(ISC)² Blog

Cybersecurity Industry News Review – March 21, 2023

KillNet is bad for your health, TikTok facing further bans, ransomware impacts cancer test results, Russia allegedly increasing its cyberwarfare efforts. By Joe Fay Microsoft Demonstrates How KillNet Is Bad for Our Healthcare Sector Microsoft has highlighted a rise in DDoS attacks on healthcare organizations, mapping a three-fold increase in attacks over three months. It said it tracked 10 to 20 attacks per day on healthcare organizations on Azure in November but was seeing 40 to 60 per day in February. The attack mix changed over this time, it added, with over half of attacks now being UDP floods, with... Read more →

Latest Cyberthreats and Advisories - March 17, 2023

Cybercriminals pounce on SVB collapse, privacy concerns around ChatGPT and the FBI warns of a rise in crypto scams. Here are the latest threats and advisories for the week of March 17, 2023. By John Weiler Threat Advisories and Alerts FBI Warning: Cryptocurrency Investment Schemes on the Rise The U.S. Federal Bureau of Investigation (FBI) is warning internet users of an increase in cryptocurrency investment scam schemes, which defrauded victims of over $2 billion in 2022. Cybercriminals (usually located overseas) use social media platforms, dating apps, professional networking apps and other online means to connect with targets. The criminals then... Read more →

Cybersecurity Industry News Review – March 14, 2023

The U.K. Online Safety Bill triggers a security rebuke from WhatsApp, the Czech Republic concerned about TikTok, an international law enforcement effort shuts down the NetWire RAT infrastructure, while a study suggests workforce malaise towards reporting security incidents. By Joe Fay WhatsApp Would Leave U.K. Rather Than Break Encryption WhatsApp would pull its end-to-end encrypted messaging service in the U.K., rather than submit to any requirement to weaken its privacy stance to comply with the U.K. government’s Online Safety Bill. WhatsApp chief Will Cathcart said that 98 per cent of its users were outside the U.K., and ALL users wanted... Read more →

Latest Cyberthreats and Advisories - March 10, 2023

By John Weiler Mexico timeshare scams, the DoppelPaymer ransomware gang gets busted and a major data leak rocks Oakland, California. Here are the latest threats and advisories for the week of March 10, 2023. Threat Advisories and Alerts FBI Issues Warning About Mexico Timeshare Scam The U.S. Federal Bureau of Investigation (FBI) has issued an advisory about timeshare scams in Mexico, which affected over 600 people and resulted in roughly $39.6 million in victim losses last year. How does the scam work? Owners of timeshares in Mexico receive an unexpected email or phone call from fraudsters requesting to sell or... Read more →

(ISC)² Members Reveal Deep Skepticism About Artificial Intelligence and Machine Learning

By John E. Dunn It’s little surprise that many people are skeptical about the rapid encroachment of artificial intelligence (AI) and machine learning (ML) into daily life. However, should cybersecurity professionals be more positive about the benefits for the field? (ISC)² asked its members and candidates – experienced cybersecurity practitioners as well as those at the beginning of their career – whether or not they were concerned about the growth and adoption of both AI and ML in different scenarios. The results of the straw poll of 126 people revealed a consistently high degree of concern and skepticism about the... Read more →

Cybersecurity Industry News Review: February 7, 2023

By Joe Fay Derivatives traders, trainer trainers, and finger lickers all hit by ransomware. Russian hackers lash out after Ukraine tanks deal announced. Apple patches decade old devices. ION Markets Hit by “Cyber Security Event” Dublin-based data and software firm ION Markets has been hit by a “cyber event” which has had a knock-on effect on financial futures and derivatives markets worldwide. The attack is thought to have been ransomware related. ION Markets said the attack on its ION Cleared Derivatives division was “contained to a specific environment”, all the affected servers are disconnected, and remediation of services is ongoing.... Read more →

Royal Mail “cyber incident” is an ongoing cyberattack CEO admits to MPs

By: Joe Fay Simon Thompson, CEO of the U.K.’s Royal Mail, has confirmed in a session with MPs that the crippling of its ability to send parcels and letters abroad was down to a “cyberattack” and that it was “ongoing”. Thompson said that investigations into the attack on the U.K. postal operator – one of the most high-profile attacks on the country’s critical infrastructure to date – were continuing, but so far there was no evidence that personal data of customers had been compromised. The U.K. National Crime Agency (NCA) and National Cyber Security Centre (NCSC) have been investigating the... Read more →

How are you marking data privacy day?

By: Joe Fay Data Privacy Day (known as Data Protection Day in Europe) falls this Saturday (January 28) and if you haven’t worked out how to mark the day yet, tech vendors and organizations are more than willing to help. The international event began as Data Protection Day in Europe in 2007, under the auspices of the Council of Europe, and has since been taken up in the U.S. and other countries. Cisco marked it by releasing its 2023 Data Privacy Benchmark Study, which found that 92% of organizations recognized they need to do more to reassure customers about how... Read more →

Latest Cyberthreats and Advisories - January 20, 2023

TikTok is fined for a privacy violation, major corporations suffer breaches and Vice Society attacks another school. Here are the latest threats and advisories for the week of January 20, 2023. Threat Advisories and Alerts U.K. School Survey Reveals Surprising Findings A new survey by London Grid for Learning (LGfL) and the National Cyber Security Centre (NCSC) revealed that the uptick in cyberattacks on the U.K. school system may not be as bad as first thought. The survey, of more than 800 schools, revealed that 78% of them had suffered at least one cybersecurity incident. Other interesting findings showed that... Read more →

Latest Cyberthreats and Advisories - December 23, 2022

Ransomware hits hard around the world – again, Cybercriminals steal food and Fortnite’s developer is fined millions. Here are the latest threats and advisories for the week of December 23, 2022. Threat Advisories and Alerts Criminal Actors Use BEC Attacks to Steal Large Food Shipments Three U.S. government agencies – The Federal Bureau of Investigation (FBI), the Food and Drug Administration Office of Criminal Investigations (FDA OCI) and the U.S. Department of Agriculture (USDA) – have issued a joint warning to food suppliers that their industry is seeing an uptick in business email compromise (BEC) attacks. Criminal actors are impersonating... Read more →

Latest Cyberthreats and Advisories - November 18, 2022

Beware the BatLoader, the NSA calls for more memory-safe programming language use and ransomware causes more trouble in Australia….Here are the latest threats and advisories for the week of November 18, 2022. Threat Advisories and Alerts Researchers Sound Alarm on Dangerous BatLoader Malware Dropper A dangerous new malware loader with features for determining whether it's running on business or home computers has begun rapidly infecting systems worldwide over the past few months. Researchers at VMware Carbon Black claim the threat, dubbed BatLoader, is being used to distribute a variety of malware tools including a banking Trojan, an information stealer, and... Read more →

LATEST CYBERTHREATS AND ADVISORIES - OCTOBER 21, 2022

Ransomware derails big businesses as the Australian cyberattack spree and student loan forgiveness scam highlight a disturbing week in the cybersecurity world. Here are the latest threats and advisories for the week of October 21, 2022. Threat Advisories and Alerts FBI Warns That Fraudsters May Target Beneficiaries of Student Loan Forgiveness Individuals seeking US federal student loan forgiveness should be cautious of potential scams related to the Student Loan Debt Relief Plan introduced in August of this year. Scammers are using a variety of digital tools – including websites, email, mobile phones and more – to trick victims into giving... Read more →

What Do You Mean My Email Isn’t Free?

By Greg Anderson, (ISC)² Associate is an emerging cybersecurity professional with an interest in digital privacy. The U.S. Postal Service is in trouble. It’s $63 billion dollars in debt, and is expected to lose another $160 billion over the coming decade. Lawmakers are scratching their heads about how to pull it out of its deepening hole. Ideas to expand USPS revenue streams include offering check-cashing services, utility bill payments and selling bonds. What about something more innovative? To offer a more contemporary service, USPS can borrow an idea from the big tech playbook. Here’s how it would work: the postal... Read more →

Security Through Obscurity. It Doesn’t Work.

By Keith Bruce, CISSP and IT Security Compliance Analyst. Keith’s primary focus is on ISO 27001 compliance and team analytics, but also manages vulnerability, policy, penetration testing and client audit review programs, just to name a few. Introduction The internet offers a plethora of information about you and everyone else, whether we like it or not. Our personal information is out there if you know where and how to look for it. Everything is tracked. Everything. All we need to do is dig a little deeper to find more information that may be public, or private for that matter. Default... Read more →

What do cybersecurity experts predict in 2022?

2022 Predictions for the Cybersecurity Industry and Advice for Newcomers or Those Working for Small to Medium-Sized Businesses By Diana-Lynn Contesti, CISSP-ISSAP, ISSMP, CSSLP, SSCP, John Martin, CISSP-ISSAP, CISM, BCS CITP, and Richard Nealon, CISSP-ISSMP, SSCP, SCF, CISM, CISA As long-time information security professionals and (ISC)² Community Champions, we have experienced the way cybersecurity employees engage and work with one another continue to adapt in response to changes in the workplace and world at large. In 2021, we experienced a rapid evolution to these interactions. Like us, you may be wondering, what will 2022 look like for information security professionals?... Read more →

The Delicate Balance of Security Versus Usability

Why Does This Have to Be So Hard? As a security practitioner, how often have you heard the refrain from your colleagues that one of the security protocols that were so carefully thought-out and expertly implemented are just too difficult to deal with? Perhaps you have sighed when you had to adhere to your own security protocol? As a security evangelist, you understand the necessity of adhering to a set of security requirements, but as a normal staff member, you can understand the frustration of your non-security coworkers. Is there ever such a thing as being a “normal” staff member... Read more →

THE HEALTHCARE INTERNET OF THINGS – FOR BETTER OR WORSE

By Rema Deo, HCISPP By now, everyone is familiar with the Internet of Things (IoT), an expanding network of physical devices, appliances, and equipment that are embedded with sensors, software, and other technologies in order to connect and exchange data with other devices and systems over the Internet. It’s an exciting digital world in which your smartphone can control the tiny computers in your air conditioning system and your house lights. Where the small computer in your refrigerator monitors water quality and automatically orders a new filter from the manufacturer. Where your computerized oven can be turned on remotely to... Read more →

Cybersecurity Predictions for 2021 from the (ISC)² Community of Security Professionals (Part 2)

By Diana-Lynn Contesti, CISSP-ISSAP, ISSMP, CSSLP, SSCP John Martin, CISSP-ISSAP, CISM Richard Nealon, CISSP-ISSMP, SSCP, SCF In part one of this blog series, we discussed privacy, remote access (aka Work from Home), insider threats, data leakage, Zero Trust Architecture (ZTA) and security architecture. To continue this discussion, we believe that 2021 will still see folks working from home; thus, the risks due to insider threats and data leakage will continue to grow. However, we believe that there are other concerns for information security professionals, including edge computing, 5G, IoMT/IoT, AI and ransomware. Edge Computing Edge Computing is a distributed computing... Read more →

Remote Work During the Pandemic: What We Got Wrong

By Stephen Fried, CISSP As COVID-19 began to spread rapidly across the globe in 2020, many organizations moved their employees off company premises and enabled large "work from home" efforts. Nobody knew how long this would last, but we assumed we could work remotely for a few months until this thing worked itself out, then return to the office and get back to "normal." We were very wrong. We weren’t just wrong about the length of the crisis; we were wrong about how our employees defined “home.” What we didn’t anticipate is that the pandemic would force companies to rethink... Read more →

Looking for Resources on Privacy? You’ve Come to the Right Place

Happy Data Privacy Day! The National Cyber Security Alliance (NCSA) designates January 28 as a day to empower individuals and encourage businesses around the world to respect privacy, safeguard data and enable trust. In honor of the effort to inspire dialogue and empower learning about how personal information is used, collected and shared in our digital society, following is a list of helpful (ISC)2 resources and activities focused on privacy best practices. Professional Development Institute courses The PDI is a portfolio of more than 40 continuing cybersecurity education courses that is free to (ISC)2 members. Among the wide array of... Read more →