Thu.Aug 13, 2020

article thumbnail

SANS Institute Sees Its Breach as Teachable Moment

Data Breach Today

Cyberecurity Training Center Wants Others to Learn From Phishing Attack The SANS Institute, which is known for its cybersecurity training courses, is now planning to turn its own data breach into a teachable moment for its membership.

IT 362
article thumbnail

Multiple Retailers Sued Under CCPA for Sharing Data Used to Identify Fraudulent Returns

Hunton Privacy

Earlier this year, The Retail Equation, a loss prevention service provider, and Sephora were hit with a class action lawsuit in which the plaintiff claimed Sephora improperly shared consumer data with The Retail Equation without consumers’ knowledge or consent. The plaintiff claimed The Retail Equation did so to generate risk scores that allegedly were “used as a pretext to advise Sephora that attempted product returns and exchanges are fraudulent and abusive.”.

Retail 144
Insiders

Sign Up for our Newsletter

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

article thumbnail

NIST Issues Final Guidance on 'Zero Trust' Architecture

Data Breach Today

Guidelines Describe Deployment Scenarios The National Institute of Standards and Technology has released the final version of its "zero trust" architecture guidelines that provide a road map for using the architecture in security programs.

Security 344
article thumbnail

Enterprise Architecture: Secrets to Success

erwin

For enterprise architecture, success is often contingent on having clearly defined business goals. This is especially true in modern enterprise architecture, where value-adding initiatives are favoured over strictly “foundational,” “keeping the lights on,” type duties. But what does enterprise architecture success look like? Enterprise architecture is central to managing change and addressing key issues facing organizations.

article thumbnail

Peak Performance: Continuous Testing & Evaluation of LLM-Based Applications

Speaker: Aarushi Kansal, AI Leader & Author and Tony Karrer, Founder & CTO at Aggregage

Software leaders who are building applications based on Large Language Models (LLMs) often find it a challenge to achieve reliability. It’s no surprise given the non-deterministic nature of LLMs. To effectively create reliable LLM-based (often with RAG) applications, extensive testing and evaluation processes are crucial. This often ends up involving meticulous adjustments to prompts.

article thumbnail

US Seizes $2 Million in Cryptocurrency From Terrorist Groups

Data Breach Today

Justice Department Describes How Groups Raised Funds The U.S. Justice Department has seized more than $2 million worth of cryptocurrency from terrorists groups who solicited donations via social media and waged fraud campaigns.

334
334

More Trending

article thumbnail

RedCurl Cyber Espionage Gang Targets Corporate Secrets

Data Breach Today

For-Hire Hackers Tied to Attacks in Canada, U.K., Russia and Beyond Since 2018, an advanced persistent threat group dubbed RedCurl, which has served as a team of for-hire hackers specializing in corporate espionage, has hit at least 14 targets in Canada, Russia, the U.K. and beyond, says cybersecurity firm Group-IB.

article thumbnail

Threat actor leaked data for U.S. gun exchange site on hacking forum

Security Affairs

A threat actor has released the databases of Utah-based gun exchange and hunting sites for free on a cybercrime forum. On August 10th, a hacker has leaked online the databases of Utah-based gun exchange for free on a cybercrime forum. He claims the databases contain 195,000 user records for the utahgunexchange.com, 45,000 records for their video site, 15,000 records from the hunting site muleyfreak.com, and 24,000 user records from the Kratom site deepjunglekratom.com.

article thumbnail

Health Data Breach Tally Surges

Data Breach Today

Victim Count in Magellan Health's April Ransomware Attack Still Climbing Why has the tally of major health data breaches - and the number of individuals affected - spiked in recent weeks? Here's an analysis of the latest trends.

article thumbnail

FBI and NSA joint report details APT28’s Linux malware Drovorub

Security Affairs

The FBI and NSA issue joint alert related to new Linux malware dubbed Drovorub that has been used by the Russia-linked APT28 group. The FBI and NSA have published a joint security alert containing technical details about a new piece of Linux malware, tracked as Drovorub , allegedly employed by Russia-linked the APT28 group. The name comes from drovo [?????

Military 134
article thumbnail

How and Why Should You Be Tracking Geopolitical Risk?

Geopolitical risk is now at the top of the agenda for CEOs. But tracking it can be difficult. The world is more interconnected than ever, whether in terms of economics and supply chains or technology and communication. Geopolitically, however, it is becoming increasingly fragmented – threatening the operations, financial well-being, and security of globally connected companies.

article thumbnail

Derek Manky of FortiGuard Labs on the Shift to Proactive Defense

Data Breach Today

Fortinet's FortiGuard Labs is out with its latest Global Threat Landscape Report, and it tracks cyber adversaries exploiting the COVID-19 pandemic at a worldwide scale. The best response? A shift to proactive defense, says FortiGuard's Derek Manky, Chief, Security Insights & Global Threat Alliances.

Security 246
article thumbnail

Microsoft failed to fix LSASS elevation of privilege flaw

Security Affairs

Microsoft did not properly address an elevation of privilege flaw ( CVE-2020-1509 ) in the Windows Local Security Authority Subsystem Service (LSASS). Google Project Zero researcher who discovered the elevation of privilege flaw ( CVE-2020-1509 ) in the Windows Local Security Authority Subsystem Service (LSASS) warn that Microsoft did not properly address it. “An elevation of privilege vulnerability exists in the Local Security Authority Subsystem Service (LSASS) when an authenticated atta

article thumbnail

Thwarting BEC Scams That Target Privileged Users

Data Breach Today

CISO Espen Otterstad on Enterprise Risk Management To help mitigate the risks posed by business email compromise scams that target privileged users, enterprises need to create a detailed enterprise risk management plan that spells out procedures to secure accounts, says Espen Otterstad, CISO at Norwegian telematics company ABAX AS.

Risk 147
article thumbnail

How to boost your Cyber Essentials certification

IT Governance

Cyber Essentials, the UK government-assured security scheme, is a terrific way of giving you a general overview of the effectiveness of your cyber security practices. Its practical approach helps you manage basic cyber security concerns, such as detecting and preventing malware, patching software vulnerabilities, avoiding unauthorised access to systems and networks and improving secure configuration.

article thumbnail

7 Pitfalls for Apache Cassandra in Production

Apache Cassandra is an open-source distributed database that boasts an architecture that delivers high scalability, near 100% availability, and powerful read-and-write performance required for many data-heavy use cases. However, many developers and administrators who are new to this NoSQL database often encounter several challenges that can impact its performance.

article thumbnail

Amazon Alexa ‘One-Click’ Attack Can Divulge Personal Data

Threatpost

Researchers disclosed flaws in Amazon Alexa that could allow attackers to access personal data and install skills on Echo devices.

article thumbnail

ISIS Allegedly Ran a Covid-19 PPE Scam Site

WIRED Threat Level

The Justice Department says that an agent of the terrorist organization operated FaceMaskCenter.com, in part of a series of cryptocurrency-related complaints.

Security 105
article thumbnail

NSA, FBI Warn of Linux Malware Used in Espionage Attacks

Threatpost

A never before seen malware has been used for espionage purposes via Linux systems, warn the NSA and FBI in a joint advisory.

135
135
article thumbnail

An “enhanced” Privacy Shield is being negotiated – third time a charm?

Data Protection Report

On 10 August, the European Commission and the US Department of Commerce confirmed that talks have begun between the EU and US for an “enhanced” Privacy Shield. This will be the third attempt to revise this framework, following the invalidation of Safe Harbor in 2015 and Privacy Shield in July 2020. Third time a charm? We’re not so sure. By way of recap, in Schrems II , the court made clear that Privacy Shield was invalid for three main reasons: US surveillance rules are disproportionate.

Privacy 95
article thumbnail

Reimagined: Building Products with Generative AI

“Reimagined: Building Products with Generative AI” is an extensive guide for integrating generative AI into product strategy and careers featuring over 150 real-world examples, 30 case studies, and 20+ frameworks, and endorsed by over 20 leading AI and product executives, inventors, entrepreneurs, and researchers.

article thumbnail

New Global Threat Landscape Report Reveals ‘Unprecedented’ Cyberattacks

Threatpost

Fortinet's recently released Global Threat Landscape Report shows how the perimeter is extending to the home in the first half of 2020 - and what that means for cybercrime.

article thumbnail

Security Jobs With a Future -- And Ones on the Way Out

Dark Reading

Some titles are hot, while others are not, amid rapidly shifting business priorities.

Security 136
article thumbnail

Zoom Faces More Legal Challenges Over End-to-End Encryption

Threatpost

The video-conferencing specialist has yet to roll out full encryption, but it says it's working on it.

article thumbnail

With iOS's Privacy Nutrition Label, Apple Upstages Regulators

Dark Reading

New iOS privacy features require developers to disclose what data they're collecting, how they're using it, and with whom they share it.

Privacy 108
article thumbnail

How to Migrate From DataStax Enterprise to Instaclustr Managed Apache Cassandra

If you’re considering migrating from DataStax Enterprise (DSE) to open source Apache Cassandra®, our comprehensive guide is tailored for architects, engineers, and IT directors. Whether you’re motivated by cost savings, avoiding vendor lock-in, or embracing the vibrant open-source community, Apache Cassandra offers robust value. Transition seamlessly to Instaclustr Managed Cassandra with our expert insights, ensuring zero downtime during migration.

article thumbnail

ReVoLTE Attack Allows Hackers to Listen in on Mobile Calls

Threatpost

Rare attack on cellular protocol exploits an encryption-implementation flaw at base stations to record voice calls.

article thumbnail

An Alexa Bug Could Have Exposed Your Voice History to Hackers

WIRED Threat Level

Amazon has patched the flaw, but its discovery underscores the importance of locking down your voice assistant interactions.

IT 109
article thumbnail

High-Severity TinyMCE Cross-Site Scripting Flaw Fixed

Threatpost

The cross-site scripting flaw could enable arbitrary code execution, information disclosure - and even account takeover.

Security 110
article thumbnail

CISA Warns of Phishing Campaign with Loan-Relief Lure

Dark Reading

Phishing emails and fake website promise help with the Small Business Administration's program that aids those affected by COVID-19.

Phishing 109
article thumbnail

Entity Resolution Checklist: What to Consider When Evaluating Options

Are you trying to decide which entity resolution capabilities you need? It can be confusing to determine which features are most important for your project. And sometimes key features are overlooked. Get the Entity Resolution Evaluation Checklist to make sure you’ve thought of everything to make your project a success! The list was created by Senzing’s team of leading entity resolution experts, based on their real-world experience.

article thumbnail

UAE Hack and Leak Operations

Schneier on Security

Interesting paper on recent hack-and-leak operations attributed to the UAE: Abstract: Four hack-and-leak operations in U.S. politics between 2016 and 2019, publicly attributed to the United Arab Emirates (UAE), Qatar, and Saudi Arabia, should be seen as the "simulation of scandal" ­ deliberate attempts to direct moral judgement against their target.

Paper 116
article thumbnail

Emotet Return Brings New Tactics & Evasion Techniques

Dark Reading

Security researchers tracking Emotet report its reemergence brings new tricks, including new evasion techniques to bypass security tools.

Security 100
article thumbnail

Digital Health and Cyber Risk in the “New Normal”

Data Matters

Sidley partnered with Aon’s Cyber Solutions for an exclusive webinar for life sciences organizations to address developments in digital health and cybersecurity in light of some key trends affecting the industry today. The speakers discussed the latest in digital health and how to better understand and mitigate cyber risk, as well as protect life sciences organizations’ highly valuable and sensitive data.

Risk 97