We have complained in this blog about the plethora of Internet connected IoT devices that are being sold without anything approaching meaningful security to an unsuspecting public. A notable exploitation of IoT devices was behind the Mirai botnet, which shut down significant parts of the Internet for a couple of days.
But other disasters await, for instance, the easy access of web cams from the Internet ...
Continue Reading →I have been working my way through a Cybrary course titled ” Incident Response and Advanced Forensics.” In it I came across the following slide, and what interested me was how it juxtaposed the Lockheed-Martin Cyber Kill Chain against a lower row of defensive tactics. The last option, hidden beneath the instructor’s image, is “Destroy.”
Where did this intriguing ...
Continue Reading →
Is a good offense? If you or your company has been a victim of cyber-crime, I am sure you have had fantasies about back-hacking the perpetrators back to the stone age. Or having some sort of magic button phone app that would do the same thing.
Currently, the bad guys are running the offense, 24/7/365. The good guys are limited to defense only. There ...
Continue Reading →
On May 25 2018, new regulations will go into effect in the European Union called the General Data Protection Regulation (GDPR). If you are doing business in Europe, this will affect your business. If your website collects personal information and other data from European site visitors or customers, this will affect your business.
The Europeans take personal privacy, especially online privacy, much ...
Continue Reading →
Crypto-ransomware continues to be one of the most popular money making exploits for cyber criminals. The reason for this is simple; its works, and the return on investment is quite high. According to a recent article in Naked Security, the score will reach $1 billion in 2017.
A poll by the IBM company found that nearly 50% of the businesses polled had been hit by ransomware, and of those 70% ...
Continue Reading →Thanks to Quartz for this list. I have posted just the tech slang, so be sure to click through for the full list.
If you own a Netgear wireless router, especially the R6200, R6250, R6400, R6700, R6900, R7000, R7100LG, R7300, R7900, R8000, D6220, and D6400 routers and possibly other models are vulnerable to arbitrary command injection. This is a security bug that could allow a remote attacker to access your router. This vulnerability was announced by US-CERT on December 9th, and reported in Naked Security on December 12th.
Vulnerabilities such as this ...
Continue Reading →
There are a number of great frameworks for developing your cybersecurity plan. Two of our favorites are the NIST-CSF and the 20 CIS Controls. We have written about these excellent tools before here (CIS Controls) and here (NIST-CSF).
Back in December we received an email from Pete Herzog of ISECOM about a new, open-source methodology manual for cybersecurity ...
Continue Reading →The Federal Trade Commission recently released an warning about fraudulent mobile apps. These apps are designed to steal personal information such as user names, passwords, credit card numbers, and other personal information.
My advise is to always get your app from an authorized app store, such as the Apple Store or the Google Store. These apps have been tested for the most part.
Another idea ...
Continue Reading →