Recent Posts

FBI: Destructive Malware Used Korean Language Packs

In a first, the F.B.I has issued a warning to U.S. businesses to be on the lookout for destructive malware that was used in an attack last week on Sony Pictures Entertainment. The FBI issued a five-page “FLASH” warning to security professionals at U.S. companies to warn them of the new malware. A copy of the warning viewed by The Security Ledger revealed that the malware deployed a number of malicious modules, including a version of a commercial disk wiping tool on target systems. Samples of the malware obtained by the FBI contained configuration files created on systems using Korean language packs. The use of Korean could suggest a link to North Korea, though it is hardly conclusive. It does appear that the attack was targeted at a specific organization. The malware analyzed by the FBI contained a hard coded list of IP addresses and computer host names. Media reports have linked the malware to the […]

Continue Reading

Has the IoT Standards Train Already Left the Station?

The Harvard Business Review has an interesting blog post from last week that looks at the effort to develop standards and promote RFID (Radio Frequency ID), a kind of Ur-technology for our current Internet of Things. Writing on the HBR blog, Thomas Davenport and Sanjay Sarma note that the effort to develop RFID standards, led by MIT’s Auto-ID Labs, provides a possible model for the development of cross-vendor standards for the Internet of Things. However, the authors caution that it may already be too late to achieve consensus on standards to govern Internet of Things communications, given the heavy investment of large and wealthy technology companies in the standards process. One of the most successful elements of the RFID standards effort, which developed and promoted the EPCGlobal standard, was close collaboration between academics, technology vendors and end users.End users of the RFID technology – notably retailer WalMart, Procter & Gamble and […]

Continue Reading

Wellness Apps & Wearables Put You up for Sale | SANS Institute

  The SANS Institute’s Securing the Human blog has a nice, contributed article by Kelli Tarala of Enclave Security on the security and privacy implications of wearable technology. Among Tarala’s conclusions: health and so-called “quantified self” products do much more than gather health data like pulse and blood pressure. Rather: they are omnivores, gobbling up all manner of metadata from users that can be used to buttress health data. That includes who you exercise with, favorite walking- and jogging routes and the times you prefer to work out. Of course, social media activity is also subject to monitoring by these health apps, which often integrate with platforms like Facebook, Twitter and Pinterest to share workout information. [Read more Security Ledger coverage of wearable technology here.] All of this could spell trouble for consumers. To quote Tarala: “there are companies interested in your Quantified Self, but their goals may not be to health related.” […]

Continue Reading

Report: Cyber Ring Stole Data To Game Stock Market | Reuters

Reuters has the story this morning about a new report out from the folks at FireEye about a cyber espionage ring that targets financial services firms. The campaign, dubbed FIN4 by FireEye, stole corporate secrets for the purpose of gaming the stock market. FireEye believes that the extensive cyber operation compromised sensitive data about dozens of publicly held companies. According to FireEye the victims include financial services firms and those in related sectors, including investment bankers, attorneys and investor relations firms. Rather than attempting to break into networks overtly, the attackers targeted employees within each organization. Phishing e-mail messages led victims to bogus web sites controlled by the hackers, who harvested login credentials to e-mail and social media accounts. Those accounts were then used to expand the hackers reach within the target organization: sending phishing email messages to other employees. The criminals behind FIN4 sought data that could be useful to stock traders, including Securities and […]

Continue Reading

Internet of Things Demands Visibility-Driven Security

In an earlier blog, I discussed essentials for visibility-driven security and the importance of having both visibility and correlation to quickly assess events in real-time. In this post, we will examine the different dimensions of visibility across the attack continuum and how crucial it is to have these dimensions in place in order to defend against known and emerging threats. Visibility-driven capabilities are critical if cybersecurity professionals are to do their job effectively. In order to accurately see what’s really happening across dynamic, changing, environments and provide a full understanding of malicious incidents, visibility must provide an accurate picture of users, devices, data, threats, and the relationships between them. And it must do so in near real-time and across  a wide range of infrastructures to support new business models related to mobility, cloud, and the Internet of Things (IoT). For many security breaches, the gap between the time of compromise and the […]

Continue Reading
1 … 289 290 291 292 293 … 396