Parliament is considering a bill that would enforce minimum security requirements for IoT devices (Photo: ISMG)

UK Legislation Seeks Mandatory Security Standards for IoT

Prajeet Nair • November 25, 2021

Could the internet of things be made more secure? A draft law in Britain would impose stronger cybersecurity regulations for manufacturers, importers and distributors of smartphones, TVs, toys and other "connected" digital devices, backed by the threat of fines of up to $13 million for noncompliance.

►

Cybercrime

Researchers Spot Comeback of the Emotet Botnet

Latest

Cybercrime

Making the Case for Centralized IAM Management Control

Anna Delaney • November 27, 2021

The problem with decentralized access management, says Manuel Garat, head of IAM at digital travel company, Booking.com, is that while you might know who or what needs access to your network, applications and data, you "don't always know who shouldn't have access."

Cybercrime

The Best Gift for the Holidays? An Incident Response Plan

Anna Delaney • November 26, 2021

In the latest weekly update, four editors at Information Security Media Group discuss important cybersecurity issues, including why security teams are still unprepared for cyberattacks over weekends and holidays, which experts warn is when attackers love to strike.

Endpoint Security

Medical Data Exposed in Breach at True Health New Mexico

Jeremy Kirk • November 26, 2021

A health insurer in New Mexico is warning of a data breach that exposed customers' personal and medical information. True Health New Mexico reports that nearly 63,000 individuals' personal details were exposed in the "early October" incident. It's offering all victims prepaid credit monitoring services.

3rd Party Risk Management

Essential Preparations for the Holiday Season Attack Surge

Anna Delaney • November 26, 2021

The latest edition of the ISMG Security Report features an analysis of how organizations can reduce risk especially over holidays and weekends, when attackers are most likely to strike. Also featured: Highlights from Ireland's IRISSCON 2021 cybercrime conference; what's ahead for COVID-19 and the workplace?

Critical Infrastructure Security

Cybersecurity Unplugged: Improving Healthcare Security

Steve King • November 26, 2021

In this episode of "Cybersecurity Unplugged," Dan Bowden, CISO at Sentara Health, discusses telemedicine, IoMT, and explains why we’re lagging so far behind in healthcare security. "It’s because of how the data is managed, data standards, data integrity."

Blockchain & Cryptocurrency

Financial Agencies Eye Existing Laws for Crypto Regulation

Dan Gunderman • November 24, 2021

Three U.S. financial agencies have conducted a series of "policy sprints" around cryptocurrency assets and related regulatory gaps, and plan to amend existing guidance and regulations to address security and market risks, the Board of Governors for the Federal Reserve said this week.

3rd Party Risk Management

Apple Sues NSO for Product and Service Abuse

Mihir Bagwe • November 24, 2021

The NSO Group is the target of a lawsuit filed by Apple, which alleges that the spyware maker abused Apple's products and services to carry out spying operations. The news follows the NSO Group's blacklisting by the U.S. government, a score downgrade by Moody's, and a reportedly failed deal with France.

Blockchain & Cryptocurrency

Cryptocrimes Proliferate: Ransomware, New Threat Campaigns

Prajeet Nair • November 24, 2021

Cryptocurrency exchange BTC-Alpha faces a ransomware attack; Morphisec researchers investigate malware that targets cryptocurrency, NFT communities on Discord; and RiskIQ researchers uncover fresh Aggah campaign that deploys clipboard hijacking code to swap a victim's cryptocurrency address.

Business Continuity Management / Disaster Recovery

Why Ransomware Is a Game Changer for Cyber Insurance

Marianne Kolbasuk McGee • November 24, 2021

Ransomware attacks have become the game changer in driving up security requirements, policy premiums and rejection rates for healthcare sector entities seeking new cyber insurance policies or renewals, says Doug Howard, CEO of privacy and security consultancy Pondurance.

3rd Party Risk Management

How to Save Money on Pen Testing - Part 1

Charles Gillman • November 24, 2021

The findings from a penetration test can help you identify risks and gaps in your security controls. Charles Gillman offers tips to maximize the value of your next pen test and, in the process, deliver better results.

Cybercrime

Report: China to Target Encrypted Data as Quantum Advances

Dan Gunderman • November 23, 2021

Chinese threat actors may increasingly look to steal sensitive, encrypted data in hopes of decrypting it with quantum computing technology in the years ahead, according to a new report. Researchers say Chinese threat actors may target government, business and academic data with long-term value.

3rd Party Risk Management

Cisco Firewall Vulnerabilities Enable Denial of Service

Prajeet Nair • November 23, 2021

Vulnerabilities in the Cisco ASA and Cisco FTD firewalls can lead to a denial of service attack, says Positive Technologies researcher Nikita Abramov. There is no workaround that addresses these vulnerabilities, but Cisco has released software updates and asks users to install them immediately.