Image: Pixabay

Xenotime Group Sets Sights on Electrical Power Plants

Scott Ferguson • June 17, 2019

Xenotime, the group suspected of launching the Trisis malware attack in Saudi Arabia during 2017, has over the past few months shifted its focus beyond the oil and gas industry to target electrical plants and utilities, security firm Dragos reports.

Critical Infrastructure Security

UK Man Sentenced for 2015 TalkTalk Hack

Latest

Artificial Intelligence & Machine Learning

Visual Journal: Infosecurity Europe 2019

Mathew J. Schwartz • June 18, 2019

The annual Infosecurity Europe conference this year returned to London. Here are visual highlights from the event, which featured over 240 sessions and more than 400 exhibitors, 19,500 attendees and keynotes covering data breaches, darknets, new regulations and more.

Endpoint Security

DHS Is Latest to Warn of BlueKeep Vulnerability

Scott Ferguson • June 17, 2019

Yet another warning has been issued about the BlueKeep vulnerability in older versions of Microsoft Windows. The latest comes from the Department of Homeland Security, which tested a remote code execution exploit.

Governance

Enhancing Security by Red Teaming

Nick Holland • June 17, 2019

James Stanger, chief technology evangelist at CompTIA, explains why red teaming can prove highly beneficial in improving organizational security controls.

Endpoint Security

Alerts: Some BD Infusion Pumps Vulnerable to Remote Attacks

Marianne Kolbasuk McGee • June 14, 2019

Medical device vendor Becton Dickinson and U.S. federal regulators have issued security alerts about vulnerabilities that potentially put certain infusion pump products from the manufacturer at risk for remote hacker attacks.

Cybercrime

10 Highlights: Infosecurity Europe 2019 Keynotes

Mathew J. Schwartz • June 14, 2019

Data breaches, incident response and complying with the burgeoning number of regulations that have an information security impact were among the top themes at this year's Infosecurity Europe conference in London. Here are 10 of the top takeaways from the conference's keynote sessions.

Geo Focus: The United Kingdom

Fusing Security With Digital Transformation for SMBs

Nick Holland • June 13, 2019

Digital transformation impacts the way that organizations deal with cybersecurity risk, says Tim Wilkinson of Avast Business, who provides advice how to place security at the center of the transformation.

Training & Security Leadership

Addressing the Human Element in Cybersecurity

Nick Holland • June 13, 2019

James Mackay of MetaCompliance explains techniques for educating and motivating employees to be more aware of cyber risks.

Artificial Intelligence & Machine Learning

Empower Employees While Preventing Insider Data Breaches

Mathew J. Schwartz • June 13, 2019

Carelessness, a lack of security awareness, unclear data ownership and poor toolsets are root causes of insider breaches, says Tony Pepper, CEO of Egress, which recently surveyed CISOs and employees to trace the cause of insider breaches resulting from both intentional and unintentional loss.

Endpoint Security

Top Drivers for Privileged Account Management

Mathew J. Schwartz • June 13, 2019

When it comes to drivers for implementing and maintaining privileged access management programs, Wallix's Grant Burst says that demonstrating compliance and safety remain top priorities. Another driver, he says, is the sheer interconnectedness of devices - driven by the rise of IoT.

Fraud Management & Cybercrime

Best Practices for Session-Based Fraud Detection/Prevention

Mathew J. Schwartz • June 13, 2019

Numerous industries, including financial services, rely on transaction-based controls to help spot and block fraud. But increasingly, organizations are also using session-based fraud detection and prevention as an "early warning" alert system, says Kaspersky's Tim Ayling.

Governance

Beyond Bug Bounties: Crowdsourced Security Testing Evolves

Mathew J. Schwartz • June 13, 2019

Crowdsourced bug bounty programs help organizations identify severe vulnerabilities in their apps and infrastructure. But that gamification model has been evolving to supply not only penetration testing but also deep dives by single researchers, says Bugcrowd CSO David Baker.

Next-Generation Technologies & Secure Development

Proactive Mitigation: A Cybersecurity Imperative

Mathew J. Schwartz • June 13, 2019

A top cybersecurity imperative for organizations is to "take proactive mitigation before an event even occurs" by tracking attack trends and mitigating against emerging types of attacks, says Akamai's Jay Coley.