survey.

  Strategy

• 

  Cybercriminals strike understaffed organizations on weekends and holidays

  Cybereason research found organizations are short-staffed on holidays and weekends, even though that's when attackers are likely to strike.

  Cyberattacks

• 

  SMB cyber budgets under pressure amid slowing economy

  The potential budget cuts during a period marked by market volatility could increase organizational risk.

  Strategy

• 

  Iran-linked threat actors exploiting Log4Shell via unpatched VMware, feds warn

  The actors compromised a federal civilian agency, CISA and the FBI said. Authorities warned VMware users to assume breach and hunt for threats if they skipped patches or workarounds.

  Vulnerability

• 

  Critical infrastructure providers ask CISA to place guardrails on reporting requirements

  Top companies and industry groups fear incident reporting mandates would overwhelm CISA with noise. 

  Strategy

• 

  McDonald’s to launch cybersecurity apprenticeship program

  The restaurant chain's initiative is among nearly 200 registered apprenticeships programs approved or under development as part of the White House's Cybersecurity Apprenticeship Sprint.

  Leadership & Careers

• 

  Nokia warns 5G security ‘breaches are the rule, not the exception’

  A majority of 5G network operators experienced up to six cyber incidents in the past year. Defenses are especially lacking for ransomware and phishing attacks.

  Breaches

• 

  Confidential computing critical for cloud security, Google and Intel say

  Confidential computing aims to isolate and encrypt data in use. The technology is young, but it could deliver significant gains for cloud security.

  Strategy

• 

  High risk, critical vulnerabilities found in 25% of all software applications and systems

  Research from Synopsys showed weak SSL/TLS configurations were the most prevalent form of vulnerability.

  Vulnerability

• 

  CISA wants to change how organizations prioritize vulnerabilities

  Federal authorities want to take the guesswork and manual decision making processes out of the messy world of vulnerabilities.

  Vulnerability

• 

  K-12 schools lack resources, funding to combat ransomware threat

  One-fifth of schools spend less than 1% of their IT budgets on security, a MS-ISAC report shows.

  Strategy

• 

  Why privacy professionals should work closely with company engineers

  Transcend's general counsel, Brandon Wiebe, said the increasingly technical nature of data privacy regulations requires cross-functional collaboration. 

  Policy & Regulation

• 

  CISA warns unpatched Zimbra users to assume breach

  Months after warnings to patch the Zimbra Collaboration Suite, government and private sector organizations are under attack from multiple threat actors.

  Vulnerability

• 

  Twitter, amid security and compliance officer exodus, could run afoul of FTC rules

  Regulatory attention is just the latest trouble for the embattled social media platform. Without chief security, privacy or compliance officers, following a consent decree becomes more difficult.

  Policy & Regulation

• 

  5 security musts for industrial control systems

  OT involves a collection of dedicated systems and physics, and that creates distinct security requirements, said Robert M. Lee, CEO and co-founder at Dragos.

  Strategy

More stories