Oktacron - Cyber Security RSS Feeds History

Cybersecurity economics

kaspersky Sep 30, 2020 Business

This is hardly the first year full of cybersecurity impact and focus, but 2020 has been a big one. Companies have had to develop and implement new practices, new technologies, and new approaches — and fast. One focus of this year’s Kaspersky Global Corporate IT Security Risks Survey is how cybersecurity has show more ...

influenced budgets and risk assessments. For the survey, they interviewed 5,266 respondents across 31 countries about the state of IT security in their companies, the threats they face, and the post-attack costs they incurred. Regrettably, large enterprise-level companies had cut cybersecurity spending from an average of $18.9 million last year to $14 million in 2020. In the face of COVID-19-related costs and losses, which were largely unforeseen, such cuts are unsurprising, even though IT budget spending on security has grown proportionally. The SMB picture is different: Security budgets there increased slightly (from $267,000 in 2019 to $275,000 in 2020). All the same, 71% of companies plan to increase their investments in security over the next three years. What’s more, regardless of company size, respondents cited the increased complexity of IT infrastructure and the need to increase employee expertise as the main reasons for the increase. Some (17%) hope to keep cybersecurity outlays at the same level, and only the remaining 12% are considering further budget cuts as part of an overall optimization or in the belief that past investments have already helped solve the key issues. We plan to publish the research results as a series of reports. Part one, which contains some of the most interesting findings, is available on the website of our IT Security Calculator, a tool for working out an optimal cybersecurity budget based on a company’s size, region, and industry. Along with statistics and analytics, this section of the report contains tips from our experts, analysis of the most common cyberincidents, and estimations of the average cost of incidents involving corporate data loss for companies of different sizes.

Who’s Behind Monday’s 14-State 911 Outage?

krebsonsecurity Sep 30, 2020 A Little Sunshine

Emergency 911 systems were down for more than an hour on Monday in towns and cities across 14 U.S. states. The outages led many news outlets to speculate the problem was related to Microsoft‘s Azure web services platform, which also was struggling with a widespread outage at the time. However, multiple sources show more ...

tell KrebsOnSecurity the 911 issues stemmed from some kind of technical snafu involving Intrado and Lumen, two companies that together handle 911 calls for a broad swath of the United States. Image: West.com On the afternoon of Monday, Sept. 28, several states including Arizona, California, Colorado, Delaware, Florida, Illinois, Indiana, Minnesota, Nevada, North Carolina, North Dakota, Ohio, Pennsylvania and Washington reported 911 outages in various cities and localities. Multiple news reports suggested the outages might have been related to an ongoing service disruption at Microsoft. But a spokesperson for the software giant told KrebsOnSecurity, “we’ve seen no indication that the multi-state 911 outage was a result of yesterday’s Azure service disruption.” Inquiries made with emergency dispatch centers at several of the towns and cities hit by the 911 outage pointed to a different source: Omaha, Neb.-based Intrado — until last year known as West Safety Communications — a provider of 911 and emergency communications infrastructure, systems and services to telecommunications companies and public safety agencies throughout the country. Intrado did not respond to multiple requests for comment. But according to officials in Henderson County, NC, which experienced its own 911 failures yesterday, Intrado said the outage was the result of a problem with an unspecified service provider. “On September 28, 2020, at 4:30pm MT, our 911 Service Provider observed conditions internal to their network that resulted in impacts to 911 call delivery,” reads a statement Intrado provided to county officials. “The impact was mitigated, and service was restored and confirmed to be functional by 5:47PM MT. Our service provider is currently working to determine root cause.” The service provider referenced in Intrado’s statement appears to be Lumen, a communications firm and 911 provider that until very recently was known as CenturyLink Inc. A look at the company’s status page indicates multiple Lumen systems experienced total or partial service disruptions on Monday, including its private and internal cloud networks and its control systems network. Lumen’s status page indicates the company’s private and internal cloud and control system networks had outages or service disruptions on Monday. In a statement provided to KrebsOnSecurity, Lumen blamed the issue on Intrado. “At approximately 4:30 p.m. MT, some Lumen customers were affected by a vendor partner event that impacted 911 services in AZ, CO, NC, ND, MN, SD, and UT,” the statement reads. “Service was restored in less than an hour and all 911 traffic is routing properly at this time. The vendor partner is in the process of investigating the event.” It may be no accident that both of these companies are now operating under new names, as this would hardly be the first time a problem between the two of them has disrupted 911 access for a large number of Americans. In 2019, Intrado/West and CenturyLink agreed to pay $575,000 to settle an investigation by the Federal Communications Commission (FCC) into an Aug. 2018 outage that lasted 65 minutes. The FCC found that incident was the result of a West Safety technician bungling a configuration change to the company’s 911 routing network. On April 6, 2014, some 11 million people across the United States were disconnected from 911 services for eight hours thanks to an “entirely preventable” software error tied to Intrado’s systems. The incident affected 81 call dispatch centers, rendering emergency services inoperable in all of Washington and parts of North Carolina, South Carolina, Pennsylvania, California, Minnesota and Florida. According to a 2014 Washington Post story about a subsequent investigation and report released by the FCC, that issue involved a problem with the way Intrado’s automated system assigns a unique identifying code to each incoming call before passing it on to the appropriate “public safety answering point,” or PSAP. “On April 9, the software responsible for assigning the codes maxed out at a pre-set limit,” The Post explained. “The counter literally stopped counting at 40 million calls. As a result, the routing system stopped accepting new calls, leading to a bottleneck and a series of cascading failures elsewhere in the 911 infrastructure.” Compounding the length of the 2014 outage, the FCC found, was that the Intrado server responsible for categorizing and keeping track of service interruptions classified them as “low level” incidents that were never flagged for manual review by human beings. The FCC ultimately fined Intrado and CenturyLink $17.4 million for the multi-state 2014 outage. An FCC spokesperson declined to comment on Monday’s outage, but said the agency was investigating the incident.

Podcast Episode 189: AppSec for Pandemic Times, A Conversation with GitLab Security VP Jonathan Hunt

securityledger Sep 30, 2020 application development

The pandemic isn't the only thing shaking up development organizations. Application security is a top concern and security work is "shifting left" and becoming more intertwined with development. In this podcast, Security Ledger Editor in Chief Paul Roberts talks about it with Jonathan Hunt, Vice President show more ...

of Security at the firm GitLab. The post ...Read the whole entry... » Related StoriesSpotlight Podcast: Taking a Risk-Based Approach to Election SecuritySpotlight Podcast: QOMPLX CISO Andy Jaquith on COVID, Ransomware and ResilienceSpotlight Podcast: How Machine Learning is redefining Application Fuzzing

Airports, ATMs, hospitals: Microsoft Windows XP leak would be less of an issue, if so many didn’t use it

cyware Sep 30, 2020 Trends, Reports, Analysis

The source code of the Windows XP operating system is now circulating online as a huge 43GB mega-dump. Although it is nearly two decades old, it’s still used by many organizations around the world.

Fresh Joker Malware Variant Targeting Android Users

cyware Sep 30, 2020 Malware and Vulnerabilities

A fresh round of Joker malware that targets Android users has been found in Google Play as well as third-party app stores, according to research reports from Zscaler and Zimperium.

Microsoft: Some ransomware attacks take less than 45 minutes

cyware Sep 30, 2020 Trends, Reports, Analysis

In its new Microsoft Digital Defense Report, the technology giant has summarized the biggest threats companies deal with today in the face of cybercrime and nation-state attackers.

As tech reaches end of life, hackers are watching

cyware Sep 30, 2020 Trends, Reports, Analysis

A recent rash of cyberattacks against Magento 1 stores underscores the criticality of having a strategy in place for securing technology that has reached end-of-life (EOL).

American Insurance Giant Arthur J. Gallagher Suffers Ransomware Attack

cyware Sep 30, 2020 Breaches and Incidents

The company did not provide technical details about the attack, it is not clear how the ransomware operators breached the company and which is the family of malware that infected its systems.

Industry Groups Ask Lawmakers to Remove Core Cybersecurity Provisions from NDAA

cyware Sep 30, 2020 Laws, Policy, Regulations

The sections of the House- and Senate-passed versions of the NDAA identified by the Acquisition Reform Working Group are based on recommendations from the Cyberspace Solarium Commission.

House passes bills to secure energy sector against cyberattacks

cyware Sep 30, 2020 Laws, Policy, Regulations

All four of the bipartisan bills were approved by voice vote, and supported by the leaders of the House Energy and Commerce and House Science, Space, and Technology panels.

4.83 million DDoS attacks took place in the first half of 2020, a 15% increase

cyware Sep 30, 2020 Trends, Reports, Analysis

Attackers focused on critical sectors such as healthcare, e-commerce, and educational services with complex, high-throughput attacks designed to overwhelm and quickly take them down, Netscout reveals.

Update: Shipping firm CMA CGM says no communications breach in cyber attack

cyware Sep 30, 2020 Breaches and Incidents

It was continuing to offer alternative access for customers after making its e-business website unavailable on Monday in order to prevent the spread of malware, the group said.

LodaRAT Update: Alive and Well

cyware Sep 30, 2020 Malware and Vulnerabilities

Talos recently identified new versions of LodaRAT, a remote access trojan written in AutoIt, that were found containing several rewritten functions and newly added functionality.

DeepSurface Security raises $1M to help cybersecurity teams automate analyzing and prioritizing risk

cyware Sep 30, 2020 Companies to Watch

Led by Cascade Seed Fund and joined by SeaChange Fund and Voyager Capital, the company will use the funds to publicly release their product in Q4 and to expand their team in the Portland area.

Vulnerability in Wireless Router Chipsets Prompts Advisory

cyware Sep 30, 2020 Malware and Vulnerabilities

Synopsys has issued an advisory warning of authentication bypass vulnerabilities in multiple wireless router chipsets built into devices manufactured by Qualcomm, MediaTek, and Realtek.

Global Scam Campaign Steals $15 Million From Over 150 Organizations

cyware Sep 30, 2020 Identity Theft, Fraud, Scams

On Wednesday, cybersecurity researchers from Mitiga said the campaign, which is ongoing, uses social engineering techniques to impersonate senior executives using Microsoft Office 365 email services.

Hidden Backdoor Account Discovered in HP Device Manager

cyware Sep 30, 2020 Malware and Vulnerabilities

HP Device Manager, which allows IT administrators to manage HP Thin Client devices, comes with a backdoor database user account that undermines network security, a UK-based consultant has warned.

This worm phishing campaign is a game-changer in password theft, account takeovers

cyware Sep 30, 2020 Threat Actors

Once one email account was compromised, the credentials for the account were sent to a remote bot. The bot would then sign into the account and analyze emails sent within the past several days.

Update: Major hospital system struggling to recover computer network operations after cyberattack

cyware Sep 30, 2020 Breaches and Incidents

Universal Health Services, a hospital system with over 400 locations across the U.S., was still working Tuesday to get its network and operations back online after a cyberattack early Sunday morning.

Cisco fixes actively exploited issues in IOS XR Network OS

cyware Sep 30, 2020 Malware and Vulnerabilities

Cisco addressed two high severity memory exhaustion denial-of-service (DoS) vulnerabilities that reside in the IOS XR Network OS that runs on multiple carrier-grade routers.

Cleveland Healthcare Provider Suffers Week-long Outage Due to Cyberattack

cyware Sep 30, 2020 Breaches and Incidents

The Ashtabula County Medical Center, a Cleveland-area hospital has spent more than a week offline after being hit by an apparent cyberattack, forcing it to postpone all elective procedures.

Axis Security raises $32 million in private funding round

cyware Sep 30, 2020 Companies to Watch

Axis Security, a U.S.-Israeli startup that helps companies enable employees to safely connect to private applications, said on Tuesday it raised $32 million in a funding round led by Canaan Partners.

Fake software crack sites used to push Exorcist 2.0 Ransomware

cyware Sep 30, 2020 Malware and Vulnerabilities

The threat actors behind the Exorcist 2.0 ransomware are using malicious advertising on legitimate sites to redirect victims to fake software crack sites that distribute their malware.

Danish scale-up LogPoint raises $30 million to help companies automate their 'digital transformation'

cyware Sep 30, 2020 Companies to Watch

The Series B financing round was led by Germany-based growth equity investor Digital+ Partners with participation from existing investors, including Evolution Equity Partners.

FireEye Proposes Converged Enterprise and ICS ATT&CK Matrix

cyware Sep 30, 2020 Security Products & Services

FireEye's Mandiant Threat Intelligence and MITRE have collaborated on developing a combined visualization from Enterprise ATT&CK and ICS ATT&CK to cover both IT and OT attack behaviors.

Malicious Pop-up Redirects Baidu Traffic

cyware Sep 30, 2020 Malware and Vulnerabilities

During a recent investigation, Sucuri researchers came across an obfuscated pop-up script leveraging baidu[.]com search results to redirect users to the attacker’s own domain.

China-based APT Group BlackTech Found Targeting Media, Finance, and Electronics Firms

cyware Sep 30, 2020 Threat Actors

Among multiple victims infected by Palmerworm, the media, electronics, and finance firms were based in Taiwan, while an engineering firm in Japan and a construction firm in China were also targeted.

MITRE Shield shows why deception is security’s next big thing

cyware Sep 30, 2020 Trends, Reports, Analysis

The key to deception technology is that it goes beyond simple detection to identify and prevent lateral movement, notoriously one of the most difficult aspects of network defense.

Sensitive Data of Azeri Navy Personnel Leaked on Russian Forums

cyware Sep 30, 2020 Breaches and Incidents

On Tuesday, a file package called Azerbaijan Navy 2020 started circulating on Russian forums. It contains 18,872 entries, and there are almost 10,000 unique citizens in the database.

Kensington Mouse Config Tool Affected by Remote Code Execution Bug

cyware Sep 30, 2020 Malware and Vulnerabilities

Earlier this year, peripheral maker Kensington patched its desktop software to close a vulnerability that could have been exploited by malicious websites to quietly hijack victims' computers.

REvil Actor Dangles a Million to Attract Potential Affiliates

cyware Sep 30, 2020 Threat Actors

The REvil ransomware gang has deposited $1 million in bitcoin in a Russian-speaking hacking forum to prove to potential partners that the business is very profitable and they should consider joining it.

Senator Asks DHS If Foreign-Controlled Browser Extensions Threaten The US

packetstormsecurity Sep 30, 2020 headline,government,usa,google,mozilla,a

$15 Million Business Email Scam In The US Exposed

packetstormsecurity Sep 30, 2020 headline,email,bank,usa,cybercrime,fraud

Anthem To Pay Nearly $40 Million To Settle Data Breach Probe

packetstormsecurity Sep 30, 2020 headline,hacker,privacy,usa,data loss