Possible Chinese Hackers Exploit Microsoft Exchange 0-Days

Prajeet Nair • September 30, 2022

Hackers, possibly Chinese, are exploiting Microsoft Exchange zero-day vulnerabilities to apparently implant backdoors and steal credentials. The computing giant says it doesn't yet have a patch, telling systems administrators to instead implement workarounds.

Cloud Security

Australian Telco Optus Warns of 'Significant' Data Breach

Latest

Breach Notification

Shangri-La Hotels Hit by Data Breach Incident

Mihir Bagwe • October 3, 2022

Upscale Asian hotelier Shangri-La Group has copped to a data breach incident that may affect hundreds of thousands of guests. The hotel detected unauthorized access to its guest database in July but didn't notify guests or regulators until September.

Application Security

Tim Eades of vArmour on Expanding From Banking to Government

Michael Novinson • October 3, 2022

While vArmour has enjoyed success in banking, the U.S. government is now the fastest-growing part of its business. CEO Tim Eades says much of the government doesn't understand the relationships and dependencies among vArmour's applications or the consequences of an application going down.

Governance & Risk Management

Digital Identity Bill Passes Key Senate Milestone

Cal Harrison • October 3, 2022

A Senate committee this week approved a bill that would create governmentwide standards for identity verification and provide grants to help states and local agencies upgrade ID systems and offer online digital identity services. Supporter Jeremy Grant hopes to see a full Senate vote in 2022.

Access Management

Passwords Are Unfit - So Why Do We Still Have Them?

Steve King • October 3, 2022

Passwords are supported everywhere. But, says Andrew Shikiar, executive director of the FIDO Alliance, "they have been proven time and time again to simply be unfit for today's networked economy." In this episode of "Cybersecurity Unplugged," Shikiar discusses how to move beyond passwords.

Business Continuity Management / Disaster Recovery

Pentagon Bug Bounty Program Uncovers 350 Vulnerabilities

Prajeet Nair • October 1, 2022

The U.S. Department of Defense uncovered almost 350 vulnerabilities in the department's networks as part of its experimental bug bounty program launched on American Independence Day. The weeklong bug bounty challenge called "Hack U.S." ran from July Fourth to July 11.

Fraud Management & Cybercrime

North Korea Trojanizing Open-Source Software

Mihir Bagwe • September 30, 2022

North Korea is using weaponized versions of open-source utilities to spy on the technology, defense and entertainment sectors worldwide. Microsoft says it spotted fake profiles of supposed job recruiters who really are Pyongyang hackers manipulating victims into downloading Trojans.

Cloud Security

Cloudflare, VCs Join Forces to Give Away $1.25B to Startups

Michael Novinson • September 30, 2022

Cloudflare has joined forces with 26 venture capital firms to provide up to $1.25 billion in financing to startups building on the company's developer platform. The Workers Launchpad Funding Program will connect developers with investors around the world to scale their startups faster.

Governance & Risk Management

DOJ: Army Doc, Wife Sought to Leak Health Records to Russia

Marianne Kolbasuk McGee • September 30, 2022

A Maryland couple faces federal indictment for an alleged conspiracy to provide the Russian government with military medical records. Anna Gabrielian and U.S. Army Maj. Jamie Lee Henry supplied an undercover FBI agent with medical records of military personnel.

Cloud Security

Orca Security's Avi Shua on Making Cloud Safe for Government

Michael Novinson • September 30, 2022

Security firms must increasingly follow U.S. government security requirements even if they don't serve federal agencies themselves, says Avi Shua, Orca Security co-founder and CEO. That's because cloud vendors such as Orca often serve businesses that contract or subcontract with the U.S. government.

3rd Party Risk Management

ISMG Editors: Will Others Follow US Lead to Legislate SBOMs?

Anna Delaney • September 30, 2022

In the latest weekly update, ISMG editors discuss how organizations can comply with the new PCI DSS 4.0 requirements, whether other countries should follow the U.S. lead on legislating software bills of materials, and key strategies for CISOs preparing for an economic downturn.

Big Data Security Analytics

Atos Rejects $4.12B Onepoint Bid for Cybersecurity Business

Michael Novinson • September 29, 2022

Atos turned down an unsolicited $4.12 billion offer from rival Onepoint to acquire the French conglomerate's $4.8 billion cybersecurity, big data and digital business. Atos received a letter of intent Tuesday related to the acquisition of its Evidian business by Onepoint and private equity fund ICG.

Cloud Access Security Brokers (CASB)

Zscaler Buys Workflow Automation Firm ShiftRight for $25.6M

Michael Novinson • September 29, 2022

Zscaler has bought out of stealth a startup established by the founders of Lacework to automate security management and dramatically reduce incident resolution time. ShiftRight will give customers real-time visibility into their security posture and help them manage an influx of risks and incidents.