David Bisson
- Senior Content Marketing Strategist, Center for Internet Security (CIS)
Is this you? As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.
Claim your profile
Articles by David Bisson
wire fraud Archives
By Tom Eston,Gary Warner,Mark Rasch,David Bisson,Gary Warner, UAB In episode 353, we discuss the February 2024 ransomware attack on Change Healthcare, resulting in the largest data breach of protected health information in history. Notifications have been sent to 100 million ...
payment security Archives
By Shai Gabay,Anthony Israel-Davis,David Bisson,Nicole White,Lorna Bradford,Geoff Forsyth Visa unveiled a suite of new security capabilities designed to help detect fraud and disrupt threats targeting financial institutions and merchants. At its U.S. Security Summit 2019, the multinational financial services corporation ...
end of life Archives
By Rohan Timalsina,Silviu STAHIE,David Bisson Microsoft says it doesn't plan to provide security updates for the Microsoft Security Essentials component integrated into Windows 7 after the operating system reaches its end of life in a little over ...
Verizon DBIR Archives
By Tom Eston,David Bisson,Ray Lapena,Zoë Rose,Anastasios Arampatzis,C. Warren Axelrod,SEORG,Dtex Systems In episode 330 Tom, Scott, and Kevin discuss the new features for iPhones and Android phones designed to warn users about secret trackers, possibly aiding in identifying stalkers. The hosts discuss Apple ...
Smart TV Archives
This is your Shared Security Weekly Blaze for June 24th 2019 with your host, Tom Eston. In this week's episode: Facebook announces a new cryptocurrency called Libra, two new zero-day vulnerabilities affecting ...
IT-OT Archives
By Nik Hewitt,David Bisson,Shelah Johnson We take a look at the Purdue Model, how it applies to ICS security, and how it can offer security professionals a clear and logical structure for implementing protection The Purdue Model ...
Why Traditional Security Tools Cant Adequately
By David Bisson Malicious actors are increasingly using API vulnerabilities to conduct digital attacks. As reported by Yahoo Finance, security researchers uncovered 11 billion attempted attacks involving API vulnerabilities between January 2020 and June 2021. More than a third of those attacks consisted of SQL Injection (SQLi) attempts. This was followed by Local File Inclusion (LFI) and Cross-Site Scripting (XSS) at 3.3 billion and 1.019 billion, respectively.
How Electricity Organizations Can Minimize the Possibility of a Hack
The SolarWinds supply chain attack testifies to the rising sophistication of digital threats confronting the North American electric grid. The incident began when malicious actors infiltrated a software update distribution channel used by the IT network management solutions provider for one of its products. The attackers then pushed out a malicious update along that compromised distribution channel to approximately 18,000 of the product’s users.
Blocking API Attacks: 3 Things To Consider
The 2020s are making a name for themselves as the decade of API attacks. In February 2021, for example, Dark Reading covered a report in which 91% of organizations revealed that they had suffered an API security-related issue during the previous year. More than half (54%) of those respondents said that the problem had stemmed from a vulnerability discovery, while 46% noted that they had encountered authentication challenges.
Attackers Used Malicious Telegram Installer to Distribute Purple Fox Rootkit
Threat actors leveraged a malicious Telegram installer to infect users with the Purple Fox rootkit. A Case Study in Evasion With the help of MalwareHunterTeam, Minerva Labs looked into a malicious Telegram installer and found that it was a compiled AutoIt script called ‘Telegram Desktop.exe.’ The script created a new folder and dropped both a legitimate Telegram installer and a malicious downloader into it. The former didn’t factor into the attack chain.
Attackers Targeting Mortgage Servicers to Steal Email Accounts Credentials
Digital attackers are targeting mortgage servicers and their clients to try to steal victims’ email account credentials. At the end of January, the Zix | AppRiver team flagged an email informing the recipient that they needed to submit a mortgage payment prior to the date contained in an attached payoff statement. “Attached” is an odd choice of words here considering that the email didn’t arrive with an attached file.
Get Started on Continuous Compliance Ahead of PCI DSS v4.0
In June 2021, the Payment Card Industry Security Standards Council (PCI SSC) announced that it was targeting Q1 2022 for the release of v4.0 of its Data Security Standard (DSS). Any company that accepts payments from Visa, Mastercard, American Express, Discover, JCB International, or UnionPay will need to comply with the standard for securing their customers' card data. Therefore, there's a lot of interest in what might end up in the new version.
Over 1,200 Phishing Kits Found in Wild With Ability to Steal 2FA Codes
Academics discovered more than 1,200 phishing kits equipped with the ability to intercept users’ two-factor authentication (2FA) codes in the wild. Two Types of 2FA Phishing As noted by researchers from Stony Brook University sponsored by security firm Palo Alto Networks, many of the toolkits referenced above used what’s known as man-in-the-middle (MitM) phishing. These tools enabled threat actors to bypass 2FA procedures by working as reverse proxies.
Security Service Edge Boosters Form New Forum to Encourage Adoption
Secure service edge (SSE) is a new way of looking at security that bundles together threat protection, security monitoring, and other capabilities to safeguard access to the Web, cloud services, and private apps. To encourage more widespread adoption, on January 25, Axis Security launched the SSE Forum with IT leaders from the United States, Canada, and the United Kingdom.
Threat Actors Often Choose the Path of Least Resistance
Every threat actor around the world shares one thing in common: they’re people. As such, they often look at their “job” from the effort/reward perspective. They ask themselves, “How can we get the greatest reward for the least amount of effort?” The answer is to go after low-hanging fruit, weaknesses which organizations might neglect in the absence of a robust security posture. Let’s examine some examples below.
When it Comes to Stopping IoT Security Camera Breaches, Focus on Procurement
Earlier this year, an enterprise security camera system maker suffered a data breach. The incident, which involved the compromise of a Jenkins server, enabled a group of attackers to bypass the company’s authorization system, including its two-factor authentication processes.
How a Cyber Criminal Justice System Resolves Disputes
The darknet community uses its own underground justice system to solve disputes that arise between one cyber criminal and another. Crime and Punishment for Cyber Criminals In this underground justice system, a ‘case’ begins when two parties experience a disagreement. Analyst1 gave the example of a threat actor having purchased compromised network access from an initial access broker who had already sold that access to someone else.
6.5 Billion Emails Quarantined in 2021
The Zix | AppRiver team quarantined 6.5 billion emails in 2021, a volume which constituted a 12.5% increase over the previous year. A Year of Email Attacks in Review In its “Global Threat Report: Full Year 2021,” Zix | AppRiver revealed that emails with malware attachments decreased in volume to below five million during the first five months of the year. Those messages jumped up above 15 million the following month and ended at around the same level in December 2021.
What CISA Incident Response Playbooks Mean for Your Organization
What does the latest U.S. federal ruling on cybersecurity mean for you? The recent executive order and U.S. Cybersecurity & Infrastructure Security Agency (CISA) commentary on it could provide a good framework for defending against ransomware and other attacks.
Countering a Brute Force Attack
There’s been a lot of chatter lately about moving on from passwords. But long passwords are still a good defense against some types of attacks. Brute force attack actors dedicate just a fraction of their efforts to cracking them, a Microsoft researcher found. The researcher analyzed over 25 million brute force attack attempts that occurred across their employer’s sensor network. What they found means most of these passwords are safe from this particular type of attack.
3 Cloud Security Trends to Watch in 2022 Original
Many organizations have cloud security on their minds going into 2022. In April 2021, for instance, Gartner predicted that global end-user spending on cloud management and security services would reach $18 million the following year. That’s a growth of 30% over the previous two years. The forecasts discussed above raise an important question. Where exactly will these businesses and agencies be committing their cloud security spending in 2022? There are three trends to watch over the next 12 months.
What It Takes to Build the Blue Team of Tomorrow
A good defense takes some testing. Ethical hacking involves pitting two teams together for the sake of strengthening digital security defenses. The red team attempts to bypass digital security barriers. By doing so, they reveal both misconceptions and flaws in their employer’s attack detection. Then, the blue team tries to defend against the red team’s attack attempts. Putting together a good blue team can be difficult. How do you make the best one you can?
The State of Credential Stuffing Attacks
Credential stuffing has become a preferred tactic among digital attackers over the past few years. As reported by Help Net Security, researchers detected 193 billion credential stuffing attacks globally in 2020. Financial services groups suffered 3.4 billion of those attacks. That’s an increase of more than 45% year over year in that sector. In H1 2021, fraudsters focused on digital accounts by breaking into existing user accounts or creating new accounts, per Business Wire.
Log4Shell Targeted by Email Attackers in Two Campaigns
The Zix | AppRiver team spotted two campaigns in which email attackers attempted to exploit a recently disclosed Log4j vulnerability on susceptible systems.
Sabbath Ransomware Gang Targets Critical Infrastructure, Backups
A ransomware gang known as Sabbath is going after critical infrastructure groups in North America. In addition, it sets itself apart by targeting backups. Backups Singled Out A rebrand of UNC2190, Sabbath has targeted U.S. and Canadian critical infrastructure. That includes education, natural resources and health sectors. In October 2021, for instance, the threat group extorted a U.S. school district on social media and demanded a multi-million dollar ransom, according to Mandiant.
Cloud Security Trends: What Is Cybersecurity Mesh?
Have you heard of cybersecurity mesh? Some are calling it one of the more notable trends for cloud security and today’s other cyber concerns. So, what is it, and how does it work? The technology stack is breaking down as more people use architectures based on microservices. They’re also using blockchain and other trust models to embrace an information-centric security model that works with distributed services (key to cloud security).
5 Things New with Bug Bounty Programs
On September 29, HackerOne announced the latest version of its Internet Bug Bounty (IBB) program. This initiative helped to coordinate the discovery of more than 1,000 security weaknesses in open-source software between 2013 and 2021.
FBI Email Account Abused to Send Out Warnings of Fake Cyberattacks
Someone used an FBI email account to send out messages warning recipients of fake cyberattacks that targeted their systems. Highlights of the Hack According to Bleeping Computer, researchers at the Spamhaus Project observed two waves of fake emails reaching more than 100,000 mailboxes on November 13, 2021. All the emails originated from “[email protected],” a legitimate email account associated with the FBI’s Law Enforcement Enterprise Portal (LEEP).
Hotly Contested Cybersecurity Trends
The worst thing that organizations can do is take a hard stance with their cybersecurity efforts. The digital threat landscape is constantly evolving. If organizations settle into a viewpoint, they could elevate one source of risk into something unrealistic—all while missing other digital threats. This reflects just how much assumptions drive cybersecurity-related decisions.
K-12 Cybersecurity Act Signed Into Law
Present Joe Biden signed the K-12 Cybersecurity Act into law, which lays out four objectives with the goal of strengthening the cybersecurity of the United States’ K-12 educational institutions. What do these mean for schools? What Is the K-12 Cybersecurity Act?? Introduced by U.S. Representative James R. Langevin (D-RI) as H.R.4691 in July, the K-12 Cybersecurity Act consists of four objectives.
Double Extortion
Need another reason to defend against ransomware instead of ending up having to find a solution other than paying it? Double extortion may be it. So, what is double extortion? When did it start? With this tactic, ransomware actors steal a victim’s data before their malware strain activates its encryption routine. They then have the option of demanding two ransoms. The first one is the provision of a decryption utility.
E-Commerce Fraud Up 178% Ahead of Holiday Shopping
The number of malicious shopping-related websites increased 178% ahead of the 2021 holiday shopping season, according to Check Point Research. See how to recognize and prevent e-commerce fraud. A Spike in E-Commerce Fraud Websites Beginning in October, Check Point Research observed an average of 5,300 malicious e-commerce fraud websites emerge each week. That marks a rise of 178% compared to the average for the rest of the year. The impact of those websites also began to pick up in that period.
Norton Names Tech Support Phishing Scams Top Threat Original
Got a pop-up message from tech support? It’s probably not the real thing. Tech support scams were the top phishing threat for organizations in the third quarter of 2021, reported NortonLifeLock. Tech Support Scam Takeaways The consumer antivirus company reported that it blocked over 12.3 million tech support URLs connected with scam attempts between July and September. At this volume, tech support scams served as the top phishing threat during that period. Those numbers weren’t a surprise.
7 Vendor-Neutral Cybersecurity News Websites to Get Your Fix
As an information security writer and security junkie at Bora, I rely on various news sites to stay on top of what’s going on in the industry so that I can speak to our client’s needs. I tend to turn to some more than others in that line of work, admittedly. Below, I’ll provide a brief overview of seven vendor-neutral cybersecurity news websites where you can get your security fix. I’ll also include a couple of links to Bora articles for which I used the featured news websites as sources.
What You Need to Know About RDP Security Going Into 2022
Threat actors put various cloud “tools” — resources like account information and application access — for sale on dark web markets that provide access for conducting follow-up attacks. But none of those utilities compare in popularity to Remote Desktop Protocol (RDP) accounts. They represent more than 70% of cloud resources available for sale on underground web marketplaces, according to a recent analysis. As such, RDP accounts are more pervasive on the dark web than regular cloud accounts.
Ransomware Attackers Have 'Industry Standards' Too
Ransomware attackers are creating ‘industry standards’ and using them to define an ideal target for their campaigns. The Ideal Target: Location, Revenue and Other Criteria In July 2021, KELA discovered 48 discussion threads on dark web marketplaces. There, users claimed to be digital attackers looking to buy access into networks.
Beyond API Security Testing: Runtime Protection
Attacks against APIs are on the rise. According to Salt Security, 91% of organizations suffered at least one security issue involving their APIs in 2020. More than half (54%) of respondents said that they discovered a vulnerability in their production APIs. Slightly fewer (46%) said that they uncovered a problem that attackers could have used to try to tamper with their authentication schemes and thereby gain access to sensitive data.
Squid Game Used as Lure for Malware Campaigns, Phishing Attacks
Digital attackers are using Netflix’s popular series “Squid Game” as a lure for their malware campaigns and phishing operations. Two Trojan Downloaders Targeting Fans Kaspersky uncovered dozens of different malicious files related to Squid Game between September and October 2021, reported PC Mag. In one of those attack instances, a user came across an animated version of the first game depicted in Netflix’s series.
Why Traditional Security Tools Can't Adequately Protect Your APIs | Truth in IT: Enterprise Tech via Video
Why Traditional Security Tools Can't Adequately Protect Your APIs By David Bisson Malicious actors are increasingly using API vulnerabilities to conduct digital attacks. As reported by Yahoo Finance, security researchers uncovered 11 billion attempted attacks involving API vulnerabilities between January 2020 and June 2021. More than a third of those attacks consisted of SQL Injection (SQLi) attempts.
IoT Security: Protecting Food and Agriculture Organizations
Ransomware actors are targeting food and agriculture organizations, potentially disrupting business. Luckily, there are already formal structures in place to boost the IoT security defenses they need. Knowing them keeps the lifeblood of industrial farms and food delivery going. Businesses in the sector could “suffer significant financial loss,” the FBI said. That loss is “resulting from ransom payments, loss of productivity and remediation costs.” They could also lose customer trust along the way.
HelloKitty Ransomware Group Turns to DDoS Extortion Attacks
The HelloKitty ransomware group, best known for breaching and stealing data from video game developer CD Projekt Red, has added distributed denial-of-service (DDoS) attacks to its arsenal of extortion tactics. Extortion Techniques Press Victims for Time The FBI first detected HelloKitty in January 2021. The gang has made a name for itself by breaching and encrypting the video game developer. In addition, it stole the source code for several of the company’s games.
Credential Phishing, Brute Force Attacks Both Increased in H1 2021
Security researchers detected an increase in both phishing campaigns and brute force attacks in the first half of 2021. Vendor and Business Email Compromise Attempts Also Up According to Abnormal Security, the volume of brute force attacks grew by 160% starting in May 2021 and ending in mid-June. This means that brute force attacks targeted 26% of all organizations per week on average during that period — more than double the rate (10%) for a typical week.
Why the Future Needs Passwordless Authentication
As of September, Microsoft users no longer have to rely on passwords when logging in to their accounts. The Redmond-based tech giant noted that users could instead use its authenticator app, Windows Hello; a physical security key or a verification code sent via SMS-based text message to sign in to Outlook, OneDrive and other Microsoft services. With this shift, passwordless authentication is going mainstream — as it should. What’s Wrong With the Password?
Hospital Ransomware Attacks Go Beyond Health Care Data
The health care industry has been on the front lines a lot lately. Along with helping control the effects of COVID-19, it has been a prime target for ransomware. In a 2021 survey conducted of 597 health delivery organizations (HDOs), 42% had faced two ransomware attacks in the past couple of years. Over a third (36%) attributed those ransomware incidents to a third party, such as what happened earlier this year with Kaseya.
Treasury Crypto Security Sanction Blocks Exchange Favored by Ransomware Actors
The U.S. government sanctioned the cryptocurrency exchange SUEX for moving money for ransomware actors. In essence, that means U.S. citizens and corporate entities are banned from using it. The statement, released in September, is part of a wider effort to boost crypto security and “disrupt criminal networks and currency exchanges”.
Why the Future Needs Passwordless Authentication
As of September, Microsoft users no longer have to rely on passwords when logging in to their accounts. The Redmond-based tech giant noted that users could instead use its authenticator app, Windows Hello; a physical security key or a verification code sent via SMS-based text message to sign in to Outlook, OneDrive and other Microsoft services. With this shift, passwordless authentication is going mainstream — as it should. What’s Wrong With the Password?
Show More
loading
Actions
Is this you?
As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.Get in touch with David
Contact David, search articles and posts on X, monitor coverage, and track replies from one place.
Learn more about Muck Rack