CyberTechTips

Travel booking website Orbitz has announced it discovered a possible data breach that exposed information for thousands of customers. The incident, discovered by the company on March 1st may have exposed information tied to about 880,000 credit cards.

Facebook executives waded into a firestorm of criticism after news reports revealed that a data firm harvested private information from 50 million users.

A DATA analysis firm employed by President Donald Trump’s 2016 campaign reportedly tapped the Facebook profiles of more than 50 million users without their permission. The data leak allowed C…

In 2014, Cambridge Analytica played a key role in harvesting profile data from more than 50 million Facebook users.

I don't know how many data breaches I'm sitting on that I'm yet to process. 100? 200? It's hard to tell because often I'm sent collections of multiple incidents in a single archive, often there's junk in there and often there's redundancy across those collections. All I really know is

People who own, run, or work for businesses should take note of several findings of a recent Cisco study of the impact of data breaches.

In the first 4 parts of "Fixing Data Breaches", I highlighted education [https://www.troyhunt.com/fixing-data-breaches-part-1-education/], data ownership and minimisation [https://www.troyhunt.com/fixing-data-breaches-part-2-data-ownership-minimisation/], the ease of disclosure [https://www.troyhunt.com/fixing-data-breaches-part-3-the-ease-of-disclosure/] and bug bounties [https://www.troyhunt.com/fixing-data-breaches-part-4-bug-bounties/] as ways of addressing the problem. It

Computer scientists have built and successfully tested a tool designed to detect when websites are hacked by monitoring the activity of email accounts associated with them. The researchers were surprised to find that almost 1 percent of the websites they tested had suffered a data breach during their 18-month study period, regardless of how big the companies' reach and audience are.

To help your business avoid the damages and costs of a data breach we interviewed experts to glean their best tips on keeping your customer's data safe.

From Anthem and Chipotle to Equifax and Uber, this year saw several data breaches and leaks.

Cybersecurity has expanded far beyond its traditional domain of external threats, typified by external hackers attacking network vulnerabilities. It now includes insider threats, which are much more complex and difficult to manage. The nature of insider threats can be categorized into malicious, accidental, or negligent, and account for a combined 39% of all data breaches according to recent research. But by employing a modern breed of analytics that enables organizations to analyze documents for sensitive content, review user actions, and track the flow of data across the enterprise, cybersecurity stakeholders can now identify many common indicators of negligent or malicious activity, including accessing, moving, or deleting large volumes of sensitive content; inappropriately creating, storing, or sending sensitive content; or expressing extreme negative sentiment towards the organization in messages. Increasingly, technology and improved practices can help you identify those employees who are most at risk of exposing your company to a cyberattack – before it becomes a major problem.

More than two years after OPM was hacked — twice — ripple effects are still felt across U.S. agencies and the third parties they associate with.

In light of Uber's recent data breach, the ride-hailer is being investigated by regulators in the U.K., Australia, the Philippines, and New York. Now the

CEO Dara Khosrowshahi has confirmed that hackers stole the data of 57 million riders and drivers around the world—and that the company kept it quiet.

When Uber paid a $100,000 ransom so that hackers who broke into its data warehouse would destroy the personal information they stole, it allowed the ride-sharing company to keep a massive breach of 57 million user and driver accounts secret for nearly a year.

There is never a good time to reveal a cyberattack. But with EU's GDPR looming, the fallout is only going to get harder and more expensive if you wait.

How many of us really  know how cyber security works or its priority level in an organisation? To give a broader picture, the rising awareness among company heads regarding the business impact of IT security incidents is already driving the global spend on security, slated to grow at a CAGR of 7 per cent globally. An independent estimate suggests that the global annual IT security spend will reach north of $93 billion in 2018.So, how do companies protect themselves against any form of cyber attack? To start with, there are many moving parts to building cyber defenses; the most important is to find vulnerabilities across the entire digital footprint of an enterprise. The three layers of security are cyber security, network security, and information security. The layers are not exactly exclusive areas but intersect with each other and thus often lead to a semantic conundrum. Simply put, cyber security is about external threats, network security is about internal threats, and information security is about protecting data and information from getting lost or stolen. External threats become internal threats when a hacker or the malicious entity breaks into a network asset, for example, an endpoint device like a Desktop or a printer. Research suggests that Enterprises can bring in significant improvements to their security profiles through enabling basic hygiene factors when it comes to IT security. Here are 10 tips for IT administrators to secure the Enterprise network: Patch: Set up all endpoints and network devices for automatic software and OS updates. An unpatched machine is more likely to have software vulnerabilities that can be exploited.Secure DNS: There are websites that distribute infected programmes, applications and Trojan files. Another threat exists in the form of poisoned DNS attacks, whereby a compromised DNS server directs you to an unauthorised web server. Users can protect themselves from DNS threats by changing the way their computers process DNS services.Secure connections: Mandate employees to use VPN or remote connectivity and secure file transfer options when off campus.Inventory: It is challenging to keep track of all devices connected in the network. Network discovery tools bring a lot of value as they identify and list all hardware/software components, and can also go one step further and identify software installations that provide weak security configurations.Beyond firewalls: Firewalls help stop incoming threats, but you still require formalised management, destruction and archival procedures for your electronic data. Threats can also come from wireless networks, dial-up modems, and internal employees. Such threats often bypass firewall protection. Next-gen security devices like the Cisco UTM Appliance could provide the ability to detect and stop a much more comprehensive array of attacks than a standard firewall, however; some attacks may pass through the device.Employees, a hidden threat? The Computer Security Institute estimates that between 60 and 80 per cent of network misuse comes from within the organisation. To mitigate the risk of a threat, dealers should have an Internet content filtering solution that will prevent employees from visiting inappropriate or virus filled websites. Monitor day and night: Obviously you cannot have your staff watching 24/7 to see when an attack happens and respond to it but you can have a ‘network behaviour anomaly detection’ tool to integrate with the threat-centric NAC  (network access control) solution to respond to security events. Thereby looking across the entire attack continuum, before, during and after an attack.Fight malware:  The power of having Advanced Malware Protection(AMP)  everywhere within an organisation’s security infrastructure is really the power of having more eyes in more places. Malware moves quickly, works together with other malware in the environment and attacks via e-mail, web, on the endpoint, mobile devices, the list goes on. Get maximum visibility and control into as many attack vectors as possible. Single AMP deployments are powerful on their own. Many organisations are okay with, for instance, deploying AMP at the endpoint or deploying AMP at the network to get the amount of visibility and control they need. However, many choose to deploy AMP simultaneously at multiple security control points to increase security effectiveness for the organisation. With AMP in more places, you get more eyes watching more attack vectors, continuously monitoring for malicious behaviour across the extended network.Enable threat-centric NAC: Centralise and unify network access policy management to provide consistent, highly secure access to end users, whether they connect to your network over a wired, wireless, or VPN connection. Also, simplify guest experiences for easier guest onboarding and administration. Streamline BYOD and enterprise mobility with easy, out-of-the-box setup for self-service device onboarding and management. Gain greater visibility and more accurate device identification and device profiling. NAC would help reduce the number of unknown endpoints and potential threats on your network.Secure e-mail traffic: More than 100 billion corporate e-mail messages get exchanged on any given day. An e-mail security solution should provide inbound e-mail security and outbound e-mail control, spam filtering, reputation filtering, virus outbreak filters provide zero-day virus protection and work along with integrated virus signatures. Corporate risk must also be reduced through embedded data loss prevention (DLP) functions, which can detect sensitive content, patterns or images in a message body or within attachments. Must be able to filter/block e-mail attachments.There are multiple vendors and multiple point solutions available in the market to support every area discussed here. However, it makes sense to go ahead with a single vendor with an integrated hardware and software solution for network security -- the IT security vendors.Security breaches are, by far, the most significant business risk in the digital age. Be proactive in ensuring the safety of your digital assets and thus protect the corporate reputation, data and information.

Hackers stole the personal data of 57 million customers and drivers from Uber Technologies Inc., a massive breach that the company concealed for more than a year. This week, the ride-hailing firm ousted its chief security officer and one of his deputies for their roles in keeping the hack under wraps, which included a $100,000 payment to the attackers.

The first three quarters of 2017 have seen 3,833 breaches reported, exposing over seven billion records, according to a new report.

Driver’s license data were stolen.

Another day, another security breach (and another, and another...). This time it's Disqus, which is revealing that in 2012 -- around the time when Engadget used Disqus for comments -- hackers made off with some of its data, covering a snapshot of usernames and associated email addresses dating back to 2007, as well as "sign-up dates, and last login dates in plain text for 17.5mm [sic] users." More distressing is news that it also coughed up passwords for a third of those accounts, which were in hashed (SHA1) form but it's possible the attackers could have decrypted them.

Taking steps now can help protect your money, and minimize the risks of tax consequences from this devastating data breach.

Equifax last week disclosed a historic breach involving Social Security numbers and other sensitive data on as many as 143 million Americans. The company said the breach also impacted an undisclosed number of people in Canada and the United Kingdom.…

In a highly unusual hacking case, an entire school district in Montana shut down for three days following a data breach of student and faculty records.

Freezing your credit is one line of defense in a data breach.

This breach of personal data potentially affects a vast number of people in the US, UK and Canada. Here's how to find out if your identity is compromised.

Equifax, the credit reporting behemoth, said on Thursday that it is the victim of a massive security breach.