10 security changes post-COVID-19
Back in March, I heard from several CISOs about how COVID-19 was disrupting their cybersecurity programs and changing their priorities. A few weeks later, I connected with some CISO friends, and got an update on phase 2 of their pandemic journeys. While no one knows when the coronavirus impact will end, we are getting a…
Enterprise internet attack surface is growing, report shows
The attack surface of large enterprises has grown in recent months driven by the new work conditions imposed by the COVID-19 pandemic. The threat has increased in many areas including servers that are directly accessible from the internet, domain names, websites, web forms, certificates, third-party applications and components or mobile apps. While some of those…
Microsoft 365 Apps update changes: What security admins need to know
As more organizations move to the Microsoft 365 platform, Microsoft has acknowledged that we need a more stable monthly update platform for the Office suite. Microsoft has made changes in naming and the patching cadence in response to customers’ concerns. Until May 2020, Office 365 applications were updated using click-to-run technology under three difference schedules…
Protecting employee COVID-19 health data: What CISOs need to know
Businesses re-opening in the wake of COVID are faced with keeping track of who in the company is healthy, who is sick, and who needs to isolate. A new International Association of Privacy Professionals (IAPP) study shows that 60% of employers are keeping records of employees diagnosed with COVID-19. These new sensitive datasets come at…
What’s next? CISOs weigh in on COVID’s long-term effects on security
As lockdowns ease, CISOs are looking ahead at how their teams operate and how they protect employees and assets. The most likely change is permanently supporting more work-at-home employees. According to a report released in April by (ISC)2, 96% of organizations had moved at least some of their staff to remote work, with nearly half…
How Abnormal Security combats business email compromise
When looking at all the different ways that hackers can threaten networks and enterprises, flashy incidents like ransomware scams often come to mind. But a relatively new kind of attack called business email compromise (BEC) has taken the lead in both frequency and overall damage, quickly becoming public enemy number one. According to the FBI’s…
Securing IoT requires a shift to a security fabric
One of the key takeaways I had coming out of RSA 2020 is that security must shift away from the traditional point product approach to a fabric architecture. At the event, I interviewed a CISO that had a strong opinion that “the current approach with security is not working, has not worked and will not…
Cloud configuration drift leaves organizations open to attack, research finds
Many organizations are automating their cloud infrastructure deployments through code. This allows them to establish a secure configuration baseline early in their DevOps lifecycle, but the security posture of most cloud resources later drifts due to undocumented changes that often remain undetected. A new study from cloud security company Accurics found that in as many…
4 tips for protecting users from COVID-19-targeted attacks
Attackers are using this time of crisis to go after victims with targeted campaigns. The biggest threats are phishing attacks related to COVID-19. Attackers are also setting up COVID-19-related domain names and enticing people to click on them. Anomali recently released a report that identified at least 15 distinct COVID-19-related campaigns associated with 11 threat…
What is smishing? How phishing via text message works
Smishing definition Smishing is a cyberattack that uses misleading text messages to deceive victims. The goal is to trick you into believing that a message has arrived from a trusted person or organization, and then convincing you to take action that gives the attacker exploitable information (like bank account login credentials, for example) or access…
