Cybersecurity News & Trends
In industry news, a new business survey explores why employees violate cybersecurity policies designed to keep their businesses safe. Also, there’s a lot of reporting on how the US power grid has improved, but experts say they still need stronger cybersecurity. In other news, the International Red Cross organization suffered a breach, Crypto.com says hackers stole more than $30 million in Bitcoin and Ethereum, cryptocurrency values take a sharp dive as Russia explores a complete ban on crypto mining and trading, and the CISA is urging US organizations to prepare for data-wiping attacks similar with what hit Ukraine last week.
Industry News
Research: Why Employees Violate Cybersecurity Policies
Harvard Business Review: Many organizations have focused their security investments on technological solutions in the face of increasingly common (and costly) cyberattacks. However, as many consultants and experts know, attackers also rely on some insider (an employee or other member) knowingly or unknowingly allowing a bad actor into secure areas. What is behind these acts that can tear down even the most advanced security solutions? HBR published a recent study that suggests that most intentional policy breaches stem not from some malicious desire to cause harm but rather from the perception that following the rules would impede employees’ ability to get their work done effectively. Therefore, under heat for productivity, employees are more likely to violate security policies on days when they are more stressed out. The study they cite suggests that high-stress levels can reduce people’s tolerance for following rules that seem to get in the way of doing their jobs. In light of these findings, the authors suggest how organizations should rethink their approach to cybersecurity and implement policies that address the fundamental, underlying factors creating vulnerabilities.
Biden’s Cybersecurity Policies Praised Despite the Persistence Of Ransomware
NBC News: From Russian cyberespionage to attacks on crucial supply chains, the Biden administration has had no shortage of cybersecurity challenges to face. While ransomware was a rapidly escalating problem before Biden took office, it became undeniable last year. Hackers, often operating with seeming impunity within Russia, extorted US hospitals and schools, a major oil pipeline company and the country’s largest beef distributor. Experts say a year later, the Biden administration has done a decent job with cybersecurity policy, filling crucial roles and hardening the country’s infrastructure cybersecurity. But they also warn that ransomware hackers will likely continue to target Americans and that Congress hasn’t helped the country’s security as much as it could.
US Power Grids Need Stronger Cybersecurity
Bloomberg: According to the country’s top energy regulator, the US power grids need to boost their cyber defenses to find hackers faster to keep them from gaining control over operations. According to a notice issued Thursday, the Federal Energy Regulatory Commission is proposing to develop standards to monitor devices or equipment on bulk power systems. The proposed standards would seek to find hackers lurking within networks instead of current efforts that use a perimeter defense that focuses on trying to keep attackers out of sensitive networks. A massive breach using software from Texas-based SolarWinds Corp. in 2020 is one example of how attackers can bypass such defenses through trusted vendors.
Indonesia C.Bank Says Ransomware Attack Did Not Impact Services
Reuters: Indonesia’s central bank said on Thursday that it had been attacked last month by ransomware, but the risk from the attack had been mitigated and did not affect its public services.
Albuquerque Public Schools (APS) Resolves Effect of Ransomware Attack
APS News: The cyberattack that forced a two-day cancellation of classes last week at Albuquerque Public Schools was the victim of a ransomware event in which there was some extortion demand. But APS officials are not saying what was demanded nor whether they negotiated with the attackers.
International Red Cross: Supply Chain Data Breach Hit 500K People
InfoSecurity: The International Committee of the Red Cross (ICRC) has revealed a significant data breach that compromised the personal details of over 515,000 “highly vulnerable” victims. The data was stolen from a Swiss contractor that stores the information on behalf of the global humanitarian organization headquartered in Geneva.
Data Breach Customer Relations: What NOT To Do
InformationWeek: Some companies try to keep a data breach relatively quiet by following only the minimum legal requirements and hoping it will blow over. From experience, say experts, it’s much more likely to blow up than blow over. This article looks at some “bad behaviors” that managers may want to avoid.
Top 3 Small-Business Cyber Threats That Many Businesses Still Haven’t Heard Of
Inc Magazine: A study released Wednesday from the San Diego-based CyberCatch, a cybersecurity platform provider focusing on small and mid-size businesses, reveals that more than 30 percent of US small businesses have weak points that bad actors can exploit. Moreover, fraudsters tend to set their sights on small businesses since smaller companies usually have weaker security safeguards than those at larger companies. Some of the vulnerabilities that the survey named as “unknown” to small businesses include “spoofing,” “clickjacking,” and “sniffing.”
Crypto.Com Says Hackers Stole More Than $30 Million In Bitcoin And Ethereum
CBS News: The cryptocurrency exchange Crypto.com, known for its viral commercial starring Matt Damon as well as its recent $700 million deal to rename the Staples Center in Los Angeles as Crypto.com Arena, said the hackers managed to bypass its two-factor authentication system and withdraw the funds from 483 customer accounts, according to a statement the Singapore-based crypto exchange posted Thursday on its corporate blog.
Crypto-Exposed Stocks Sink Amid Bitcoin’s Decline, Broader Market Rout
CoinDesk: Stock declines come as prices for Bitcoin have dropped almost 11% in the past 24 hours, trading below $40,000 for the first time in months. Crypto watchers note that as bitcoins, in general, are getting hammered, crypto miners are seeing their revenues fall sharply. They also point out the double-whammy as Bloomberg, and other outlets reported that Russia’s central bank is proposing a complete ban on crypto mining and trading.
CISA Urges US Orgs to Prepare For Data-Wiping Cyberattacks
Bleeping Computer: US organizations are getting another warning to strengthen their cybersecurity defenses. This time, the CISA is concerned about recent data-wiping attacks that targeted Ukrainian government agencies and corporate entities. Several major entities suffered coordinated cyberattacks where hackers defaced websites and distributed data-wiping malware that corrupted data and rendered Windows devices inoperable. Sources believe that the attackers likely conducted the website defacements using a vulnerability in the OctoberCMS platform. Ukrainian authorities are also investigating what role Log4j vulnerabilities and stolen credentials may have played in the attacks. The message: update your security and keep a watchful eye on all activity.
In Case You Missed It
- Everything Old Is New Again: Remote Access Comes Full Circle – James Whewell
- How SonicWall ZTNA protects against Log4j (Log4Shell) – Rishabh Parmar
- 10 Tips for a Safe and Happy Holiday – Amber Wolff
- The Rise and Growth of Malware-as-a-Service – Ray Wyman
- A Record-Breaking Year for SonicWall’s Boundless Future – Ray Wyman
- Cybersecurity is Infrastructure – Ray Wyman
- Frost & Sullivan Commend SonicWall for Security Excellence – Kayvon Sadeghi
- SonicWall Answers the Call with New NGFWs – Ajay Uggirala
- Illuminating Cybersecurity with Unified Insights – Suroop Chandran
- How Unified Cloud Simplifies Network Switch Management – Tiju Cherian
- Cyber Threat Alert: Ransomware Breaks Another Record – Ray Wyman
- Why Cybersecurity Must be First – Ray Wyman
- How to Protect Multi-Cloud Environments with a NSv Virtual Firewall – Tiju Cherian
- What’s driving job growth in cybersecurity? – Ray Wyman
