Uber sees Lapsus$'s hand in its hack. Trends in resilience and quantum security. Updates from Russia's hybrid war.

Summary

By the CyberWire staff

At a glance.

Uber attributes the cyberattack it sustained to the Lapsus$ Group.
Trends in resilience.
Readiness for quantum security.
An overview of Russian cyber operations.
Ukraine's IT Army says it's doxed the Wagner Group.

Uber attributes the cyberattack it sustained to the Lapsus$ Group.

In Monday's forenoon Uber published an update on the breach it discovered last week. They've developed an idea of who was responsible: Lapsus$. "We believe that this attacker (or attackers) are affiliated with a hacking group called Lapsus$, which has been increasingly active over the last year or so. This group typically uses similar techniques to target technology companies, and in 2022 alone has breached Microsoft, Cisco, Samsung, Nvidia and Okta, among others. There are also reports over the weekend that this same actor breached video game maker Rockstar Games. We are in close coordination with the FBI and US Department of Justice on this matter and will continue to support their efforts." Uber thinks the breach began with a password purchased in a criminal-to-criminal souk. This afforded a degree of contact sufficient for the persistent social engineering that followed. Uber is moderately optimistic that the attackers hadn't been able to access either production systems or user information data. For more information, see CyberWire Pro.

Attend Mandiant Worldwide Information Security Exchange (mWISE) Oct 18-20

Hear insights, gather intel, and learn about best practices from security practitioners to CISOs at Mandiant Worldwide Information Security Exchange (mWISE). A new event from security leader Mandiant for an evolving cybersecurity industry, focused on gathering bright minds from across the globe. Curated by a program committee of experts without vendor influence. Attend October 18-20 online or in-person in Washington, DC. Learn more or register now.

Trends in resilience.

Druva and IDC released a report today on trends in data resilience. 77% of those surveyed indicated that data resilience, defined for the purposes of this survey as “the practice of making data available within the organization. As such, it is central to any sort of disaster or cyber-recovery and requires a coordinated effort of people, process, and technology,” was a top three priority, with 19% indicating that it’s a priority, but not top three. 85% of respondents said that they had a formal “cyber-recovery playbook,” with 92% saying that their data resiliency tools are “efficient” or “highly efficient.” See more at CyberWire Pro.

Don't miss the opportunity to share your company's commitment to diversity and inclusion.

The CyberWire’s Women in Cybersecurity reception returns next month. Show your support of the premiere networking event that highlights and celebrates the value and successes of women in the cybersecurity industry to leaders from the private sector, academia, and government. Limited sponsorships are available. View our prospectus for available sponsorships and benefits.

Readiness for quantum security.

Deloitte has published the results of a survey on awareness of cybersecurity risks related to quantum computing. The survey found that just over half (50.2%) of respondents are aware of “harvest now, decrypt later” attacks. These attacks involve stealing encrypted data and storing it until a quantum computer is developed that can break the encryption. 26.6% of respondents said their organization has already conducted a risk assessment on quantum computing risks, while 18.4% plan to conduct an assessment within one year. See more at CyberWire Pro.

An overview of Russian cyber operations.

The Atlantic Council has published a study of offensive Russian cyber operations. While such operations have clearly fallen short of expectations during Russia's war against Ukraine, they've nonetheless continued. The threat actors Russia uses are varied, and the level of control they operate under ranges from toleration to inspiration to direct command. "Contrary to popular belief," the report says, "the Kremlin does not control every single cyber operation run out of Russia.... This network includes: cybercriminals who operate without state backing and inject money into the Russian economy; patriotic hackers and criminal groups recruited by the state on an ad hoc basis; and proxy organizations and front companies created solely for the purpose of conducting government operations, providing the Kremlin a veil of deniability." There's a tendency for analysts to blur this complexity, and any effective response to Russian cyber activity needs to take this complexity into account.

Ukraine's IT Army says it's doxed the Wagner Group.

Mykhailo Fedorov, Ukraine's Minister of Digital Transformation, has reposted a Telegram notice from the IT Army of Ukraine in which the hacktivist militia claims to have obtained detailed information about Wagner Group contract mercenaries. "The website of the Wagner group, which collects russian prisoners for the war in Ukraine, was hacked by the IT Army!" the post begins. "We have all personal data of mercenaries! Every executioner, murderer and rapist will be severely punished." The Wagner Group has increasingly served as a source of frontline manpower for depleted Russian infantry. It's recently concentrated its recruiting on Russian prisons, offering convicts pardons in exchange for active service. Reuters quotes US estimates that put the private military company's prison recruiting goals at 1500.

The CyberWire's continuing coverage of the unfolding crisis in Ukraine may be found here.

Notes.

Today's issue includes events affecting Albania, Bosnia Herzegovina, Chile, China, Colombia, El Salvador, the European Union, Iran, Japan, Mexico, Nigeria, Peru, Russia, Ukraine, the United Kingdom, the United Nations, and the United States.

Dateline

Ukraine at D+108: Russia spins as Ukraine advances. (CyberWire) Ukraine retakes its first town in Luhansk. Gunfire and explosions are reported in Sevastopol. Russian cyber operations remain varied, complex, and conducted under varying levels of control. Ukraine's IT Army says it has obtained identifying data on Wagner Group mercenaries. And Russian television simultaneously spins the war as a humanitarian relief effort that must become utterly ruthless to achieve its humanitarian ends.

Russia-Ukraine war: List of key events, day 209 (Al Jazeera) As the Russia-Ukraine war enters its 209th day, we take a look at the main developments.

Ukraine’s counter-offensive recaptures first village in Luhansk (The Telegraph) Defence expert describes Kremlin’s troops as ‘an army in crisis’ as Ukrainians look to force Russians out of the entire region

Liberation has finally come to Ukraine's Kharkiv. But scars of Russia's brutal occupation remain (CNN) In the city of Kupiansk, there are telltale signs of a hellish occupation. A former police building was used as a vast detention center by the Russians, where at one point up to 400 prisoners were held in its cramped and dark cells, Ukrainian authorities told CNN.

‘We have nothing’: Izium’s trauma after Russian occupation (AP NEWS) The school was a shattered mess. Its six-month life as a Russian base and mechanic shop ended in August with a Ukrainian missile strike. Its years educating Izium's youth were over, but it had one last gift for the residents who needed so much: the wood that made up its lattice work, its chalkboards, its furniture and beams.

Russia-Ukraine war:Russian-backed separatists in Kherson say they will hold vote on joining Russia – live (the Guardian) Russian-appointed head of Kherson says he hopes region will become ‘part of Russia, a fully-fledged subject of a united country’

Ukraine war latest: Russian submarines retreat from Crimea after drone strike (The Telegraph) Russia has withdrawn submarines from its Black Sea naval headquarters in Crimea, according to the Ministry of Defence.

Sounds of explosions and gunfire heard during the night and morning in occupied Sevastopol (Ukrainska Pravda) On the morning of 20 September, what sounded like explosions and gunfire were heard in the central part of Sevastopol.

Russian saboteurs attempt to cross Siverskyi Donets river, but sunk by precision targeting (Ukrainska Pravda) A border guard unit on the Sviatohirsk front has killed a group of Russian saboteurs who tried to cross the Siverskyi Donets river.

Ukraine has shot down 55 Russian warplanes, U.S. general says (POLITICO) The general estimated that Ukraine retains about 80 percent of its air force, seven months into the war.

Forest of the Dead (Foreign Policy) Another mass grave in Ukraine reveals the horrors of Russia’s occupation.

Kyiv alleges ‘terrorism’ after Russian strike near second nuclear plant (Washington Post) Ukrainian officials accused Russia of “nuclear terrorism” on Monday after a rocket reportedly hit just hundreds of yards from the reactors at Ukraine’s second-largest nuclear power plant, disabling three high-voltage electricity lines and a hydropower unit, and blowing out windows.

Memo to the president: How to deter Russian nuclear use in Ukraine—and respond if deterrence fails (Atlantic Council) The US should issue vague public threats of serious consequences should Russia use nuclear weapons and be prepared to follow through with conventional military strikes if deterrence fails.

British PM promises at least $2.63bn for Ukraine war in 2023: FT (Al Jazeera) Liz Truss arrives in the US with ‘hawkish’ message of continued military support for Kyiv, the Financial Times reports.

Top U.S. general urges vigilance as Russia weighs Ukraine setbacks (Reuters) The top U.S. general cautioned on Sunday it remained unclear how Russia might react to the latest battlefield setbacks in Ukraine and called for increased vigilance among U.S. troops as he visited a base in Poland aiding Ukraine's war effort.

It took 'couple of months' to put US anti-radiation missiles on Ukrainian fighters, USAF reveals (Breaking Defense) The Defense Department confirmed it had sent AGM-88 High Speed Radiation Missiles to Ukraine in August.

Putin's administration claims to see no prospects for diplomatic solution of war (Ukrainska Pravda) Dmitry Peskov, the press secretary of the President of the Russian Federation, stated that Russia is not yet considering the prospects of a political and diplomatic solution of the war with Ukraine.

Ukraine war to take centre stage at UN as west and Russia vie for support (the Guardian) The general assembly is expected to see fresh tussles over future of Ukraine, as well as the threats of famine and the climate crisis in the global south

A Crisis of Faith Shakes the United Nations in Its Big Week (Foreign Policy) From its failure to stop Russia’s war in Ukraine to its inaction on Myanmar and climate change, the institution is under fire from all sides.

Russia's Wagner trying to recruit over 1,500 felons for Ukraine war -U.S. official (Reuters) The Wagner Group, a Russian private military company, is trying to recruit over 1,500 convicted felons to take part in Russia's war in Ukraine, but many are refusing to join, a senior U.S. defense official said on Monday.

Ukraine's IT Army hacks Russia's Wagner Group (Computing) The private military company is trying to recruit over 1,500 convicted criminals to join Russia's attack on Ukraine

Bosnia and Herzegovina investigating alleged ransomware attack on parliament (The Record by Recorded Future) Prosecutors in Bosnia and Herzegovina are investigating a ransomware attack that has crippled the operations of the country’s parliament.

Untangling the Russian web: Spies, proxies, and spectrums of Russian cyber behavior (Atlantic Council) This issue brief analyzes the range of Russian government’s involvement with different actors in the large, complex, and often opaque cyber web, as well as the risks and benefits the Kremlin perceives or gets from leveraging actors in this group. The issue brief concludes with three takeaways and actions for policymakers in the United States, as well as in allied and partner countries.

Russia Analytical Report, Sept. 12-19, 2022 (Russia Matters) 5 Ideas to Explore

More military defeats could ‘finish off Vladimir Putin’, warns Russian war criminal (The Telegraph) Igor Girkin, a former commander blamed for downing Malaysia Airlines MH17, says the Kremlin is doomed unless it orders a full mobilisation

Ukraine’s 1777 Moment (Foreign Policy) Victory in Kharkiv may be as significant for Ukraine’s independence as the Battle of Saratoga was for America’s.

Attacks, Threats, and Vulnerabilities

Code42 Incydr Detects Source Code Exfiltration from Git to Unsanctioned Repositories (Business Wire) Code42 Software, Inc., the Insider Risk Management (IRM) leader, today announced it has enhanced source code exfiltration detection within its Code42®

Azure Cloud Shell Command Injection Stealing User’s Access Tokens (Lightspin) This post describes how I took over an Azure Cloud Shell trusted domain and leveraged it to inject and execute commands in other users’ terminals.

Hacking group focused on Central America dumps 10 gigabytes of military emails, files (CyberScoop) This is the fourth release from Guacamaya, a Central American hacking group that says it fights environmental devastation and exploitation.

Excel Document Delivers Multiple Malware By Exploiting CVE-2017-11882 – Part I (Fortinet Blog) FortiGuard Labs discovered an Excel document with an embedded file name that is randomized, which exploits CVE-2017-11882 to deliver and execute malware on a victim’s device. Read our blog to learn…

"Keys to the Kingdom" at Risk: Analyzing Exposed SSO Credentials of Public Companies (Bitsight) Our research found that 25% of the S&P 500 and half of the top 20 most valuable public U.S companies have had at least one SSO credential for sale on the web.

Security update | Uber Newsroom (Uber Newsroom) Updates on security incident

Tentative attribution in the Uber breach. (CyberWire) Lapsus$ may have been behind the Uber breach.

Uber says Lapsus$-linked hacker responsible for breach (Reuters) Uber Technologies Inc said on Monday a hacker affiliated with the Lapsus$ hacking group was responsible for a cyber attack that forced the ride-hailing company to shut several internal communications temporarily last week.

Uber blames security breach on Lapsus$, says it bought credentials on the dark web (ZDNET) The hacking group apparently gained access to several internal Uber systems after stealing a third-party contractor's credentials and then convincing the contractor to approve a two-factor authentication request.

Uber's breach shows how hackers keep finding a way in (Protocol) The attack is another reminder that not all forms of multifactor authentication are created equal.

Uber attributes hack to Lapsus$, working with FBI and DOJ on investigation (The Record by Recorded Future) Uber said on Monday that the cyberattack on their systems was traced to hackers connected to the notorious extortion group Lapsus$.

Uber data breach spotlights need for enterprises to ‘get the basics right’, say experts (ITP.net) The cybersecurity incident forced the company to shut several internal communications and engineering systems as a precaution, the company said in a statement

Hacker steals GTA6 source code from Rockstar (Computing) The attacker may be the same as the one who breached Uber last week - and could be affiliated with the Lapsus$ group

Hackers Leaked ‘Grand Theft Auto’ Footage, Rockstar Games Says (Wall Street Journal) Take-Two, the videogame firm’s parent, discloses an unauthorized third party illegally accessed and downloaded confidential data.

Rockstar Games Confirms Breach Leading to GTA 6 Leak (SecurityWeek) Rockstar Games has confirmed suffering a network breach that led to information on GTA 6 getting stolen and leaked.

Stolen Grand Theft Auto footage dumped online in hack (AP NEWS) Video game producer Rockstar Games said Monday that early development footage from the next version of its popular title Grand Theft Auto was stolen in the hack of its network. Someone claiming to be the hacker, posting on Telegram, dumped 90 video clips from the theft online on Sunday and claimed also to have source code, which they were seeking to sell for a minimum of $10,000.

Rockstar comments on GTA 6 leak and claims project won’t be delayed | VGC (VGC) The company said it was "extremely disappointed" to have details on the game shared in this way…

A look at the risk of stolen single sign-on credentials. (CyberWire) New research analyzes exposed single sign-on credentials for public companies in 2022.

Fake Tech Support Scam Pop Ups are now using a popular news website Wired to target victims (The Tech Outlook) Recent developments noticed abusive services attacking the American magazine Wired. According to a Twitter update by Malwarebytes Threat Intelligence (@MBThreatIntel), tech support scammers created a fake Wired URL. According to @MBThreatIntel the said URL is a cloaking browser locker domain. The domain is globalnews[.]cloud. @MBThreatIntel tagged @Namecheap (Namecheap.com) informing them about the threat action. Namecheap …

Scam advertisements are finding their victims through the Microsoft Edge browser (Digital Information World) Within a day, the ad malware was able to get its hands on more than two hundred different users.

Kiwi Farms has been breached; assume passwords and emails have been leaked (Ars Technica) Harassment site is down for now after hacker gains access to admin account.

LastPass source code breach – incident response report released (Naked Security) Wondering how you’d handle a data breach report if the worst happened to you? Here’s a useful example.

American Airlines discloses data breach after employee email compromise (BleepingComputer) American Airlines has notified customers of a recent data breach after attackers compromised an undisclosed number of employee email accounts and gained access to sensitive personal information.

Revolut security breach: data of +50,000 users exposed (Security Affairs) Revolut has suffered a cyberattack, threat actors have had access to personal information of tens of thousands of customers. The financial technology company Revolut suffered a ‘highly targeted’ cyberattack over the weekend, threat actors had access to the personal information of 0.16% of its customers (approximately 50,000 users). The company states that it has already contacted the […]

M.C. Dean, Inc. Reports Data Breach After Unauthorized Party Had Access to the Company’s Computer System for Six Months (JD Supra) On September 14, 2022, M.C. Dean, Inc. confirmed that the company experienced a data breach after an unauthorized party gained access to sensitive...

Lubbock Heart & Surgical Hospital Reports Data Breach Affecting 23,379 Patients (JD Supra) On September 9, 2022, Lubbock Heart & Surgical Hospital filed official notice of a data breach with the U.S. Department of Health and Human Services...

Ameriprise Financial, Inc. Confirms the Company’s Fourth Data Breach of 2022 (JD Supra) On September 13, 2022, Ameriprise Financial, Inc. filed official notice of a data breach with the Massachusetts Office of Consumer Affairs and...

Trends

Quantum computing perspectives. (CyberWire) Organizations prepare for quantum computing.

Harvest Now, Decrypt Later Attacks Pose a Security Concern as Organizations Consider Implications of Quantum Computing (PR Newswire) Just over half of responding professionals at organizations considering quantum computing benefits believe that their organizations are at risk...

Trends in data resilience and preparedness. (CyberWire) Druva and IDC have released a report detailing the data resilience and the preparedness of IT professionals.

Druva Blog - Data Protection for the Cloud Era | Druva (Druva) Get industry news, customer stories, engineering deep dives, and company updates with Druva's blog. Click here!

SpyCloud Report: Despite Increased Spend on Ransomware Mitigation, 90% of Companies Affected in the Last Year (Business Wire) SpyCloud, the leader in account takeover and fraud prevention, today released its 2022 Ransomware Defense Report, an annual analysis of how IT securit

2022 Ransomware Defense Report (SpyCloud) SpyCloud’s annual report offers insights from security leaders on the current state of ransomware and future plans to improve defenses.

Marketplace

Operant Networks, emerges from stealth raising $3.8M in Seed funding led by Constellation Technology Ventures, to simplify networking and cybersecurity for the energy edge (Prowly) Santa Rosa, CA – Operant Networks is setting the standard for secure machine-to-machine communications. Today at RE+, the largest and most comprehensive event in North America for the clean energy industry, Operant announced it raised a $3.8M round of seed-funding led by...

CrowdStrike’s Falcon Fund Invests in API Security Leader, Salt Security (Business Wire) Corporate venture arm for CrowdStrike continues to invest in an ecosystem of best-in-class security innovators

Imply Announces $100M Investment Led by Thoma Bravo to Drive the Market Shift to Modern Analytics Applications - Imply (Imply) New funding round validates Imply’s leadership position in the real-time analytics database category

Palo Alto Networks on verge of $600 million acquisition of Apiiro (CTech) The Israeli startup’s code risk platform is designed to provide risk visibility and control from design to code

KnowBe4 gets $4.22 billion go-private offer from Vista Equity Partners (Reuters) Cybersecurity firm KnowBe4 Inc said on Monday that Vista Equity Partners had offered to take it private for $4.22 billion in cash, the latest sign of private equity interest in a sector whose valuations have declined in this year's downturn.

Any Distance raises $1.5M to build social activity tracking for everyone (PR Newswire) Building digital and physical experiences to motivate people to be active, Any Distance today announced that it has secured $1.5M in a pre-seed...

Deep Instinct raises $62 million from BlackRock and Chrysalis (CTech) The Israeli cybersecurity company is also undergoing a major change in its leadership team, with Guy Caspi to leave his role as CEO and become the company’s Chairman and CPO. Lane Bess will take over as CEO

Data Security Startup Sentra Launches in U.S. Market (PR Newswire) Sentra, a cloud data security company, today formally announced its arrival in the U.S. market with the opening of its new North American...

Devo Technology Delivers Industry’s First Comprehensive Cloud-Native Platform for the SOC with Acquisition of Next-Gen SOAR Provider LogicHub (GlobeNewswire News Room) Addition of automated, no-code detection and response capabilities further delivers on vision for the autonomous SOC...

Netsurion Reveals Amplified Focus on Managed Open XDR (GlobeNewswire News Room) Company makes series of pivotal changes following recent divesture of Secure Edge Networking business...

DoControl Named 2022 SINET16 Innovator for Automated, No-code SaaS Data Security (PR Newswire) DoControl, the automated Software as a Service (SaaS) security company, today announced that it has been named a 2022 SINET16 Innovator, an...

Council Post: How To Hire If You've Laid People Off This Year (Forbes) Give candidates what they want.

NTT Research Names Takashi Goto Head of the Technology Promotion Team (Business Wire) NTT Research, Inc., a division of NTT, today announced that it has named Takashi Goto as head of its Technology Promotion Team.

OPSWAT Expands Leadership Team and Appoints Tomer Zuker as Chief Marketing Officer (OPSWAT) OPSWAT , a leading provider of critical infrastructure protection (CIP) cybersecurity solutions, announced today the expansion of its executive leadership team with the addition of Tomer Zuker as Chief Marketing Officer (CMO). I look forward to accelerating the organization’s global marketing strategies, while collaborating with cross-functional teams on growth opportunities and executing go-to-market plans to meet the growing demand for CIP cybersecurity solutions to better secure our way of life.” Tomer Zuker, CMO at OPSWAT Prior to joining OPSWAT, Zuker served as the Chief Marketing Officer of Nintex Kryon, a leading startup in the field of Robotic Process Automation (RPA) and Process Excellence.

Distinguished Board Director and Former Fortune 100 CIO, Annabelle Bexiga Joins Quantexa Board of Directors (GlobeNewswire News Room) Today Quantexa, a global leader in Decision Intelligence (DI) solutions for the public and private sectors,...

Tenable Appoints Technology Industry Veteran Patricia Grant to Chief Information Officer (Tenable®) Tenable®, the Cyber Exposure Management company, today announced that it has appointed Patricia Grant to Chief Information Officer (CIO). As the leader of the IT organization, Grant will drive digital transformation, innovation and modernization to support the company’s ambitious business objectives.

Atrium Health CISO Todd Greene Joins Semperis as Strategic Advisor (Business Wire) Semperis, a pioneer of identity-driven cyber resilience for enterprises, today announced the addition of Todd Greene, Vice President & Enterprise

Products, Services, and Solutions

SecurityScorecard Enables Organizations to View Risks and Measure the ROI of Security Investments in the Midst of Turbulent Economic Times (Business Wire) SecurityScorecard, the global leader in cybersecurity ratings, today announced it has launched a series of resources designed to help organizations na

Inspira Enterprise, Inc. Launches iSMART2 "Vulnerability Management-in-the-Box" (PR Newswire) Inspira Enterprise, Inc., a leader in business outcome-based cybersecurity solutions and digital transformation, today announced the launch of...

Absolute Software Adds Trellix Endpoint Security to Application Resilience Ecosystem (Absolute) Absolute is the leading visibility and control platform that gives you tamper-proof protection for all of your devices, data and applications. With the Absolute Platform, you get the power of asset intelligence, continuous compliance and endpoint hygiene.

ThreatQuotient Enhances Data-Driven Automation Capabilities With New ThreatQ TDR Orchestrator Features (Dark Reading) Focused on bringing ease of use to IT security automation, ThreatQ TDR Orchestrator addresses industry needs for simpler implementation and more efficient operations.

XONA and Nozomi Networks Partner to Enhance Security for the Digital Transformation of Critical Infrastructure | XONA Systems (XONA Systems) Leaders in OT and ICS Security Combine Zero Trust User Access with Comprehensive Network and Asset Visibility to Drive Cost and Business Efficiencies Annapolis, MD – September 20, 2022 – XONA, the frictionless user access platform purpose-built for critical infrastructure, and Nozomi Networks, the leader in OT & IoT security, today announced a partnership […]

Byos Releases Free Assessment Tool to Provide Companies with Tailored (PRWeb) HALIFAX, Nova Scotia (PRWEB) September 20, 2022 Byos (http://www.byos.io), the edge microsegmentation company dedicated to helping organizations protect themselves from the risk of ubiquitous rem

Technologies, Techniques, and Standards

GDPR Compliance challenges of AI projects and how to solve them (Wire19) In this article, learn about the compliance challenge of AI projects, especially with respect to the GDPR and several best practices.

How Mathematical Curves Power Cryptography (Quanta Magazine) A simple geometric idea has been used to power advances in information theory, cryptography and even blockchain technology.

New York National Guard Cyber Experts Learn from Brazilian Counterparts (Diálogo Américas) When the Brazilian Cyber Defense Command (CDCiber) showcased itself to representatives of 15 nations August 18 as part of its Cyber Guardian Exercise, two New York Army National Guard Soldiers represented the United States.

Design and Innovation

Exclusive: Gmail launches pilot to keep campaign emails out of spam (Axios) Despite hundreds of negative comments, the FEC approved the program in August.

DARPA launches new program to let small innovators behind the classified curtain (Federal News Network) DARPA thinks security clearance issues are keeping a vast array of innovative companies from solving the government's biggest problems. The agency thinks it has big idea to bridge the security…

Research and Development

SRI International Spearheads Two Groundbreaking Efforts to Secure 5G (Business Wire) SRI International, the nonprofit research institute behind some of the world’s most impactful deep-tech advancements, today announced that it has won

Academia

Academic Advice: Certification courses in emerging tech may get you lucrative jobs (Education Times) Career counsellor Pervin Malhotra discusses how Blockchain, IoT and AI are at the top of organisations’ priority list. session chat Education Times

Legislation, Policy, and Regulation

Iranian-backed attacks on Albania highlights need for Cyber Capacity Building (The Cipher Brief) Mark Montgomery, former Executive Director of the Cyberspace Solarium Commission highlights need for cyber capacity after attacks on Albania

Japan Needs a Cyber Ministry: Former JGSDF Major General (Diplomat) Tokyo needs to establish a cyber ministry to oversee and defend the nation’s cybersecurity infrastructure against threats, says Major General Tanaka Tatsuhiro, a former commanding general of the GSDF’s Signal School.

The Deep Roots of Nigeria’s Cybersecurity Problem (WIRED) Despite having one of the strongest data-protection policies in Africa, the country’s enforcement and disclosure practices remain dangerously broken.

White House guidance on third-party software seen as a major test of cyber risk strategy (Cybersecurity Dive) The U.S. hopes that by forcing software producers to meet a set of minimum security standards for federal use, a new baseline strategy will be adopted industrywide.

White House issues new software security guidance for agencies (SC Media) Federal agencies have been ordered by a new White House software security guidance to provide a complete inventory of software in use within 90 days, reports The Record, a news site by cybersecurity firm Recorded Future.

U.S. Treasury Seeks Comment on Crypto’s Illicit Finance Risks (Wall Street Journal) The U.S. Treasury Department is seeking public comment on the possible illicit finance and national security risks posed by the use of digital assets, as part of the agency’s mandate under President Biden’s March executive order to study the development of cryptocurrency.

Federal CISO: Software security memo is an enabler of the digital future (Federal News Network) Chris DeRusha, the federal chief information security officer in OMB, said agencies and vendors need time to understand and implement NIST’s new Secure Software Development Framework.

Space Force shifting resources to intelligence and cybersecurity (SpaceNews) The U.S. Space Operations Command is assigning cybersecurity and intelligence specialists to work side-by-side with satellite operators so they’re better prepared to protect U.S. systems from electronic and physical threats, said Maj. Gen. Douglas Schiess.

Litigation, Investigation, and Law Enforcement

5 health systems facing lawsuits for data breaches (Becker's Hospital Review) Several health systems have faced lawsuits regarding data breach incidents.

Industry Events

For a complete running list of events, please visit the Event Tracker.

Events

Air Force Association Air, Space & Cyber Conference (National Harbor, Maryland, USA, Sep 19 - 21, 2022) AFA's Air, Space, & Cyber Conference is the leading professional development event for Air Force and Space Force officers, enlisted members, civilians, veterans, and defense industry leaders and representatives. Our conference brings together top Air Force and Space Force leadership, industry experts, and government officials to discuss challenges facing the aerospace and cyber communities today and in the future.

CSO50 (National Harbor, Maryland, USA, Sep 19 - 21, 2022) We’re back in person and excited to bring the CSO50 Conference & Awards to the East Coast for the very first time! It’s all happening September 19-21 at the scenic MGM National Harbor Hotel, conveniently located in the metro DC area. In addition to recognizing this year’s CSO50 award winners, and our CSO Hall of Fame inductees, you’ll get exclusive access to career and operational advice from the profession’s top thought-leaders and drivers of change. Only CSO can deliver an action-packed agenda like this, and it’s all hosted by our Senior Vice President and Managing Director Worldwide, Bob Bragdon.

MSSP Alert Live (Washington, DC, USA, Sep 19 - 21, 2022) This September 19-21 in Washington, D.C., MSSPs and MSPs will convene for a new conference dedicated to managed security. Join us for this inaugural event as we deliver the managed security services roadmap for 2023. This event will bring together managed security services providers, managed services providers, and technology vendors working in the cybersecurity space.

Wyoming Blockchain Stampede, WyoHackathon, and Wyoming Cybersecurity Conference (Laramie, Wyoming, USA, Sep 19 - 23, 2022) Celebrating its fifth anniversary, the 2022 Wyoming Blockchain Stampede, will be held Sept. 19-23 at the University of Wyoming Conference Center in Laramie. The Stampede, sponsored by the UW Center for Blockchain and Digital Innovation (CBDI), features speakers, panels and events exploring the next generation of digital assists, blockchain-related startups, educational programs, financial and regulatory issues, digital identity, state and federal legislation, and cybersecurity and digital identity. “Since the inception of the Stampede, industry leaders from around the world have attended the event, highlighting the opportunities, challenges and latest developments in blockchain, digital assets and cryptocurrency,” said Steve Lupien, director of the UW Center for Blockchain and Digital innovation. “This year we plan to examine more in-depth the impact of digital assets on Wyoming through legislation, economic development and education from K-12 to community colleges and UW,” Lupien added. The 2022 WyoHackathon will start ahead of the Stampede on Friday, Sept 9. Operated by Rensa Games, it will be online with winners announced at the end of the Stampede. This year’s competition length will allow for more participants from UW and around the world to be involved, and more time for them to meet challenges for rewards offered by blockchain-related businesses. This year’s event includes the annual Wyoming Cybersecurity Conference presented by the nonprofit the CyberWyoming Alliance (CWA) on Friday, Sept. 23. “It's About Identity” is the theme for this year’s conference with speakers and panels examining issues involving digital identity.

CMMC Day (Huntsville, and virtual, Alabama, USA, Sep 20, 2022) NeoSystems, a full-service strategic outsourcer, IT systems integrator and managed services provider to the government contractor market, announced today that it will host an in-person CMMC Day with panel discussions featuring industry experts from the Department of Defense (DoD), Coalfire, Deltek, Forvis, and Holland & Knight and more, which also will be live streamed.

Sponsor & Support

Grow your brand, generate leads, and fill your funnel.

With the industry’s largest B2B podcast network, popular newsletters, and influential readers and listeners all over the world, companies trust the CyberWire to get the message out. Learn more.