Cyber Security News

By Lauren C. Williams Nov 08, 2021 The Defense Department is one of the world's largest technology organizations, but it
By Sean Lyngaas, CNN Updated 9:13 PM ET, Sun November 7, 2021 (CNN)Suspected foreign hackers have breached nine organizations in
NEWS!
The Biden Administration’s planned order is rolling on, as The Wall Street Journal reports. This seeks to mandate that nearly all
Independent Study Finds Brinqa Customers Realize $4.05M In Benefits Over Three Years, Including Reduction in Business Process Interruptions and Decline
A 2021 ransomware attack on a massive Southern California health system sent a sudden flood of critical patients to two
CISA released a first-ever 2021 Common Weakness Enumeration (CWE), containing a list of the most important and common hardware weaknesses.
NEWS!
Thousands of pages of internal documents offer the clearest picture yet of how Facebook endangers American democracy—and show that the
NEWS!
“We’re losing this battle.” The United States is losing the AI race against communist China, says Nicolas Chaillan, who recently resigned from his
The Financial Stability Board (FSB) is urging the financial sector to develop a common method for reporting cyber incidents Financial
https://www.justsecurity.org/78667/us-cybersecurity-has-a-metrics-problem-heres-how-to-fix-it/

Cyber Security News

Why track cyber security news? Cyber security is a world unto itself. It’s a profession, an IT discipline and now a major industry. Companies, consumers and governments are spending billions of dollars a year on cyber security. Security also pervades many areas of life that have little to do, seemingly, with cyberspace. Thus, to keep up with the world in general, it’s helpful to stay aware of news that relates to cyber security.

For example, the dispute between the US government and Huawei is at once about international trade, national security, telecom industry competition… and cybersecurity. Security is a root issue with Huawei, given the suspicions about the company’s connections to the Chinese Communist Party (CCP). However, the company’s size, reach and technological innovation push the matter to the forefront of US-China relations.

cyber security newsOr, take consumer cyber risks. We cover cyber security news that deals with consumers’ exposure to cybercrime and fraud. Consumers are increasingly at risk for identity theft, credit card and other malfeasance at the hands of cyber criminals. The articles we curate on this subject come from law enforcement publications, mainstream media and specialized blogs.

Public policy is now being influenced (or should be) by cyber security news. Policy makers should be aware of how cyber security affect their jobs and constituents’ lives. For instance, the “smart city” is both an innovation and a threat. Using IoT sensors and advanced data analytics to improve municipal services is a great idea. However, the smart city also exposes government data to breach.

This is particularly urgent given the relatively insecure technologies (e.g. Chinese-made sensors) used for the smart city and the wireless connectivity that make it all possible. Add malicious nation-state actors to the mix, such as the ones currently paralyzing American cities with ransomware, and one can see the potential danger.

 

Why DOD is so bad at buying software

software (whiteMocca/Shutterstock.com)

The Defense Department is one of the world’s largest technology organizations, but it has trouble buying IT, particularly software. It can take years for DOD to make it through the process for buying technology — whether it’s software to operate a fighter jet, tactical radios or the latest version of Microsoft Office — and by that time, the technologycan be out of date.

https://fcw.com/articles/2021/11/08/dod-software-buying-problem.aspx

Hackers have breached organizations in defense and other sensitive sectors, security firm says

By Sean Lyngaas, CNN

(CNN)Suspected foreign hackers have breached nine organizations in the defense, energy, health care, technology and education sectors — and at least one of those organizations is in the US, according to findings that security firm Palo Alto Networks shared exclusively with CNN.

With the help of the National Security Agency, cybersecurity researchers are exposing an ongoing effort by these unidentified hackers to steal key data from US defense contractors and other sensitive targets.

https://www.cnn.com/2021/11/07/politics/hackers-defense-contractors-energy-health-care-nsa/index.html

Biden calls for tightening up of federal security

The Biden Administration’s planned order is rolling on, as The Wall Street Journal reports. This seeks to mandate that nearly all federal agencies patch hundreds of cybersecurity vulnerabilities that are considered major risks for damaging intrusions into government computer systems.

The BOD 22-01 directive from the Cybersecurity and Infrastructure Security Agency (CISA) covers around 200 known threats that cybersecurity experts discovered between 2017 and 2020, as The Verge assesses.

Biden calls for tightening up of federal security

Total Economic Impact™ Study Reveals Brinqa Platform Delivers 210% ROI to Organizations

Independent Study Finds Brinqa Customers Realize $4.05M In Benefits Over Three Years, Including Reduction in Business Process Interruptions and Decline in Critical Vulnerabilities

AUSTIN, Texas, Nov. 4, 2021 – Brinqa™, a leader in Cyber Risk Management, today announced findings from a commissioned Total Economic Impact™ (TEI) study conducted by Forrester Consulting. The Total Economic Impact™ of Brinqa study revealed that organizations realize benefits of $4.05 million over three years versus costs of $1.31 million, resulting in a net present value (NPV) of $2.74 million and a return on investment (ROI) of 210%, with the Brinqa Platform paying for itself in less than six months.

Forrester Consulting interviewed decision-makers at four Brinqa customers to assess the benefits, costs, and risks associated with deploying the platform. These organizations range from 4,500 employees to 400,000 employees in size and deliver products and services across diverse industries — retail, healthcare, financial services, and transportation and logistics. To create a framework to quantify benefits, Forrester designed a composite organization modeled on the aggregate results of interviewed customers. The model measured a three-year ROI based on customer interviews and financial analysis.

The independent study found that prior to using Brinqa, companies lacked visibility into portions of the IT and security ecosystem — resulting in potentially dangerous blind spots in their cybersecurity practice. The organizations strived for informed, data-driven, and risk-based cybersecurity decision-making, but struggled to bring together information from relevant IT, security, and business data sources. These limitations led to poor data fidelity and ineffective manual processes, which resulted in greater risk exposure for critical applications and IT assets.

“Previously, none of the contextual information — such as if the application contained personal health information, its categorization as customer-facing, its business criticality, or its disaster recovery tier — was married up with the actual vulnerability data. That was the gap we were trying to close,” said the director of security architecture and engineering at the health insurance organization interviewed.

According to the study, Brinqa enabled customers to improve the accuracy and effectiveness of their asset management programs by transforming disparate, fragmented data sources into a single, consolidated view of the complete asset landscape. The interviewees’ organizations obtained a centralized platform for analysis, prioritization, and remediation management — resulting in fewer business interruptions and more secure IT landscapes. Armed with better data and a holistic view of the IT and security landscape, the organizations implemented risk-based programs to significantly reduce the number of high-risk and critical vulnerabilities in their environments.

In the TEI study, Forrester details quantifiable benefits that customers using the Brinqa Platform achieve over a three-year period. The composite organization, a global B2C firm with 20,000 employees, realizes a return on their investment within six months and the benefits increase as the scope of the platform grows. Quantified benefits attributable to Brinqa include:

 

  • Reduction in business process interruption – 20% to 40% reduction in business process interruptions from security patching.

 

  • Material breach risk reduction savings – 13% to 15% decline in the likelihood of a breach.

 

  • Risk analysis efficiency gain – Automation of 30% to 50% of risk analysis processes.

 

  • Asset management efficiency improvement – Uncovering of 20,000 to 24,000 unnecessary device-based licenses.

 

“Since deploying Brinqa, we’ve seen a shift in cybersecurity from [being] a very subjective process to [being] a more risk-centric program that’s based on deterministic data, and it’s just managing in a more objective way,” said a distinguished cybersecurity engineer at the retail organization interviewed.

Another customer, a senior manager of information security – threat and vulnerability management at a transportation and logistics company, told Forrester, “Now we can do reporting based on how long it’s taking to work through critical issues. We’ve automated the process of sending out reminders to the teams that are actually tracking these remediations. Brinqa has helped to bring our cyber-risk program to the next level…Brinqa allows us to better track the high-risk areas and prioritize addressing issues. So, I think [we’re in] a constant state of getting better and better.”

“Our customers know first-hand the value that informed, data-driven decisions bring to effective cybersecurity programs,” said Amad Fida, CEO of Brinqa. “The customers featured in this study have established the Brinqa Cyber Risk Graph — a unified knowledge source for all relevant IT, security, and business data — as a foundation that supports and secures their digital transformation initiatives. By leveraging the Brinqa Platform’s extensive cybersecurity integration ecosystem, intelligent automation, and powerful analytics, they have transformed the culture and practice of cybersecurity within their organizations. This new study by Forrester Consulting highlights the experiences of our customers and affirms the transformative risk reduction, efficiency gains, and cost savings that businesses can achieve through Brinqa.”

For more details, download “The Total Economic Impact™ of Brinqa” study.

To learn more about the TEI methodology, key findings, and quantified results join us for a webinar as we welcome guest speaker Mark Lauritano, Lead Forrester Consultant for the study. Available live and on-demand here.

 

About Brinqa
Brinqa is leading the charge for a new wave of knowledge-driven, risk-based cybersecurity solutions. Brinqa Cyber Risk Graph – the knowledge graph for cybersecurity – connects relevant security and business data, establishes common data ontology, and powers cybersecurity decisions and outcomes. Brinqa solutions apply this knowledge to uniquely inform risk management strategies, standardize data management and analysis, deliver actionable insights, and automate risk remediation. With Brinqa, businesses get all the tools they need to implement risk-based cybersecurity – packaged in a high-performance, enterprise-grade platform. Brinqa solutions evolve with the business and provide a stable, robust and dynamic cybersecurity foundation that supports and enables true digital transformation. Follow us on LinkedIn and Twitter or visit brinqa.com to learn more.

 

###

Brinqa is a trademark of Brinqa, Inc., in the United States and other countries. All other brands, products, or service names are or may be trademarks or service marks of their respective owners.

 

San Diego EDs Deluged With Patients After Cyberattack

A 2021 ransomware attack on a massive Southern California health system sent a sudden flood of critical patients to two large academic emergency departments (EDs), leading to overcrowding that providers struggled to keep pace with, a researcher reported.

https://www.medpagetoday.com/meetingcoverage/acep/95357?xid=nl_covidupdate_2021-11-01&eun=g1921108d0r&utm_source=Sailthru&utm_medium=email&utm_campaign=DailyUpdate_110121&utm_term=NL_Gen_Int_Daily_News_Update_active

Policy Insights: CISA releases first-ever 2021 Common Weakness Enumeration (CWE)

CISA released a first-ever 2021 Common Weakness Enumeration (CWE), containing a list of the most important and common hardware weaknesses. The list was compiled by the Hardware CWE Special Interest Group (SIG). Excerpt:

The 2021 CWE Most Important Hardware Weaknesses

  • CWE-1189           Improper Isolation of Shared Resources on System-on-a-Chip (SoC)
  • CWE-1191           On-Chip Debug and Test Interface With Improper Access Control
  • CWE-1231           Improper Prevention of Lock Bit Modification
  • CWE-1233           Security-Sensitive Hardware Controls with Missing Lock Bit Protection
  • CWE-1240           Use of a Cryptographic Primitive with a Risky Implementation
  • CWE-1244           Internal Asset Exposed to Unsafe Debug Access Level or State
  • CWE-1256           Improper Restriction of Software Interfaces to Hardware Features
  • CWE-1260           Improper Handling of Overlap Between Protected Memory Ranges
  • CWE-1272           Sensitive Information Uncleared Before Debug/Power State Transition
  • CWE-1274           Improper Access Control for Volatile Memory Containing Boot Code
  • CWE-1277           Firmware Not Updateable
  • CWE-1300           Improper Protection of Physical Side Channels

 

Policy Insights:

According to Saryu Nayyar, CEO, Gurucul (she/her), “Who would have thought that computing hardware would have security flaws? It turns out that hardware has plenty of vulnerabilities that can be exploited by competent and determined hackers. From poor system-on-a-chip design and implementation to improper shared physical memory spaces, hardware vulnerabilities can cause just as much havoc as software. Software developers and testers not only have to be concerned about their own code, but also weaknesses in the hardware they are deploying on. While it’s possible to keep some attackers out with firewalls and malware detection software, enterprises also have to use analytics to monitor unusual activity and flag that for possible intrusion.”

‘HISTORY WILL NOT JUDGE US KINDLY’

Thousands of pages of internal documents offer the clearest picture yet of how Facebook endangers American democracy—and show that the company’s own employees know it.

https://www.theatlantic.com/ideas/archive/2021/10/facebook-papers-democracy-election-zuckerberg/620478/

Nicolas Chaillan, Former Pentagon Software Chief, on What the US Must Do to Win China AI Battle Before ‘Point of No Return’

“We’re losing this battle.” The United States is losing the AI race against communist China, says Nicolas Chaillan, who recently resigned from his position as the chief software officer for the U.S. Air Force.

U.S. companies still lead in technological advancements, but they are unwilling to share their technology with the Department of Defense. “If we stopped over-classifying information … they might see pretty quickly that [the communist China threat] is going to become a real problem even to their day-to-day lives,” Chaillan says.

https://www.theepochtimes.com/nicolas-chaillan-former-pentagon-software-chief-on-what-the-us-must-do-to-win-china-ai-battle-before-point-of-no-return_4052569.html?welcomeuser=1

FSB calls for standardised cyber breach reporting

The Financial Stability Board (FSB) is urging the financial sector to develop a common method for reporting cyber incidents

Financial institutions have been hit with increasing cyber attacks over the past few years, with a rapid rise during the pandemic.

In a survey conducted by the Ponemon Institute research centre, 70% of financial services companies in the UK suffered cyberattacks in 2020, with 59% of such attacks being exacerbated as a result of hackers targeting people working in remote environments.  It was found that 41% of such companies fear that remote workers are putting them at real risk of suffering a major data breach.

https://fintechmagazine.com/fraud-and-cybersecurity/fsb-calls-standardised-cyber-breach-reporting

US Cybersecurity Has a Metrics Problem. Here’s How to Fix It.

US Cybersecurity Has a Metrics Problem. Here’s How to Fix It.