Latest

Governance & Risk Management

VA Center's IT Legacy Flaws Common at Other Health Entities

Marianne Kolbasuk McGee  •  September 29, 2022

A watchdog security audit of a south Texas VA center identified a variety of deficiencies related to legacy systems still in use years after no longer being supported with vendor updates. The findings represent the state of security at many organizations across the healthcare sector, experts say.

Cloud Security

Malware Shifting to Virtual Environments, Warns Mandiant

Prajeet Nair  •  September 29, 2022

Hackers may shift malware attacks into technical environments beyond the reach of endpoint detection and response, says Mandiant. The threat intel firm says it uncovered a novel malware family targeting VMware hypervisors and virtual machine appliances.

►

Application Security

Tom Kellermann's New Mission: Secure the Code

Tom Field  •  September 29, 2022

Over his 23-year career in cybersecurity, Tom Kellermann has focused on policy, endpoints and even strategic investments. Now, in his new role as senior vice president of cyber strategy at Contrast Security, his mission is to protect code security - particularly in the public and financial sectors.

Cybercrime

Examining What Went Wrong for Optus

Anna Delaney  •  September 29, 2022

The latest edition of the ISMG Security Report discusses what went wrong for Optus in the wake of one of Australia's biggest data breach incidents, the state of code security today and the growing trend of private equity firms pursuing take-private deals.

Cyberwarfare / Nation-State Attacks

Cyberwar: Assessing the Geopolitical Playing Field

Steve King  •  September 29, 2022

The United States is arguably involved in a cyberwar against Russia and China - and appears to be losing. In this episode of "Cybersecurity Unplugged," Tom Kellerman of Contrast Security and Richard Bird of Traceable.ai discuss what the U.S. government and companies need to do to win this cyberwar.

Endpoint Security

The Troublemaker CISO: How Much Profit Equals One Life?

CyberEdBoard  •  September 29, 2022

"It's stupid and adds zero value," writes Ian Keller, director of security at a telecom company, about connecting hospital networks - and especially life-sustaining information - to the internet. He encourages CISOs to be socially responsible about their moral obligation to patients.

Breach Notification

Microsoft 365 Email Hack Led to American Airlines Breach

Cal Harrison  •  September 28, 2022

American Airlines says unauthorized access to its email system is behind a July data breach incident affecting more than 1,700 individuals. Someone synced with an employee's inbox to send out phishing emails that appeared to come from the Texas-based airliner.

Endpoint Security

WhatsApp Patches 2 Flaws Affecting Apple and Android Users

Mihir Bagwe  •  September 28, 2022

Chat app WhatsApp patched two memory-related flaw that could be exploited by an attacker as a first step to installing smartphone malware on Android or Apple devices. WhatsApp vulnerabilities can be highly valuable to malicious actors.

Healthcare

Groups Urge HHS to Extend 'Information Blocking' Deadline

Marianne Kolbasuk McGee  •  September 28, 2022

Healthcare providers and their health IT vendors need more time to meet a pending federal deadline to comply with information-sharing regulations that pertain to an expanding set of electronic health information, say a slew of heavyweight lobbying groups in a letter to federal regulators.

Cybercrime

Would-Be Software Pirates Served Malware Through 'NullMixer'

Prajeet Nair  •  September 27, 2022

A new malware dropper uncovered by Kaspersky targets would-be users of pirated software with a slew of nasty infections including backdoors, Trojan-Banker programs, downloaders, spyware and more. The cybersecurity company calls the dropper "NullMixer."

Governance & Risk Management

California Restricts Sharing Abortion Data With Other States

Marianne Kolbasuk McGee  •  September 27, 2022

California Gov. Gavin Newsom on Tuesday signed into law two bills containing privacy protections for information related to reproductive health and abortion, in the wake of the Supreme Court's ruling overturning Roe v. Wade. Other states may follow suit.

Governance & Risk Management

FDA Authorization Bill Drops Medical Device Cybersecurity

Marianne Kolbasuk McGee  •  September 27, 2022

A congressional deal will ensure the U.S. Food and Drug Administration can continue collecting fees from medical device manufacturers but at the price of dropping increased cybersecurity mandates for the industry. Requiring manufacturers to patch devices had bipartisan support.