Healthcare attackers switch to smaller targets
While large healthcare providers have lots of juicy data to tempt cybercriminals, they are also likely to have strong defenses.
It's not too surprising then that a new report from managed detection and response provider Critical Insight shows that in the first half of this year attackers have shifted their attentions to smaller hospital systems and specialty clinics that lack the same level of security preparedness, staff size, or budget.
Plex suffers data breach; third-party gains access to emails, usernames and more
Plex has emailed its users to warn about a security indecent it has become aware of. While the subject line of the email refers to a "potential data breach", the body goes on to talk about suspicious activity and a third-party gaining access to part of a database.
The company says that the exposed data included emails, usernames and encrypted passwords. Although all passwords were secured and hashed, all Plex users are required to change their security credentials out of an "abundance of caution".
Security drives DevOps platform adoption
Nearly three-quarters of respondents to a new survey have adopted -- or plan to adopt within a year -- a DevOps platform in order to meet rising industry expectations around security, compliance, toolchain consolidation, and faster software delivery.
The study from GitLab shows security has overtaken even cloud computing as the number one investment area across DevOps teams at global organizations.
Consumers absorb cybersecurity tips from popular culture
According to a new study 59 percent US and UK consumers are now more cautious about trusting others online thanks to having watched fraud documentaries.
The report from Onfido looks at the impact of popular shows like Inventing Anna and The Tinder Swindler and finds that 67 percent of consumers admit they have changed their outlook on fraud.
Taking the risk-based approach to vulnerability patching
As one of the most effective ways to prevent attacks on IT assets, it is universally acknowledged and known that patching vulnerabilities is a critical process. But as the volume of vulnerabilities discovered in the tools we use continues to proliferate -- and the speed at which they are being weaponized increases -- patching is becoming a complex and difficult task for security teams. During the 2021 calendar year alone, more than 20,000 individual vulnerabilities were discovered and announced, and by May 2022, more than 10,000 issues had been released. The number of vulnerabilities being discovered and disclosed is not slowing down, it is accelerating.
While the security community’s ability and attention towards discovering vulnerabilities has matured, the scale of these issues has - in tandem - become overwhelming. So what can organizations do to stay afloat in today’s "sink-or-swim" threat landscape?
Organizations plagued by identity sprawl
A new study reveals that identity sprawl is a major problem for organizations, with 60 percent reporting as many as 21 separate identities per user.
The report from Radiant Logic and Gartner Peer Insights looks at the rapid growth of enterprise identity silos, and the explosion of user information, attributes, and credentials that accompanies it.
Maintaining top API-level security in today's cyber landscape
Data breaches, cyberattacks and security concerns are growing exponentially in the digital climate, as new development practices, extra languages, and structural frameworks appear -- compounded by geopolitical tensions giving rise to state sponsored attacks. In 2022 to date, 39 percent of UK businesses have already experienced the disruption and costly consequences of cyberattacks. Some of the largest enterprises, such as Microsoft, T-Mobile, and Vodafone, have experienced attacks by highly organized groups, such as Lapsus$.
With the scale, type of attacks and target industries constantly evolving, the healthcare sector has joined financial services and the public sector in becoming a lucrative target. Healthcare data breaches reached an all-time high in 2021, impacting 45 million people -- personal health information (PHI) became worth more than credit card information on the dark web. Attack approaches are constantly evolving, with hackers searching for any weak links in growing infrastructure.
Supply chains cybersecurity risks: Closing the protection gap
Supply chain attacks have been on the threat radar of many organizations and their security teams for several years. However, since the infamous SolarWinds attack in 2020 -- which led to widespread and damaging compromises of data, networks and systems -- the supply chain attack vector has taken on a new level of focus. Indeed, supply chain attacks, which have become an effective way for hackers to gain access to IT networks at scale, and as such, are among the most worrying cybersecurity risks currently facing organizations today.
Supply chain risks come in many forms -- from complex to relatively simplistic. The UK government’s Cyber Security Breaches Survey, which explores organizations’ policies, processes, and approaches to cybersecurity and is used to inform government cybersecurity policy, looked at this in its latest report. The 2022 survey reveals that just 13 percent of businesses review the risks posed by their immediate suppliers, with that number dropping to 7 percent for their wider supply chain. Possibly even more concerning, many organizations commonly perceive 'big tech' companies to be "invulnerable to cyber attacks".
Securing the new hybrid education network
Even before 2020, connectivity played an important role in university life. In recent years, however, connectivity shifted from a mere convenience to a lifeline for students and universities. As these institutions built and expanded online remote access for their students, many from scratch, their IT departments were forced to shift their focus from on-campus networking to supporting a distributed global network to meet the new normal of education.
Although in-person teaching has now seen a welcome return, the wealth of online learning resources available, both on internal and external networks, are an invaluable asset to both teachers and students. Meanwhile, online retail, banking, health services, gaming, media, and more are mainstays of student life.
Rethinking cybersecurity
If you’ve been in the cybersecurity field for a while, you’ve probably noticed that there’s less emphasis on formal disaster recovery and business continuity plans than there used to be. CISOs still create plans, but it’s not the centerpiece of cybersecurity operations in the same sense. As security technology evolved, people started focusing more on technology solutions that they hoped could prevent problems altogether.
There’s some magical thinking involved in that, and ironically, one of the biggest struggles CISOs face now is how their organizations think about cybersecurity problems, i.e., that there shouldn’t be problems. That’s not the world we live in. Having difficulties is not the issue. Rather, thinking there are magic solutions that can eliminate every weakness is the problem. We need to rethink cybersecurity to accommodate this reality and create a holistic response for when problems inevitably arise.
Why we need to make data integration obsolete [Q&A]
Nowadays there are apps for almost everything. As users they clutter up our phones and tablets, but they present problems for businesses too, in particular the storing and analysis of the data they create.
Data is often tied to a specific app and each app needs its own copy, so enterprises can end up with lots of copies of the same information leading to issues with control, compliance and more.
Ransomware variants almost double in six months
In the past six months, FortiGuard Labs has seen a total of 10,666 ransomware variants, compared to just 5,400 in the previous half year.
In addition ransomware-as-a-service (RaaS), with its popularity on the dark web, continues to fuel an industry of criminals forcing organizations to consider ransomware settlements.
DevSecOps delivers significant results but take up remains low
Only 22 percent of organizations have developed a formal DevSecOps strategy integrating security into software development lifecycle processes, according to a new report.
But the study from Mezmo shows an overwhelming percentage of those that do have a strategy report a positive impact on accelerating incident detection (95 percent) and response (96 percent) efforts.
New, free tool to help enterprises assess financial risk of cyberattacks
A successful cyberattack can have significant costs for a business, in terms of both reputation and finances. But what's the actual cost of an attack? And if you're looking at insurance how much should you be covered for?
To help answer those questions Safe Security is announcing two industry-first assessment tools to empower organizations to make financial decisions based on their actual cyber risk.
Cybercriminals attack the wrong water company in bungled extortion attempt
On Monday, hacker group ClOp claimed to have gained access to 5TB of data from UK water supplier Thames Water and said it could change the chemical composition of the company's water supply.
Thames Water denied the reports and said it hadn't faced a cyber attack. Today it emerges that an attack has taken place but on a different company, South Staffordshire plc, the parent company of South Staffs Water and Cambridge Water.
© 1998-2025 BetaNews, Inc. All Rights Reserved. About Us - Privacy Policy - Cookie Policy - Sitemap.