Scan4You Operator Gets 14-Year Prison Sentence

Mathew J. Schwartz • September 25, 2018

Scan4You, a notorious cornerstone of the cybercrime-as-a-service economy that allowed malware developers to more easily create code to bypass anti-virus defenses, has been dismantled, and its Latvian technical administrator has been slammed with a 14-year U.S. prison sentence.

Authentication

Yahoo's Mega-Breaches: Altaba Moves to Settle Lawsuits

Latest

Breach Preparedness

Health Data Breach Tally Shows Mistakes That Lead to Trouble

Marianne Kolbasuk McGee • September 25, 2018

Recent additions to the federal health data breach tally shine a light on the mistakes that contribute to breaches - and in some cases, make situations far worse.

Breach Response

Massachusetts HIPAA Case Outlines Series of Missteps

Marianne Kolbasuk McGee • September 24, 2018

A HIPAA-related enforcement case in Massachusetts involving two insider breaches alleges a trail of missteps, including failure to take prompt action after receiving tips about potential misuse of patient information. What can other entities learn from the mistakes?

Data Loss

Twitter Bug Sent Direct Messages to External Developers

Jeremy Kirk • September 24, 2018

Twitter has fixed a bug that sometimes sent a user's direct messages not only to the specified recipient, but also to unrelated external developers. The social networking service is notifying more than 3 million affected users and has requested that unintended recipients delete the messages.

Anti-Phishing, DMARC

How to Spot and Stop Newer Email Threats

Tom Field • September 24, 2018

Email fraud threats have evolved from attackers targeting networks to them focusing on specific individuals within an organization. What can enterprises do to halt these attacks before they reach the inbox? Denis Ryan of Proofpoint shares defensive tactics.

Breach Preparedness

Breach Investigations: The Detective's View

Tom Field • September 24, 2018

Kenrick Bagnall, a former IT executive who is now a detective constable with the Toronto Police, offers unique insights on public/private partnerships and how enterprises can work better with investigators in the event of a breach.

Fraud

Winning the Battle Against New Account Fraud

Nick Holland • September 24, 2018

With the abundance of PII available on the dark web, there has been an explosion of synthetic identity fraud. Michael Lynch of InAuth discusses how device and user data can be leveraged to combat the fraudulent opening of new accounts.

Endpoint Security

Future-Proofing for IoT Risks

Tom Field • September 24, 2018

The internet of things promises to change how enterprises operate - as well as the cybersecurity risks they will face. Robert Falzon of Check Point Software Technologies outlines IoT risks and how to prepare to mitigate them.

Network Firewalls, Network Access Control

The Link Between Volatility and Risk

Tom Field • September 24, 2018

Financial service organizations have networks that are larger and more dynamic than ever - and so are their network security risks. Matt Kraning of Qadium shares the results of a new review and how organizations can respond to it.

Cybercrime

Cybercrime Markets Sell Access to Hacked Sites, Databases

Mathew J. Schwartz • September 21, 2018

One mystery with the recently discovered payment card sniffing attacks against such organizations as British Airways and Newegg has been how attackers might have first gained access to the victims' networks. But a number of cybercrime markets sell such access, in some cases for as little as 50 cents.

Business Continuity Management / Disaster Recovery

Scotland's Arran Brewery Slammed by Dharma Bip Ransomware

Mathew J. Schwartz • September 21, 2018

Scotland's Arran Brewery fell victim to a Dharma Bip ransomware attack that infected its Windows domain controller and crypto-locked files and local backups, leading to the loss of three months' worth of sales data. The brewery refused to pay the attackers' two bitcoin ransom demand.

Business Email Compromise (BEC)

Business Email Compromises Fuel Procurement Fraud

Nick Holland • September 21, 2018

Business email compromises have been at the center of a number of procurement fraud scams, says Allan Stojanovic, a security architect and analyst at the University of Toronto, who describes the fraud and why it's so difficult to thwart.

Cybersecurity

Defending Against Next-Generation DDoS Attacks

Nick Holland • September 21, 2018

DDoS attacks have increased significantly in scale via IoT botnet attacks. Gary Sockrider of Netscout Arbor discusses best practices for dealing with this significant threat.