Latest

Fraud Management & Cybercrime

Ransomware Attack Vectors: RDP and Phishing Still Dominate

Mathew J. Schwartz  •  May 19, 2022

Attackers who successfully infect targets with ransomware primarily first gain access by exploiting poorly secured remote desktop protocol or VPN connections or by using malware-laden phishing emails, reports security firm Group-IB, based on more than 700 attacks it investigated in 2021.

Critical Infrastructure Security

Ransomware Ecosystem: Big Changes Since Colonial Pipeline

Anna Delaney  •  May 19, 2022

The latest edition of the ISMG Security Report analyzes the changes in the ransomware landscape one year after the attack on Colonial Pipeline. It also revisits the Ryuk ransomware attack on a school district in Illinois and examines common culprits hindering effective Zero Trust adoption.

Business Continuity Management / Disaster Recovery

Closing the Gaps in Ransomware Prevention Strategies

CyberEdBoard  •  May 18, 2022

Alberto Hasson, the CISO at ICL Group, discusses how to avoid becoming the next victim of a ransomware or other malware attack. He outlines what defenders can do to close gaps in their defense strategies and how they can mitigate attackers' ever-evolving tactics.

►

Access Management

Proof of Concept: Apple/Microsoft/Google Back Passwordless

Anna Delaney  •  May 16, 2022

In the latest "Proof of Concept," Lisa Sotto, Jeremy Grant and ISMG editors discuss the significance of Apple, Google and Microsoft supporting the FIDO protocol's passwordless sign-in standard, progress made on Biden's cybersecurity executive order and updates on U.S. cybersecurity and privacy laws.

Next-Generation Technologies & Secure Development

Late-Stage Startups Feel the Squeeze on Funding, Valuations

Michael Novinson  •  May 13, 2022

Mature cybersecurity startups are beginning to slow hiring and prune operating expenses as macroeconomic storm clouds obscure future funding sources. Emerging vendors must grapple with an IPO market that has essentially dried up and investors unwilling to offer valuations anywhere near 2021 levels.

3rd Party Risk Management

A $150 Million Plan to Secure Open-Source Software

Brian Pereira  •  May 13, 2022

The Linux Foundation and the Open Source Security Foundation have put forth a nearly $150 million investment plan, spread across two years, to strengthen open-source security in the U.S. The plan was announced at the Open Source Software Security Summit II in Washington, D.C., on Thursday.

►

Blockchain & Cryptocurrency

ISMG Editors: What Have We Learned From the Conti Leaks?

Anna Delaney  •  May 13, 2022

In the latest update, four editors at Information Security Media Group discuss the intriguing insights exposed by the leak of ransomware gang Conti's internal communications, the U.S. Treasury's first-ever sanctions on a cryptocurrency mixer and the latest cyber activity in Russia's hybrid war.

3rd Party Risk Management

Tips to Improve Medical Device Vulnerability Communications

Marianne Kolbasuk McGee  •  May 13, 2022

New Health Sector Coordinating Council guidance aims to help medical device makers improve their communications regarding security vulnerabilities in their products, says Matt Russo, a security leader at Medtronic and a member of the task group that developed the document.

►

Healthcare

Profiles in Leadership: Dennis Leber

Tom Field  •  May 12, 2022

Dennis Leber, CISO and CTO at the University of Tennessee Health Science Center, says cybersecurity is not just a profession - it's a lifestyle. And as he leads this life, he finds one of today's biggest cybersecurity threats is not ransomware or IP theft - it's "the buzzword mentality."

►

Cryptocurrency Fraud

Proof of Concept: Crypto - A New National Security Threat

Anna Delaney  •  May 12, 2022

In the latest "Proof of Concept," Ari Redbord, head of legal and government affairs at TRM Labs, and former CISO David Pollino of PNC Bank join editors at ISMG to discuss the U.S Treasury's decision to sanction cryptocurrency mixer Blender.io. They also assess software supply chain security.

Access Management

Lessons for Cybersecurity Leaders From Russia-Ukraine War

Anna Delaney  •  May 12, 2022

The latest edition of the ISMG Security Report analyzes what lessons cybersecurity leaders can learn from the Russia-Ukraine war. It also examines the Okta data breach and Lapsus$ attack and describes how tech companies are supporting new developments in the FIDO protocol.

3rd Party Risk Management

The Troublemaker CISO: Supply Chains and Disclosure

CyberEdBoard  •  May 12, 2022

In the latest "Troublemaker CISO" post, security director Ian Keller discusses the issue of supply chain security and whether you should disclose information about your supply chain to companies as part of the effort to secure it. His conclusion: Build your defenses and trust no one.