Ransomware – a cyberattack in which attackers hijack computer systems and demand payment to release them – has skyrocketed from a relative rarity a few years ago to the single biggest type of cybercrime today. And there is no end in sight to its growth trajectory. Last year, 2,354 American government entities, healthcare organizations and schools were the victims of ransomware attacks. The average ransomware payout swelled to $178,000 in the first half of 2020, up from $112,000 a year ago, according to ransomware incident response firm Coveware, and few clandestine culprits were caught.
The developer of the 16Shop phishing platform added a new component that targets users of popular Cash App mobile payment service, according to reports.
Third specification from OSSA prescribes leading measures to mitigate cybersecurity camera threats and vulnerabilities; New app developer council involves essential entrepreneurs and small businesses in the alliance ecosystem
March 4, 2021
The Open Security & Safety Alliance (OSSA), an industry body comprised of stakeholders from all facets of the security, safety and building automation space, announced two important developments to help pave the road towards trustworthy and innovative security and safety solutions. First, a new specification is now available to members that focuses on camera cybersecurity measures. OSSA also introduces a new App Developer Council designed to attract and involve app developers in the Alliance’s ever-growing ecosystem of security and safety industry players.
2021 has proven to be busy for law enforcement operations already, taking down numerous high-profile dark web marketplaces and forums including Dark Market (500k users, 2.4k sellers, transactions ~ €140 million), Emotet, Netwalker, and Egregor, with some even producing arrests of site operators. Digital Shadows’ new report, “Cybercriminal law enforcement crackdowns in 2021,” highlights the impact that these takedowns have had to date.
CISA has issued Emergency Directive (ED) 21-02 and Alert AA21-062A addressing critical vulnerabilities in Microsoft Exchange products. Successful exploitation of these vulnerabilities could allow an attacker to access on-premises Exchange servers, enabling them to gain persistent system access and control of an enterprise network.
Malaysia Airlines has confirmed it has suffered a "data security incident" via a third-party IT service provider. The company also said the breach had not affected its carrier's core IT infrastructure and systems.
Synopsys Cybersecurity Research Center (CyRC) researchers have discovered CVE-2020-27223, a denial of service vulnerability in Eclipse Jetty, a widely used open source web server and servlet container.
Positive Technologies security researcher Alexander Popov has discovered and fixed five similar issues in the virtual socket implementation of the Linux kernel. These vulnerabilities could be exploited for local privilege escalation, as confirmed by Popov in experiments on Fedora 33 Server. The vulnerabilities, known together as CVE-2021-26708, have received a CVSS v3 base score of 7.0 (high severity).
Humor is tricky business in the security world, however. Briefing staff on warning signs of workplace violence, precursors of terrorist attacks, contingency plans for natural disasters, and methods of corporate espionage doesn’t exactly lend themselves to one-liners. Dealing with most security incidents isn’t a laughing matter.
Left attempting to optimize security teams while struggling to cope with multiple crises simultaneously, security leaders feel as if almost 75% of the workday is spent battling internal bureaucracy, while 25% is spent dedicated to the issues that require attention. But you’re not alone. To start, have some real conversations with your staff, and don’t forget to focus on yourself and your own well-being.