The 27-year sentence handed down to a 32-year-old Russian hacker set the high water mark for cybercriminal prosecution. Security firm Webroot was also in trouble after its endpoint security product inadvertently began tagging Windows system files as malware – rendering their systems unusable. This, as experts offered tips for protecting older Windows Server machines.
Wholesale theft of healthcare records has continued unabated, with a US medical clinic finding its patient records available online for less than $0.01 per record. Atlassian’s HipChat was also breached, forcing a mass password reset after hackers breached the app’s chats archive.
The digital-certificates row between Symantec and Google highlights broader issues of online trust, some were warning, even as the trend towards bring your own authentication (BYOA) continues to gain momentum.
Also gaining momentum were the Hajime Internet of Things (IoT) botnet and a wave of Shamoon attacks that, McAfee said, is being coordinated by a single group. This, amidst the release of the latest OWASP Top 10 and warnings that cyber infrastructure protection is letting down its proponents.
Car protection isn’t much better, according to reports that a Hyundai smartphone app exposed its users’ cars to potential hijacking. This sort of thing is why companies like Cloudflare want to secure IoT connections to the Internet, while Google is doing its part to improve security by labelling HTTP pages with search fields as insecure.
The US Air Force was being much more overt, calling on hackers in ‘Five-Eyes’ nations to help detect and fix unknown security flaws.
It was just one tactic being used to improve the visibility of security issues – which remains so poor that only 1 in 5 CISOs believes their company is “highly effective” in preventing security breaches. This, as figures suggest nearly 70 percent of employees – who already feel companies can’t protect their mobile devices while they’re working there – tend to steal company data when they’re fired.
They’re going to have to do better, according to the latest Verizon Data Breach Investigations Report, which found cyberespionage and ransomware exploded in prevalence during 2016. This was particularly important for small businesses, whose exemption from looming breach-notification laws – which are pushing many companies into a frenzy of preparation – could perpetuate a security-visibility blind spot.
Patch management doesn’t have to be complex but you do need to embrace it to protect your data, one expert advised. It’s equally important to plan for recovering from a ransomware attack – which are modelling the past as a failure to communicate their risks makes them more common and more expensive overall – and, indeed, to ensure that you are vigilant in training workers to protect their sensitive data.
A range of leading security products can help in this regard, although many are turning to security-as-a-service models to gain such capabilities. Yet for each security improvement, there are new weaknesses too – such as stealthy new Mac malware or an SNMP vulnerability that exposes cable modems to being hacked.