Sat.Aug 15, 2020 - Fri.Aug 21, 2020

article thumbnail

So You Want to Build a Vulnerability Disclosure Program?

Data Breach Today

Bug Bounty Pioneer Katie Moussouris on Challenges, Sustainability, Election Security To build a successful vulnerability disclosure program, avoid thinking of it as quick-fix "bug bounty Botox," and instead focus on building positive relationships with the security community, hiring top-notch talent and "building a sustainable ecosystem," says Luta Security's Katie Moussouris.

Security 364
article thumbnail

FBI, CISA Echo Warnings on ‘Vishing’ Threat

Krebs on Security

The Federal Bureau of Investigation (FBI) and the Cybersecurity and Infrastructure Security Agency (CISA) on Thursday issued a joint alert to warn about the growing threat from voice phishing or “ vishing ” attacks targeting companies. The advisory came less than 24 hours after KrebsOnSecurity published an in-depth look at a crime group offering a service that people can hire to steal VPN credentials and other sensitive data from employees working remotely during the Coronavirus pand

Insiders

Sign Up for our Newsletter

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

article thumbnail

NEW TECH: A better way to secure agile software — integrate app scanning, pen testing into WAF

The Last Watchdog

The amazing array of digital services we so blithely access on our smartphones wouldn’t exist without agile software development. Related: ‘Business logic’ hacks on the rise Consider that we began this century relying on the legacy “waterfall” software development process. This method required a linear plan, moving in one direction, that culminated in a beta deliverable by a hard and fast deadline.

Security 186
article thumbnail

The Schrems II decision – some EU data exporters will face a huge task to work out whether SCCs are sufficient

Data Protector

Many privacy professionals will be shocked to learn that, in terms of safeguarding personal data flows from an EU to a non-EU country, in the absence of an adequacy decision, more is required than simply slipping the right set of SCCs into a vendor contract. The CEJU has clarified that one of the key tasks facing data exporters, when considering whether SCCs are appropriate, is to consider whether there is a conflict between the protections afforded by the SCCs and other local laws, particularly

GDPR 156
article thumbnail

Peak Performance: Continuous Testing & Evaluation of LLM-Based Applications

Speaker: Aarushi Kansal, AI Leader & Author and Tony Karrer, Founder & CTO at Aggregage

Software leaders who are building applications based on Large Language Models (LLMs) often find it a challenge to achieve reliability. It’s no surprise given the non-deterministic nature of LLMs. To effectively create reliable LLM-based (often with RAG) applications, extensive testing and evaluation processes are crucial. This often ends up involving meticulous adjustments to prompts.

article thumbnail

Medical Records Exposed via GitHub Leaks

Data Breach Today

Report: 9 Leaks Account for Exposure of PHI for at Least 150,000 Patients Never store hardcoded credentials in code uploaded to public-facing GitHub repositories, and make sure none of your business associates are doing that. Those are just two takeaways from a new report that describes how nine organizations were inadvertently exposing health records for at least 150,000 patients.

363
363

More Trending

article thumbnail

Cruise ship operator Carnival crippled by ransomware

IT Governance

Carnival has suffered a ransomware attack, putting the personal data of both customers and staff at risk. The Florida-based cruise operator says that the incident, which was discovered on 15 August, affected the IT systems of one of its brands – which include Cunard, P&O, AIDA and Princess – although it hasn’t specified which one. In a statement , the organisation says that it “does not believe the incident will have a material impact on its business, operations or financial results”.

article thumbnail

Data Protection: Where’s the Brexit Privacy Dividend?

Data Protector

One of the Government's core objectives throughout the Brexit negotiations has been to respect data protection rights, slash Brussels' red tape and allow the United Kingdom to be a competitive safe haven for businesses all over the world. With that in mind, how could the Government reduce its ties to the EU's 'data protection level playing field' while continuing to maintain a robust and effective data protection regime?

Privacy 156
article thumbnail

Carnival Cruise Ship Firm Investigating Ransomware Attack

Data Breach Today

SEC Filing Warns That Guest and Employee Data Likely Compromised Carnival Corp., the world's largest cruise ship company, is investigating a ransomware attack that likely compromised guest and employee data, according its filing with the SEC. It's the company's second security incident this year.

article thumbnail

Microsoft Put Off Fixing Zero Day for 2 Years

Krebs on Security

A security flaw in the way Microsoft Windows guards users against malicious files was actively exploited in malware attacks for two years before last week, when Microsoft finally issued a software update to correct the problem. One of the 120 security holes Microsoft fixed on Aug. 11’s Patch Tuesday was CVE-2020-1464 , a problem with the way every supported version of Windows validates digital signatures for computer programs.

Security 348
article thumbnail

How and Why Should You Be Tracking Geopolitical Risk?

Geopolitical risk is now at the top of the agenda for CEOs. But tracking it can be difficult. The world is more interconnected than ever, whether in terms of economics and supply chains or technology and communication. Geopolitically, however, it is becoming increasingly fragmented – threatening the operations, financial well-being, and security of globally connected companies.

article thumbnail

University of Utah pays a $457,000 ransom to ransomware gang

Security Affairs

The University of Utah admitted to have paid a $457,059 ransom in order to avoid having ransomware operators leak student information online. The University of Utah admitted having paid a $457,059 ransom after the ransomware attack that took place on July 19, 2020, that infected systems on the network of the university’s College of Social and Behavioral Science [CSBS]).

article thumbnail

Privacy Shield shafted – but do SCCs really deliver better privacy protections?

Data Protector

Here we go again. The compulsory Sunday morning church services for all Anglicans at my boarding school served as an opportunity for The Reverend James Culross, (or Druid, as we boys affectionately called him), to churn out stuff from the Book of Common Prayer. It was stuff designed to cleanse our souls and provide us with helpful words of comfort, to prepare us for the horrors that would be inflicted upon each and every one of us during the school week ahead.

Privacy 156
article thumbnail

Marriott Hit With Class-Action Data Breach Lawsuit

Data Breach Today

UK Claim Seeks Damages Under GDPR Over Long-Running Starwood Reservation System Hack Marriott faces a new class-action lawsuit, filed in Britain, over the breach of its Starwood guest reservation system. The breach ran from 2014 to 2018 - Marriott acquired Starwood in 2016 - and exposed personal information for an estimated 7 million customers in the U.K.

article thumbnail

Let’s Social Distance Together, Register Now for erwin Insights 2020

erwin

I’m thrilled to officially announce that registration is open for our first global conference as erwin, Inc. erwin Insights 2020 is a free, virtual, two-day event being held October 13-14. Social distancing doesn’t mean we should stop connecting. In fact, opportunities for personal and professional growth are more important than ever. That’s why we look forward to bringing together erwin’s global community of users, partners, prospects and friends to engage and explore ideas, experiences, trends

article thumbnail

7 Pitfalls for Apache Cassandra in Production

Apache Cassandra is an open-source distributed database that boasts an architecture that delivers high scalability, near 100% availability, and powerful read-and-write performance required for many data-heavy use cases. However, many developers and administrators who are new to this NoSQL database often encounter several challenges that can impact its performance.

article thumbnail

Keeping up the fight on cancer during pandemic

OpenText Information Management

In just a few months, COVID-19 changed the world. Millions have been infected and hundreds of thousands have died at the time of writing. This health emergency has strained healthcare systems around the world. Amidst this disruption, COVID-19 has put innumerable other lives at risk. Other diseases and conditions haven’t gone away during the pandemic. … The post Keeping up the fight on cancer during pandemic appeared first on OpenText Blogs.

Risk 140
article thumbnail

Data Protection: Whither the EU’s SCCs …

Data Protector

It is possible that the European Commission will fail to provide the UK with a data protection adequacy assessment by the end of the year. It is also possible that, in the near future, the EU will publish revised sets of Standard Contractual Clauses to replace the existing SCCs in a bold effort to ensure that flows of personal data outside the European Union remain suitably protected.

GDPR 120
article thumbnail

Ransomware Payday: Average Payments Jump to $178,000

Data Breach Today

Coveware: Average Ransom Paid Jumps 60%; Sodinokibi, Maze, Phobos Dominate Ransomware gangs continue to see bigger payoffs from their ransom-paying victims, driven by "big-game hunting," data exfiltration and smaller players seeking larger returns, according to ransomware incident response firm Coveware.

article thumbnail

What Is Enterprise Architecture (EA)? – Definition, Methodology & Best Practices

erwin

Enterprise architecture (EA) is a strategic planning initiative that helps align business and IT. It provides a visual blueprint, demonstrating the connection between applications, technologies and data to the business functions they support. In this post: What Is Enterprise Architecture? Think City Planning. Why Is Enterprise Architecture Important?

Big data 140
article thumbnail

Entity Resolution Checklist: What to Consider When Evaluating Options

Are you trying to decide which entity resolution capabilities you need? It can be confusing to determine which features are most important for your project. And sometimes key features are overlooked. Get the Entity Resolution Evaluation Checklist to make sure you’ve thought of everything to make your project a success! The list was created by Senzing’s team of leading entity resolution experts, based on their real-world experience.

article thumbnail

Technology giant Konica Minolta hit by a ransomware attack

Security Affairs

IT giant Konica Minolta was hit with a ransomware attack at the end of July, its services have been impacted for almost a week. A ransomware attack has impacted the services at the business technology giant Konica Minolta for almost a week, the attack took place at the end of July. Konica Minolta is a Japanese multinational technology company headquartered in Marunouchi, Chiyoda, Tokyo, with offices in 49 countries worldwide.

article thumbnail

GDPR supervisory authorities issued £2.6 million in fines in Q2 2020

IT Governance

In the second quarter of 2020, data protection bodies across Europe issued at least 46 administrative fines under the GDPR (General Data Protection Regulation) , with the penalties totalling nearly €2.9 million (£2.6 million). This is a sharp decrease on Q1, which saw more than £45 million in fines – something that is to be expected given the disruption caused by COVID-19.

GDPR 128
article thumbnail

Fraudsters Putting on the Ritz

Data Breach Today

Luxury London Hotel Investigates 'Food and Beverage Reservation System' Data Breach Scammers have reportedly been putting one over on customers of the famous Ritz London, which says it is "aware of a potential data breach within our food and beverage reservation system, which may have compromised some of our clients' personal data." No payment card data was exposed, it says.

article thumbnail

Ransomware Attack on Carnival May Have Been Its Second Compromise This Year

Dark Reading

Security vendor Prevailion says it observed signs of malicious activity on the cruise operator's network between at least February and June.

IT 143
article thumbnail

Reimagined: Building Products with Generative AI

“Reimagined: Building Products with Generative AI” is an extensive guide for integrating generative AI into product strategy and careers featuring over 150 real-world examples, 30 case studies, and 20+ frameworks, and endorsed by over 20 leading AI and product executives, inventors, entrepreneurs, and researchers.

article thumbnail

ATM Hackers Have Picked Up Some Clever New Tricks

WIRED Threat Level

Over the last few years, so-called jackpotting attacks have gotten increasingly sophisticated—while cash machines remain largely the same.

Security 142
article thumbnail

Thousands of Canadian government accounts hacked, Treasury Board of Canada Secretariat say

Security Affairs

The Treasury Board of Canada Secretariat confirmed that thousands of user accounts for online Canadian government services were recently hacked. According to a press release issued by the Treasury Board of Canada Secretariat, thousands of user accounts for online government services were recently hacked. The hackers targeted the GCKey service with credential stuffing attacks, the service is used by some 30 federal departments and Canada Revenue Agency accounts.

article thumbnail

Dozens Arrested in ATM Cash-Out Scheme

Data Breach Today

Suspected Fraudsters Targeted Santander Bank Branches in 3 States Dozens of suspects have reportedly been arrested in connection with an ATM cash-out scheme that targeted Santander Bank branches in New Jersey, New York and Connecticut.

321
321
article thumbnail

Smart-Lock Hacks Point to Larger IoT Problems

Dark Reading

Two recent reports on smart-locks vulnerabilities show that IoT vendors have a bigger job to do in ensuring their products are safely deployed and configured.

IoT 134
article thumbnail

Strategic CX: A Deep Dive into Voice of the Customer Insights for Clarity

Speaker: Nicholas Zeisler, CX Strategist & Fractional CXO

The first step in a successful Customer Experience endeavor (or for that matter, any business proposition) is to find out what’s wrong. If you can’t identify it, you can’t fix it! 💡 That’s where the Voice of the Customer (VoC) comes in. Today, far too many brands do VoC simply because that’s what they think they’re supposed to do; that’s what all their competitors do.

article thumbnail

Weekly Update 205

Troy Hunt

Between still feeling a little groggy after hitting the water hard on an early wake boarding session then my camera overheating and shutting down towards the end of the live stream, this wasn't the smoothest of weekly updates, I still got across everything I needed to. I'm especially excited about those Shelly 1 units for cheaply IoT'ing existing lights and I'm hoping to have some of that up and running next week.

article thumbnail

Steel sheet giant Hoa Sen Group hacked by Maze ransomware operators

Security Affairs

Experts at threat intelligence firm Cyble came across a post published by Maze ransomware operators claiming to have breached the steel sheet giant Hoa Sen Group. During the ordinary monitoring of Deepweb and Darkweb , researchers at Cyble came across the leak disclosure post published by the Maze ransomware operators that claim the hack of the Hoa Sen Group.

article thumbnail

Former Uber CSO Charged With Covering Up 2016 Data Breach

Data Breach Today

Joe Sullivan Accused of Making 'Hush Money' Bitcoin Payoff to Hackers The U.S. Department of Justice has charged former Uber CSO Joseph Sullivan with obstruction of justice for allegedly covering up the 2016 hack of the ride-sharing service, which compromised sensitive data for 57 million Uber passengers and drivers.