Week in review: RunC, Snapd flaws, Zero Trust browsing, 5 years of NIST Cybersecurity Framework
Here’s an overview of some of last week’s most interesting news and articles:
Machine learning fundamentals: What cybersecurity professionals need to know
In this Help Net Security podcast, Chris Morales, Head of Security Analytics at Vectra, talks about machine learning fundamentals, and illustrates what cybersecurity professionals should know.
Bank of Valletta suspended all operations in wake of cyber attack
Maltese Bank of Valletta (BOV) has been breached by hackers and has temporarily suspended all of its operations to minimize risk and review its systems.
NIST Cybersecurity Framework: Five years later
Five years after the release of the Framework for Improving Critical Infrastructure Cybersecurity, organizations across all sectors of the economy are creatively deploying this voluntary approach to better management of cybersecurity-related risks.
Trickbot becomes one of the most dangerous pieces of modular malware hitting enterprises
Most recently, its creators have added another dangerous module to it, which allows it to extract and exfiltrate credentials from popular remote access software.
Three reasons employee monitoring software is making a comeback
Modern user activity monitoring software is incredibly flexible, providing companies with the insights they need while offering the protection they demand. By examining three prominent use cases, it’s evident that employee monitoring software is the right tool for our digital moment.
RunC container escape flaw enables root access to host system
A serious vulnerability in runC, a widely used CLI tool for spawning and running containers, could be exploited to compromise the runC host binary from inside a privileged runC container, allowing the attacker to gain root access on the underlying host system.
People still shocked by how easy it is to track someone online
Netflix’s hit series You, has got people discussing their online privacy and traceability.
Azure AD Identity Protection now revolves around risky users and risky sign-ins
Since Microsoft Threat Protection’s launch, Microsoft has slowly been polishing the offering by adding new and improved features to its various components.
How can we improve adoption and ROI on security investments?
Businesses can balance the need for strong security with employee convenience and ease of use through the spectrum of email encryption.
Most wanted malware in January 2019: A new threat speaks up
Check Point’s Global Threat Index for January 2019 reveals a new backdoor Trojan affecting Linux servers, which is distributing the XMRig crypto-miner.
Snapd flaw gives attackers root access on Linux systems
A vulnerability affecting Snapd – a package installed by default in Ubuntu and used by other Linux distributions such as Debian, OpenSUSE, Arch Linux, Fedora and Solus – may allow a local attacker to obtain administrator privileges, i.e., root access and total control of the system.
Healthcare email fraud: Attack attempts jump 473% over two years
Proofpoint found that healthcare organisations were targeted in 96 email fraud attacks on average in Q4 2018.
Hackers hit VFEmail, wipe US servers and backups
Unknown attackers have breached the servers of VFEmail and have wiped disks on every one of its US-based servers, the email provider has confirmed.
Zero trust browsing: Protect your organization from its own users
The major browser providers make diligent efforts to save users from their own susceptibility to manipulation by hackers. In the best case, these efforts meet with only partial success.
February 2019 Patch Tuesday: PrivExchange hole plugged
For the February 2019 Patch Tuesday, Microsoft has released fixes for over 70 CVE-numbered vulnerabilities, 20 of which are rated Critical.
SMBs spending a day each week dealing with cybersecurity issues
Almost half of UK small to medium-sized businesses (SMBs) believe a cyberattack would put their business at risk of closure, and 48 per cent of businesses report they have had to deprioritise activities that would help grow their business to address cybersecurity, a new research from Webroot reveals.
BEC-style attacks exploded in Q4 2018
The number of email fraud attacks against targeted companies increased 226% Quarter-on-Quarter and 476% vs. Q4 2017
There’s a growing disconnect between data privacy expectations and reality
Consumer backlash in response to the numerous high-profile data breaches in recent years has exposed one of the hidden risks of digital transformation: loss of customer trust.
Average DDoS attack volumes grew by 194% in 12 months
59% of attacks used multiple attack vectors.