European Central Bank headquarters in Frankfurt, Germany (Photo: Fred Romero via Flickr/CC)

European Central Bank Closes a Website Following Hack

Scott Ferguson • August 16, 2019

The European Central Bank has closed one of its websites after its IT staff found that a hacker compromised some personal information on the site and also planted malware.

Cybercrime

Apple Expands Bug Bounty; Raises Max Reward to $1 Million

Latest

Business Email Compromise (BEC)

Phishing Scheme Uses Google Drive to Avoid Security: Report

Akshaya Asokan • August 16, 2019

A newly identified phishing campaign used Google Drive to help bypass some email security features as attackers attempted to target a company in the energy industry, security firm Cofense reported this week.

Account Takeover

The Renaissance of Deception Technology

Nick Holland • August 16, 2019

This edition of the ISMG Security Report discusses the latest improvements in deception technology and how best to apply it. Also featured: a report on the growth of mobile fraud, plus insights on Merck's experience recovering from a NotPetya attack.

Active Defense & Deception

Making the Most of an Investment in Deception Technology

Jeremy Kirk • August 15, 2019

Deception technology is attractive in that it offers - in theory - low false positives and critical clues to attackers' methodologies. But the benefits depend on its ability to fool attackers and whether organizations can spare the time to fine-tune it.

Cybercrime

Cloud Atlas Uses Polymorphic Techniques to Avoid Detection

Jeffrey Burt • August 15, 2019

The group behind the Cloud Atlas cyber espionage campaigns, which were first detected five years ago, is now deploying polymorphic techniques designed to avoid monitoring and detection, according to researchers at Kaspersky Lab.

Governance

Microsoft Issues Patches for BlueKeep-Like Vulnerabilities

Akshaya Asokan • August 14, 2019

Microsoft has released a set of patches for two newly discovered BlueKeep-like vulnerabilities in a number of Windows operating systems. The "wormable" bugs in remote desktop services permit propagation of malware from one compromised device to others, the company reports.

Endpoint Security

SQLite Vulnerability Permits iOS Hack: Report

Akshaya Asokan • August 13, 2019

Security researchers at Check Point Software Technologies say they've uncovered an SQLite database vulnerability in Apple iOS devices that can run malicious code capable of stealing passwords and gaining persistent control on affected devices.

Cybercrime

Members of Chinese Espionage Group Develop a 'Side Business'

Apurva Venkat • August 12, 2019

Some members of a hacking group with ties to China's government that's primarily known for its complex cyberespionage campaigns have developed a side business targeting the global gaming industry for financial gain, the security firm FireEye says.

Endpoint Security

Unsecure Drivers Allow for Easy Windows Hacking: Report

Akshaya Asokan • August 12, 2019

Researchers from the security firm Eclypsium have identified 40 poorly designed drivers from 20 hardware and BIOS vendors that can give attackers numerous way to hack into various versions of Windows.

Next-Generation Technologies & Secure Development

Understanding the Mindset of Attackers

Varun Haran • August 12, 2019

An important component of building an effective cybersecurity strategy is to understand the mindset of attackers, says IBM Security's Etay Maor, who offers insights.

Big Data Security Analytics

Big Data Analytics' Role in Security

Varun Haran • August 12, 2019

Big data analytics can help security professionals stay ahead of emerging challenges in a rapidly changing threat landscape, says Splunk's Haiyan Song.

Governance

The Role of the Cloud in Updating Security

Varun Haran • August 12, 2019

The velocity of change at large corporations has made traditional IT security methods inadequate, but cloud-based solutions can play an important role, says Aaron Mog of RiskIQ.

Governance

BlueKeep Patching Still Spotty Months After Alerts: Report

Scott Ferguson • August 9, 2019

More than two months after Microsoft issued the first warnings about the BlueKeep vulnerability, many enterprises have a spotty record when it comes to patching for this particularly worrisome flaw, new research from SecurityScorecard finds. Financial services companies have fared better than those in other sectors.