Exclusive Interview: New HHS ONC Leader on Health Data Security

Marianne Kolbasuk McGee • May 7, 2021

As patients more commonly use smartphones and APIs to access their health information, critical security and privacy considerations need to be top of mind, says Micky Tripathi, the new national coordinator for health IT at HHS.

Critical Infrastructure Security

NSA Offers OT Security Guidance in Wake of SolarWinds Attack

Latest

Endpoint Security

How Patched Android Chip Flaw Could Have Enabled Spying

Prajeet Nair • May 7, 2021

A severe vulnerability in a system on certain Qualcomm chips, which has been patched, potentially could have enabled attackers to remotely control Android smartphones, access users' text messages and listen in on conversations, according to a new report from Check Point Software Technologies.

Fraud Management & Cybercrime

CISA Alert Describes FiveHands Ransomware Threat

Doug Olenick • May 7, 2021

The Cybersecurity and Infrastructure Security Agency has issued an alert providing more details on the threat posed by FiveHands ransomware attacks and offering risk mitigation tips.

Cryptocurrency Fraud

ISMG Editors Discuss Cryptocurrency Regulations and More

Anna Delaney • May 7, 2021

Four editors at Information Security Media Group discuss timely cybersecurity issues, including a call for cryptocurrency regulation and the impact of hospital ransomware attacks.

DDoS Protection

DNS Flaw Can Be Exploited for DDoS Attacks

Akshaya Asokan • May 7, 2021

Security researchers have uncovered a flaw dubbed TsuNAME in DNS resolver software that attackers could used to carry out distributed denial-of-service attacks against authoritative DNS servers. Google and Cisco have resolved the issue in their DNS servers.

Application Security

Can Evidence Collected by Cellebrite's Tools Be Trusted?

Anna Delaney • May 7, 2021

The latest edition of the ISMG Security Report features an analysis of whether courts can trust evidence collected by Cellebrite's mobile device forensic tools. Also featured: Report shows attackers' dwell times plummeting; a call for partnership with law enforcement.

Application Security

Newly Patched Peloton API Flaws Exposed Users' Private Data

Marianne Kolbasuk McGee • May 6, 2021

Security researchers say API flaws could have exposed the private data of millions of Peloton fitness equipment online service users for months before they were recently patched.

Endpoint Security

Intel, AMD Dispute Findings on Chip Vulnerabilities

Doug Olenick • May 6, 2021

Intel and AMD are disputing the findings of researchers from two universities who say they've discovered new attacks on Intel and AMD processors that can bypass most of the defenses put in place earlier for similar "Spectre" and "Meltdown" attacks.

Cloud Security

Mitigating the Risks of Malicious OAuth Apps

Prajeet Nair • May 6, 2021

Attackers are increasingly using malicious OAuth 2.0 applications to siphon data and access sensitive information from cloud platforms, and mitigating the risks is proving challenging, according to the security firm Proofpoint.

Business Continuity Management / Disaster Recovery

DHS Secretary: Small Businesses Hard-Hit by Ransomware

Doug Olenick • May 6, 2021

About 50% to 70% of all ransomware attacks in the U.S. are targeting small and medium-sized businesses, costing the victims an estimated total of $350 million in the last year, Secretary of Homeland Security Alejandro Mayorkas said Wednesday in a speech to the U.S. Chamber of Commerce.

Endpoint Security

Millions of Dell Devices Vulnerable to Update Driver Flaw

Jeremy Kirk • May 5, 2021

Dell has patched five issues in a firmware update driver that has shipped in millions of laptops, tablets and desktops since 2009. The vulnerabilities apparently have not been exploited in the wild and are not remotely exploitable.

DDoS Protection

DDoS Attack Knocks Belgian Websites Offline

Doug Olenick • May 5, 2021

The websites of about 200 public and private entities in Belgium were knocked fully or partially offline Tuesday by a distributed denial-of-service attack against the publicly funded internet service provider Belnet.

HIPAA/HITECH

NIST Seeks Input on HIPAA Security Rule Guidance Update

Marianne Kolbasuk McGee • May 4, 2021

The National Institute of Standards and Technology is seeking public comment as it plans to update its 2008 guidance for implementing the HIPAA Security Rule. But is it time to update the security rule itself?