Sign in Subscribe

Topic

Security

A collection of 51 issues

Change Healthcare Hack

Some details of the Change Healthcare hack have leaked. Access via compromised credentials on a remote access system - that didn’t have MFA. Dwell time nine days. (Total cost for this they are estimating at $1.35 - $1.6 billion, $872m already realised) “Lawmakers have raised questions about

British Library report on attack

Very interesting read. The British Library has released its report on their ransomware attack. Hit at the end of October last year and still recovering. Kudos to them for releasing this. Some key systems couldn’t be restored as they were just unsupported or just couldn’t be moved to

Make it illegal?

Round table a little staid, or a dinner party needs to be a little more piccante? “Ransomware payouts are made illegal. Company Directors are held liable if they pay them. Net positive or negative impact? Discuss” I read a few years ago that banning payments may mean gangs target those

Anydesk breach

Last year Barracuda had an exploit issue that could not be fixed and required replacement hardware. Same with Ivanti now (https://lnkd.in/epxtpa9c). Although in the case of Ivanti it’s a comprehensive rebuild that’s required. Then last night Anydesk confirmed a breach. As an aside - breach

SMB Threat Report

This is an interesting and worthwhile report covering threat insights for the SMB space (you need to register for the report). Eye opening takeaway is 56% of incidents are malware free and 65% use your own RMM software (remote monitoring and management). It’d be good to see vendors understand

Survivorship Bias

This is a really good post from Microsoft. Transparency is becoming more important - for all companies. Results of Major Technical Investigations for Storm-0558 Key Acquisition | MSRC Blog | Microsoft Security Response CenterResults of Major Technical Investigations for Storm-0558 Key AcquisitionMicrosoft Security Response CenterMSRC My thoughts? Not on this but to

Online Safety Bill Concerns

Oh this is going to be a nasty car crash. “God, I wish we had been a lot more vociferous. The legislation sounded so outlandish that I thought surely someone else would step up and shoot it down. We clearly should have been in the room but there was no-one

Solarwinds investigation

Quite a debate about this: “The US SEC has roiled the cybersecurity industry by putting executives of SolarWind on notice that it may pursue legal action for violations of federal law in connection with their response to the 2020 attack on the company’s infrastructure that affected thousands of customers

Ransomware updates

Some interesting figures here on ransomware events: * Only 4% of ransomware victims recover all their data * Only 61% recover data at all * Typical experience is 25 days of disrupted business There are no end of products and services to defend/protect against this. But how many decades have we had

Solarwinds supply chain attack

Excellent article by Kim Zetter in Wired breaking down the SolarWinds supply-chain attack. It does make your blood run cold a little. Two year dwell time, and a bit of luck in discovering it. Lovely nightmare fuel. The Untold Story of the Boldest Supply-Chain Hack EverThe attackers were in thousands