US organizations hit by almost half of all ransomware since 2020

The Latest

• 

  Opinion

  6 things businesses need to know about the changing privacy landscape

  New bills are proposed every day, and while only a few will become official policy, there may be important trends that impact businesses.

  Policy & Regulation

• 

  Australia’s second-largest wireless carrier suffers major cyberattack

  Optus pinned the blame on a sophisticated threat actor and expressed concern about potential phishing attacks against its customers.

  Cyberattacks

• 

  Malicious OAuth applications used to control Exchange tenants in sweepstakes scam

  Microsoft researchers said a threat actor launched credential-stuffing attacks against high-risk accounts that failed to deploy multifactor authentication.

  Cyberattacks

• 

  How common telecom cyber risks snowball in cloud, open source

  Public cloud plays a central role in the modernization of wireless networks. But more open source software, vendors and vulnerabilities could spell trouble.

  Strategy

• 

  The tools and strategies schools need for ransomware defense

  CISOs empathize with the unenviable position schools are in as they confront ransomware. The right capabilities could make a big difference.

  Strategy

• 

  Organizations rapidly shift tactics to secure the software supply chain

  Synopsys’ 13th annual BSIMM study shows rapid increases in automation and use of SBOMs among software producers and other organizations.

  Strategy

• 

  ‘Shift-left’ software strategy challenged by security and compliance

  Developer burnout and supply chain concerns mount as companies push to begin software testing early in the development process.

  Strategy

• 

  Ransom demand escalates fallout from Los Angeles schools cyberattack

  The Los Angeles school district hasn’t responded to the demand, following the advice of federal authorities. The stakes are high as sensitive data may hang in the balance.

  Cyberattacks

• 

  Stolen single sign-on credentials for major firms available for sale on dark web

  Stolen SSO credentials are available for half of the top 20 public companies, and 25% of the entire S&P 500, BitSight found.

  Breaches

• 

  Morgan Stanley fined $35M by SEC over improper data disposal

  The bank hired a company with no data-destruction experience to decommission hard drives and servers, which were sold to a third party and auctioned with some unencrypted customer data intact, the regulator found.

  Breaches

• 

  Uber details how it got hacked, claims limited damage

  While there's no evidence the rideshare company's codebase was altered, the attacker did gain access to Slack, vulnerability reports and financial data.

  Cyberattacks

• 

  Capital One freed from consent order tied to 2019 breach

  The Office of the Comptroller of the Currency determined the bank had reached a level of “safety and soundness” no longer requiring extra oversight regarding a leak of 106 million customers’ data.

  Breaches

• 

  American Airlines targeted by threat actor in July data incident

  The airline has notified customers about the potential release of personal data, but said there is no evidence of the data being misused. 

  Breaches

• 

  White House guidance on third-party software seen as a major test of cyber risk strategy

  The U.S. hopes that by forcing software producers to meet a set of minimum security standards for federal use, a new baseline strategy will be adopted industrywide. 

  Vulnerability

• 

  US government rejects ransom payment ban to spur disclosure

  Federal authorities strongly discourage organizations from paying ransoms, but Anne Neuberger of the National Security Council explains why it decided against a ban.

  Strategy

• 

  LastPass says it contained August breach, leaving customer data and vaults secure

  After investigating alongside Mandiant, the widely used password manager has enhanced a number of security protocols in response to the four-day incident.  

  Breaches

• 

  Threat actor breaches many of Uber’s critical systems

  After duping an employee into providing their password, the attacker claims it gained access to Uber’s cloud infrastructure and sensitive data.

  Cyberattacks

• 

  Industrial control systems face more cyber risks than IT, expert testifies

  Most ICS technology was designed more than 20 years ago and built without cyber resilience, Idaho National Laboratory's Vergle Gipson said. 

  Strategy

• 

  Microsoft cloud security exec challenges organizations to ditch outdated practices

  Modern systems and modes of attack demand a dynamic and realistic security strategy, Shawn Bice said. The problem can be managed, not solved.

  Strategy

• 

  CISA can’t definitively say if ransomware is getting better or worse

  Organizations can be unwilling to notify government officials when ransomware intrusions occur, but that simple act might prevent the next attack.

  Policy & Regulation

• 

  State education leaders prioritize cybersecurity, but lack funding

  In a survey by the State Educational Technology Directors Association, 57% of respondents said their state provides a low amount of funding for cybersecurity.

  Strategy

• 

  White House sets minimum security standards for federal software use

  The Office of Management and Budget is requiring agencies to get a self-attestation from software producers showing compliance with NIST guidance.

  Policy & Regulation

• 

  Cloud security pros expect elevated risk for serious data breaches

  Just one out of five cybersecurity and engineering professionals escaped the previous year without incident.

  Breaches

• 

  Security vendor consolidation a priority for majority of organizations worldwide

  Gartner research shows a surge in organizations that want to reduce the complexity of their security stacks.

  Strategy

• 

  US is shoring up gaps in cyber policy, but critical goals remain unfulfilled

  Legislators say the Cyberspace Solarium Commission led to significant national security enhancements, but analysts are calling for urgent momentum on a federal law on data privacy and security.

  Strategy

More stories