Ransomware: Best Practices for Negotiating a Ransom Payment

Mathew J. Schwartz • November 25, 2021

No ransomware victim ever wants to pay a ransom. But if for whatever reason they choose to do so, multiple tactics can help them negotiate down initial demands by 50% or more. So say two researchers at NCC Group's cybersecurity division Fox-IT, based on their review of over 700 ransomware negotiations.

Application Security

Misconfigured FBI Email System Abused to Run Hoax Campaign

Latest

Cybercrime

The Best Gift for the Holidays? An Incident Response Plan

Anna Delaney • November 26, 2021

In the latest weekly update, four editors at Information Security Media Group discuss important cybersecurity issues, including why security teams are still unprepared for cyberattacks over weekends and holidays, which experts warn is when attackers love to strike.

Endpoint Security

Medical Data Exposed in Breach at True Health New Mexico

Jeremy Kirk • November 26, 2021

A health insurer in New Mexico is warning of a data breach that exposed customers' personal and medical information. True Health New Mexico reports that nearly 63,000 individuals' personal details were exposed in the "early October" incident. It's offering all victims prepaid credit monitoring services.

3rd Party Risk Management

Essential Preparations for the Holiday Season Attack Surge

Anna Delaney • November 26, 2021

The latest edition of the ISMG Security Report features an analysis of how organizations can reduce risk especially over holidays and weekends, when attackers are most likely to strike. Also featured: Highlights from Ireland's IRISSCON 2021 cybercrime conference; what's ahead for COVID-19 and the workplace?

Critical Infrastructure Security

Cybersecurity Unplugged: Improving Healthcare Security

Steve King • November 26, 2021

In this episode of "Cybersecurity Unplugged," Dan Bowden, CISO at Sentara Health, discusses telemedicine, IoMT, and explains why we’re lagging so far behind in healthcare security. "It’s because of how the data is managed, data standards, data integrity."

COVID-19

UK Legislation Seeks Mandatory Security Standards for IoT

Prajeet Nair • November 25, 2021

Could the internet of things be made more secure? A draft law in Britain would impose stronger cybersecurity regulations for manufacturers, importers and distributors of smartphones, TVs, toys and other "connected" digital devices, backed by the threat of fines of up to $13 million for noncompliance.

Cybercrime

Ukraine's Secret Service Busts 5 Alleged 'Phoenix' Hackers

Mihir Bagwe • November 25, 2021

The Secret Service of Ukraine has arrested five Ukrainian citizens on suspicion of being part of a cybercrime group called Phoenix, which it says has been tied to hacking hundreds of mobile devices, stealing personal data and also selling "hacking as a service" to others.

Fraud Management & Cybercrime

Synthetic ID Fraud: What to Look Forward to in 2022

Suparna Goswami • November 24, 2021

Automation, a good criminal network and the ability to use accounts as an alias are some of the factors contributing to synthetic ID fraud, says a panel of three experts.

Blockchain & Cryptocurrency

Financial Agencies Eye Existing Laws for Crypto Regulation

Dan Gunderman • November 24, 2021

Three U.S. financial agencies have conducted a series of "policy sprints" around cryptocurrency assets and related regulatory gaps, and plan to amend existing guidance and regulations to address security and market risks, the Board of Governors for the Federal Reserve said this week.

3rd Party Risk Management

Apple Sues NSO for Product and Service Abuse

Mihir Bagwe • November 24, 2021

The NSO Group is the target of a lawsuit filed by Apple, which alleges that the spyware maker abused Apple's products and services to carry out spying operations. The news follows the NSO Group's blacklisting by the U.S. government, a score downgrade by Moody's, and a reportedly failed deal with France.

Blockchain & Cryptocurrency

Cryptocrimes Proliferate: Ransomware, New Threat Campaigns

Prajeet Nair • November 24, 2021

Cryptocurrency exchange BTC-Alpha faces a ransomware attack; Morphisec researchers investigate malware that targets cryptocurrency, NFT communities on Discord; and RiskIQ researchers uncover fresh Aggah campaign that deploys clipboard hijacking code to swap a victim's cryptocurrency address.

Business Continuity Management / Disaster Recovery

Why Ransomware Is a Game Changer for Cyber Insurance

Marianne Kolbasuk McGee • November 24, 2021

Ransomware attacks have become the game changer in driving up security requirements, policy premiums and rejection rates for healthcare sector entities seeking new cyber insurance policies or renewals, says Doug Howard, CEO of privacy and security consultancy Pondurance.

3rd Party Risk Management

How to Save Money on Pen Testing - Part 1

Charles Gillman • November 24, 2021

The findings from a penetration test can help you identify risks and gaps in your security controls. Charles Gillman offers tips to maximize the value of your next pen test and, in the process, deliver better results.