At a glance.
- Belden discloses breach.
- Sophos suffers data exposure incident.
- Ransomware defense reconsidered.
- Three arrested in Québec data theft incident.
Belden discloses data breach.
American networking solutions firm Belden, Inc. announced they experienced a “sophisticated attack” that resulted in an unauthorized party accessing employee and business partner data, reports Security Week. The organization has worked to secure the breach but continues to investigate. Chris Clements, VP of Solutions Architecture at Cerberus Sentinel, sent us these comments shortly after the breach was disclosed:
"Belden hasn’t provided a lot of detail on the exact nature of the cyber-attack, but a consistent theme in recent security breaches is that cyber criminals only need to find and exploit the weakest links in order to cause significant damage. Poor password hygiene, employees falling victim to phishing, or VPN appliances that aren’t included the regular organization patch cadence are all low hanging fruit for cyber criminals to target for exploitation. It’s those things that are missed or orphaned where attackers thrive. The only strategy to ensure that an organization stays as protected as possible is to adopt a culture of security that is first in the minds of all employee personnel from executive leadership to line of business operations."
Sophos becomes the victim.
Leading UK data security company Sophos was on the receiving end of a security breach, as they announced they suffered a data exposure resulting from a misconfigured database last week, reports ZDNet. The compromised data included the names and contact information of a “small subset” of customers, but Sophos has declined to disclose how many customers were impacted. This is the second time this year that Sophos has been involved in a security incident, the first occurring in April when a threat actor infiltrated several of its clients’ systems by exploiting a zero-day vulnerability in Sophos’ XG firewall product.
Security myths debunked.
SC Media reports that cybersecurity firm KnowBe4 hosted a webinar this month in which their information security researchers Erich Kron and Roger Grimes examined popular IT security myths and misconceptions. It's not so much that the myths are entirely false and without foundation, but if taken at face value they could induce a false sense of security. Some highlights include:
- Myth: Data backups will protect against ransomware attacks. Sometimes. Kron agreed that for smaller businesses, backups can be a lifesaver as long as they are frequently tested. But Grimes argued that backing up is useless if not coupled with regular critical systems restoration, which many companies neglect. Also, backups are meaningless in the face of extortion, a tactic becoming more popular in recent ransomware attacks.
- Myth: Long passwords are more secure than short passwords. Not really. After advocating for longer passwords, the National Institute of Standards and Technology has changed its mind on this. Kron and Grimes feel the real focus should be on avoiding password reuse and taking advantage of multifactor authentication.
- Myth: Technology is more important than end user training. While this is hardly what the lawyers would call an admission against interest, since training is among KnowBe4's offerings, the salience social engineering has assumed in the threat landscape surely renders training more important than ever. Training can be very effective as long as it’s tailored to fit the organization’s needs. Keeping end users informed about common threats like phishing scams can help the company identify attacks before they get too deep.
Three arrested after exposing Canadian teacher data.
The perpetrators of a data breach that targeted the Montreal Treasury Board have been arrested, reports CBC. Using stolen login credentials, the cybercriminals infiltrated a database containing the personal data of up to 360,000 teachers in the Canadian province in 2018. After an investigation conducted by the Sûreté du Québec’s financial crimes unit and the Québec Education Ministry, the three men responsible for the breach were taken into custody. The incident left the teaching population wary of the government’s data handling practices. "You would suspect that your data would be in good hands, and that's not the case,” said Heidi Yetman, president of the Québec Provincial Association of Teachers.