Data security and privacy

How was Google Firebase security bypassed?

Google Firebase's inadequate back-end development led to data leaks and vulnerabilities, including HospitalGown. Learn more about this security flaw from expert Michael Cobb. Continue Reading

By

• Michael Cobb

Facebook GDPR fate uncertain following data breach

Facebook's GDPR consequences are still up in the air following a data breach, as Irish regulators are waiting on more information before determining if the social network will face a fine. Continue Reading

By

• Michael Heller, TechTarget

State Department data breach exposes employee info

A State Department data breach involving the agency's unclassified email system may have been due to a lack of multi-factor authentication, according to one expert. Continue Reading

By

• Michael Heller, TechTarget

GovPayNow leak exposes 14 million records dating back six years

Experts question the security audit and government agency vetting that took place before the GovPayNow leak, which affected 14 million customer records dating back six years. Continue Reading

By

• Michael Heller, TechTarget

What the GAO Report missed about the Equifax data breach

The Government Accountability Office investigated the Equifax data breach, but the GAO's report leaves out several important points about the infamous incident. Continue Reading

By

• Rob Wright, Senior News Director

British Airways data breach may be the work of Magecart

News roundup: The British Airways data breach may be the handiwork of hacking group Magecart, according to researchers. Plus, hacker Guccifer will be extradited to U.S., and more. Continue Reading

By

• Madelyn Bacon, TechTarget

Risk & Repeat: Inside the GAO's Equifax breach report

In this week's Risk & Repeat podcast, SearchSecurity editors discuss the Government Accountability Office's report on the Equifax breach and the questions it raises. Continue Reading

By

• Rob Wright, Senior News Director

Five Eyes wants to weaken encryption, or legislation may be needed

Five Eyes -- the government intelligence alliance between Australia, Canada, New Zealand, the U.K. and the U.S. -- vows not to weaken encryption, while pushing for encryption backdoors. Continue Reading

By

• Michael Heller, TechTarget

What risks does the OpenFlow protocol vulnerability present?

Researchers found a vulnerability in OpenFlow that can cause problems. Learn how vendor-specific SDN controllers may cause these OpenFlow protocol vulnerabilities. Continue Reading

By

• Judith Myerson

Facebook user data: How do malicious apps steal user data?

Malicious apps collected Facebook user data through Facebook APIs. Expert Michael Cobb explains how social networking platforms can monitor third-party apps' access to data. Continue Reading

By

• Michael Cobb

Yale data breach discovered 10 years too late

A Yale University data breach from 2008 was only just discovered, and the school has released details on the compromised information, including Social Security numbers. Continue Reading

By

• Michael Heller, TechTarget

Three steps to improve data fidelity in enterprises

Ensuring data fidelity has become crucial for enterprises. Expert Char Sample explains how to use dependency modeling to create boundaries and gather contextual data. Continue Reading

By

• Char Sample, ICF International

LifeLock vulnerability exposed user email addresses to public

News roundup: A LifeLock vulnerability exposed the email addresses of millions of customers. Plus, Amazon's Rekognition misidentified 28 members of Congress as criminals, and more. Continue Reading

By

• Madelyn Bacon, TechTarget

Ponemon: Mega breaches, data breach costs on the rise

The Ponemon Institute's '2018 Cost of a Data Breach Study' details a rise in data breaches with a look at mega breaches and why U.S. companies experience the greatest loss. Continue Reading

By

• Casey Clark, TechTarget

How does SirenJack put emergency warning systems at risk?

Bastille researchers created the SirenJack proof of concept to show how a vulnerability could put San Francisco's emergency warning system at risk. Judith Myerson explains how it works. Continue Reading

By

• Judith Myerson

How to identify and protect high-value data in the enterprise

Protecting data in the enterprise is a crucial but challenging task. Expert Charles Kao shares key steps and strategies to consider to identify and protect high-value data. Continue Reading

By

• Charles Kao, Simply Auri

Cisco's chief privacy officer on the future of data after GDPR

Michelle Dennedy, vice president and chief privacy officer at Cisco, discusses her company's approach to meeting the requirements of the EU's General Data Protection Regulation. Continue Reading

By

• Kathleen Richards

Exactis leak exposes database with 340 million records

Experts said the Exactis leak needs to be treated as a learning moment for defining identity online after the marketing firm exposed data on 230 million adults and 110 million businesses. Continue Reading

By

• Michael Heller, TechTarget

How are air-gapped computers put at risk by the Mosquito attack?

Researchers recently discovered Mosquito -- an air-gapped attack that bites computers to put air-gapped networks at risk. Discover the logistics of this technique with Judith Myerson. Continue Reading

By

• Judith Myerson

How lattice-based cryptography will improve encryption

As the prospect of quantum computing-based attacks grows, the need for stronger encryption increases. Expert Michael Cobb discusses lattice-based cryptography as an option. Continue Reading

By

• Michael Cobb

Q&A: Why data security controls are a hard problem to solve

Feeling less friendly after Facebook? "There is a great deal of power in being able to combine data-sources," says Jay Jacobs, security data scientist. Continue Reading

By

• Marcus J. Ranum

Q&A: Why data security controls are a hard problem to solve

 Continue Reading

DeOS attacks: How enterprises can mitigate the threat

An increase in DeOS attacks has been reported just as the 'Cisco 2017 Midyear Cybersecurity Report' predicted. Learn how these attacks target off-site backups with David Geer. Continue Reading

By

• David Geer, Geer Communications

Risk & Repeat: Why Ray Ozzie's Clear proposal isn't so clear

In this week's Risk & Repeat podcast, SearchSecurity editors discuss Ray Ozzie's solution for going dark, known as Clear, and what infosec experts are saying about it. Continue Reading

By

• Rob Wright, Senior News Director

SSH private keys: How do threat actors find exposed keys?

Cybersecurity vendor Wordfence reported a rise in scans for SSH private keys that are often accidentally exposed to the public. Learn how to stay protected with Nick Lewis. Continue Reading

By

• Nick Lewis

Another misconfigured Amazon S3 bucket exposes 48M records

News roundup: A misconfigured Amazon S3 bucket led to the exposure of 48 million records collected by a private data analytics firm. Plus, PCI SSC updated its cloud guidelines, and more. Continue Reading

By

• Madelyn Bacon, TechTarget

Fidelis rolls out new active deception approach to security

Active deception is set to be an important part of cloud defense, as Fidelis Cybersecurity adds active decoys to protect cloud assets in the enterprise. Continue Reading

By

• Peter Loshin, Former Senior Technology Editor

What the security incident response process should look like

An enterprise needs to have a strong security incident response process plan mapped out early. Expert Ernie Hayden shares how to turn an incident into a learning experience. Continue Reading

By

• Ernie Hayden, 443 Consulting LLC

Cybersecurity defense in depth means more than ticking boxes

F-Secure's Tom Van de Wiele explains the realities of cybersecurity defense in depth, and why companies need to have the right attitude to defend against cyberattacks. Continue Reading

By

• Peter Loshin, Former Senior Technology Editor

Misconfigured cloud storage leaves 1.5B files exposed

Researchers found misconfigured cloud storage across multiple platforms left huge amounts of data exposed, including medical information and payroll data. Continue Reading

By

• Michael Heller, TechTarget

Cost of data privacy breach may not be enough

While the European Union is taking major steps to protect residents' data privacy, little has happened in the United States, even after Equifax and Facebook. Continue Reading

By

• Kathleen Richards

Cost of data privacy breach may not be enough

 Continue Reading

Watson's Law: IBM preaches data stewardship as A.I. advances

At IBM's Think conference, executives discussed the importance of protecting and managing data as artificial intelligence offerings like Watson grow and touch more information. Continue Reading

By

• Rob Wright, Senior News Director

IBM outlines visions for crypto anchors, lattice cryptography

At IBM's Think conference, Big Blue researchers discussed new security-centric projects around blockchain databases, crypto anchors and quantum-resilient encryption. Continue Reading

By

• Rob Wright, Senior News Director

Following Equifax data breach, executive charged with insider trading

News roundup: A CIO has been charged with insider trading after the Equifax data breach. Plus, Trump blocked Broadcom's acquisition of Qualcomm, and more. Continue Reading

By

• Madelyn Bacon, TechTarget

Entropy sources: How do NIST rules impact risk assessments?

NIST recently released new guidance on entropy sources used for random bit generation. Judith Myerson explains these recommendations and how they alter cryptography principles. Continue Reading

By

• Judith Myerson

Equifax data breach affected 2.4 million more consumers

The massive Equifax data breach affected even more people. The startling total is now 147.9 million U.S. consumers who had their information stolen by hackers. Continue Reading

By

• Madelyn Bacon, TechTarget

Uber breach: How did a private GitHub repository fail Uber?

The recent Uber breach calls into question the use of code repositories. Expert Matt Pascucci explains how the breach of GitHub and Amazon Web Services occurred. Continue Reading

By

• Matthew Pascucci

Equifax breach worsens, additional consumer data exposed

The Equifax breach compromised even more consumer data, including tax identification numbers, than originally reported. But the credit rating agency didn't disclose the update. Continue Reading

By

• Madelyn Bacon, TechTarget

GDPR breach notification: Time to focus on the requirements

Some large U.S. companies have been working behind the scenes on GDPR requirements for more than a year, but there's strong evidence that many have not been as diligent. Continue Reading

By

• Steve Zurier, ZFeatures

Data protection compliance costs less than noncompliance

Smaller companies -- with fewer than 5,000 employees -- in particular may be hit hard by GDPR requirements and other data compliance hurdles. A new report does the math. Continue Reading

By

• Kathleen Richards

GDPR breach notification: Time to focus on the requirements

 Continue Reading

Data protection compliance costs less than noncompliance

 Continue Reading

What do Dnsmasq vulnerabilities mean for Android users?

Researchers found several Dnsmasq vulnerabilities that affect Google's Android operating system. Matt Pascucci explains how these flaws can be exploited by threat actors. Continue Reading

By

• Matthew Pascucci

Confused deputy: How did the vulnerability affect Slack?

A major SAML vulnerability was found in Slack that granted expired login credentials permission into the system. Matt Pascucci explains how this 'confused deputy' problem was handled. Continue Reading

By

• Matthew Pascucci

Business threat analytics: How does real-time data impact results?

Explore the top things you should know about real-time analytics with Johna Till Johnson and learn how it reduces false positives detected in your system on a daily basis. Continue Reading

By

• Johna Till Johnson, Nemertes Research

How is IP theft possible despite cryptographic protections?

Expert Judith Myerson explains how IP theft can happen despite the cryptographic protections in IEEE standard P1735, as well as what can be done to protect intellectual property. Continue Reading

By

• Judith Myerson

A DHS data breach exposed PII of over 250,000 people

News roundup: A DHS data breach exposed PII of 250,000 federal employees, as well as investigative data from 2002 to 2014. Plus, a new bill aims to nix paperless voting, and more. Continue Reading

By

• Madelyn Bacon, TechTarget

The ROCA vulnerability: How it works and what to do about it

The ROCA vulnerability is a serious flaw in cryptographic keys. Expert Michael Cobb explains what the flaw is, how it works and what can be done to lessen the risk to enterprises. Continue Reading

By

• Michael Cobb

After 2017, data breach fatigue should be a thing of the past

Data breach fatigue should be put on hold after the Equifax data breach and Uber hack taught us painful lessons about enterprise security shortcomings. Continue Reading

By

• Rob Wright, Senior News Director

Half of business leaders admit to hiding data breach information

News roundup: Data breach information is kept from customers 50% of the time, according to a report. Plus, the FBI director continues to preach against encryption, and more. Continue Reading

By

• Madelyn Bacon, TechTarget

1.4 billion stolen credentials found on dark web

A massive repository containing more than 1.4 billion stolen credentials was found on the dark web with special features for malicious actors. Continue Reading

By

• Michael Heller, TechTarget

How can platform firmware be protected from attacks?

The NIST published guidance on building up platform firmware resiliency. Expert Judith Myerson looks at the NIST guidelines and the major takeaways for enterprises. Continue Reading

By

• Judith Myerson

Hacker behind Uber data breach was paid off through bug bounty

News roundup: The man responsible for the 2016 Uber data breach is a 20-year-old from Florida. Plus, Ethiopia reportedly targeted dissidents with Israeli spyware, and more. Continue Reading

By

• Madelyn Bacon, TechTarget

Risk & Repeat: Analyzing the accidental data breach

In this week's Risk & Repeat podcast, SearchSecurity editors discuss the rise of accidental data breaches following a series of enterprise exposures of user data online. Continue Reading

By

• Rob Wright, Senior News Director

Uber data breach raises unsettling questions for infosec

The Uber data breach episode is another black eye for the ride sharing company, but the cover up raises troubling implications for the infosec community. Continue Reading

By

• Rob Wright, Senior News Director

Following Equifax breach, CEO doesn't know if data is encrypted

News roundup: Following the massive Equifax breach, the CEO said he doesn't know if customer data is encrypted or not. Plus, flaws were found in IEEE's P1735 standard, and more. Continue Reading

By

• Madelyn Bacon, TechTarget

Risk & Repeat: Responsible encryption ramps up

In this week's Risk & Repeat podcast, SearchSecurity editors discuss the recent push from law enforcement officials for responsible encryption and what that may mean. Continue Reading

By

• Rob Wright, Senior News Director

Microsoft mum on 2013 database breach of bug tracking system

News roundup: Former employees reveal a 2013 database breach exposed Microsoft's bug tracking system, DHS sets new rules for federal agencies on web, email security, and more. Continue Reading

By

• Peter Loshin, Former Senior Technology Editor

ROCA RSA flaw unveils secret keys on wide range of devices

Researchers disclosed the ROCA RSA vulnerability as a dangerous flaw in the cryptographic code of Infineon chips that could undermine encryption key security for a number of devices. Continue Reading

By

• Michael Heller, TechTarget

Telerik web UI: Can the cryptographic weakness be mitigated?

A cryptographic weakness was discovered in the Telerik web UI. Expert Judith Myerson alerts readers about this weakness and the alternative options for companies to explore. Continue Reading

By

• Judith Myerson

Risk & Repeat: Scope of Equifax, Yahoo breaches expands

In this week's Risk & Repeat podcast, SearchSecurity editors discuss the expanding scope of the Equifax and Yahoo breaches and the long-term effects of these major security incidents. Continue Reading

By

• Rob Wright, Senior News Director

NSA breach leads to theft of government spy software

An NSA contractor became the target of a cyberattack after storing agency spying software on a personal device, and this NSA breach has caused a rise in fears regarding Russia. Continue Reading

By

• Michael Heller, TechTarget

Understanding data manipulation attacks in enterprise security

When it comes to protecting data, ransomware isn't the only thing that should worry enterprises. Nick Lewis explains the threat of data manipulation attacks and how to stop them. Continue Reading

By

• Nick Lewis

No customer data leaks? Companies look down the rabbit hole

When Yahoo finally disclosed a massive 2014 data breach to up to five hundred million affected account holders in September 2016, some already had legal representation. Continue Reading

By

• Kathleen Richards

Growing data protection risks and how to manage them

Companies today collect more data from more sources than ever before. Often the data is distributed across on-premises environments, cloud systems and third-party networks. The network perimeter behind which most enterprise data once resided is gone, and users now have the ability to access data from anywhere and at any time via laptops, smartphones and other mobile devices. Managing these data protection risks creates unique challenges for CISOs and their security teams.

"Security must be able to protect the data wherever it is being used, viewed or saved," said Christopher Pierson, executive vice president, general counsel and CSO at Viewpost, an electronic payments and invoicing service, based in Maitland, Fla.

For organizations covered by regulations such as PCI DSS, HIPAA, the Gramm-Leach-Bliley Act and, soon, the European Union General Data Protection Regulation, the trends pose enormous compliance headaches. The distribution of data and the many ways in which it can be accessed has made handling data protection risks especially challenging.

At the same time, many companies have network-level security models that prevent their security teams from transitioning to data-level controls. In this issue of Information Security magazine, we look at data-centric security models and better ways to manage data protection risks.

 Continue Reading

Deloitte hack compromised sensitive emails, client data

News roundup: During the Deloitte hack, attackers had access to client data and internal email servers. Plus, the U.S. asks China not to enforce its Cybersecurity Law, and more. Continue Reading

By

• Madelyn Bacon, TechTarget

No customer data leaks? Companies look down the rabbit hole

 Continue Reading

Risk & Repeat: Equifax data breach fallout continues

In this week's Risk & Repeat podcast, SearchSecurity editors continue discussing the Equifax data breach and examine new details about an Apache Struts flaw tied to the attack. Continue Reading

By

• Rob Wright, Senior News Director

Symantec Data Loss Prevention: Product overview

Expert Bill Hayes checks out the Symantec Data Loss Prevention suite, featuring an architecture consisting of content-aware detection servers, endpoint agents and unified management. Continue Reading

By

• Bill Hayes

Equifax breach response deemed insufficient in multiple ways

Experts criticized the Equifax breach response as insufficient, given the size and scope of the data loss, and they said the company was likely not prepared for such an incident. Continue Reading

By

• Michael Heller, TechTarget

Risk & Repeat: Equifax data breach response called into question

In this week's Risk & Repeat podcast, SearchSecurity editors tackle the massive Equifax data breach and how the credit bureau's response to the security incident is creating more problems. Continue Reading

By

• Rob Wright, Senior News Director

Equifax breach exposes 143 million consumers' personal data

A massive Equifax breach, which was discovered in July, exposed the personal information, including names, birth dates and Social Security numbers, of 143 million Americans. Continue Reading

By

• Rob Wright, Senior News Director

NotPetya ransomware impact costs Maersk hundreds of millions

Danish shipping giant A.P. Moller-Maersk said the NotPetya ransomware attacks severely damaged business processes and the impact has been estimated at as much as $300 million in lost revenue. Continue Reading

By

• Michael Heller, TechTarget

CISSP Domain 2: Asset security

This Security School will help prepare you for Domain 2 of the CISSP exam, providing overviews of data encryption methods, data ownership concepts and asset protection. Continue Reading

Why data fidelity is crucial for enterprise cybersecurity

Cybersecurity teams can't be effective if they don't trust their data. Expert Char Sample explains the importance of data fidelity and the threat of cognitive hacking. Continue Reading

By

• Char Sample, ICF International

How did flaws in WhatsApp and Telegram enable account takeovers?

Flaws in WhatsApp and Telegram, popular messaging services, enable attackers to break encryption and take over accounts. Expert Michael Cobb explains how the attacks work. Continue Reading

By

• Michael Cobb

Could the WannaCry decryptor work on other ransomware strains?

Researchers created WannaCry decryptor tools after the outbreak of the ransomware. Expert Matthew Pascucci explains how the tools work and if they work on other ransomware. Continue Reading

By

• Matthew Pascucci

Risk & Repeat: Why are Amazon S3 buckets spilling on the web?

In this week's Risk & Repeat podcast, SearchSecurity editors discuss the series of enterprise data leaks through misconfigured Amazon S3 buckets and what should be done about them. Continue Reading

By

• Rob Wright, Senior News Director

ASLR side-channel attack: How is JavaScript used to bypass protection?

Researchers have developed an ASLR Cache side-channel attack that enables them to eliminate ASLR protections. Expert Nick Lewis explains how JavaScript code is used in the attack. Continue Reading

By

• Nick Lewis

What data loss prevention systems and tactics can do now

Setting up systems to preventing data loss is a must for companies of all sizes. Learn the basics of and what's new in data loss prevention and how to keep your DLP system humming. Continue Reading

Tools to transfer large files: How to find and buy the best

Need to transfer files within headquarters or between branches? Managed file transfer tools now offer some interesting new features. Continue Reading

By

• Karen Scarfone, Scarfone Cybersecurity

Another AWS data leakage due to misconfiguration

Dow Jones becomes the latest organization to be affected by an AWS cloud data leakage due to misconfiguration and user error. Continue Reading

By

• Michael Heller, TechTarget

AWS S3 bucket leak exposes millions of Verizon customers' data

News roundup: An AWS S3 bucket leak containing personal data of millions of Verizon customers was exposed to the public. Plus, DNC hack victims are suing the Trump campaign, and more. Continue Reading

By

• Madelyn Bacon, TechTarget

How are forged cookies used in attacks on online user accounts?

Yahoo claimed a vulnerability in its email service enabled attackers to use forged cookies to gain access to user accounts. Expert Michael Cobb explains what forged cookies are and how they are used in attacks Continue Reading

By

• Michael Cobb

Risk & Repeat: RNC voter database left open to the public

In this week's Risk & Repeat podcast, SearchSecurity editors discuss how the Republican National Committee's voter database was accidentally exposed in an Amazon S3 bucket. Continue Reading

By

• Rob Wright, Senior News Director

How did thousands of MongoDB databases get hijacked?

Thousands of MongoDB configurations were hijacked due to poor authentication practices. Expert Nick Lewis explains how organizations can properly configure their implementations. Continue Reading

By

• Nick Lewis

How intelligence data leaks caused collateral damage for infosec

Alvaka Networks' Kevin McDonald looks at the real-world damage caused by data leaks at the CIA and NSA, which have put dangerous government cyberweapons in the hands of hackers Continue Reading

By

• Kevin McDonald, Alvaka Networks

Information privacy and security requires a balancing act

Maintaining information privacy and security seem to be separate challenges, but in reality, each is integral to the other. Expert Kevin Beaver explains how to work toward both. Continue Reading

By

• Kevin Beaver, Principle Logic, LLC

Cloud access security brokers: Hard to tell what's real

Most cloud access security brokers offer CISOs a way to set policy and gain better understanding of multiple cloud services and data in use across the enterprise. As CASBs have gained momentum in recent years, use cases for them have expanded. Do these tools fill the gaps around visibility and control of software as a service and other cloud services?

Although cloud service visibility and data leak protection continue to be the biggest drivers, cloud access security brokers can do more than just help with your shadow IT problem and unsanctioned application activity in the cloud.

Organizations are increasingly looking to use cloud access security brokers to identify anomalies in data movement between on-premises and cloud apps as well as multiple cloud services. Malware identification and encryption of data have become important. More enterprises are also beginning to use CASBs or similar intermediary security technologies to provide some level of security policy management for custom identity-as-a-service platforms.

In this issue of Information Security magazine, we look at cloud access security brokers and the best ways to evaluate new models, such as infrastructure as a service and platform security.

 Continue Reading

What MongoDB security issues are still unresolved?

There are some MongoDB security issues that have yet to be resolved. Expert Matthew Pascucci discusses the risks and how to protect your enterprise from them. Continue Reading

By

• Matthew Pascucci

Target data breach settlement requires security improvements

News roundup: The Target settlement following the 2013 data beach requires the company to adopt a stronger security program. Plus, experts knock the FCC's DDoS claim, and more. Continue Reading

By

• Madelyn Bacon, TechTarget

Trustwave Data Loss Prevention: Product overview

Expert Bill Hayes examines Trustwave Data Loss Prevention and how the product addresses data at rest, endpoint data in use and network data in transit for enterprises. Continue Reading

By

• Bill Hayes

Cognitive hacking: Understanding the threat of bad data

Bad data can create more than just 'fake news.' Expert Char Sample explains how cognitive hacking and weaponized information can undermine enterprise security. Continue Reading

By

• Char Sample, ICF International

How effective is geofencing technology as a security method?

Geofencing technology is increasingly being used as a security tactic, such as to control access to servers with DNS settings. Expert Michael Cobb explains how it works. Continue Reading

By

• Michael Cobb

ISAOs: The benefits of sharing security information

ISAOs are a good way for organizations to share information about security threats. Expert Steven Weil explains what these organizations are and their attributes. Continue Reading

By

• Steven Weil, Point B

How can a distributed guessing attack obtain payment card data?

Attackers can gather payment card data by carrying out distributed guessing with a minimal amount of existing information. Expert Michael Cobb explains how this attack works. Continue Reading

By

• Michael Cobb

How does USB Killer v3 damage devices through their USB connections?

USB Killer devices, with the ability to destroy systems via a USB input, are available and inexpensive. Expert Nick Lewis explains how they work and how to defend against this threat. Continue Reading

By

• Nick Lewis

DARPA's SSITH program takes aim at hardware vulnerabilities

News roundup: DARPA's SSITH program tackles hardware vulnerabilities for better security. Plus, new risks placed in OWASP Top 10, SWIFT launches new anti-fraud tool, and more. Continue Reading

By

• Madelyn Bacon, TechTarget

Risk & Repeat: Strong encryption under fire again

In this episode of SearchSecurity's Risk & Repeat podcast, editors discuss the latest round of the encryption debate and what it means for apps that use strong encryption. Continue Reading

By

• Rob Wright, Senior News Director