Microsoft CISO, Deputy CISO Reassigned in Management Shakeup

Cal Harrison • December 7, 2023

Microsoft has demoted its CISO after 14 years on the job, reassigned its deputy CISO and named Igor Tsyganskiy - a former CTO at Bridgewater Associates who just joined Microsoft four months ago as chief strategy officer - as its new chief information security officer.

Cyberwarfare / Nation-State Attacks

Okta Delays New Products, Projects 90 Days to Boost Security

Latest

Cybercrime

Breach Roundup: Meta Debuts Messenger End-to-End Encryption

Anviksha More • December 7, 2023

This week, Meta debuted end-to-end encryption on Messenger, AeroBlade cyberespionage targeted U.S. aerospace, Trojan-Proxy threatened cracked apps, Tipalti investigated a ransomware attack, a Pennsylvania hospital faced lawsuits, Nissan probed a cyber incident and the U.S. FCC teamed up with states.

Fraud Management & Cybercrime

Feds Levy First-Ever HIPAA Fine for a Phishing Breach

Marianne Kolbasuk McGee • December 7, 2023

Weeks after the Department of Health and Human Services announced its first HIPAA enforcement action in a ransomware breach, federal regulators have reached another milestone: a $480,000 settlement in a HIPAA case centered for the first time ever on a phishing attack.

Governance & Risk Management

The Joint Commission Unveils New Data Privacy Certification

Marianne Kolbasuk McGee • December 7, 2023

The Joint Commission is kicking off a new voluntary certification program for hospitals' "responsible use" of health data. The effort aims to help address growing privacy concerns over the secondary use of patient data by third parties for artificial intelligence initiatives and other activities.

Cyberwarfare / Nation-State Attacks

UK and US Accuse Russian FSB of 'Hack and Leak' Operation

David Perera • December 7, 2023

The U.K. government accused Russia's domestic intelligence agency of running a yearslong campaign to interfere in British politics. U.S. federal prosecutors unsealed a criminal indictment against two FSB agents, accursing them of phishing campaigns against national security government employees.

Artificial Intelligence & Machine Learning

EU AI Act Talks Drag on Past Expected End Date

Akshaya Asokan • December 7, 2023

European lawmakers and officials failed to hammer out a compromise regulation on artificial intelligence after two days of talks that stretched over 22 hours and were intended to culminate in a Thursday settlement. The European Union has been at work on the Artificial Intelligence Act since 2021.

Blockchain & Cryptocurrency

Cryptohack Roundup: Bitzlato Boss Admits to Laundering Money

Rashmi Ramesh • December 7, 2023

This week, a Bitzlato co-founder pleaded guilty to money laundering charges, a federal judge accepted ex-Binance chief's guilty plea, thieves stole $363M in crypto this November, KyberSwap looks to compensate hack victims, Platypus hackers walked free, and Velodrome and Aerodrome were hacked again.

Cybercrime

Ransomware, Vendor Hacks Push Breach Number to Record High

Marianne Kolbasuk McGee • December 7, 2023

The number of data breaches in the U.S. has hit an all-time high, amid mounting attacks against third-party vendors and aggressive ransomware attacks, says a report from Apple and a Massachusetts Institute of Technology researcher. Breaches have more than tripled between 2013 and 2022.

Cybercrime

Joe Sullivan Tells Black Hat Europe: 'Choose Your Own Destiny'

Mathew J. Schwartz • December 7, 2023

Cybersecurity professionals must choose their own destiny, former CSO Joe Sullivan said at this week's Black Hat Europe in London. CISOs will either remain down in the weeds, technically speaking, or learn to become true senior executives and be treated as such by the board.

Governance & Risk Management

Lessons in Threat Detection for Insider Threats

David Perera • December 7, 2023

Whether because they're malicious, oblivious to company rules or outsmarted by hackers, insiders pose a mounting degree of risk to companies. Hunting for outside hackers offers lessons in preventing insider incidents, said Thomas Etheridge, CrowdStrike chief global professional services officer.

Fraud Management & Cybercrime

Russia Uses AI, Evasion Tactics in Disinformation Drive

Mihir Bagwe • December 6, 2023

A Russia-linked disinformation campaign known as Doppelgänger is employing advanced obfuscation techniques and likely deploying AI to generate content, say security researchers. Doppelgänger has been called Russia's "most aggressively persistent covert influence operation" since 2017.

Governance & Risk Management

CISA Urges Software Developers to Prioritize Memory Safe Coding

Chris Riotta • December 6, 2023

The U.S. Cybersecurity and Infrastructure Security Agency is urging software developers to implement memory safe coding as part of an effort to address critical vulnerabilities in programming languages and further shift security responsibilities away from end users.

Governance & Risk Management

Biden Administration Issues Cyber Strategy for Health Sector

Marianne Kolbasuk McGee • December 6, 2023

The U.S. Department of Health and Human Services on Wednesday released a sweeping strategy document proposing how the Biden administration intends to push the healthcare sector - through new requirements, incentives and enforcement - into improving the state of its cybersecurity.