In a study that looked at the password strength required to access website account for Wells Fargo, Capital One and 15 other banks, researchers found that 35 percent had significant weaknesses in their password policies, according to University of New Haven Cyber Forensic Research and Education Group. The crux of UNH’s finding center around the fact all the banks in question had website password policies that do not differentiate between upper and lower-case letters. That, according to the study, is the difference between a “strong” password and a less secure password. Tim Erlin, director of security and product management at…
ISBuzz Team
Monzy Merza, chief security evangelist and director of cyber research at Splunk on the Hack the Pentagon project, which invites experts to hack into Pentagon systems to test its security defenses. [su_note note_color=”#ffffcc” text_color=”#00000″]Monzy Merza, Chief security Evangelist and Director of CyberResearch at Splunk: “The DoD already has mature red teams and offensive cyber capabilities. Bug bounty programs are fairly common in the technology industry. This DoD program will strengthen DoD deployments, exercise blue team capabilities, and shine a light on those who build the DoD’s Internet presence. Bug bounty programs typically pay for performance, thus this is a good precedent…
Proofpoint discuss their recent discovery of a new Advanced Persistent Threat (APT) which is targeting Indian diplomatic and military resources. What initially appeared to be a relatively small email campaign sent to Indian embassies in Saudi Arabia and Kazakstan now appears connected to watering hole sites targeting Indian military personnel as well as other campaigns designed to drop a remote access Trojan (RAT), which Proofpoint has dubbed “MSIL/Crimson”. This RAT has a variety of data exfiltration functions, including screen capture and keylogging. [su_note note_color=”#ffffcc” text_color=”#00000″]Researchers at Proofpoint : Proofpoint has released a new paper around its discovery, which can be…
Tenth annual survey also explores evolution of internal auditing over the past decade According to Arriving at Internal Audit’s Tipping Point Amid Business Transformation, the 2016 Internal Audit Capabilities and Needs Survey report released by global consulting firm Protiviti, organisations are more likely than ever to evaluate cybersecurity risk as part of their annual audit plans. Nearly three out of four organisations (73 percent) now include cybersecurity risk in their internal audits, a 20 percent increase year-over-year. While there is a clear need among most internal audit groups to strengthen their ability to address cybersecurity risk, the survey found that…
Cybercriminals have been able to snatch thousands of pounds from Natwest bank accounts using stolen mobile phones. Natwest has admitted that a serious flaw in its online banking system has allowed criminals to raid accounts. Security experts from Tripwire, ESET and Proofpoint provide advice for users. [su_note note_color=”#ffffcc” text_color=”#00000″]Lamar Bailey, Sr. Director, Security R&D at Tripwire : “The popularity of mobile banking has made it easier for people to keep up with their finances and get alerts in almost real time when abnormalities occur but it has also had an adverse affect on security. Many mobile banking users have reduced…
Nokia has released a report which shows that smartphones now account for 60% of infections in the mobile network with iOS-based malware appearing on the top 20 list for first time with XcodeGhost and FlexiSpy. Android malware more than doubled in last six months of 2015. Craig Young, cybersecurity researcher for Tripwire have the following comments on it. [su_note note_color=”#ffffcc” text_color=”#00000″]Craig Young, Cybersecurity Researcher at Tripwire : “The consolidation of personal data on smartphones has made them a natural target for malware campaigns. While trusted app stores do a lot to reduce exposure to malware, examples of apps slipping past vendor…
The news that the Internal Revenue Service has issued its second major warning about tax scams in a little over a month (this one involving a phishing email scheme that look a like a message from company executive requesting personal information from employees), Jon French, security analyst at AppRiver have the following comments on it. [su_note note_color=”#ffffcc” text_color=”#00000″]Jon French, Security Analyst at AppRiver: Is the spate of IRS scams and data breaches at the moment indicative of major failings at the institution? This current W-2 phishing problem isn’t indicative of any problems with the IRS I’d say (this time). This…
It was way back in 2011 when I spoke of the key security challenges on the CISO’s radar in the basic forms of: Malware The Insider Threat’s Phishing & Spam Complimented of course by other generic security challenges which appear on a daily basis. Way back in 2011 I did acknowledge that whilst these were nevertheless important in the overall scheme of the Security Mission, wondered if they did consume far too much interactive intervention and security bandwidth with responding to the manifestation of active compromise and security breaches – with much focus on the reactive, rather than the proactive.…
There is no such thing as static security – all security products become vulnerable over time as the threat landscape evolves. Any ‘deploy once, update infrequently or never’ security solution is inherently flawed. Which is why every switched on organisation routinely updates its anti-virus and anti-malware solutions, hardens its infrastructure and updates its policies. So why is SIP security still based upon a one off implementation of a Session Border Controller (SBC)? From denial of service attacks to toll fraud, SIP trunking is inherently vulnerable. And in an era of near continuous security breaches, that vulnerability continues to change and…
Nearly one million new malware threats were released every day in 2014, with no signs of slowing down, according to Symantec’s Internet Security Threat Report. Malware, worms and other viruses can spread through a company’s network like wildfire. Getting your system and network back up and running only scratches the surface of expenses. Malware can cause data breaches and compromise customers’ security and hold you liable for damages. According to the 2015 Cost of Data Breach Study’s global analysis, the average total cost of a data breach for participating companies in the study increased 23 percent to $3.79 million. The…