Latest

Anti-Money Laundering (AML)

Darknet Market Search Engine Operator Gets 8-Year Sentence

Mathew J. Schwartz  •  January 28, 2022

Tal Prihar, a former administrator of the DeepDotWeb darknet market search engine, has been sentenced to serve eight years in a U.S. federal prison after pleading guilty to money laundering, tied to his having received more than $8 million in kickbacks from markets to which he referred buyers.

►

3rd Party Risk Management

ISMG Editors: Tough Lessons Learned From Log4j, Ransomware

Anna Delaney  •  January 28, 2022

Four ISMG editors discuss: how too many organizations fail to implement basic cybersecurity defenses - such as MFA; a proposed lawsuit against health insurer Excellus that calls for an improvement to its data security program; and strategies for securing open-source and other software components.

Business Continuity Management / Disaster Recovery

All the World's a Stage: Russia Arrests Ransomware Suspects

Anna Delaney  •  January 28, 2022

The latest edition of the ISMG Security Report features an analysis of whether a new ransomware operation is a spinoff of the notorious REvil or simply copying the group's moves; how Maersk responded to the NotPetya wiper malware attack; and essential incident response skills.

►

Governance & Risk Management

Spotting Cybersecurity Gaps, Becoming More Systems-Focused

Brian Barnier  •  January 27, 2022

Lisa Young prepares security teams to protect and defend their organizations from cybercriminals by seeing the things that others miss and asking the questions that others are too afraid to ask. She discusses how critical thinking improves cybersecurity.

Access Management

US OMB Releases Zero Trust Strategy for Federal Agencies

Dan Gunderman  •  January 26, 2022

OMB on Wednesday released a federal strategy to move the U.S. government toward mature zero trust architectures. White House officials say the new strategy - with a focus on MFA, asset inventories, traffic encryption, and more - is a key step in delivering on Biden's May 2021 executive order.

Business Continuity Management / Disaster Recovery

Ransomware Trends: Volume of Known Victims Remains Steady

Mathew J. Schwartz  •  January 26, 2022

Despite Western governments' increased focus on disrupting ransomware, the quantity of new victims doesn't appear to have declined, at least so far. But multiple experts say that nation-state efforts to combat cybercrime syndicates are still picking up speed and may well yet have an impact.

Business Continuity Management / Disaster Recovery

US, NATO Discuss Ukrainian Cyber Aid Amid Tensions

Dan Gunderman  •  January 25, 2022

As tensions continue to flare between Ukraine and Russia, which has amassed at least 100,000 troops along Ukraine's eastern border, the U.S. continues to mull intervention, a part of which includes bolstering Ukraine's cyber defenses. This comes as experts warn that cyberwarfare could play an increasingly significant...

3rd Party Risk Management

Log4j Updates: Flaw Challenges Global Security Leaders

Devon Warren-Kachelein  •  January 25, 2022

The security world continues its fight against potential widespread exploitation of the critical remote code execution vulnerability - tracked as CVE-2021-44229 - in Apache's Log4j software library, versions 2.0-beta9 to 2.14.1, known as "Log4Shell" and "Logjam." This is a digest of ISMG's updates.

►

Anti-Phishing, DMARC

'Email Security Doesn't Get the Attention It Deserves'

Anna Delaney  •  January 25, 2022

"Email security doesn't get the attention it deserves" because "phishing is not going away and is not getting any less," says Jess Burn, a senior analyst at Forrester. She shares best practices for phishing prevention.

Business Continuity Management / Disaster Recovery

Brand Narratives and Awareness in Cybersecurity

Steve King  •  January 25, 2022

Kyle Flaherty has worked with a range of companies, changing the worlds of big data, IoT, BYOD, SaaS, open-source software, network security, fraud detection, data analytics, marketing automation and network management. He weighs in on brands and how metrics feed different audiences.

3rd Party Risk Management

The Ransomware Files, Episode 4: Maersk and NotPetya

Jeremy Kirk  •  January 25, 2022

Maersk was one of dozens of organizations crippled by the NotPetya malware in June 2017. Gavin Ashton and Bharat Halai worked in identity and access management at Maersk and share how the company's technology team tirelessly brought the company back from the brink of an IT systems meltdown.

Cybercrime

Suspected REvil Ransomware Spinoff 'Ransom Cartel' Debuts

Mathew J. Schwartz  •  January 24, 2022

Has the notorious REvil, aka Sodinokibi, ransomware operation rebooted as "Ransom Cartel"? Security experts say the new group has technical and other crossovers with REvil. But whether the new group is a spinoff of REvil, bought the tools, or is simply copying how they work, remains unclear.