Why is it so hard for us to pay attention to cybersecurity?

With a daily deluge of cyberattacks, hacking incidents, data breaches and malware campaigns, it appears that – finally – many organisations now understand that cyber security is an important issue that needs to be taken seriously from the board down. But if three quarters of organisations view cybersecurity as a high priority, then around a quarter don’t rate it as important. Indeed, 20 percent of businesses say that cybersecurity is seen as a fairly low or very low priority, with 22 percent of charities saying the same.

Utilities are under cyber threat, so what they can do about it?

Critical infrastructure networks are increasingly being targeted by cyber criminals. Utility providers, in particular, are more frequently having to deal with data breaches as hackers look to disrupt or even destroy supply of vital services. So serious is the threat that the U.S. Department of Homeland Security set up a new centre devoted to helping protect critical assets — from banks to electric companies to manufacturing plants.

If you’re forward thinking you should be talking about cyber threats in the context of legitimacy, not down-time, lost productivity, and stock prices. The city of Atlanta, the California DMV, the city of Del Rio Texas, Garfield county Utah, Albany New York, West Haven Connecticut, Muscatine Ohio, Valdez Alaska, voting machines and tally systems, power and water…Is this a trend, or just a whole lot of data points that point in one direction? If you remember Iraq post-invasion, he who provides order and services receives the support of the people. When the city, the county, the state, the power co-op is no longer functional, what steps in is what rules. Movie plot scenario? It is one that’s playing out all around the world right now.

Bayer contains cyber attack it says bore Chinese hallmarks

German pharmaceutical company Bayer has contained a cyber attack it believes was hatched in China. Bayer found the infectious software on its computer networks early last year, covertly monitored and analysed it until the end of last month and then cleared the threat from its systems. “There is no evidence of data theft,” Bayer said in a statement, though a spokesman added that the overall damage was still being assessed and that German state prosecutors had launched an investigation. “This type of attack points toward the ‘Wicked Panda’ group in China, according to security experts,” the spokesman added, citing DCSO, a cyber security group set up by Bayer in 2015 with German partners Allianz, BASF and Volkswagen.

UK govt selects STIX 2, TAXII 2 standards for cyber threat intelligence

The UK government has revealed the new standards to be used by its various departments for exchanging cyber threat intelligence. Entrusted with the responsibility to select the new standards for cyber threat intelligence exchange, the Open Standards Board has picked the Structured Threat Information Expression (STIX 2) and the Trusted Automated eXchange of Indicator Information (TAXII 2) standards.

Deepfake Malware Can Trick Radiologists Into Believing You Have Cancer

One of the problems with convincing people to take computer security seriously is that it’s, in a word, boring. Every now and then, however, someone demonstrates a flaw with the potential to break through the walls of ennui surrounding the topic and register with the public consciousness. Israeli researchers have likely done just that, by demonstrating that malware running on CT and MRI machines can either inject realistic images of cancerous growths — fooling trained diagnosticians — or remove said tumors from the screen entirely, leaving technicians convinced no disease was present when it very much was.

Why the Navy is giving agencies, industry a much-needed wake-up call on supply chain risks

On page 6 of the Navy’s recent report about its cyber readiness, there is a jaw-dropping confession: “The systems the U.S. relies upon to mobilize, deploy and sustain forces have been extensively targeted by potential adversaries, and compromised to such an extent that their reliability is questionable.”

Leadership turnover at DHS and Secret Service could hurt US cybersecurity plans

Departures of top officials at Secret Service and DHS will add to an already difficult public-private disconnect on cybersecurity. Kirstjen Nielsen in particular has a rare set of cybersecurity and enterprise risk skills that helped DHS in its initiatives to protect companies in critical industries, such as finance, energy and water.

Craigslist Founder Funds Security Toolkit for Journalists, Elections

A gift from Craigslist’s founder Craig Newmark is funding the development of cybersecurity toolkits for journalists and elections offices ahead of the 2020 US elections. The toolkits, which will be developed by the Global Cyber Alliance (GCA), are intended to “protect journalists and media outlets from cyber-attacks that are designed to either manipulate public opinion or expose sources, enable election boards or other bodies to leverage the latest in cybersecurity protections to preserve election integrity and help ensure that all votes are accurately recorded and counted, and secure nonprofit community organizations that work to uphold the right to vote.”

New Mirai Variant Targets More Processor Architectures

A recently discovered variant of the Mirai malware is targeting more processor architectures than before, which allows it to attack a wider range of Internet of Things (IoT) devices. Mirai’s source code was publicly released in October 2016, and various threat actors built their own iterations of the malware in order to target additional device types. A version that emerged earlier this year aims at devices specifically intended for businesses.

Samsung Galaxy S10 Fingerprint Sensor Duped With 3D Print

The Samsung Galaxy S10 fingerprint sensor can be fooled in a hack that takes a mere 13 minutes and involves a 3D printed fingerprint. The researcher first took a picture of his own fingerprint, then transferred that picture to Adobe Photoshop and created a 3D print. From there, he used the 3D print to physically sign on to his phone.

Outside-the-box malware is getting more common, security researchers warn

Malware authors have been experimenting with unusual malware formats, presenting new challenges for the security industry. Most malware authors have become lazy in the past few years, copying code and techniques from each other. A few, however, “have invested in really fresh ideas,” building tools that are often difficult to detect by antivirus software and pose challenges to human researchers,” Aleksandra Doniec, malware intelligence analyst at Malwarebytes, tells CSO.

Google Boosts Security of Google Cloud

Google this week announced a series of tools meant to increase the overall security of Google Cloud and improve customer trust in the service. The new functionality will allow users to gain better visibility into their environments, detect threats and accelerate response and remediation, mitigate data exfiltration risks, ensure a secure software supply chain, and strengthen policy compliance.

79% Indian firms lack hacking response plan

Nearly 79 per cent of Indian firms do not have a computer security incident response plan (CSIRP) in place that is applied consistently across operations, a new IBM-Ponemon Institute study said on Thursday. In the past two years, 51 per cent of Indian organisations surveyed experienced a data breach and 56 per cent experienced a cyber security incident, revealed the study conducted by US-based Ponemon Institute on behalf of IBM Security. Of the organisations that do have a CSIRP in place, 57 per cent do not test plans regularly or at all.

Breach at IT Outsourcing Giant Wipro

Indian IT outsourcing and consulting giant Wipro Ltd. is investigating reports that its own IT systems have been hacked and are being used to launch attacks against some of the company’s customers, multiple sources tell KrebsOnSecurity. Wipro has refused to respond to questions about the alleged incident. Earlier this month, KrebsOnSecurity heard independently from two trusted sources that Wipro — India’s third-largest IT outsourcing company — was dealing with a multi-month intrusion from an assumed state-sponsored attacker. Both sources, who spoke on condition of anonymity, said Wipro’s systems were seen being used as jumping-off points for digital fishing expeditions targeting at least a dozen Wipro customer systems.

Why conducting a cybersecurity due diligence is vital in M&A deals

As security increasingly becomes a boardroom issue, cyber risks should be a focal point in M&A talks. There have been numerous high-profile examples of cyber breaches that came to light only after an acquisition. Such unfortunate cases illustrate the cyber risks associated with mergers and acquisitions, and bring to the fore the importance of cybersecurity due diligence, which involves carrying out a comprehensive audit of the cybersecurity status of a target company.

North Dakota Adopts Statewide Cybersecurity Approach

The North Dakota legislation authorizing a new unified approach to cybersecurity was signed into law Thursday by Gov. Doug Burgum. The governor, a former Microsoft executive, said Senate Bill 2110 would go far toward protecting the state’s digital infrastructure. The bill gives authority to the state’s Information Technology Department (ITD) to define cybersecurity for all of the state’s public entities — including cities and counties, state agencies, school districts and institutions for higher education.