Oktacron logo
Cyber security aggregate rss news

Cyber security aggregator - feeds history
image for Zimbabwe Government ...

 Cybersecurity News

Zimbabwe's government has taken a significant step to prioritize the growth of national cybersecurity capabilities by conducting a program where public officials are trained in several key aspects of cybersecurity and security governance. The effort aims to bolster the Information and Communication Technology   show more ...  

(ICT) capability within the country and improve related public services. Zimbabwe's Government Security Commitment The Zimbabwean government's commitment to cybersecurity was on full display during a recent graduation ceremony in Harare where over 100 government officials were said to have successfully completed a comprehensive cybersecurity training program, with the aim of equipping these individuals with the necessary tools and expertise to safeguard the country's digital landscape. The training program included the following topics:  global cybersecurity trends, international security standards, enterprise private protection governance, and enterprise data security governance practice. These efforts were prompted by pressing concern after several recent high-profile hacking incidents within Zimbabwe, such as the targeting of social media accounts and a major bank's systems. Dr. Tatenda Maveteras, the Minister of Information Communication Technology, Postal and Courier Services, stated: “Zimbabwe is not immune to cyber threats, as evidenced by recent incidents where social media accounts of prominent individuals and entities were hacked. We also received reports that a leading Zimbabwean bank had its systems compromised, with hackers demanding ransom in exchange for not leaking sensitive operational and customer information.” Forging Partnerships in Zimbabwe The government's efforts have earned praise from its partners, including Huawei Zimbabwe, which has been working with the government for over 25 years. Managing Director Yang Shengwan commended Zimbabwe's commitment to strengthening its digital defenses and expressed Huawei's continued support through cutting-edge technologies, expert training, and collaboration to build a secure digital ecosystem. “We have witnessed Zimbabwe’s remarkable digital transformation and are proud to have contributed to this journey. Our partnership has only grown stronger as we tackle the pressing cybersecurity challenges of today,” Shengwan remarked. Earlier, before the commencement of the four-day training session, Shengwan stated, "Huawei takes cybersecurity seriously, and we have made it a top priority in all of our operations and product development. Huawei invests heavily in research and development to ensure our technologies are secure and resilient against evolving cyber threats." The Deputy Director General of POTRAZ (Postal & Telecommunications Regulatory Authority of Zimbabwe), Alfred Marisa, focused on the critical importance of cybersecurity in today's data-driven world, where data consumption has doubled in recent years, making cybersecurity a vital aspect of digital lives. As data becomes increasingly valuable, partnerships are essential to protect our digital infrastructure. The global landscape has changed drastically, with data consumption in 2023 doubling from previous years. This new reality makes cybersecurity a vital aspect of our digital lives," Marisa said. By equipping its public workforce with cybersecurity skills and fostering strategic partnerships with the private sector, the government's efforts may position Zimbabwe as a regional leader in the fight against cyber threats.

image for Researchers Discover ...

 Cybersecurity News

Researchers have recently uncovered vulnerabilities in the popular Shimano Di2 electronic gear-shifting system, raising concerns about the security of these high-end bicycles. While cybersecurity experts have long been warning about the potential risks of interconnected devices, from baby monitors to automobiles, this   show more ...  

latest frontier of bicycle hacking may still come as a surprise. Ins and Outs of Electronic Gear-Shifting Shimano, the world's largest manufacturer of bicycle components, has been experimenting with electronic gear-shifting systems since 2001. Unlike traditional mechanical systems, which rely on cables to connect the gear-derailleurs to the gear-shifters, electronic systems use wireless or wired connections to transmit commands. [caption id="attachment_87982" align="aligncenter" width="470"] Source: https://si.shimano.com/en/pdfs/dm/RAGN010/DM-RAGN010-03-ENG.pdf[/caption] The Shimano Di2 system, which dominates the high-end market, uses a combination of Bluetooth Low Energy and ANT+ protocols to communicate with the bike's computers and the Shimano smartphone app. The system's communication is surprisingly simple, with the shifter sending a command to the derailleur, which confirms receipt of the command. [caption id="attachment_87981" align="alignnone" width="1970"] Source: https://www.usenix.org/[/caption] However, researchers from Northeastern University and the University of California San Diego discovered a critical vulnerability in the system's proprietary protocol, which uses a fixed frequency of 2.478 GHz. While the commands are encrypted, the researchers found that the transmitted packets lack a timestamp or one-time code, making the system vulnerable to a replay attack. This means that an attacker can intercept the encrypted commands and use them to shift gears on a victim's bike without decrypting them. Risks and Implications for Shimano Di2 Bicycles The researchers successfully demonstrated that they could intercept and replay commands using an off-the-shelf software-defined radio, with an effective attack range of 10 meters. This raises significant concerns for professional cyclists, who could use this vulnerability to gain an unfair advantage in competitions. Malicious commands could be sent remotely by a support team, affecting an opponent's performance or even causing damage to the bike. The researchers also explored the possibility of 'targeted jamming,' where continuous repeat commands are sent to the victim's bike, causing the gear-shifting system to malfunction. These attacks, which effectively work as a denial-of-service (DoS) attack, could leave the cyclist stranded or injured while continuous repeat commands could potentially render the bicycle unusable. Shimano's Response to Vulnerability Shimano has been made aware of the security vulnerabilities in the Shimano Di2 system and has developed an update to address the issue. However, as of now, the update has only been made available to professional cycling teams. While Shimano has promised to make the update available to the general public through the E-TUBE PROJECT Cyclist app, the general public could remain vulnerable until a wider release is made, although the risk of exploitation is assumed to be low for non-professional cyclists.

image for U.S. Department of J ...

 Cybersecurity News

The U.S. Department of Justice has filed a lawsuit against the Georgia Institute of Technology - better known as Georgia Tech - and its research corporation, Georgia Tech Research Corp, alleging that the institute failed to meet essential cybersecurity requirements in contracts with the Department of Defense. The   show more ...  

complaint, which was filed in conjunction with a whistleblower suit, accuses the defendants of compromising the confidentiality of sensitive government information. Lapses at Georgia Tech Believed To Put National Security at Risk According to the lawsuit, the Astrolavos Lab at Georgia Tech failed to develop and implement a system security plan, which is a requirement under Department of Defense (DoD) regulations, and didn't develop a suitable plan until at least February 2020. Even after implementing the plan, the lab allegedly did not properly scope it to include all necessary equipment, including laptops, desktops, and servers. Furthermore, the lab failed to install and update anti-virus and anti-malware tools on its devices, despite being required to do so by both federal law and Georgia Tech's own policies. The lab had been allowed to bypass the installation of antivirus software at the request of the lab's head, a professor. Deficiencies in cybersecurity controls pose a significant threat not only to our national security, but also to the safety of the men and women of our armed services who risk their lives daily," said Special Agent in Charge Darrin K. Jones of the DoD's Office of Inspector General, Defense Criminal Investigative Service. False Cybersecurity Reporting The lawsuit also alleges that in December 2020, Georgia Tech and its research corporation submitted a false cybersecurity assessment score to the DoD for the entire Georgia Tech campus. DoD requires contractors to report summary-level scores reflecting their compliance with applicable cybersecurity requirements on systems used to store or access covered defense information. However, the lawsuit claims the score of 98 that was reported was inaccurate, as Georgia Tech did not have a campus-wide IT system, and the score was for a 'fictitious' or 'virtual' environment not representative of any actual covered contracting system. "Government contractors that fail to fully implement required cybersecurity controls jeopardize the confidentiality of sensitive government information," said Principal Deputy Assistant Attorney General Brian M. Boynton of the Justice Department's Civil Division. "The department's Civil Cyber-Fraud Initiative was designed to identify such contractors and to hold them accountable," he added. Georgia Tech Accountability and Consequences The whistleblower lawsuit was filed by two former members of Georgia Tech's cybersecurity compliance team under the False Claims Act, which allows private parties to sue on behalf of the government for false claims and receive a share of any recovery. If found liable, Georgia Tech and its research corporation could face penalties of up to three times the government's losses, plus applicable fines. The case is being handled by the Justice Department's Civil Division and the U.S. Attorney's Office for the Northern District of Georgia. "Cybersecurity is not an optional add-on for government contractors - it is a fundamental requirement to protect sensitive information and systems," said U.S. Attorney Ryan K. Buchanan for the Northern District of Georgia. We will hold accountable those who ignore these critical security measures," he added.

 Malware and Vulnerabilities

Slack fixed a vulnerability in its AI feature that could allow attackers to steal data from private channels. The flaw involved a prompt injection flaw in an AI feature, which allowed attackers to manipulate the system to perform malicious actions.

 Identity Theft, Fraud, Scams

Liverpool fans have suffered the most in Premier League ticket scams for the 2023/24 season, losing over £17,000 (~$22,460) to criminals, as revealed by a report from NatWest Bank. Arsenal supporters were also hit hard, losing £12,000 (~$15,855).

 Feed

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has placed a security flaw impacting Versa Director to its Known Exploited Vulnerabilities (KEV) catalog based on evidence of active exploitation. The medium-severity vulnerability, tracked as CVE-2024-39717 (CVSS score: 6.6), is case of file upload bug impacting the "Change Favicon" feature that could allow a threat actor to

 Feed

Meta Platforms on Friday became the latest company after Microsoft, Google, and OpenAI to expose the activities of an Iranian state-sponsored threat actor, who it said used a set of WhatsApp accounts that attempted to target individuals in Israel, Palestine, Iran, the U.K., and the U.S. The activity cluster, which originated from Iran, "appeared to have focused on political and diplomatic

 Cyber Security News

Source: www.databreachtoday.com – Author: 1 Artificial Intelligence & Machine Learning , Next-Generation Technologies & Secure Development Hackers Could Exploit Bug to Manipulate Slack AI’s LLM to Steal Data Rashmi Ramesh (rashmiramesh_) • August 23, 2024     Image: Shutterstock Chat app   show more ...  

Slack patched a vulnerability in its artificial intelligence tool set that hackers could have […] La entrada Slack Patches Prompt Injection Flaw in AI Tool Set – Source: www.databreachtoday.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.databreachtoday.com – Author: 1 Healthcare , HIPAA/HITECH , Industry Specific Cyberattacks Soar, But Guarding PHI From Break-Ins, Natural Disasters Is Critical Marianne Kolbasuk McGee (HealthInfoSec) • August 23, 2024     Image: Getty Images Despite a seemingly endless barrage of cyberattacks   show more ...  

hitting the healthcare sector, physical threats against patient data still remains a danger, […] La entrada Feds to Health Sector: Don’t Skimp on Physical Security – Source: www.databreachtoday.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Banking

Source: www.databreachtoday.com – Author: 1 Finance & Banking , Industry Specific , Standards, Regulations & Compliance Banking and Housing Policy Groups Call New Cyber Reporting Measures ‘Impractical’ Chris Riotta (@chrisriotta) • August 23, 2024     Bank lobbying groups don’t   show more ...  

like a cybersecurity incident reporting requirement for custodians of mortgage-backed securities. (Image: Shutterstock) A coalition […] La entrada Banking Lobby Asks Ginnie Mae to Modify Cyber Reporting Rule – Source: www.databreachtoday.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.databreachtoday.com – Author: 1 Fraud Management & Cybercrime , Geo Focus: Australia , Geo-Specific Australian Insurer Expects Years of Litigation Related to 2022 Hack Jayant Chakravarti (@JayJay_Tech) • August 23, 2024     Australia’s largest private medical insurer, Medibank, is   show more ...  

still feeling the effects of its October 2022 hack. (Image: Shutterstock) Australia’s largest provider […] La entrada Medibank to Spend AU$126M on Post-Breach Security Upgrade – Source: www.databreachtoday.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.databreachtoday.com – Author: 1 George Freeman Sr. Solutions Consultant, Fraud & Identity for Government, Healthcare, Insurance, LexisNexis Risk Solutions With well over two decades experience in cybersecurity consulting, George is a subject matter expert for LNRS customers in government,   show more ...  

insurance & healthcare. George provides illustrated use cases and workflow designs to mitigate online identity […] La entrada High Profile AI Fraud: DeepFake, Identity Imitation – Source: www.databreachtoday.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.databreachtoday.com – Author: 1 Governance & Risk Management Why Acquisition Reports Emerge in the Media, and What It Means for Those Mentioned Michael Novinson (MichaelNovinson) • August 23, 2024     Image: Shutterstock Companies historically responded to M&A reports with milquetoast   show more ...  

statements about “not commenting on rumors or speculation,” but recently, aggressive clapbacks have […] La entrada A Tangled Web We Weave: When Reported M&A Never Materializes – Source: www.databreachtoday.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Banking

Source: www.databreachtoday.com – Author: 1 Artificial Intelligence & Machine Learning , Fraud Management & Cybercrime , Next-Generation Technologies & Secure Development As Banks Combat Fraud, Customers Feel the Strain of Overly Cautious Measures Suparna Goswami (gsuparna) • August 23, 2024     show more ...  

  Image: Shutterstock In today’s AI-driven world, banks are becoming increasingly vigilant, freezing accounts […] La entrada Is AI Making Banking Safer or Just More Complicated? – Source: www.databreachtoday.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 0 - CT - SOC - CSIRT Operations - Threat

The content you are trying to access is private only to member users of the site. You must have a free membership at CISO2CISO.COM to access this content. You can register for free.       Thank you. The CISO2CISO Advisors Team. Username or E-mail Password Remember Me     Forgot Password La   show more ...  

entrada A Guide to User and Entity Behavior Analytics (UEBA) se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 0 - CT - SOC - CSIRT Operations - Red -

The document titled “A Guide to Penetration Testing” is a comprehensive guide published by CREST in December 2022. It provides in-depth advice on establishing and managing a penetration testing program, aiming to help organizations conduct effective penetration testing as part of their technical security   show more ...  

assurance frameworks. Summary: Purpose and Scope: The guide is designed to […] La entrada A Guide to Penetration Testing se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 0 - CT - Cybersecurity Architecture - De

The content you are trying to access is private only to member users of the site. You must have a free membership at CISO2CISO.COM to access this content. You can register for free.       Thank you. The CISO2CISO Advisors Team. La entrada 100 Offensive Linux Security Tools se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 0 - CT - CISO Strategics - CISO Strategi

The document emphasizes the critical importance of cybersecurity for small businesses, highlighting that protecting data and systems is essential for business continuity. It outlines a comprehensive approach to cybersecurity, starting with a thorough risk assessment to identify potential vulnerabilities and threats   show more ...  

that could impact the organization. The checklist includes the establishment of clear security policies […] La entrada 100-Question Cybersecurity checklist for small businesses se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

2024-08
Aggregator history
Saturday, August 24
THU
FRI
SAT
SUN
MON
TUE
WED
AugustSeptemberOctober