Latest

Cybersecurity

Your Garage Opener Is More Secure Than Industrial Remotes

Jeremy Kirk  •  January 16, 2019

Radio controllers used in the construction, mining and shipping industries are vulnerable to hackers, Trend Micro says in a new report. To address the issue, researchers say, manufacturers need to move away from proprietary communication protocols and embrace secure standards, such as Bluetooth Low Energy.

Cybersecurity

Quantum Computing: Sizing Up the Risks to Security

Suparna Goswami  •  January 16, 2019

Within the next five to 10 years, quantum computing will get so powerful that it could be used to break encryption on the fly, predicts Steve Marshall, CISO at U.K.-based Bytes Software Services.

Governance

Avoiding Critical Security Risk Analysis Mistakes

Marianne Kolbasuk McGee  •  January 16, 2019

Privacy attorney Adam Greene provides tips for avoiding mistakes when conducting a HIPAA security risk analysis and spells out the essential steps to take.

Governance

Hard-Coded Credentials Found in ID, Access Control Software

Jeremy Kirk  •  January 15, 2019

Researchers from Tenable Security claim they have found what is essentially a skeleton key for an ID and access control system that could open the doors for anyone, plus other less severe but nonetheless zero-day vulnerabilities.

Application Security

Why Software Bugs Are So Common

Suparna Goswami  •  January 15, 2019

The recent exposure of customer data on the website of Singapore Airlines as a result of a software bug is further evidence of the persistent challenge of adequately addressing security during the development stage.

Breach Preparedness

Government Shutdown: Experts Fear Deep Cybersecurity Impact

Jeremy Kirk  •  January 11, 2019

The U.S. government shutdown is impacting agencies integral to the nation's cybersecurity readiness, and experts fear its long-term impact on the country's cyberattack response capabilities, as well as the risk that it will drive away desperately needed new cybersecurity talent from entering public service.

General Data Protection Regulation (GDPR)

'Right to Be Forgotten' Should Be EU-Only, Adviser Says

Mathew J. Schwartz  •  January 11, 2019

Europe's "right to be forgotten" should not apply worldwide, but only inside the EU, according to a nonbinding opinion issued to the European Court of Justice by one of its advocate generals regarding a case that arose from a dispute between France's data privacy watchdog and Google.

Breach Response

Card-Not-Present Fraud Costs Mount

Nick Holland  •  January 11, 2019

A Juniper Research analysis of why card-not-present fraud will continue to grow leads this week's edition of the ISMG Security Report. Also featured: Updates on a Neiman Marcus breach lawsuit settlement and a German hacking incident.

Authentication

Why Are We So Stupid About Passwords? German Edition

Mathew J. Schwartz  •  January 11, 2019

German officials say the suspect behind the mega-leak of politicians' and celebrities' personal details exploited their weak passwords to access email, social media and cloud service accounts. What can the security industry do to help address the password problem?

Awareness & Training

Lessons From Report on Massive Singapore Healthcare Hack

Marianne Kolbasuk McGee  •  January 10, 2019

A variety of security weaknesses contributed to a massive 2017 health data security breach in Singapore, according to a new report. What can healthcare organizations around the world learn from the report's security recommendations?

Audit

Neiman Marcus Settles Lawsuit Over Payment Card Breach

Jeremy Kirk  •  January 10, 2019

Forty-three states have reached a settlement with Neiman Marcus over its 2013 data breach, one of several breaches from that period blamed on in-memory malware. The retailer will pay $1.5 million and must use encryption and tokenization to protect card data.

Cybersecurity

Vietnam's 'Cybersecurity' Law Says Little on Security

Suparna Goswami  •  January 10, 2019

On Wednesday, just days after a new "cybersecurity" law took effect, Vietnam alleged that Facebook has violated the law by allowing users to post anti-government comments on the platform. The so-called cybersecurity law actually speaks little about IT security measures.