Parliament is considering a bill that would enforce minimum security requirements for IoT devices (Photo: ISMG)

UK Legislation Seeks Mandatory Security Standards for IoT

Prajeet Nair • November 25, 2021

Could the internet of things be made more secure? A draft law in Britain would impose stronger cybersecurity regulations for manufacturers, importers and distributors of smartphones, TVs, toys and other "connected" digital devices, backed by the threat of fines of up to $13 million for noncompliance.

►

Cybercrime

Hackers Disrupt Canadian Healthcare and Steal Medical Data

Latest

Cybercrime

Making the Case for Centralized IAM Management Control

Anna Delaney • November 27, 2021

The problem with decentralized access management, says Manuel Garat, head of IAM at digital travel company, Booking.com, is that while you might know who or what needs access to your network, applications and data, you "don't always know who shouldn't have access."

Cybercrime

The Best Gift for the Holidays? An Incident Response Plan

Anna Delaney • November 26, 2021

In the latest weekly update, four editors at Information Security Media Group discuss important cybersecurity issues, including why security teams are still unprepared for cyberattacks over weekends and holidays, which experts warn is when attackers love to strike.

Endpoint Security

Medical Data Exposed in Breach at True Health New Mexico

Jeremy Kirk • November 26, 2021

A health insurer in New Mexico is warning of a data breach that exposed customers' personal and medical information. True Health New Mexico reports that nearly 63,000 individuals' personal details were exposed in the "early October" incident. It's offering all victims prepaid credit monitoring services.

3rd Party Risk Management

Essential Preparations for the Holiday Season Attack Surge

Anna Delaney • November 26, 2021

The latest edition of the ISMG Security Report features an analysis of how organizations can reduce risk especially over holidays and weekends, when attackers are most likely to strike. Also featured: Highlights from Ireland's IRISSCON 2021 cybercrime conference; what's ahead for COVID-19 and the workplace?

Critical Infrastructure Security

Cybersecurity Unplugged: Improving Healthcare Security

Steve King • November 26, 2021

In this episode of "Cybersecurity Unplugged," Dan Bowden, CISO at Sentara Health, discusses telemedicine, IoMT, and explains why we’re lagging so far behind in healthcare security. "It’s because of how the data is managed, data standards, data integrity."

Cybercrime

Ukraine's Secret Service Busts 5 Alleged 'Phoenix' Hackers

Mihir Bagwe • November 25, 2021

The Secret Service of Ukraine has arrested five Ukrainian citizens on suspicion of being part of a cybercrime group called Phoenix, which it says has been tied to hacking hundreds of mobile devices, stealing personal data and also selling "hacking as a service" to others.

Blockchain & Cryptocurrency

Financial Agencies Eye Existing Laws for Crypto Regulation

Dan Gunderman • November 24, 2021

Three U.S. financial agencies have conducted a series of "policy sprints" around cryptocurrency assets and related regulatory gaps, and plan to amend existing guidance and regulations to address security and market risks, the Board of Governors for the Federal Reserve said this week.

3rd Party Risk Management

Apple Sues NSO for Product and Service Abuse

Mihir Bagwe • November 24, 2021

The NSO Group is the target of a lawsuit filed by Apple, which alleges that the spyware maker abused Apple's products and services to carry out spying operations. The news follows the NSO Group's blacklisting by the U.S. government, a score downgrade by Moody's, and a reportedly failed deal with France.

Blockchain & Cryptocurrency

Cryptocrimes Proliferate: Ransomware, New Threat Campaigns

Prajeet Nair • November 24, 2021

Cryptocurrency exchange BTC-Alpha faces a ransomware attack; Morphisec researchers investigate malware that targets cryptocurrency, NFT communities on Discord; and RiskIQ researchers uncover fresh Aggah campaign that deploys clipboard hijacking code to swap a victim's cryptocurrency address.

Business Continuity Management / Disaster Recovery

Why Ransomware Is a Game Changer for Cyber Insurance

Marianne Kolbasuk McGee • November 24, 2021

Ransomware attacks have become the game changer in driving up security requirements, policy premiums and rejection rates for healthcare sector entities seeking new cyber insurance policies or renewals, says Doug Howard, CEO of privacy and security consultancy Pondurance.

3rd Party Risk Management

How to Save Money on Pen Testing - Part 1

Charles Gillman • November 24, 2021

The findings from a penetration test can help you identify risks and gaps in your security controls. Charles Gillman offers tips to maximize the value of your next pen test and, in the process, deliver better results.

Cybercrime

Report: China to Target Encrypted Data as Quantum Advances

Dan Gunderman • November 23, 2021

Chinese threat actors may increasingly look to steal sensitive, encrypted data in hopes of decrypting it with quantum computing technology in the years ahead, according to a new report. Researchers say Chinese threat actors may target government, business and academic data with long-term value.