News Analyses
Phishing attacks that bypass 2-factor authentication are now easier to execute
Researchers released two tools--Muraen and NecroBrowser--that automate phishing attacks that can bypass 2FA. Most defenses won't stop them.
Public SAP exploits could enable attacks against thousands of companies
A recently released exploit takes advantage of a known configuration vulnerability that persists among many on-premise and cloud SAP instances. Here's what companies using SAP should do.
2016 election hacking in Florida: Russian emails, hidden tracks
The Mueller Report says the Russians planted malware on at least one Florida county system, and Florida's governor announces that two counties were hacked in 2016. Experts believe the problem could be bigger.
Will the U.S. government draft cybersecurity professionals?
A Congressional commission might soon recommend conscription of cybersecurity professionals to serve in both the military and civil service. Will the government force security pros to work for Uncle Sam?
200 million-record breach: Why collecting too much data raises risk
Avoid the siren song of big data and collect only what you need. This is the big takeaway from a 200-million record direct marketing list, including home address, telephone, religious affiliation and financial information now...
video
Why is the state of medical IoT so scary?
Security is the Achilles’ heel of all modern IoT technology, but the consequences of medical IoT hacking, in particular, can be disturbingly serious. A look at the state of the connected devices commonly found in hospitals, and why...
Why local governments are a hot target for cyberattacks
Recent ransomware and other attacks underscore the value attackers see in the data stored in city and regional government systems. Here's why they are vulnerable and what they can do to reduce the threat.
Inside the 2014 hack of a Saudi embassy
According to documents seen by CSO, an unknown attacker took control of the official email account of the Saudi embassy in The Netherlands and demanded a ransom of $50 million for ISIS.
![Computerworld - Scary Tech [Slide-05] - Encryption systems with backdoors](https://images.idgesg.net/images/article/2017/10/cw_scary_tech_05-100740219-small.3x2.jpg)
ASUS users fall victim to supply chain attack through backdoored update
Attackers hijack ASUS's auto-update process to deliver malware. Preventing such attacks is difficult, but vendors and their customers can do more to mitigate the risk.
Magecart payment card skimmer gang returns stronger than ever
Web-based card skimmers are becoming harder to detect and remove thanks to evolving techniques.
Congress steers clear of industrial control systems cybersecurity
Industry resistance to regulation, complexity of securing ICS systems are roadblocks to passage of critical infrastructure cybersecurity legislation.
Preserving the privacy of large data sets: Lessons learned from the Australian census
Preserving the privacy of large data sets is hard, as the Australian Bureau of Statistics found out. These are the big takeaways for the upcoming U.S. census and others dealing with large amounts of personal data.
Password managers remain an important security tool despite new vulnerability report
Experts downplay discovery of a vulnerability that can expose passwords in a computer's memory. Hackers likely to take easier paths to stealing passwords.
Bruce Schneier takes his pitch for public-interest security to RSA Conference
Bruce Schneier's new all-day track at the RSA Conference explores idea that security pros, like lawyers, should be expected to engage in a certain amount of pro bono work.
The cybersecurity legislation agenda: 5 areas to watch
The 116th Congress is only a few months old, but far-reaching cybersecurity bills to protect infrastructure and the supply chain, ensure election integrity, and build a security workforce are now being considered. Here’s the list.
Are zero-day exploits the new norm?
Research from Microsoft's Matt Miller shows that every actively exploited Windows vulnerability in 2017 was first done using a zero-day attack. Other research shows this trend extends across the IT landscape.
Add cybersecurity to Doomsday Clock concerns, says Bulletin of Atomic Scientists
The Doomsday Clock, once a ritual feature of the Cold War, warns that cybersecurity issues like IoT and cyber-enabled information warfare endanger humanity.
EFF has an encryption plan for the entire internet
Spurred by government surveillance of data, the Electronic Frontier Foundation is making progress toward its goal of encrypting all internet traffic using technology and scorecards.
Sponsored Links