Indian IT Firms Embrace Encryption, Lack Adoption*:
- Indian IT companies readily embrace data encryption, but are behind in the adoption of technology compared to the global average according to a new study by a French security firm.
- The report reveals that organizations are increasingly adopting encryption to address compliance requirements.
- Indian organizations transfer sensitive or confidential information to the cloud whether encrypted or not at a rate that is the highest of all countries in the survey – 70 percent, while the global average is 53 percent.
- The survey is based on responses from more than 5,000 IT security decision makers across multiple industry sectors in the various countries in which it includes responses from 548 individuals in India.
- The top threat to sensitive data continues to be employee mistakes (55 percent) followed by hackers (36 percent) and temporary workers (31 percent).
- In India, encryption deployment grew the most year-on-year in databases, big data, and email.
- In contrast, public cloud services are least likely to be extensively or partially encrypted.
*Source: CXO today, July 27, 2017
Hacker Broke Into Virgin America’s Network, Forced Staff to Change Passwords*:
- The hacker had gained unauthorized access to certain Virgin America information systems containing employee data on March 13.
- 3,120 employees and contractors had their login information compromised, while 110 additional employees may have had personal information stolen.
- It is not known how the hacker gained access to Virgin America’s network.
- A person who used to work for the airline said that the company hosted its email with Google and requires employees to use two-factor authentication.
- The use of two-factor authentication on the network would prevent the hacker from using credentials from an account with higher privileges.
- The company's security team identified the unauthorized access and mitigated the hacker's access.
- Employees and contractors were forced to change their passwords, and the airline consulted a cybersecurity firm and informed law enforcement of the breach.
- Customer data for Virgin America and Alaska Airlines was not impacted.
*Source: ZDnet, July 27, 2017
North Korea’s Army of Hackers Has a New Target: Bank Accounts*:
- North Korea’s cyber-army has splintered into multiple groups and is unleashing orchestrated attacks increasingly focused on funnelling stolen funds to the secretive nation.
- The emphasis on finances represents a significant shift from Pyongyang’s prior patterns of attack seeking to obtain military information, destabilize networks or intimidate.
- Pyongyang has been blamed for major cyberattacks including 2014’s Sony Pictures Entertainment hack, last year’s daring cyber-heist at Bangladesh’s central bank and this year’s WannaCry global ransomware attack.
- Cybersecurity researchers have long suspected the hacking group Lazarus carried out those attacks with the backing of North Korea.
- One report has identified a second group called “Andariel” that is linked with Lazarus and has carried out a range of cyberattacks on South Korea.
- Their efforts include even low-level scams such as planting malware in South Korean ATMs to steal bank-card information.
- South Korean government groups and agencies withstand 1.4 million hacking attempts a day.
- North Korea’s attacks are more orchestrated now, as if it were a military operation.
- North Korea’s hacking teams have been recruited internally over years within the country’s military and Ministry of State Security.
- Lazarus and BlueNoroff in recent years they have made attempts to breach financial companies or institutions in at least 18 countries, including Mexico, Norway and India.
*Source: The Wall Street Journal, July 27, 2017
Cars Suck Up Data About You. Where Does It All Go?*:
- A car can track phone calls and texts, log queries to websites, and record what radio stations you listen to.
- Automakers, local governments, retailers, insurers and tech companies are eager to leverage this information, and they want to tap into even more data, including what your car’s video cameras see as you travel down a street.
- Government rules limit how event data recorders – the black boxes in cars that record information such as speed and seatbelt position during a crash – can be used, but no single law in the US covers all the data captured by all the other devices in automobiles.
- Those devices include radar sensors, diagnostic systems, in-dash navigation systems and built-in cellular connections.
- Smartphones connected to the car, and those not connected to the car, can also track your activities, including any texting while driving.
- While anyone from an app developer to Google or Spotify may be capturing your digital moves while you drive, in most cases the primary collector and owner of this data is the automaker.
- Many car companies view the acknowledgement of such data collection as problematic for customer relations – so much so that several companies declined to comment on their future plans or data collection policies.
- There are cases in which drivers regularly choose to trade their data to get a benefit; for example, live traffic services can save a driver hours of sitting in traffic in exchange for sharing location and speed information.
- Even insurance companies are experimenting with apps and dongles that record braking, acceleration and speed with the lure of lower rates for well-mannered drivers.
- The benefits to consumers – and potential threats to personal privacy and security – become murkier as companies trade and combine information collected from multiple sources.
- Many countries have specific laws about what information can be collected about drivers, but some vary so widely that one company has built a business on sorting through privacy and data laws around the world for automakers, helping companies remain in compliance amid changing regulations.
*Source: New York Times, July 27, 2017
Hackers Demanded Nearly $30K From Buffalo Hospital*:
- Erie County Medical Center didn't pay a nearly $30,000 ransom demand to the perpetrators of a massive cyber-attack in April, but ECMC officials estimate expenses tied to the incident were nearly $10 million.
- About half of that amount is for computer hardware, software and assistance needed in the response.
- The other half represents a combination of increased expenses, such as for staff overtime pay, and lower revenues from the loss of business during the system down time.
- Going forward, medical center officials also anticipate an ongoing additional expense of $250,000 to $400,000 a month for investments in upgraded technology and employee education.
- The attack took down more than 6,000 computers and forced the medical center back to the days of paper charts and face-to-face messaging.
- A ransom demand appeared on hospital computer screens that sought 24 bitcoins, valued at about $30,000, to unlock the medical center’s system.
- Fortunately (and unlike many big urban public hospitals) ECMC finds itself in a reasonably good position to handle the problem – the center increased its insurance coverage against such events last year from $2 million to $10 million.
- Officials believe a hacker or hackers used an automatic program that anti-virus software could not recognize to exploit a hospital web server accessible remotely that should have been configured differently to prevent an incursion.
- What happened at ECMC reflects a global crisis, with thousands of attacks now occurring each year at many businesses, organizations, and government agencies.
- Health care is one of the most frequently targeted industries by cybercriminals, and that's partly a result of its many interconnected computer systems, patient records and medical devices.
- A report from earlier this year found that health care lags behind other industries in cybersecurity because of inadequate in-house expertise, poorly secured or outdated systems, and a lack of awareness of the seriousness and complexity of the threat, especially to patient privacy and safety.
- A big piece of the challenge is educating people not to be tricked by fraudulent email and reacting quickly if a cyber-attack breaks through computer defenses.
*Source, Syracuse, July 28, 2017
Apple Warns Cyber Threat Could Wipe Out iPhones, Issues Fix*:
- Apple issued a warning this week after a new hacking threat.
- Apple has now issued a critical security patch for all iOS devices and for Mac computers against a potential hack that could come remotely via Wi-Fi.
- So the company is urging users to install the updates to protect their devices.
- The latest cyber threat is also a risk to Android device users, but Google has taken steps as well to block the virus.
*Source: Fox Business, July 29, 2017
Security Researcher Arrested a Teenager After He Warns Hungarian Transit Company About Their Dumb Mistake*:
- A teenager discovered that the website of Budapesti Közlekedési Központ, the public transit authority in Budapest, would allow you to edit the price you paid for your tickets, so that purchasers could give themselves massive discounts on their travel.
- When he told the authority about it, they had him arrested and issued a press-release boasting about it.
- Companies who are embarrassed by researchers who reveal product defects that endanger the company, their customers, and the public routinely threaten and coerce researchers into silence.
- The US Copyright Office heard that copyright law had stifled security researchers who'd discovered grave flaws in infrastructure, medical implants, automobiles and industrial vehicles, phones, computers, and more.
- When the Budapest transit authority announced that it had sued the whistleblower, 45,000 people gave the transit authority a one-star review on Facebook; this shows that web users want critics to be shielded from vengeful, embarrassed companies.
- The young hacker only had the best intentions when he reported the issue to BKK and said he hopes the organization withdraws its report.
*Source: Boing Boing, July 24, 2017