Dateline Houston, Texas, to Linden, New Jersey: Colonial Pipeline’s ransomware incident.
U.S. government denies disrupting Russian ransomware ring that hacked Colonial Pipeline (Washington Post) Hackers affiliated with DarkSide are complaining the group disappeared without sharing payoff money
Ransomware hits near pre-Colonial Pipeline levels, data suggests (Reuters) Digital extortion attempts are returning to their pre-Colonial Pipeline levels, according to data and interviews with some incident responders, suggesting that the upheaval around the hack that paralyzed a major U.S. fuel conduit has yet to curb cybercriminals’ appetite for ransoms.
DarkSide is Standing Down, But Its Affiliates Live On (RiskIQ) DarkSide, the group behind the infamous ransomware used in the attack against Colonial Pipeline that caused a national panic and sent gas prices soaring, stated on May 13 that they were immediately ceasing operations.
Colonial Pipeline Ransomware Attack: Revealing How DarkSide Works (Nozomi Networks) Throughout the last two weeks, the entire cybersecurity community has been riveted by the Colonial Pipeline ransomware attack. It is one of the most notable attacks on critical infrastructure of the past few years and has directly and indirectly impacted multiple industries in the U.S economy. Thankfully, operations are up and running after an approximately week-long outage and reported payment of a $5 million ransom.
Colonial Pipeline CEO Explains $4.4M Ransomware Payment (SecurityWeek) Colonial Pipeline chief executive Joseph Blount said the multi-millior dollar ransomware extortion payment was necessary to lessen downstream, real-world impact in the gas supply ecosystem.
Colonial Pipeline CEO says company paid hackers $4.4 million in ransomware attack (TheHill) The CEO of Colonial Pipeline, hit by a ransomware attack that forced it to shut down operations for much of last week, confirmed publicly for the first time Wednesday that the company paid the hackers behind the att
Granholm expresses openness to pipeline cyber standards after Colonial attack (TheHill) Energy Secretary Jennifer Granholm on Wednesday threw her tentative support behind the idea of mandatory standards to secure pipelines in the wake of the debilitating ransomware attack on Colonial Pipeline earlier t
Lawmakers Grill Pentagon Officials on How to Prevent Another Colonial Pipeline-Style Attack (USNI News) Members of a key cyber panel wanted to know why the Department of Homeland Security wasn’t alerted to the ransomware attack that set off panic-buying of gasoline and whether the Pentagon could have taken measures to stop it before it happened. Sen. Joe Manchin, (D-W.Va.) said at Tuesday’s Senate Armed Services cyber subcommittee hearing that …
Pipeline attack was a warning: Stop cyber threats, or suffer a disaster (TheHill) Ongoing cybersecurity efforts aren’t working so we must evolve our strategy along four principal lines of effort.
Attacks, Threats, and Vulnerabilities
Israel bombed two Hamas cyber targets (The Record by Recorded Future) Amid the recent flareup in the Israel-Palestine conflict, the Israeli military said it bombed two objectives in the Gaza Strip that housed centers for Hamas cyber operations.
Just a handful of Android apps exposed the data of more than 100 million users (The Record by Recorded Future) Almost half a decade after the first reports were published, mobile app developers are still exposing their users’ personal information through abhorrently simple misconfigurations.
Misconfiguration of third party cloud services exposed data of over 100 million users (Check Point Software) Research by: Aviad Danin, R&D Team Leader, Check Point Software Technologies Aviran Hazum, Analysis and Response Team Leader, Check Point Software
DarkSide: Newly Found Variant and Implications for the Ransomware Gang’s Future (SecurityWeek) Researchers have found a DarkSide variant containing a new function, raising two questions: is the new variant a threat; and what should we make of the DarkSide shutdown?
Newly Discovered Function in DarkSide Ransomware Variant Targets Disk Partitions (Fortinet Blog) FortiGuard Labs has uncovered additional tactics used by the DarkSide Threat Actors, primarily the discovery of the DarkSide ransomware seeking out partition information. Learn more.…
BazarCall: Call Centers Help Spread BazarLoader Malware (Unit42) Call center operators offer to personally guide victims through a process designed to infect vulnerable computers with BazarLoader malware.
Beware: This new malware can steal your passwords and hijack your webcam (BGR) Cybersecurity news has been dominated in recent days by the fallout from the Russian ransomware gang you’ve no doubt heard about by now, the one that hacked the IT network of a major US fuel …
The Adobe Spark “Request for Proposal” Scam (INKY) Beginning in January 2021, several INKY users began receiving emails with fake “requests for proposal” (RFPs). These supposed RFPs came from recipients’ legitimate contacts, but those accounts had been compromised by bad actors. In this case, phishers were staging their forays from Adobe Spark, a cloud-based design application that allows users to create and share content. The goal of the ruse was to harvest recipients’ credentials.
Threat Actors Exploit Microsoft and Google Platforms to Host and Send Millions of Malicious Messages (Proofpoint) Organizations worldwide have adopted cloud collaboration tools in record numbers—and attackers have quickly followed. In recent months we have observed an acceleration in threat actors abusing Microsoft and Google’s popular infrastructure to host and send threats across Office 365, Azure, OneDrive, SharePoint, G-Suite, and Firebase storage.
Probe Into Florida Water Plant Hack Led to Discovery of Watering Hole Attack (SecurityWeek) An investigation conducted into the recent hack at the Oldsmar water treatment plant led to the discovery of a watering hole attack that initially appeared to target water utilities.
Botnet traced to computer at hacked Florida water plant (CyberScoop) On Feb. 5, an unidentified hacker broke into the computer system of a water treatment plant in the Florida town of Oldsmar and temporarily changed the plant’s sodium hydroxide setting to a potentially dangerous level, according to local officials. It turns out that hacker wasn’t alone on the network.
SolarWinds CEO reveals much earlier hack timeline, regrets company blaming intern (CyberScoop) SolarWinds saw signs of hackers invading their networks as early as January of 2019, about eight months earlier than the previously publicly disclosed timeline for the sweeping cyber-espionage campaign, and nearly two years before anyone discovered the breach.
Nearly 40 defense companies were impacted in SolarWinds breach (FedScoop) Thirty-seven companies reported being involved in the SolarWinds hack, a reminder of one of DOD’s biggest cyber weaknesses.
Hackers scan for vulnerable devices minutes after bug disclosure (BleepingComputer) Every hour, a threat actor starts a new scan on the public web for vulnerable systems, moving at a quicker pace than global enterprises when trying to identify serious vulnerabilities on their networks.
Cobalt Strike Becomes a Preferred Hacking Tool by Cybercrime, APT Groups (Dark Reading) Incident response cases and research show how the red-team tool has become a become a go-to for attackers.
This is how the Cobalt Strike penetration testing tool is being abused by cybercriminals (ZDNet) Cobalt Strike is a popular tool with cybersecurity professionals. Unfortunately, it’s also utilized by threat actors.
Report: Consulting Firm Leaks Global Employee Data From French Sporting Giant (vpnMentor) Led by Noam Rotem, vpnMentor’s research team discovered a data breach by French consulting firm Bluenove that indirectly exposed thousands of employees and customers from sporting
Packaging vendor Ardagh admits cyber-attack disrupted operations (The Daily Swig) Mystery assault contained
Domain hit by cyber attack, warns of rental scam email (Australian Financial Review) Nine majority-owned real estate classifieds business Domain is warning users to look out for suspicious emails that purport to be from rental agents offering property deals after it was hit by a cyber attack.
Hello, Is It Me You’re Phishing For: Amazon Vishing Attacks (Armorblox) This blog highlights two Amazon vishing (voice phishing) attacks that attempted to steal credit card details by sending fake order receipts and including phone numbers to call for processing returns.
Ireland’s Healthcare System Works to Rebuild After Ransomware Hit (Wall Street Journal) Hackers will likely publish personal data stolen from Ireland’s public health system after the attack, officials say.
HSE patient files released online after Russian gang cyber attack (Irish Mirror) Criminal gang leaders are believed to be flexing their muscles to show the Government they are serious unless ransom is paid
Hackers hit IT systems at Glasgow Caledonian University (Times) Security experts are tackling a cyberattack on Glasgow Caledonian University which started on Friday.The university is managing the “limited” breach with the help of Scottish government cybersecurity
Security Patches, Mitigations, and Software Updates
Microsoft is finally retiring Internet Explorer in 2022 (The Verge) IE11 won’t be supported for Microsoft services in August.
Google Workspace Gets New Security Features (SecurityWeek) Google this week announced adding new security features to its Google Workspace collaboration and productivity solution, to provide administrators with more capabilities and controls for protecting users and organizations.
May Android security updates patch 4 zero-days exploited in the wild (BleepingComputer) According to info provided by Google’s Project Zero team, four Android security vulnerabilities were exploited in the wild as zero-day bugs before being patched earlier this month.
Emerson Patches Several Vulnerabilities in X-STREAM Gas Analyzers (SecurityWeek) Industrial giant Emerson patches high-severity vulnerabilities in its Rosemount X-STREAM gas analyzers.
Quarterly Threat Intelligence Report: Q1, 2021 (Radware) Radware’s Quarterly DDoS Attack report provides insight into today’s evolving threat landscape – quarter by quarter, threat by threat.
New Dashlane Report: The Future of Security in the Hybrid Workplace (PR Newswire) Today, Dashlane released “The Future of Security in the Hybrid Workplace” report, commissioned in partnership with Datalands, which looks at…
Password Hygiene Amongst Cybersecurity Leaders is Lacking, Survey Finds (Constella) Constella Intelligence research reveals that one in four cybersecurity leaders use the same passwords for both work and personal use; more than half experience account takeover first-hand
Ransomware Boom Forces More Companies to Cut Deals With Criminals (Wall Street Journal) A ransomware surge has created a cottage industry of negotiators who broker payouts.
RDP Hijacked for Lateral Movement in 69% of Attacks (Infosecurity Magazine) RDP Hijacked for Lateral Movement in 69% of Attacks. Sophos report warns that dwell time is up to 11 days
More than Half of U.S. Companies Hit with Privileged Credential Theft, Insider Threats in Last Year (PR Newswire) ThycoticCentrify, a leading provider of cloud identity security solutions formed by the merger of privileged access management (PAM) leaders…
How ransomware is reshaping the cyber insurance market (SC Media) In the wake of Colonial Pipeline and other recent incidents, more shifts in coverage could emerge – and priorities of the insurers might not match up with those of victims.
42Crunch raises $17m in Series A to solve global API security threat (42Crunch) 42Crunch, the API security leader, today announces that it has secured $17 million in a Series A investment led by Energy Impact Partners, a leading global investment firm, joined by Adara Ventures.
Blue Ridge Networks Closes Growth Capital Investment Round (PR Newswire) Blue Ridge Networks, Inc., today announced that it closed an investment round with funding from a US private venture fund with additional…
No-code cybersecurity platform SpecTrust emerges from stealth with $4.3M (VentureBeat) Cybersecurity firm SpecTrust, which offers a no-code platform for cyberdefense, raised $4.3 million in seed funding.
Clearlake runs $2bln-plus single-asset deal on software company DigiCert (PE Hub) Such deals give the GP more flexibility not only to hold assets longer out of older funds, but also fresh capital to continue growing the business.
Splunk’s TruSTAR acquisition could add 4% to cloud ARR, says bull (SeekingAlpha) Yesterday, Splunk (SPLK) announced signing a definitive agreement to acquire cloud-native security startup TruSTAR for undisclosed terms
Minerva Labs Posts Positive Results for Cybersecurity Business Despite COVID-19 Restrictions (BusinessWire) Minerva Labs, a leading provider of anti-malware endpoint platform, today announced that the company has achieved positive business results and compan
Egnyte Wins 2021 InfoSec Awards for Innovation in Data Governance and (PRWeb) Egnyte, the unified content security, compliance, and collaboration solution for multicloud businesses, today announced it has been recognized as a lead
Hillstone Networks Named Winner of the Coveted Global InfoSec Awards during RSA Conference 2021 (IT News Online) Hillstone Networks Named Winner of the Coveted Global InfoSec Awards during RSA Conference 2021
ISRAEL/EUROPE : Excem, Israeli cyber’s bridgehead in Spain (Intelligence Online) Although Spain has developed its own cyber intelligence capacities with firms the likes of Mollitiam Industries, this has not stopped Israeli firms from trying to edge into the country, especially
SPAC Selloff Bruises Individual Investors (Wall Street Journal) Shares of special-purpose acquisition companies and firms they have taken public are tumbling, punishing individual investors who piled into the once-hot sector.
SPAC Market is Healthier Than Most Think (Boardroom Alpha) It’s painful, and often boring, for many in the SPAC markets these days, but today’s market is healthier than during “peak SPAC” and that bodes well for its long-term viability.
Cisco reports solid product order growth in Q3, supply chain challenges (ZDNet) The company’s third quarter results were slightly ahead of market estimates, with growth across categories. However, Cisco said it will face supply chain issues at least through the rest of the calendar year.
Rome company among ‘Best Places to Work’ (Rome Daily Sentinel) For a third consecutive year, Assured Information Security (AIS), headquartered in Rome, has been named one of Central New York’s Best Places to Work for 2021 by BizEventz in collaboration with The Business Journal News Network and Research & Marketing Strategies, Inc.
Verve Industrial Expands Leadership Team to Accelerate Growth in Key Markets (GlobeNewswire) OT/ICS Cyber Security Innovator Taps Developer of Tripwire Whitelist Profiler to Drive Customer Success; Former Forescout Sales Executive to Lead Strategic Growth Initiatives in MENAT
Bishop Fox Appoints Industry Veteran as Chief Marketing Officer (GlobeNewswire) Julie Albright Brings Proven Leadership to Accelerate Growth for Leader in Offensive Security Market
SentinelOne Hires Former Dell Executive to Lead Americas Sales (MSSP Alert) Endpoint security platform provider SentinelOne hires former Dell executive Daniel Donovan as VP of Americas sales. SentinelOne IPO speculation continues.
SafeGuard Cyber Names Rusty Carter as Chief Product Officer (PR Newswire) SafeGuard Cyber, the only SaaS platform dedicated to managing the full lifecycle of Digital Risk Protection, is pleased to announce that it has…
HackerOne Welcomes Product and Engineering Leaders to Scale the World’s Most Trusted Hacker-Powered Security Platform | HackerOne (HackerOne) Rand Wacker joins as Senior Vice President of Product and Ashish Warty appointed as Senior Vice President of Engineering
Products, Services, and Solutions
Infosec Institute Brings Award-Winning Cybersecurity Training to Cours (PRWeb) Infosec, the leading cybersecurity education company, today announced they have partnered with Coursera, one of the world’s leading online learning platforms…
Celerium Announces Supply Chain Cybersecurity Education Program Featuring CMMC Insights Course (PR Newswire) Celerium Inc., the leading company focused on supply chain cybersecurity, today announced its new Supply Chain Cybersecurity Compliance…
Netskope Launches Online Community Connecting Network, Data, and Cloud Security Professionals Through Peer Collaboration (Netskope) Highlights increased demand for Netskope’s leading SASE solution SANTA CLARA, Calif. – May 19, 2021 – Netskope, the SASE leader, today launched the Netskope Online Community, a forum built for customers to come together with like-minded professionals to learn from one another, share tips, ideate, and gain valuable perspective on the industry in a peer-driven […]
Acuant and Airside Partner to Make Privacy First Digital ID for a Secure Reopening of Borders and Economies (GlobeNewswire) The new Airside Digital Identity App provides robust identity verification and secure sharing of IDs, and COVID health status information
Hunters Announces its Open XDR: Closing the Gap Between Detection and Response (GlobeNewswire) Hunters announced today the launch of Hunters XDR, the company’s Open Extended Detection and Response Platform, a vendor-agnostic cloud-native platform that applies an open approach to data.
Cowbell Cyber Joins Marshberry’s Connect Platform As Premier Partner (Cowbell Cyber) Cowbell Cyber brings AI-powered, standalone, and admitted cyber insurance to MarshBerry’s members.
Exabeam and Pcysys Partner to Arm Customers Against Latest Advanced Attack Techniques (BusinessWire) Exabeam and Pcysys today announced a partnership to enable organizations to defend against ever-changing attack techniques.
Nozomi Networks Integrates with ServiceNow to Help Automate, Optimize and Secure Manufacturing Operations Worldwide (Nozomi Networks) Solution combines process workflows and detailed network, OT and IoT asset information to maximize productivity, reduce waste, and achieve higher profitability
KnowBe4 Launches PhishFlip To Turn Active Phishing Attacks Into Safe Templates (KnowBe4) KnowBe4 Launches PhishFlip To Turn Active Phishing Attacks Into Safe Templates
Napatech Extends Multi-Year Design-Win with Innovative Cybersecurity Leader (PR Newswire) Napatech™ (OSLO: NAPA.OL), the leading provider of FPGA-based programmable SmartNICs, announced that a high-growth cybersecurity original…
Thales’s new data solutions protect and control sensitive data in multicloud environments (Help Net Security) Thales announced new data protection solutions for Google Cloud, Microsoft Azure, and Amazon Web Services.
Introducing MITRE ATT&CK Defender (GovInfo Security) A recent study showed that even though 82% of cybersecurity professionals are familiar with the MITRE ATT&CK framework, only 8% said they used it regularly. This
Specops Partners with Duo Security to Secure Password Resets (PRWeb) Specops Software announced that it is now a Duo Security Technology Partner. The technology partnership demonstrates a commitment to provide customers with solution
Appdome Releases No Code Solution to Preempt Mobile Fraud (PR Newswire) Appdome, the industry leader in no code Appdome Mobile App Security, today announced the immediate release of no code Appdome Mobile Fraud…
Wind River Delivers Cybersecurity and Anti-tamper Protections for Mission-Critical Intelligent Systems (Wind River) Wind River®, a global leader in delivering software for intelligent systems, today announced security enhancements to Wind River Studio, a cloud-native platform for the development, deployment, operations, and servicing of mission-critical intelligent systems.
Palo Alto Networks pushes enterprise zero trust (Network World) Palo Alto Networks has added products and features to for enterprises looking to a zero-trust protection environment.
VicTrack taps Juniper Networks to boost its network and infrastructure (iTWire) VicTrack delegates Juniper Networks to upgrade its statewide network to provide safer and more efficient commuting experience in Victoria, one of the most populated states in Australia. VicTrack, the state-owned enterprise that owns all railway and tram lines, networks and infrastructure in the stat…
Offensive Security Launches Federal Practice Area (BusinessWire) Offensive Security, the leading provider of hands-on cybersecurity training and certification for information security professionals, today announced
Rubrik Forward Begins with Palo Alto, ServiceNow Ransomware Team-Up (Channel Futures) The Rubrik Forward conference begins with the announcement of a partnership with Palo Alto Labs to enable more rapid recoveries from ransomware attacks.
Vectra and Zscaler Enable Zero Trust Visibility into Business-Critical Applications (PR Newswire) Vectra AI, a leader in threat detection and response, today announced a deep product integration with Zscaler Private Access™ (ZPA) to provide…
Driving ISV success: CyberHound and Hewlett Packard Enterprise (CRN Australia) How one Australian software company went global through an OEM partnership.
IronNet Partners With Nutanix to Bring Collective Defense to Hybrid and Multicloud Environments (BusinessWire) IronNet Cybersecurity, in its mission to transform cybersecurity through Collective Defense, announced today its Nutanix Ready validated solution with
Mandiant Cyber Risk Management Services addresses critical business and security requirements (Help Net Security) FireEye announced new Cyber Risk Management Services from Mandiant to enhance security strategies and optimize risk reduction.
EY announces alliance with Tanium to transform IT and cybersecurity operations (PR Newswire) EY today announces an alliance between Tanium, the provider of endpoint management and security built for the world’s most demanding IT…
Tanium Adds OCI to its Multi-Cloud Strategy (Database Trends and Applications) Tanium, a provider of endpoint management and security built for demanding IT environments, has turned to Oracle Cloud Infrastructure (OCI) as part of its multi-cloud approach to deliver its flagship SaaS platform, Tanium-as-a-Service (TaaS).’Adopting Oracle as a cloud partner gives our customers an industry-leading, security-first approach to endpoint management,’ said Orion Hindawi, co-founder and CEO of Tanium.
CyberGRX Announces Client Services to Support Customers’ TPCRM Journey (BusinessWire) CyberGRX announces availability of CyberGRX Client Services to help businesses capture more value from the CyberGRX Exchange.
SteelCloud Publishes “CMMC For Dummies” eBook (PR Newswire) SteelCloud LLC, a leading STIG and CIS compliance automation software developer, announced today the release of “CMMC For Dummies,” an eBook to…
AttackIQ Introduces New Partner Academy to Help Channel Partners Around the World Accelerate Adoption of Threat-Informed Defense Practice – AttackIQ (AttackIQ) In the wake of recent ransomware attacks, AttackIQ helps customers and partners embrace proactive defense strategies to reduce their chances of breaches and attacks
Druva Expands Salesforce Data Protection, Delivering Industry’s Most Comprehensive Offering (Druva) Druva Inc., the leader in Cloud Data Protection and Management, today announced the availability of its enhanced data protection for Salesforce
Technologies, Techniques, and Standards
How CISA limited the impact of the SolarWinds attack (Federal News Network) Matt Hartman, the deputy executive assistant director for cyber at CISA, said without EINSTEIN, there may be departments today that still did not know they were victims of the SolarWinds campaign.
Evaluating your Supply Chain Security | Cloud Native Computing Foundation (Cloud Native Computing Foundation) Last December, as we were all counting down the days until 2020 was no more, FireEye posted an announcement that caused various beveragewares across the world to fall and shatter on the floor: some…
CISA and Local Partners Conduct Tabletop Exercise in Preparation for the U.S. Olympic Team Track and Field Trials (Homeland Security Today) The U.S. Department of Homeland Security Cybersecurity and Infrastructure Security Agency (CISA), private sector partners, local first responders, and state and federal partners held a tabletop exercise today to test emergency response and recovery operations in preparation for the U.S. Olympic Team Trials – Track & Field, which will be held June 18-27 at Hayward Field on the University of Oregon campus.
Cybersecurity Metrics That Matter (GovInfo Security) Wendy Nather, head of advisory CISOs at Cisco, recently teamed up with researcher Wade Baker to investigate cybersecurity metrics and determine how to make a
Council Post: Be Sure To STUD-E: Five Steps To Mitigate Security Risks In A Multi-Cloud World (Forbes) You can protect yourself from cybersecurity risks like ransomware, even in this multi-cloud world. But you have to STUD-E.
Air Force held first information warfare test exercises (Defense News) The Air Force is using a new information warfare range in New Mexico to test and integrate capabilities.
NFTs are cool, but they’re a hot target for hackers: How to keep them safe (TechRepublic) Security expert says non-fungible tokens are a really exciting possibility for artists, but they can be stolen. He offers some ways to keep them secure.
Design and Innovation
I’m Not a Robot! So Why Won’t Captchas Believe Me? (Wired) If clicking crosswalks makes your blood boil, you’re not alone. Fortunately, there are some tips that make solving those challenges way less frustrating.
Bug Bounty Program pays off for cybersecurity at Virginia Tech (Virginia Tech) A new vulnerability rewards program offers an opportunity for talented hackers at Virginia Tech to use their skills to improve the university’s cybersecurity — and earn a little cash.
Legislation, Policy, and Regulation
NATO Deputy Secretary General highlights collaboration as key to strong cyber defence at ”Defence Disrupted” conference (NATO) NATO Deputy Secretary General Mircea Geoană discussed NATO’s role in cyber defence, its approach to cyber security, and the Alliance’s responsibility in driving technological innovation in remarks to the ”Defence Disrupted” conference on Wednesday (19 May 2021).
Neuberger: Ransomware Requires International Response (BankInfo Security) The threat posed by ransomware attacks, including the growth of cybercriminal cartels, double extortion schemes and big game hunting targeting larger organizations,
Opinion | Cyber Letters of Marque and Ransomware (Wall Street Journal) Let’s give all corporations making good-faith efforts to protect personal and organizational information limited immunity and rewards for working with governments.
Ericsson’s China ambitions in jeopardy over Sweden’s Huawei ban (Reuters) An upcoming court decision that will decide the future role Huawei (HWT.UL) can play in Sweden could also be a potential turning point for national champion Ericsson’s (ERICb.ST) ambitions in China.
EU countries keep different approaches to Huawei on 5G rollout (www.euractiv.com) After the German Bundesrat recently passed the IT-Security Law, things have been looking increasingly grim for Huawei’s expansion in Europe, while a patchwork of different national approaches to the Chinese tech giant has emerged. EURACTIV took a closer look at where various European capitals currently stand on the issues related to the Chinese 5G supplier.
Senate Weighs Investing $120 Billion in Science to Counter China (New York Times) The legislation has drawn bipartisan support amid the coronavirus pandemic as Democrats and Republicans have become increasingly concerned about Beijing’s supply chain dominance.
Biden’s executive order calls for greater open source security but not how to achieve it (TechRepublic) Commentary: It’s progress that President Biden’s executive order recognizes the need to secure open source software. What it doesn’t do is address the best way to accomplish it.
The Cybersecurity 202: Industry groups express cautious optimism about Biden’s executive order on software standards (Washington Post) Industry is cautiously welcoming the Biden administration’s recent executive order mandating new software security requirements for companies that contract with the federal government.
US introduces bills to secure critical infrastructure from cyber attacks (BleepingComputer) The US House Committee on Homeland Security has passed five bipartisan bills on Monday to bolster defense capabilities against cyber attacks targeting US organizations and critical infrastructure.
Lawmakers Reintroduce ‘Pipeline Security Act’ Following Colonial Hack (SecurityWeek) Over a dozen U.S. lawmakers have reintroduced the Pipeline Security Act following the recent ransomware attack on Colonial Pipeline.
House Panel Passes Bill to Explore Bringing State and Local Cybersecurity Workers into CISA (Nextgov.com) The Homeland Security Committee cleared several bills to address cybersecurity following the attack on Colonial Pipeline.
Hill Presses For Better Cyber Responses, More Info Sharing (Breaking Defense) Colonial Pipeline “refused” to share details of ransomware payment with Congress. “Our constituents are on the front lines of these [cyber]attacks, and yet they don’t know what their country is doing to respond,” Rep. Slotkin said.
SolarWinds: A Harbinger For a National Data Breach Reporting Law (Decipher) The disclosure of the SolarWinds attack by FireEye is encouraging for the development of a national data breach reporting law, government and private-sector experts say.
Army Cyber Pivots To Pacific: Fogarty (Breaking Defense) “Wherever [Army forces] are deployed, particularly those in Europe and the Pacific, they’re under just constant, constant assault,” Lt. Gen. Stephen Fogarty, chief of Army Cyber Command, says.
Energy Chief Urges Better ‘Cyber Hygiene’ In Budget Hearing (Law360) U.S. Department of Energy Secretary Jennifer Granholm told House lawmakers Wednesday the country’s cybersecurity safeguards are currently “inadequate” and that she would support imposing minimum security standards, like those in place for the U.S. electric grid, on the oil and gas sector.
Litigation, Investigation, and Law Enforcement
UK businesses urged to appoint EU representative after Canadian firm fined under GDPR (Computing) LocateFamily.com fell foul of Article 27
Regulator fines COVID-19 tracker for turning contact data into sales leads (Naked Security) Would you like marketing material with your track-and-trace?
Apple cites ‘significant’ malware on Mac while defending iOS App Store in Fortnite trial (CNET) Apple’s head of software engineering, Craig Federighi, says malware on Macs has hit “unacceptable” levels.
At the Epic trial, Phil Schiller got away clean (The Verge) Schiller insists nobody knows how much the App Store makes.
Apple’s Revenue From Epic’s Fortnite Topped $100 Million (Bloomberg) Epic seeks to show judge that App Store is highly lucrative. Epic lawyer calls Apple’s $1 million marketing tab ‘good deal’
We’re Suing Google. Here’s Why. (The Nation) Together with The Progressive and Genius Media Group, Inc., we’re fighting back against the tech giant’s predatory pricing and monopoly practices that put independent journalism at risk.
Scammer jailed for sending fake NHS text messages to people waiting for Covid-19 vaccination (Computing) Messages told recipients that their details were needed to determine if they qualified for the vaccination
Russian hacker sentenced to 5 years for $1.5 million tax fraud (The Record by Recorded Future) A Russian national was sentenced to 60 months in prison on Wednesday for attempting to steal $1.5 million in tax refunds by hacking into tax preparation firms, the Department of Justice announced.
UHS Data Breach Lawsuit Proceeds (Infosecurity Magazine) Data breach lawsuit against healthcare provider gets the go-ahead but only for one patient