CyberSecurity Updates

24 Jan

P-to-P fraud most concerning cyber threat in 2023: CSI

Data Breaches, Malware, Social Engineering

US financial institutions see peer-to-peer fraud and other digital fraud as the biggest cybersecurity concern in 2023. It was cited by 29% of respondents in a survey by Computer Systems Inc. (CSI), followed by data breaches (23%), ransomware (20%) and a breach at a third party (15%).  Industry respondents also expressed concerns over identity theft at 4%, unavailable or unaffordable cyber insurance at 4%, geopolitical risks at 3%, DDoS attacks at 2% and website defacement at…

Read More
24 Jan

CISA Releases Protecting Our Future: Partnering to Safeguard K–12 organizations from Cybersecurity Threats

Attacks, Insights, Malware

Original release date: January 24, 2023 Today, CISA released Protecting Our Future: Partnering to Safeguard K–12 organizations from Cybersecurity Threats. The report provides recommendations and resources to help K-12 schools and school districts address systemic cybersecurity risk. It also provides insight into the current threat landscape specific to the K-12 community and offers simple steps school leaders can take to strengthen their cybersecurity efforts. The report’s findings state that K-12 organizations need resources, simplicity and…

Read More
24 Jan

ServiceNow to detect open source security vulnerabilities with Snyk integration

Data Breaches, Malware, Social Engineering

ServiceNow Vulnerability Response users will now have access to Snyk Open Source, a software composition analysis (SCA) platform designed to help developers find, prioritize, and fix security vulnerabilities and license issues in open source dependencies. Snyk Open Source is backed by the Israeli-US company’s own security intelligence that relies on a combination of public sources, data from the developer community, proprietary expert research, machine learning, and human-in-the-loop AI.  ServiceNow Vulnerability Response is part of ServiceNow Security Operations…

Read More
24 Jan

Hybrid play: Leveling the playing field in online video gaming and beyond

Information

Does VALORANT’s approach to cheating signal a turning point in how we deal with the continued hacks afflicting our hybrid world of work and play? First social apps, now gaming? The growth of cloud-powered apps like Telegram and Teams has created mega communities out of their users. Many of these apps have opened the door to personal self-expression and the types of risk-taking notorious on social media platforms. Oversharing, connecting with strangers, clickbait, and phishing…

Read More
24 Jan

Serious Security: How dEliBeRaTe tYpOs might imProVe DNS security

Information

by Paul Ducklin Over the years, we’ve written and spoken on Naked Security many times about the thorny problem of DNS hijacking. DNS, as you probably know, is short for domain name system, and you’ll often hear it described as the internet’s “telephone directory” or “gazetteer”. If you’re not familiar with the word gazeteer, it refers to the index at the back of an atlas where you look up, say, Monrovia, Liberia in a convenient…

Read More
24 Jan

Apple patches are out – old iPhones get an old zero-day fix at last!

Information

by Paul Ducklin Last year, on the last day of August 2022, we wrote with mild astonishment, and perhaps even a tiny touch of excitement, about an unexpected but rather important update for iPhones stuck back on iOS 12. As we remarked at the time, we’d already decided that iOS 12 had slipped (or perhaps been quietly pushed) off Apple’s radar, and would never be updated again, give that the previous update had been a…

Read More
24 Jan

How passkeys are changing authentication

Data Breaches, Malware, Social Engineering

Passwords are a central aspect of security infrastructure and practice, but they are also a principal weakness involved in 81% of all hacking breaches. Inherent useability problems make passwords difficult for users to manage safely. These security and useability shortcomings have driven the search for alternative approaches known generally as passwordless authentication. Passkeys are a kind of passwordless authentication that is seeing increasing focus and adoption. They are set to become a key part of…

Read More
24 Jan

Skyhawk launches platform to provide threat detection and response across multi-cloud environments

Data Breaches, Malware, Social Engineering

Cloud threat detection vendor Skyhawk Security has released a platform designed to address alert fatigue that provides cloud detection and response (CDR) across multi-cloud environments, the company said Tuesday in a statement. The company says the Synthesis platform is being released on a “freemium” basis—the base version is available at no cost, but supplement features can be purchased. Skyhawk claims the platform improves upon products focused on identifying numerous static cloud security misconfigurations by employing…

Read More
24 Jan

Australia fronts International Counter Ransomware Taskforce

Data Breaches, Malware, Social Engineering

The International Counter Ransomware Taskforce (ICRTF), envisioned by the International Counter Ransomware Initiative (CRI), kicked off its operations on Monday with Australia as its inaugural chair and coordinator. The CRI was first brought together in October 2021 with a virtual meeting of 30 countries, facilitated by the US White House National Security Council. In November 2022, a second meeting took place where the following was established by the 37 participating member: Hold ransomware actors accountable for…

Read More
23 Jan

Nvidia targets insider attacks with digital fingerprinting technology

Data Breaches, Malware, Social Engineering

Nvidia today announced that a digital lab playground for its latest security offering is now available, letting users try out an AI-powered system designed to monitor individual user accounts for potentially hazardous behavior. The idea, according to the company, is to leverage the large amounts of data that many organizations compile anyway about login and data access events on their systems, and use that to train an AI that watches for user accounts to diverge…

Read More