Content by Mathew J. Schwartz

PwndLocker: Free Decryptor Frees Crypto-Locked Data

Mathew J. Schwartz  •  March 10, 2020

Security firm Emsisoft is offering free, customized decryptors to victims of PwndLocker ransomware, which first surfaced in late 2019 and has been tied to attacks against Lasalle County in Illinois and the Serbian city of Novi Sad, with the gang demanding up to $660,000 or more in bitcoins from its victims.

Careless and Malicious Insiders: The Threat Persists

Mathew J. Schwartz  •  March 10, 2020

Careless and malicious insiders, overly complex IT infrastructure and having an excess of privileged users continue to pose serious risks to the integrity of corporate cybersecurity practices, says Timothy Brown of SolarWinds.

The State of Endpoint Resilience: Improvement Required

Mathew J. Schwartz  •  March 10, 2020

The state of endpoint security might appear good at first glance, but look below the surface and the situation may not be as rosy as it seems, says Christy Wyatt, CEO of Absolute, based on her company's new "2020 Endpoint Resilience Report."

Ransomware Gangs Hit Larger Targets, Seeking Bigger Paydays

Mathew J. Schwartz  •  March 9, 2020

Targeted ransomware attacks continue to increase as gangs seek to obtain bigger ransom payoffs by hitting larger targets, aided by a cybercrime services economy that provides access to tools and tactics that were previously the domain of APT groups, security experts warn.

Security-as-a-Service Imperative: Predictive, Not Reactive

Mathew J. Schwartz  •  March 9, 2020

For maximum effectiveness, security-as-a-service solutions can no longer simply be reactive, but must instead be predictive, says Mat Gyde, CEO Security Division, NTT Ltd., and Palo Alto Network's Karl Soderlund, as they describe their companies' new partnership.

Why Risk Literacy Is Essential for Digital Transformation

Mathew J. Schwartz  •  March 9, 2020

Want to maximize your digital transformation project success and impact? Start by ensuring that you correctly explain risk to stakeholders, as well as continually benchmark your organization's risk management maturity, says ServiceNow's Barbara Kay.

How Technical Do CISOs Need To Be?

Mathew J. Schwartz  •  March 6, 2020

Do CISOs need to have deep technical proficiency? Many information security professionals will say: "Of course." Ask them which skills rank highest, however, and you'll hear words such as "communication" and "building trust," says Thom Langford, director of (TL)2 Security.

From Cybercrime Zero to 'Hero' - Now Faster Than Ever

Mathew J. Schwartz  •  March 6, 2020

No advanced hacking skills required: The burgeoning cybercrime-as-a-service economy continues to make it easy for aspiring cybercriminals to procure highly automated, easy-to-use and effective attack tools to fuel illicit profits, says Liv Rowley, a threat intelligence analyst at Blueliv.

7 RSA Takeaways: 'Human Element' Meets COVID-19 Concerns

Mathew J. Schwartz  •  March 6, 2020

RSA 2020 touched on a number of topics, including the security of elections and supply chains, plus AI, zero trust and frameworks, among many others. But from sessions on cryptography, to this year's lower attendance, to the antibacterial dispensers dotted around venues, concerns over COVID-19 also dominated.

Zero Trust and the Battle to Block Data Breaches

Mathew J. Schwartz  •  March 5, 2020

Ten years since he coined the term "zero trust," John Kindervag, field CTO of Palo Alto Networks, sees CISOs increasingly being faced with the challenge of having to implement the "never trust, always verify" model across increasingly complex IT environments, including cloud and IoT.

8 Takeaways: The Cryptographer's Panel at RSA 2020

Mathew J. Schwartz  •  March 5, 2020

The Cryptographer's Panel, which sees five cryptography experts analyze and debate top trends, remains a highlight of the annual RSA conference. For 2020, the panel focused on such topics as facial recognition, election integrity and the never-ending crypto wars, while giving shout-outs to bitcoin and blockchain.

Cyberattack Trends and Essential Hack-Repelling Defenses

Mathew J. Schwartz  •  March 5, 2020

The human element is a fundamental component of some of the newest cyberattacks that Sophos has been tracking, says the firm's principal research scientist, Chet Wisniewski, who advises organizations to adapt their security and protection plans accordingly.

Why Doesn't Software Get Sold With a List of Ingredients?

Mathew J. Schwartz  •  March 4, 2020

Just as consumers can look at a box of Twinkies and read a list of ingredients, so too should software makers provide users with a "bill of materials" explaining their composition, says Allan Friedman, director of cybersecurity initiatives at the U.S. National Telecommunications and Information Administration.

DevOps and the State of Software Security

Mathew J. Schwartz  •  March 4, 2020

Software development over the past decade: The good news is that more organizations than ever have secure software development practices in place, says Chris Eng, chief research officer at Veracode. But the bad news is that many of the same flaws - including injection vulnerabilities - persist.

Taming Regulations: Frameworks Needed More Than Ever

Mathew J. Schwartz  •  March 4, 2020

As organizations face having to demonstrate compliance with a broad range of regulations that have an IT and cybersecurity impact, the imperative is to adopt frameworks such as ISO 27001 and NIST 800-53, says David Ogbolumani, chief cybersecurity and privacy officer at IT Security Consultants.