Tag: security

Executives Personally Sued for Data Privacy Incidents

By Nathan Morales on Posted in Announcements, Data Breach, Data Protection, Law/Regulation Update, Privacy, Security
If you manage a company that collects and otherwise processes personal data (which is just about every company, these days), you may need to protect your own pocketbook.  As governments across the globe continue to enact and enforce data privacy, data protection, and cybersecurity laws, data becomes more readily available, and the volume of incidents … Continue Reading

Seattle & Portland Virtual Cybersecurity Summit Begins Tomorrow

By Jon Washburn on Posted in Announcements, Events
Join me, Stoel Rives’ Chief Information Security Officer (and Global Privacy & Security Blog® author) Jon Washburn, for a panel discussion in which I will partner with top industry CISOs and CIOs to address the most pressing cybersecurity challenges of 2021. Register now for free for the Seattle & Portland Virtual Cybersecurity Summit, March 31 and … Continue Reading

Don’t let Cyber Insurance be Your Cybersecurity Plan

By Jon Washburn on Posted in Announcements, Cyber Crime, Data Breach, Disaster Recovery, Insurance Coverage, Security
In a recent letter to insurers, the New York State Department of Financial Services (“NYDFS”) acknowledged the key role cyber insurance plays in managing and reducing cyber risk – while also warning insurers that they could be writing policies that have the “perverse effect of increasing cyber risk.” If a cyber insurance policy does not … Continue Reading

Securing Online Shopping has Never Been More Important

By Jon Washburn on Posted in COVID-19, Data Breach, Internet, Security, Software
In the wake of the COVID-19 pandemic, more consumers than ever before are shopping online – and they’re not likely to be very forgiving to any retailer that breaches their personal information. According to this recent survey from payment solutions provider PCIPal, 64% of people in the US would avoid a business following a COVID-19 … Continue Reading

Working from Home? Here are 12 Steps to Reduce Data Privacy and Security Risk

By Ronak Chokhani and Jon Washburn on Posted in COVID-19, Cyber Crime, Phishing, Security
Businesses are instituting widespread remote work policies and procedures to facilitate social distancing and “flatten the curve.” Enterprises simultaneously need to be mindful of increased data privacy and security risks. The risks can range from pandemic-related phishing emails to increased pressure on network architecture to well-intentioned employee shortcuts. Hackers will try to take advantage of … Continue Reading

Soon, All Ransomware Attacks May Be Data Breaches

By Jon Washburn on Posted in Cyber Attack, Cyber Crime, Data Breach, Privacy, Security
As this recent article illustrates, many ransomware operators are now collecting information from victims before encrypting their data, and then threatening to release what they’ve collected – or actually releasing some of it – to increase the chance they’ll get paid. There have been many cases already where at least a portion of data has … Continue Reading

Your Security Program Must Think Beyond Malware Protection

By Jon Washburn on Posted in Cyber Attack, Security
According to Crowdstrike’s most recent Global Threat Report, in 2019 they observed that malware-free attacks – attacks  where malicious files are not written to disk – outpaced malware attacks by 51% to 49%. In Malware-free attacks, the attackers leverage Tactics, Techniques and Procedures (TTPs) that are less likely to be detected by traditional anti-malware solutions.  … Continue Reading

Trickbot and Emotet Financial Malware Now Attacking the Healthcare Industry

By Jon Washburn on Posted in Announcements, Cyber Attack, Cyber Crime, HIPAA, Security
In a recent Cybercrime Tactics and Techniques Report focusing on the health care industry, cybersecurity company Malwarebytes discovered a significant 82% spike in Trojan malware attacks on health care organizations in Q3 2019. Emotet and TrickBot, two especially sophisticated and dangerous forms of malware, were mostly responsible for this surge. Used primarily as ’banking Trojans” … Continue Reading

Achieving Industry Standards

By Jon Washburn on Posted in Cyber Attack, Cyber Crime, Data Breach, Privacy, Security
For Cybersecurity and Privacy, “What Are the Industry Standards? Are We Meeting Them?” These are questions the FTC Chairman, Joseph Simons, strongly suggested a CEO must ask before a data breach occurs to avoid the prospect of personal liability. These questions and statements by other commissioners emphasizing the FTC’s role – to bring about a … Continue Reading

New tool released that may allow bad actors with almost any skill set to bypass many implementations of Two-Factor Authentication (2FA)

By Jon Washburn on Posted in Cyber Attack, Cyber Crime, Phishing, Security, Software
Until recently, hackers have had limited success stealing Two-Factor Authentication (2FA) PIN and token information.  Unfortunately, a tool has been released that will now make it much easier for practically any bad actor to bypass many implementations of 2FA: https://www.zdnet.com/article/new-tool-automates-phishing-attacks-that-bypass-2fa/ This does not mean we should stop using Two-Factor Authentication (2FA). We should still use … Continue Reading

Anthem Pays OCR $16 Million in Record-Breaking HIPAA Data Breach Settlement

By Sarah Bimber on Posted in Cyber Attack, Data Breach, HIPAA, Regulators, Security
The Office of Civil Rights (OCR) announced in a press release this week that Anthem, Inc. (Anthem), one of the nation’s largest health benefit companies, has agreed to pay $16 million and take substantial corrective action to settle potential violations of the Health Insurance Portability and Accountability Act (HIPAA) Privacy and Security Rules. This settlement … Continue Reading

When was the last time you looked at RDP access?

By Jon Washburn on Posted in Cyber Attack, Cyber Crime, Data Breach, Security
A presentation at Black Hat recently revealed that the creators of the “SamSam” ransomware have netted over $6M to date, attacking mostly medium-to-large public and private sector organizations. And they’re showing no signs of slowing down. In the most recent SamSam attacks, the attackers concentrated their efforts on brute-force hacking of weak passwords on devices accessible … Continue Reading

New threat targeting old medical imaging equipment

By Jon Washburn on Posted in Cyber Attack, Cyber Crime, HIPAA, Industrial Control Systems, Security
Health care providers and suppliers should be wary of the “Orangeworm” threat, an implementation of malware out in the wild that’s gathering information off of compromised medical equipment, especially old systems where file shares and Windows XP are still in use: https://www.zdnet.com/article/mysterious-cyber-worm-targets-medical-systems-found-on-x-ray-machines-and-mri-scanners/ While this group seems to be limiting their actions to reconnaissance and compromising … Continue Reading

How does your leadership remain aware of cyber security threats?

By Jon Washburn on Posted in Cyber Attack, Industrial Control Systems, Security, Software
Some notable stats showed up in the recently-released 2017 Veracode State of Software Security report: while “nearly a third (29 percent) of survey respondents indicated that they are actively pursuing digital transformation projects [and] … a further 29 percent stated that they are either planning for or considering digital transformation projects for the future,” there … Continue Reading

Funds transfer fraud in real estate transactions has seen an explosive increase this year

By Jon Washburn and Tamara Boeck on Posted in Cyber Crime, Fraud, Phishing, Security
As a firm with a large real estate practice, we are keenly aware of the risks of wire transfer fraud in real estate transactions – which has exploded from a reported $19 Million in 2016 to almost $1 Billion in 2017. Often this fraud is the result of the hacker compromising a legitimate email account … Continue Reading

You may be subscribing to US-CERT … but have you heard of ICS-CERT?

By Jon Washburn on Posted in Industrial Control Systems, Security
The United States Computer Emergency Readiness team (US-CERT) operates within the U.S. Department of Homeland Security’s National Cybersecurity and Communications Integration Center (NCCIC), protecting America by responding to major incidents, analyzing threats, and exchanging critical cyber security information with trusted partners around the world.  You may have already signed up for the popular email alert … Continue Reading
LexBlog