Latest

Application Security

Twitter Reportedly Fires Head of Security, CISO to Leave

Prajeet Nair  •  January 22, 2022

Twitter has said it is firing Peiter Zatko, the network security expert that it hired on November 2020 as head of security. The changes in the security team followed “an assessment of how the organization was being led,” according to a company memo shared with The New York Times.

Application Security

Federal Authorities, Patient Safety Experts Warn of Risks

Marianne Kolbasuk McGee  •  January 21, 2022

Cyberattacks remain a critical security concern - and a top patient safety hazard - for the healthcare and public health sector in 2022, federal authorities and other experts warned this week. Will recent takedowns of ransomware criminal gang members by law enforcement agencies help?

Cybercrime

EU Plans to Build Its Own DNS Infrastructure

Mihir Bagwe  •  January 21, 2022

The European Union has initiated plans to build its own high-performance and secure DNS resolution infrastructure to reduce reliance on a few public DNS resolvers operated by non-EU entities. The service, named DNS4EU, is to be made available to all EU citizens and organizations.

►

Application Security

ISMG Editors: Will Ransomware Kill Cyber Insurance?

Anna Delaney  •  January 21, 2022

In the latest weekly update, four ISMG editors discuss the state of cyber insurance today and why its future is uncertain; applying a security-by-design reliability model to analyze vulnerabilities; and how Russia takes down members of the REvil ransomware group as cyber aggressions in Ukraine rise.

►

3rd Party Risk Management

From the Trenches: Remediating Widespread Apache Log4j Flaw

Mathew J. Schwartz  •  January 21, 2022

Although flaws in Apache Log4j software that need remediating remain widespread in organizations, "some of them are aware of the issue, some of them aren't aware of the issue, and likely this issue is going to be persisting with us for many, many years," says Jeff Macko, an offensive security expert at Kroll.

Application Security

Ukraine Cyber Attacks: A Case of Hacktivism?

Anna Delaney  •  January 21, 2022

The latest edition of the ISMG Security Report features an analysis of whether the cyberattacks that hit Ukraine's government agencies last week are attributable to any group or nation-state along with updates to the cybersecurity executive order and illicit cryptocurrency trends.

Business Continuity Management / Disaster Recovery

Teardown: Fake Ransomware Targeting Ukrainian Government

Mathew J. Schwartz  •  January 20, 2022

More information continues to emerge about the destructive malware attack that targeted Ukrainian government systems last week. As a probe continues, numerous questions about the incident remain unanswered. But the three-stage wiper attack, disguised as ransomware, apparently hit few systems.

3rd Party Risk Management

Update: 'This Was a Targeted Attack,' Says Red Cross

Mihir Bagwe  •  January 20, 2022

Data on more than 515,000 "highly vulnerable people" has been compromised as the result of a supply chain cyberattack, the International Committee of the Red Cross has disclosed. The organization's humanitarian activities are already being impacted.

3rd Party Risk Management

HHS HC3: Healthcare Sector Remains at Risk for Log4j Attacks

Marianne Kolbasuk McGee  •  January 20, 2022

Although there have been no major compromises in the healthcare and public health sector to date involving Apache Log4j flaws, the sector remains highly vulnerable, federal regulators warn.

3rd Party Risk Management

How Medical Device 'Ingredient Labels' Could Bolster Security

Marianne Kolbasuk McGee  •  January 20, 2022

Among the simplest things that vendors can do to help improve the cybersecurity of their products is providing better transparency, especially regarding the third-party components contained in their technology, says Rob Suárez, CISO of medical device maker Becton Dickinson.

Application Security

Log4Shell Update: VMware Horizon Targeted

Prajeet Nair  •  January 19, 2022

Attackers have been actively targeting Log4j vulnerabilities, or Log4Shell, vulnerabilities in the servers of virtualization solution VMware Horizon to establish persistent access via web shells, according to an alert by the U.K. National Health Service.

3rd Party Risk Management

Why SBOMs in the Healthcare IT Supply Chain Are Critical

Marianne Kolbasuk McGee  •  January 19, 2022

Because healthcare IT environments are so complicated, it will become essential for all suppliers to provide and maintain a software bill of materials for their products to remain relevant, says Curt Miller of the Healthcare Supply Chain Association.