Understanding human triggers in fraudulent transactions

  Too often, discussions about fraud prevention emphasize the security controls organizations should put in place: risk engines, step-up authentication, biometrics… These are all necessary for a successful fraud prevention program, but we tend to minimize the ‘humans in the loop’ aka the end users. It’s human nature to have biases, and an effective security program should…

Read More
Image from a YouTube video posted by Johnny Adams on the report of a German steel mill cyberattack

Steel Mills and the Security of Critical Infrastructure

In late December, the German government issued a report about a cyber attack on a steel mill that resulted in significant damage to that facility. The attack has received extensive publicity since then, from the BBC to YouTube, including a detailed analysis of the attack by SANS. Many of these reports, such as the one…

Read More

2015 Year of Cybersecurity Consilience?

Art Coviello just sent out his annual end of year letter with the following 2015 predictions: 1.Nation-state cyber-attacks will continue to evolve and accelerate but damage will be increasingly borne by private sector 2. Privacy debate will mature 3. Retail is an ongoing target and Personal Health Information (PHI) is next 4. The Internet Identity…

Read More

Oops, They Did it Again…

Another day… another credit card breach letter in the mail …and yet another card to throw away….. While talking to my mailman the other day I noticed he lost some weight. Ironically, he thanked the many credit card breaches to his improved physical fitness. (guess there is a silver lining to anything) He also expressed…

Read More
Access Denied

Not Your Average Cyber Attack

I recently attended an industry conference.  During a break, I chatted with a group of attendees and learned something eye-opening.  The purpose of many cyber attacks is not necessarily to obtain intellectual property, PCI or PII data; many times, it’s to devalue a company by making small changes that impact management decisions and revenue.  Even…

Read More

A New Liberty Reserve Emerges

The takedown of Liberty Reserve in May 2013 was a major blow to many fraudsters who used the e-currency for years to launder their illicit gains. By the time the U.S. government took action, Liberty Reserve had been around for seven years and was reportedly responsible for the laundering of billions of dollars in transactions. More recently, yet another option for fraudsters seems to be materializing in what some are now calling “The New Liberty Reserve,” an e-currency known as LessPay.

Read More

Rogue Refrigerators and Critical Infrastructure

Several weeks ago, Proofpoint announced that their investigation of a major cyber-attack launched in late December 2013 uncovered the use of more than 100,000 malware-infected consumer devices as the source of malicious email. The devices included “home-networking routers, connected multi-media centers, televisions and at least one refrigerator”. As the Proofpoint announcement noted, this appears to…

Read More

The Danger of Denial

I was very surprised recently, in a conversation I had with someone I used to work with, to hear him remark that he didn’t think there is any such thing as stealthy, targeted attacks. His comment was something like “those warnings about APTs, targeted attacks, whatever you want to call them, is just a distraction…

Read More

Security Analytics and the OECD Security Guidelines

In 2002, the OECD (Organization for Economic Cooperation and Development) published a revision of their 1992 Security Guidelines, reflecting significant changes in information technology and information security during that 10-year period. The 2002 OECD Guidelines for the Security of Information Systems and Networks played an important role in fostering a “culture of security”, including through their influence on the ISO 27001 standard.

Read More

Workplace Security: Are You the Weakest Link?

As an employee at some company somewhere, you are probably putting your organization at risk every day – and you don’t even know it. Do you re-use the same password to login to multiple accounts? Are you visiting social networking sites and planning your upcoming summer vacation while at work? Have you ever logged in to check your work email from unsecured wireless hotspots? These are just some of the activities employees around the world do every day that seem relatively harmless, but could be putting their company at risk.

Read More