Cyber Security Update July 2022

Uber has admitted to the US Department of Justice that it covered up a massive data breach in 2016 that exposed around 57 million users and 600,000 drivers' licence numbers.

The California Department of Justice accidentally exposed the personal details of hundreds of thousands of gun owners who applied for a license to carry a concealed weapon when it mistakenly published a confidential spreadsheet.

The personal details of 69 million members of Neopets, a virtual pet website, are on sale after hackers stole the site's source code and a database.

In what could be one of the biggest data thefts ever, hackers claim to have stolen 24TB of data containing information on one billion people from a Chinese police database.

An average corporate data breach now costs the exposed company around USD 4.35 million, which is an all time high, according to IBM Security.

Almost half of all companies have faced a major security breach in the past five years, according to a new poll, with one third of the incidents blamed on internal theft.

T-Mobile has agreed to pay USD 350 million in settlements to compensate victims of a security breach last year. Of the 76.6 million people affected, 10 million will receive $25 each. In addition, it will pay USD 150 million to upgrade its data security.

The FBI, CISA and FinCEN have issued a CyberSecurity Advisory (CSA) on the MedusaLocker ransomware attack, which they warn is operating a ransomware-as-a-service business.

North Korea is responsible for Maui Ransomware attacks on the public healthcare sector, according to a Cybersecurity Advisory from the FBI, CISA and the US Treasury.

The FBI is warning US investors about fraudulent cryptocurrency investment schemes. According to a recent Cybersecurity Advisory, 244 victims in the US have been identified who have lost a total of USD 42 million.

Cyber criminals are increasingly targeting smaller businesses instead of focusing mainly on enterprises and financial institutions. SMBs account for the largest percentage of the economy but do not have the security products or awareness found in large companies, making them an easier target.

Off-the-shelf cyber weapons are being used to launch an increasing number of phishing, malware and ransomware attacks on SMBs. Criminals are exploiting the fact that smaller businesses don't believe that they are at risk and so take fewer security precautions. A lack of awareness when it comes to social engineering techniques, combined with weak security and passwords, leave many small businesses vulnerable. SMBs can better protect themselves by taking security more seriously:

• Adopt multi-factor authentication - strong passwords alone are not enough. Adding an extra layer of protection, such as biometrics, could block the vast majority of attacks.
• Keep abreast of the latest attacks and share information with the global cybersecurity community. Subscribe to security alerts from organizations such as the World Economic Forum Centre for Cybersecurity, Interpol, CISA and the UK National Cyber Security Centre.
• Implement security policies such as requiring dual authorization for all payments and restricting access to resources that are unnecessary to the employees' job function.
• Implement cloud-based solutions such as secure storage, back-up services and secure email services. If possible, subscribe to a managed security solutions provider (MSSP).

Cybersecurity

• 12 July 2022
• Joe Morley
• Managed Security, Cybersecurity User Awareness, cloud-security, Cybersecurity, Digital Transformation
• Cyber Threats, Cyber Attack

Getting Started with a Cyber Security: Attack Types & The Attack Cycle

Charities and nonprofits hear about security a lot. Let's take it back to basics. This first post outlines how attacks happen and the attack cycle.

• 23 June 2022
• Bala Sethunathan
• Managed Security, Cybersecurity, Cyber Threat Bulletin
• Data Security, Security, Ransomware

Cyber Security Update May 2022

Scammers are using more ruthless and sophisticated phishing techniques to acquire confidential data. Don't let the criminals fool you.

• 23 June 2022
• Bala Sethunathan
• Cybersecurity
• Automation

Automation: Cybersecurity's Friend and Enemy

Have you integrated automation into your security strategy? Keep reading as we take a closer look at the pros and cons of an automated cybersecurity defense.