Sign in Subscribe

Topic

Security

A collection of 50 issues

Leadership by example

This is happening more and more. It also reads as pretty lo-fi, as in just AI voice cloning being used - it’s cloned video as well for others. I doubt there will be published stories when it’s successful. CEO of world’s biggest ad firm targeted by deepfake

Do better

Brute forcing 5000 requests per minute for 3 weeks, to scrape 49 million names and addresses after getting approved for the partner portal by trying ‘several different names’. Sending multiple emails to say there was an issue before it was patched. Threat actor says he scraped 49M Dell customer addresses

Dial up the drama

The drama always gets turned up to eleven* for things like this. I suppose ‘MoD hacked!’ is a better headline than service provider breached. MoD data breach: State involvement cannot be ruled out in armed forces hack, says Grant ShappsThe details of serving Army, RAF and Navy personnel are involved,

Marriot held to account?

Remember the Marriot breach back in 2018? Details of 500 million guests were exposed over a period of four years. I remember it because I’d been a Starwood guest during the time so after a lot of swearing I did some checks to see what card details I would

Microsoft push on security

This is quite good from Microsoft - what was needed after the CISA report. Especially the ‘six prioritized security pillars’. Nadella put out a pretty good memo as well. Read Satya Nadella’s Microsoft memo on putting security firstNadella doesn’t want Microsoft employees making security tradeoffs.The Verge The

Big not always best

The reference to the lack of a ‘healthy marketplace’ is key. I will admit in the past, when under pressure, I have calmed Exec and Audits with “Don’t worry it’s on Big Provider™️ At Microsoft, years of security debt come crashing downCritics say negligence, misguided investments and hubris

LLM's and vulnerabilities

So the latest LLMs are better at exploiting one-day vulnerabilities according to a study. Much better at exploiting than finding. 87% success rate if the CVE has a description. That drops to 7% if there is no description. GPT-4 nutzte 87 Prozent bereitgestellter One-Day-Vulnerabilities ausEine neue Studie zeigt auf, dass

Train your teams

A question or a challenge for anyone who has a security team in their org. It came off the back of a conversation about communication to Leadership and buy-in, and I don’t see it mentioned a lot. If you don’t have some sort of Selling/Marketing/Storytelling/Presentation

CloudNordic goes under

How bad can ransomware be? Last year the Danish cloud hosting company CloudNordic suffered a particularly vicious attack. Danish cloud host says customers ‘lost all data’ after ransomware attack | TechCrunchCloudNordic said a ransomware attack destroyed customer data on its servers, including primary and secondary backups.TechCrunchZack Whittaker Eight months later

Change Healthcare Hack

Some details of the Change Healthcare hack have leaked. Access via compromised credentials on a remote access system - that didn’t have MFA. Dwell time nine days. (Total cost for this they are estimating at $1.35 - $1.6 billion, $872m already realised) “Lawmakers have raised questions about