U.K. Prime Minister Boris Johnson (pictured upper left) holds a Cabinet meeting via Zoom on Tuesday.

The Cybersecurity Follies: Zoom Edition

Mathew J. Schwartz • April 3, 2020

The stuck-at-home chronicles have fast become surreal, as remote workers face down a killer virus on the one hand and the flattening of their work and personal lives on the other. To help, many have rushed to adopt Zoom. And for many use cases - hint: not national security - it is a perfectly fine option.

►

Business Continuity Management / Disaster Recovery

Zoom Stops Transferring Data by Default to Facebook

Latest

Cybercrime

Botnet Targets Devices Running Microsoft SQL Server: Report

Apurva Venkat • April 3, 2020

Researchers at security firm Guardicore Labs are tracking a botnet they call Vollgar that's targeting devices running vulnerable Microsoft SQL Server databases with brute-force attacks and planting cryptominers in the infected databases.

Anti-Phishing, DMARC

Analysis: The Path Back to Business as Usual After COVID-19

Nick Holland • April 3, 2020

The latest edition of the ISMG Security Report offers an analysis of the phases businesses will go through in the recovery from the COVID-19 pandemic, plus an assessment of new risks resulting from the work-at-home shift and lessons learned from the Equifax breach.

Business Continuity Management / Disaster Recovery

What Went Wrong at Equifax? We Have Good Answers

Mathew J. Schwartz • April 3, 2020

What missteps led to hackers stealing details on 145 million Americans from Equifax in 2017? The answer to that question can be found in numerous reports and a Justice Department indictment. Security researcher Adrian Sanabria says they're essential reading for anyone responsible for cybersecurity defenses.

Governance & Risk Management

COVID-19 Crisis Triggers More HIPAA Policy Changes

Marianne Kolbasuk McGee • April 2, 2020

In the latest move to relax certain HIPAA requirements during the COVID-19 crisis, federal regulators Thursday paved the way for business associates to share protected health information for public health-related activities during the pandemic.

Governance & Risk Management

Zoom Rushes Patches for Zero-Day Vulnerabilities

Apurva Venkat • April 2, 2020

The day after security researcher Patrick Wardle disclosed two zero-day vulnerabilities in the macOS client version of Zoom's teleconferencing platform, the company on Thursday rushed out patches for these flaws and one other.

Artificial Intelligence & Machine Learning

Washington Governor Signs Facial Recognition Law

Akshaya Asokan • April 2, 2020

Washington's governor has signed a new law that regulates the use of facial recognition technology. But some privacy advocates say the measure, which was backed by Microsoft, doesn't do enough to protect individuals' rights.

Endpoint Security

Australian Kids' Smartwatch Maker Hit By Same Bug Again

Jeremy Kirk • April 2, 2020

An Australian company that sells a GPS tracking smartwatch for kids accidently exposed personal data a second time. But this time around, it has not notified users about the bug, which also could have been used to spoof the location of children.

Identity & Access Management

A CISO Conversation: Managing the Remote Workforce

Tom Field • April 1, 2020

As CISO of SoftBank Investment Advisers, Gary Hayslip is dealing with a familiar crisis management challenge: Supporting a remote workforce, with extra emphasis on secure identities. But he's also keeping a close eye on his team and the risks of burnout.

Fraud Management & Cybercrime

Zoom Contacts Feature Leaks Email Addresses, Photos

Jeremy Kirk • April 1, 2020

Popular teleconferencing software Zoom is continuing to fall under scrutiny as questions are raised over its privacy and security practices. The latest issue: a feature that inadvertently reveals strangers' email addresses and profile photos.

Endpoint Security

Alerts: Security Flaw in Medication, Anesthesia Systems

Marianne Kolbasuk McGee • April 1, 2020

A vulnerability in medication dispensing equipment and an anesthesia system from Becton Dickinson could enable an attacker to access and modify sensitive data, according to alerts issued Tuesday. Medical device security challenges are potentially heightened during the COVID-19 pandemic, experts say.

Account Takeover

FBI Alleges Russian Man Laundered Cybercriminals' Money

Ishita Chigilli Palli • April 1, 2020

The FBI has arrested a Russian national for allegedly helping an international cybercriminal gang launder its money by turning cash into bitcoin and other cryptocurrencies, according to court documents.

Business Email Compromise (BEC)

Nigerian BEC Scammers Increase Proficiency: Report

Akshaya Asokan • April 1, 2020

Nigerian cybercriminal gangs have become even more proficient in waging business email compromise attacks, according to an analysis from Palo Alto Network's Unit 42 that describes recent trends.