Cybersecurity is a national security priority. That’s why Microsoft is setting the standard with security built-in. And our 8,000 threat hunters analyze 65 trillion+ signals daily, partnering with federal agencies to protect their digital estate. We help strengthen cybersecurity at scale—from identity, data, and apps to endpoints, infrastructure, and networks—so you can focus on what matters: your mission. Visit aka.ms/FedCyber today to get started.
Join us for CSO Perspectives Live on Tuesday, April 2, 2024 at 2:00 PM EST. During this live and interactive event, Rick Howard and a panel of our Hash Table security experts will discuss emerging industry trends, recent threats and events, and the evolving role of executives in our field. Register now.
Google has agreed to delete billions of browsing activity records collected from users who were in Incognito Mode, Mashable reports. A class-action lawsuit filed in 2020 alleged that Google failed to properly disclose the extent of data collected on users in Incognito Mode. As part of the settlement, the company has also added updated information to Chrome's Incognito home page, outlining the types of data it collects.
A Google spokesperson told CNN, "We are pleased to settle this lawsuit, which we always believed was meritless. We never associate data with users when they use incognito mode. We are happy to delete old technical data that was never associated with an individual and was never used for any form of personalization."
With more than half of cybersecurity experts saying an increase in pen testing decreased breaches by over 50%, it is clear that the shift to offensive security is underway. Download our OffSec Shift report to explore how leading organizations blend defense and offense for a comprehensive cybersecurity strategy.
The Indian government says it's rescued 250 Indian citizens who were forced into cyber slavery in Cambodia, the Record reports. India's Ministry of External Affairs stated, "Our Embassy in Cambodia has been promptly responding to complaints from Indian nationals who were lured with employment opportunities to that country but were forced to undertake illegal cyber work. Collaborating closely with Cambodian authorities, it has rescued and repatriated about 250 Indians, of which 75 in just the last three months."
The Record cites the United Nations as saying at least 100,000 people in Cambodia and 120,000 in Myanmar are being forced by criminal gangs to participate in online scams. Many of these individuals were lured from other countries with phony job offers.
N2K’s Talent Insights solutions provide the workforce intelligence needed to take strategic action. Our workforce experts and proprietary data-analysis tools do the heavy lifting to assess and refine your cyber job roles, the competencies required, and build org charts to organize your workforce. The takeaway? Clarity on where you are, what you need, and a data-driven framework to get you there. Ready to dive in? Learn more.
Florida-based yacht retailer MarineMax has disclosed that personal data was stolen during a cyberattack the company sustained last month, BleepingComputer reports. The company stated, "[O]ur ongoing investigation has identified that this organization exfiltrated limited data from this environment that includes some customer and employee information, including personally identifiable information." BleepingComputer notes that the Rhysida ransomware gang has claimed responsibility for the attack and is selling the allegedly stolen data for just over $1 million.
Cybercrime knows no bounds, and a united front is our strongest defense. At RSA Conference™ 2024, May 6 – 9, we unite in San Francisco as a cybersecurity community, fostering learning, networking, idea exchange, and exploration of cutting-edge innovations. Join us as we face the future of cybersecurity head on. Learn more and register.
Today's issue includes events affecting Cambodia, India, Myanmar, and the United States.
Microsoft FAQ and guidance for XZ Utils backdoor (Microsoft) Latest information about XZ Utils vulnerability and guidance on how to assess your potential exposure.
A Vulnerability in XZ Utils Could Allow for Remote Code Execution (CIS) A vulnerability has been discovered in XZ Utils that could allow for remote code execution. XZ is a general-purpose data compression format present in nearly every Linux distribution, both community projects and commercial product distributions. Successful exploitation of this vulnerability could allow for remote code execution in the context of the logged on user. Depending on the privileges associated with the user, an attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have less rights on the system could be less impacted than those who operate with administrative user rights.
PandaBuy data breach allegedly impacted +1.3M customers (Security Affairs) Threat actors claimed the hack of the PandaBuy online shopping platform and leaked data belonging to more than 1.3 million customers.
FTC: Americans lost $1.1 billion to impersonation scams in 2023 (BleepingComputer) Impersonation scams in the U.S. exceeded $1.1 billion in losses last year, according to statistics collected by the Federal Trade Commission (FTC), a figure that is three times higher than in 2020.
Vulnerability database backlog due to increased volume, changes in 'support,' NIST says (The Record) As a backlog in the National Vulnerability Database has grown, industry experts have sounded the alarm about changes to an "integral" piece of cybersecurity infrastructure.
How to bridge the gap between the IT and legal staffs to better combat insider risk (SC Media) Here are three strategies for forging closer ties between the IT and legal departments so the teams are better prepared for an attack by an insider.
India says it has rescued 250 citizens from Cambodian cyber slavery (The Record) India’s Ministry of External Affairs responded to local media reports about Indians trapped in Cambodia, saying they are collaborating with Cambodian authorities to rescue them.
For a complete running list of events, please visit the Event Tracker.
Spring 2024 CISSP Study Group presented by ISSA Central MD (Columbia, or virtual, Maryland, USA, Feb 20 - May 1, 2024) Our Study Group fosters a learning environment to better absorb and understand the material. This is much better than the alternative of cram it in and regurgitate it on a test immediately following. Our approach simply makes the information more useful and easier to interpret! You can attend each session in-person in Columbia, MD, or attend virtually on line.
Insider Risk Management Program Evaluation & Optimization Training Course (Vienna, Virginia, USA, Apr 8 - 9, 2024) The training course will be taught on April 8-9, 2024. Students will receive extensive training, knowledge and resources to help them evaluate an Insider Risk Management (IRM) Program, identify gaps and provide cost effective strategies to optimize the program. This training will provide a 360 perspective for detecting Insider Risks / Threats and also covers establishing an Employee Continuous Monitoring & Reporting Program and employee monitoring on computer systems and networks using Insider Threat Detection Tools. Our student satisfaction levels are in the exceptional range. Over 900+ individuals have attended our training courses and received ITP Manager Certificates. The Insider Threat Defense Group offers the most affordable, advanced / next generation and value packed training for IRM. This provides students with IRM training that is taught from a real world, practical and operational perspective.
SANS New York City Spring 2024 (New York (or virtual), New York, USA, Apr 8 - 13, 2024) At SANS New York City Spring 2024, choose from 41 interactive courses with hands-on labs. Practice your skills and compete against your peers during NetWars Tournaments, and network with your instructor and industry colleagues in real-time. Each course includes electronic and printed books, and several courses align with GIAC certifications!
SANS Santa Clara (Santa Clara (and virtual), California, USA, Apr 8 - 13, 2024) At SANS Santa Clara 2024, choose from 41 interactive courses with hands-on labs. Practice your skills and compete against your peers during NetWars Tournaments, and network with your instructor and industry colleagues in real-time. Each course includes electronic and printed books, and several courses align with GIAC certifications!
Cybersecurity Competitions & Gaming (Virtual, Apr 9, 2024) Season IV, US Cyber Games: An Overview The United States faces a critical shortage of well-qualified cyber talent. While attracting students to computer science programs is a crucial first step, additional, complementary programming is needed to truly begin to close this workforce gap. The US Cyber Games program looks to serve this need via practical, hands-on experience with current and emerging technologies provided through cybersecurity competitions and games. These competitions support traditional academic pathways and widen the net by engaging new and different populations with opportunities to learn more about the field, develop skills, gain invaluable experience, and establish connections with industry professionals.
