Social engineering attack: Screenshot shows recent tech-support scam page targeting U.S. users. (Source: Malware-Traffic-Analysis.net)

Threats: Social Engineering and Malicious Spam Dominate

Mathew J. Schwartz • June 22, 2017

Good news: Exploits kits are in decline, thanks to concerted efforts to disrupt their efficacy. Unfortunately, criminals are diversifying their attacks, focusing more on social engineering - including tech-support scams - and malicious spam campaigns.

Encryption

Euro Cops Cuff Suspected Payment Card Fraudsters

Latest

Awareness & Training

CISO Thom Langford on Risk and Awareness

Tom Field • June 23, 2017

Publicis Groupe CISO Thom Langford discusses how best to measure your organization's true risk appetite and the business value of blending storytelling techniques into your security awareness programs.

DDoS

The Weaponization of DDoS

Tom Field • June 23, 2017

The Mirai botnet is just the most high-profile example of the new weaponization of DDoS. Attacks are stronger than ever, and multilayer defenses are needed to prevent disruption and distraction, says Darren Anstee of Arbor Networks.

DDoS

FBI: Reported Internet-Enabled Crime Losses Hit $1.3 Billion

Mathew J. Schwartz • June 23, 2017

The FBI says reported losses due to internet crime last year totaled $1.3 billion, based on nearly 300,000 complaints logged with its Internet Complaint Center. It warns that CEO fraud, ransomware, tech-support fraud and extortion are becoming increasingly prevalent.

Anti-Malware

The Return of the Luddite: Securing Critical Systems

Eric Chabrow • June 23, 2017

The latest edition of the ISMG Security Report leads off with a look at why organizations turn to paper when critical systems can't be secured. Also, how to hack air-gapped systems over the internet.

Fraud

How PayPal Protects Billions of Transactions

Varun Haran • June 23, 2017

In an in-depth interview, Guru Bhat, head of engineering at PayPal, describes how the online payments provider has used a mix of sophisticated automation, including machine learning, and human insight to maintain a fraud loss rate of just 0.32 percent.

Breach Preparedness

Hollywood Studio Hit By Cyber Extortion Says: 'Don't Trust Hackers'

Jeremy Kirk • June 23, 2017

The back story behind the ransom attack that led to the unauthorized early release of the Netflix series "Orange Is the New Black" is a cautionary tale in dealing with cyber extortionists such as The Dark Overlord.

Anti-Malware

Microsoft Defends AV Handling After Kaspersky Antitrust Lawsuits

Jeremy Kirk • June 22, 2017

Microsoft has sought to get in front of a brewing controversy over whether it unfairly disables third-party anti-virus products in Windows 10. The company is seeking to dampen charges that are reminiscent of its years-long legal tangles with global antitrust regulators.

Anti-Malware

Honda Hit by WannaCry

Mathew J. Schwartz • June 21, 2017

One month after the SMB-targeting WannaCry worm outbreak began spreading globally, Honda discovered fresh infections at multiple facilities, and was forced to temporarily idle one plant as a result of the ransomware.

Anti-Malware

'Eulogizing' Neutrino Exploit Kit

Eric Chabrow • June 20, 2017

Writing the obituary for the lifeless Neutrino exploit kit leads the latest edition of the ISMG Security Report. Also, judging the value of the Department of Health and Human Services' wall-of-shame website of healthcare sector breaches.

Breach Preparedness

Leak Reveals CIA 'CherryBlossom' Program Targeting Routers

Mathew J. Schwartz • June 19, 2017

A new dump from WikiLeaks has revealed an apparent CIA project - code named "CherryBlossom" - that since 2007 has used customized, Linux-based firmware covertly installed on business and home routers to monitor internet traffic and exploit targets' devices.

Compliance

Is the World Ready for GDPR?

Tom Field • June 19, 2017

GDPR is in effect, and in one year, regulators will start to assess penalties against enterprises not in conformance with the regulation. How prepared are entities? Will it take a high-profile penalty to get the world's attention? Michael Hack of Ipswitch weighs in.

Breach Response

How WannaCry Survives

Eric Chabrow • June 16, 2017

The CEO of the company that crippled WannaCry's ransomware component explains to Congress how the worm continues to attack unpatched systems at increasing rates. Also, creating a healthcare cybersecurity framework.