Security CenterRecent Security Articles

One of the topics covered In a recent RSA Conference presentation was how attackers are using the victims’ own Windows operating system against them to avoid detection. This concept of “living off the land” (LotL) — the use of binaries, DLLs and other computer code that is already on our system — makes it harder to protect our systems.To read this article in full, please click here(Insider Story)

The tech giant will take control of the U.S.-based infrastructure used by the criminals behind the world’s most prolific botnet used to distribute malware and infect victim computers.

For Chad Teat, CISO of Atlanta-based specialty retailer Floor & Decor, the secret to balancing risk and business opportunity comes down to reducing friction with the business. To do that, Teat says, the CISO, engineers, and analysts all need to make it their day-to-day job to build relationships and influence with the business. “I think every security professional has been a part of highly complex projects that succeeded because everybody was rowing in the same direction. And we’ve also been a part of short puts that fail miserably because of internal squabbles.” As for where security could be doing a better job, Teat points to risk quantification and communication. “We’ve got to be speaking the same language as the rest of the business and right now in the industry a lot of times we’re not even speaking the same language as IT.”To read this article in full, please click here

The IT systems of the City of Durham and Durham County in North Carolina have been shuttered since a successful ransomware attack struck the municipalities on the evening of March 6. Although details are still sketchy, the North Carolina Bureau of Investigation indicated the attackers used Russian-made malware known as Ryuk. [ Read our blue team's guide for ransomware prevention, protection and recovery. | Get the latest from CSO by signing up for our newsletters. ]To read this article in full, please click here

Anecdotal evidence of security operations center (SOC) tool overload is overwhelming — at CSO we hear complaints from industry sources about this problem all the time — but the 2019 SANS SOC Survey attempted to quantify the problem. For most survey respondents, there were roughly equal numbers of SOC analysts as there were full-time employees tasked with maintaining the SOC security tools. That's on top of the expense of purchasing those security tools in the first place.To solve this problem, IBM and McAfee launched the Open Cybersecurity Alliance (OCA) in October 2019. Together they have released two open-source projects meant to improve interoperability among enterprise security tools. One, STIX Shifter, enables federated search for indicators of compromise (IoC) across different security tools. The other, OpenDXL, is an open messaging format so that tools can share information, notifications and commands in a standardized way.To read this article in full, please click here

A full 98 percent of all IoT device traffic is unencrypted, exposing personal and confidential data on the network.

Threat actors can easily infiltrate networks because attacks evade detection by typical security protections.

Mozilla Foundation snuffs out bugs with the introduction of Firefox 74 and ESR 68.6.

Attackers are purporting to send victims HIV test results - but in reality are convincing them to download the Koadic RAT.

Intel patched six high-severity flaws in its graphics drivers, as well as other vulnerabilities in its NUC firmware, and a load value injection vulnerability that could allow attackers to steal sensitive data.

RSA 2020 had an uninvited guest, Covid-19.  Fist bumps replaced handshakes and hand sanitizing stations were spread throughout the Moscone Center.  Attendance seemed to be down due to factors like the virus panic and the withdrawal of major players like AT&T, IBM, and Verizon. To read this article in full, please click here(Insider Story)

Bugs affecting programmable logic controllers (PLC) and physical access-control systems for facilities are rated 9.8 in severity.

2019 was another big year for mergers and acquisitions (M&A) in the cybersecurity industry. According to Momentum Cyber, more than 150 deals totaling more than $23 billion in value took place this year. Four billion-dollar deals have occurred in the security space this year, the same as in 2018.To read this article in full, please click here(Insider Story)

Researchers have devised a new attack against Intel CPUs that can leak sensitive secrets stored in SGX secure enclaves and, at least in theory, from privileged processes across security boundaries such as kernel space, virtual machines and hypervisors. Dubbed Load Value Injection (LVI), the new attack is based on techniques used in other CPU vulnerabilities such as Spectre, Meltdown and Microarchitectural Data Sampling (MDS), but is different, more importantly, in that it bypasses the mitigations put in place for those flaws.To read this article in full, please click here

Last week a pair of US senators on the Senate Judiciary Committee, Lindsey Graham (R-SC) and Richard Blumenthal (D-CT), introduced a flashpoint piece of legislation called The Eliminating Abusive and Rampant Neglect of Interactive Technologies Act (EARN IT). The law, ostensibly designed to dampen the rampant child exploitation activities online, has drawn criticism from civil rights groups, free speech advocates, and cybersecurity professionals during draft discussions. Most observers said it is a sneak attack on end-to-end encryption. The release of the formal version of the bill only solidified this fear.To read this article in full, please click here