Expert Comments

Experts On American Payroll Assn attack; Fed. Acquisition Supply Chain Security Act

Expert(s): Security Experts
Expert(s): Security Experts

The nonprofit American Payroll Association (APA) notified members and customers of a data breach resulting from a web skimmer on its website login and online store checkout pages. The Association and its 121 local chapters organize training seminars and events that are attended by more than 36,000 yearly.

Experts Comments

September 02, 2020
Saryu Nayyar
CEO
Gurucul
Government acquisition and supply contracts are a complex issue. Every organization needs to balance capability, cost, and security, when they're buying new hardware or software, but buyers in the Federal space have National Security concerns that civilian agencies don't have to consider. Hopefully, this new guidance from OMB (Office of Management and Budget) will provide a transparent and consistent way to assure resources acquired through the Federal supply chain remain secure.
September 02, 2020
Saryu Nayyar
CEO
Gurucul
The American Payroll Association breach shows a number of places where the industry as a whole still needs to do a better job. Attackers were apparently able to leverage a flaw in APA's content management system (CMS) or a compromised admin account to place their skimmer. If it was a CMS flaw, it shows that security holes aren't being patched in a timely fashion. Whether it was because the flaw was undetected, the patch hadn't been released, or an existing patch hadn't been applied, the.....Read More
The American Payroll Association breach shows a number of places where the industry as a whole still needs to do a better job. Attackers were apparently able to leverage a flaw in APA's content management system (CMS) or a compromised admin account to place their skimmer. If it was a CMS flaw, it shows that security holes aren't being patched in a timely fashion. Whether it was because the flaw was undetected, the patch hadn't been released, or an existing patch hadn't been applied, the result is the same. APA was able to identify this attack in under 90 days, which is an improvement over previous years in reducing attacker dwell time, but is still much too long. Better analytic tools could have mitigated the situation by recognizing the behaviors associated with an attack, both on the affected servers and in user activity with stolen credentials. Separately, the US Office of Management and Budget today issued the Federal Acquisition Supply Chain Security Act and a request for comments (open through Nov. 2, 2020) designed to control who supplies the US Federal government with technology and technology services. The Act is intended to help curtail procurements from vendors and organizations that may pose a threat to national security.  Read Less

Submit Your Expert Comments

What do you think of the topic? Do you agree with expert(s) or share your expert opinion below.
Be part of our growing Information Security Expert Community (1000+), please register here.

Write Your Expert Comments *
Your Registered Email *
Notification Email (If different from your registered email)
* By using this form you agree with the storage and handling of your data by this web site.
SUBMIT

You may also like

Booz Allen Report On CISOs And China Quantum Computing Risks,...

Experts Reactions On Sky Broadband Hack Warning

Ransomware Set To Break Records This Black Friday 2021

The Changing Face Of The COO Role

Security Expert On Apple Suing NSO Group

Meta Delays Plans To Rollout End-to-end Encryption

NCSC Issues Black Friday Warning To Tetailers

How The Zelle Fraud Scam Steals Your Bank Credentials

GoDaddy Data Breach Impacts Over A Million Users, Experts Reactions

Utah Imaging Data Breach – Expert Comments

Information Security Buzz (aka ISBuzz News) is an independent resource that provides the experts comments, analysis and opinion on the latest Information Security news and topics

Twitter Facebook-f Linkedin Youtube

Working With Us

The Pages

Our Contributing Experts