learn more
<https://castlehalldiligence.com>
shutterstock_490960141-1

Industry News: ESG5

Know Your Breach: West Bengal Health and Welfare Department

The target: The Health and Welfare Department of West Bengal, India

The take: 8 million COVID-19 test results including personally identifiable information such as: name, age, address, and positive or negative test results.

The attack vector: The breach revolves around the health authority’s reporting system, whereby individuals who had been tested for COVID-19 received links by SMS with a unique URL to access their test results by web. It was discovered that there was no authentication in place on the reporting system, and that by incrementing the ID number included in the URL, anyone with internet access could access all test results for the state.

This example serves once again to highlight the huge risks of adopting a ‘security by obscurity’ model. When administering a public facing portal which provides access to sensitive information, authentication controls are not optional – it is simply inadequate to make all records publicly available and trust that the uniqueness of the URL will protect the sensitive data of organizations or individuals.

Read more...

HYAS Closes $16 Million Series B Funding Round Led by S3 Ventures for Cyberattack Intercept Technology

2021-02-25

GlobeNewswire: HYAS, a leader in threat intelligence, adversary infrastructure, and network defense, today announced that it had closed a $US16 million round of funding led by Austin, TX based, S3 Ventures. The funds will be used to accelerate product development and global market expansion for the company’s cyber attack infrastructure identification and blocking technology.

Read more...

Hundreds of Workers At Cybersecurity Agency Vote to Strike

2021-02-24

CBC: Hundreds of workers at Canada's foreign signals intelligence agency have voted to strike — a move that comes as the threat of state-sponsored cyber attacks related to the pandemic appears to be rising.

Read more...

The World Is Facing A 'Global Cybercrime Pandemic'

2021-02-24

Tech Radar: The world is facing a cybercrime pandemic, a new report on the Covid-19 security landscape suggests. According to research from security firm Check Point, more than 100,000 malicious websites are currently active each day, as well as 10,000 different malware strains. 

Read more...

Microsoft Unveils Three More 'Industry Clouds' for Financial, Manufacturing and Nonprofit

2021-02-24

ZDNet: Microsoft is continuing to roll out more vertical cloud packages tailored for specific vertical industries. On February 24, the company announced three more of these "industry clouds" for financial services, manufacturing and nonprofit. These supplement the already-announced Microsoft cloud packages for healthcare and retail.

Read more...

A Constant State of Flux

2021-02-23

Trend Micro: 2020 was the year that stymied organizations and tested their limits on many fronts. Incidents of great consequence, shifts to remote-work arrangements, and other significant changes from the familiar prompted a renewed awareness and reassessment in organizations. The challenges they encountered paved the way for adaptive and alternative solutions that took into account human as well as technological perspectives.

Read more...

SolarWinds, Microsoft, FireEye, CrowdStrike Defend Actions In Major Hack - U.S. Senate Hearing

2021-02-23

Reuters: Top executives at Texas-based software company SolarWinds Corp, Microsoft Corp and cybersecurity firms FireEye Inc and CrowdStrike Holdings Inc defended their conduct in breaches blamed on Russian hackers and sought to shift responsibility elsewhere in testimony to a U.S. Senate panel.

Read more...

Sequoia Capital Investigates Cyber Security Breach That Might Have Exposed Investors' Data

2021-02-22

The Business Times: Sequoia Capital told its investors that some personal data and financial information may have been accessed by a third party after one of its employees fell victim to a successful phishing attack, according to a report from US news website Axios.

Read more...

Know Your Breach: St. Louis County School Board

The target: The Independent School District of 2142 of St. Louis County Schools

The take: W-2 tax forms of 677 district employees with personally identifiable information including: Social Security Number, first and last name, home address, wages, and more.

The attack vector: A spoofed email requesting the forms came from an attacker pretending to be the district Superintendent. Believing the request to be legitimate, the forms were sent to the fraudulent email address provided in the request.

This breach highlights the importance of employee cybersecurity training and a posture of constant vigilance. Scammers rely upon people’s natural inclination to be helpful and prompt, and it’s critical to ensure that employees who handle sensitive information receive tailored training, emphasizing the caution and care they must employ in responding to unusual requests for data.

Read more...

France to Boost Cyberdefense After Hospital Malware Attacks

2021-02-18

Yahoo Finance: French President Emmanuel Macron on Thursday unveiled a plan to better arm public facilities and private companies against cybercriminals following ransomware attacks at two hospitals this month and an upsurge of similar cyber assaults in France.

Read more...

UK’s Cybersecurity Sector Experiences Record Growth

2021-02-18

Info Security: The latest DCMS Annual Cyber Sector Report revealed there was a record £821m of investment raised by companies in this field across 73 deals in 2020, more than doubling the amount recorded in 2019.

Read more...

Cybersecurity Needs to Be Proactive with Involvement from Business Leaders

2021-02-18

Tech Republic: Effective CISOs and other leaders are those who plan for today but with an eye on tomorrow, and always put people first, according to Christopher Krebs, former director of the Department of Homeland Security's cybersecurity and infrastructure agency.

Read more...

U.S. Charges Three North Koreans in $1.3 Billion Hacking Spree

2021-02-17

Reuters: The United States has charged three North Korean computer programmers with a massive hacking spree aimed at stealing more than $1.3 billion in money and cryptocurrency, affecting companies from banks to Hollywood movie studios, the Department of Justice said.

Read more...

White House Says Solarwinds Probe Could Take ‘Months’

2021-02-17

The Mercury News: The US government’s probe into the devastating SolarWinds breach is likely to take “several months” at least, according to the top White House cybersecurity official, speaking to reporters Wednesday in the Biden administration’s first public assessment of the gravity of the suspected Russian spying campaign.

Read more...

This Cybersecurity Threat Costs Business Millions. And It's the One They Often Forget About

2021-02-16

ZDNet: While ransomware is the cyberattack most feared by businesses, another form of cybercrime is slipping under the radar, one that is proving highly lucrative for internet fraudsters – and costly to business.

Read more...

100+ Financial Services Firms Targeted in Ransom DDoS Attacks in 2020

2021-02-15

Dark Reading: More than 100 financial services firms across multiple countries were targeted in a wave of ransom distributed denial-of-service (DDoS) attacks conducted by the same threat actor in 2020.

Read more...

Know Your Breach: Accellion

The target: Accellion, a U.S based cloud service vendor providing secure file transfer applications for enterprise use. 

The take: A variety of datasets including personally identifying information and proprietary data for an estimated 300 clients, including The Australian Securities and Investments Commission, The Reserve Bank of New Zealand, Harvard Business School, Singtel (a Singapore-based telcom conglomerate), and the QIMR Berghofer Medical Research Institute.

The attack vector: Hackers breached the firm’s legacy File Transfer Application software by taking advantage of a zero-day vulnerability in a legacy software product a point of weakness identified and exploited by a threat actor before the developer was made aware of it and was able to produce a patch.

This supply-chain attack against a platform which was near retirement highlights the danger of relying on end-of-life, legacy software products. Firms should be proactive in moving to current-generation software solutions - Accellion have reportedly “encouraged all FTA customers to migrate to Kiteworks [their current generation offering] for the last three years”.

Read more...

Cyber Security Levels Not Consistent Among UK Pension Schemes

2021-02-11

Professional Pensions: The levels of cyber security are not consistent among UK pension schemes, according to research by Aon. The firm's Cyber Threats to Corporate Pension Schemes survey revealed a mixed state of cyber security, finding three in five schemes have a cyber strategy.

Read more...

People Are Often the Collateral Damage of Attacks On Corporations

2021-02-11

Help Net Security: Thanks to cyberattacks making regular headlines in the news, it’s no secret that massive data breaches are a significant threat to organizations. However, a report from F-Secure highlights the rarely-discussed impact these attacks can have on people and families using online services.

Read more...

Israeli Cybersecurity Group CYE Raises $100 Million from EQT, 83North

2021-02-10

Reuters: Israeli cybersecurity company CYE said on Wednesday it had raised $100 million from Swedish private equity firm EQT and London-based venture capital firm 83North as it looks to expand in European and North American markets.

Read more...

Hackers Targeted Financial Sector In Mass Extortion Campaign

2021-02-09

WSJ: Late last year, more than 100 financial-services companies across the world received threats from a group of hackers who claimed destructive attacks would follow unless large payments were made.

Read more...

U.K. Merger Watchdog Suffers 150 Data Breaches In Two Years

2021-02-09

BNN Bloomberg: The U.K. government’s antitrust regulator was hit by 150 personal data breaches in the last two years, as hackers targeted its trove of sensitive business information.

Read more...

Appgate, A Leading Cybersecurity Company, to Merge with Public Company Newtown Lane Marketing

2021-02-09

Businesswire: Newtown Lane Marketing, Incorporated and Appgate (the “Company”), an industry leading secure access company, today announced that they have entered into a definitive merger agreement. Upon consummation of the transaction, Appgate will become a public company with significant financial resources to accelerate growth, scale, and go-to-market strategies.

Read more...

New Zealand Exchange Cyberattack Also Hit More Than 100 Firms

2021-02-08

BNN Bloomberg: More than 100 banks, exchanges, insurers and other financial firms worldwide were targets of the same type of cyberattack that crippled the New Zealand Stock Exchange in August, though they didn’t suffer the same extent of damage.

Read more...

Know Your Breach: UScelluar

The target: UScelluar, the fourth largest mobile network operator in the United States.

The take: Customer records of personally identifiable information including: names, addresses, account names and PIN codes, telephone numbers, information on their phone service plans, and the ability to alter the phone number on accounts which receive two-factor authentication texts.

The attack vector: The attackers tricked retail employees into downloading malicious software which contained a RAT (remote access tool), allowing the threat actors to access the computer systems remotely. As the employees were already logged into the CRM (customer retail management) software, the hackers were able to move freely within the systems using an employee’s credentials. 

Social engineering is a widely used tactic by attackers to exploit our innate desire to be helpful in a quick manner without thinking through the consequences. The employee’s mistake, innocent or not, of clicking on an unverified link granted the attacker the ability to install a Remote Access Tool and navigate through the company’s systems under legitimate credentials. Continuous employee education around suspicious links, and the social engineering tactics they’re paired with, are critical components of a firm’s robust cybersecurity posture.

Read more...

New York Regulator Issues Guidance for Insurers Writing Cyber Policies In the State

2021-02-04

Insurance Journal: The New York State Department of Financial Services (DFS) has issued new guidance spelling out best practices for New York-regulated property/casualty insurers that write cyber insurance. This serves as the first guidance the regulator has issued on cyber insurance in particular.

Read more...

Hackers Steal StormShield Firewall Source Code In Data Breach

2021-02-04

Bleeping Computer: Leading French cybersecurity company StormShield disclosed that their systems were hacked, allowing a threat actor to access the company's support ticket system and steal source code for Stormshield Network Security firewall software.

Read more...

It’s Time to Rethink Cybersecurity Training… Again

2021-02-04

Security Magazine: Cybersecurity training today is much different than it was 10 years ago. In most organizations, we have developed training that is engaging, interactive, even enjoyable at times. Security leaders of yesterday realized that having a once a year, boring, PowerPoint like training that employees had to undergo to check a box was not working. Everyone dreaded that training and that led to skimming the material and clicking through slides, then brute-forcing their way through the answers on the final exam.

Read more...

IT Directors Flag Risk of Employees Building Their Own Software

2021-02-03

Funds Europe: According to a survey of IT directors and chief technology officers by consulting firm Sionic, 93% of asset management firms have employees creating and designing their own applications.

Read more...

Suspected Chinese Hackers Used SolarWinds Bug to Spy On U.S. Payroll Agency

2021-02-02

Reuters: Suspected Chinese hackers exploited a flaw in software made by SolarWinds Corp to help break into U.S. government computers last year, five people familiar with the matter told Reuters, marking a new twist in a sprawling cybersecurity breach that U.S. lawmakers have labeled a national security emergency.

Read more...

Board Members Aren’t Taking Cybersecurity As Seriously As They Should

2021-02-01

Help Net Security: Trend Micro shared results from a study that reveals systemic challenges with security integration into business processes. The report includes the top ways to drive engagement and agreement around cybersecurity strategies within an organization.

Read more...

The Necessity for Better Data Security in 2021

2021-02-01

IT Pro Portal: Cybersecurity plays an essential role in protecting us and the digital systems we use on a daily basis. Although technology is rapidly evolving, we are witnessing a vast number of data breaches due to organizations facing minimal charges for poor protection of data and storage.