Is this you? As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.
Claim your profile
Articles by Greg Sim
The Journey of Securing a Long-Tail Supply Chain
Supply chains often are long and complex, and as organizations rely more and more on data to drive their businesses, digital supply chains continue to grow. And as the supply chains continue to grow, so do expectations and risks. To increase profits, many organizations rely on outsourcing to a supply chain partner, which leads to an extended, long-tail value chain.
Securing every partner from infection in the long-tail supply chain
While supply chain partners are trusted to observe best practice, the reality is that participants lower their guard to achieve mutual commercial goals. by Greg Sim To access this content please sign in or register below for free SIGN IN Email address Password Stay signed in REGISTER NOW FOR FREE REGISTRATION BENEFITS Full access to feature, opinion and review content The weekly SC Newswire bulletin The Buyers' Guide of the latest products, and salary survey Create an account now
Weaponised Emails Pose Biggest Threat To Cyber Security In 2019
UK cyber security innovator Glasswall Solutions predicts decline of mass cyber-attacks as criminals opt for more tailored methods, with awareness growing that anti-virus technology fails to provide full protection Glasswall Solutions, the pioneering UK-based cyber security company, today reveals its five top predictions for 2019. The list covers the developments that Glasswall’s team of experts believes will have biggest impact on cyber security over the next 12 months.
Security Boulevard
It shouldn’t come as a surprise to anyone reading this article that there has been a major shift towards businesses hosting their critical applications in the cloud. Software-as-a-Service (SaaS), as well as cloud-based servers from Amazon or Microsoft, have changed the way we build networked business systems for any size organization. Cloud-hosted solutions can (but not always) simplify local management, save money, provide flexibility, and generally simplify the planning for a system life cycle.
Security Boulevard
Bolting on security after the fact. It’s been a common approach to software security for decades. We architect, build code, deploy it and then figure out how to secure it. From the parade of application-related breaches and data thefts over the last few years, we pretty much know this approach does not work. Fortunately, the evolution of continuous deployment and DevOps, when coupled with the use of containers, offers great potential to improve application security.
Security Boulevard
You’d think that life would be pretty hard for threat actors these days, given the plethora of security companies out there feeding insatiable, ever-growing blacklists of malware that track millions upon millions of payload fingerprints. You’d think getting malware past antivirus products would be a Herculean task, requiring the development of new, never before seen custom malware. If you thought either of those things, you’d be wrong.
Security Boulevard
The four major U.S. wireless carriers today detailed a new initiative that may soon let Web sites eschew passwords and instead authenticate visitors by leveraging data elements unique to each customer’s phone and mobile subscriber account, such as location, customer reputation, and physical attributes of the device.
Data breach — 380,000 British Airways transactions compromised | Avast - Security Boulevard
Continuing the seemingly unending parade of data breaches marching through the headlines over the past year, including the Reddit breach, the Atlas Quantum breach, the Huazhu hotel chain breach, and the Air Canada breach — and those were all just in August — a targeted attack on British Airways made off with the full payment info of 380,000 transactions.
Security Boulevard
I was chatting with some cyber-mates at a recent event and the topic of cyber attacks on the U.S. power-grid came up (as it often does these days).
Security Boulevard
As part of our continued efforts to tackle entire classes of threats, Office 365 client applications now integrate with Antimalware Scan Interface (AMSI), enabling antivirus and other security solutions to scan macros and other scripts at runtime to check for malicious behavior. Macro-based threats have always been a prevalent entry point for malware, but we have observed a resurgence in recent years.
Security Boulevard
Managed security services provide a great way to deliver the protection that today’s small and medium businesses (SMBs) require while providing an opportunity to differentiate and grow your business through new revenue and services. Done right, managed security services can be a valuable extension to your existing service portfolio and provide a cost-effective and efficient way to provide security solutions suitable for SMB budgets.
Security Boulevard
You’ve seen that movie, the one where humans fabricate robots that are so human-like they end up taking over the world. What was once the plot line for every other sci-fi film is now leaking into the reality of our everyday lives. The future of artificial intelligence isn’t so distant with voice-powered personal assistants like Siri and Alexa, and autonomously-powered self-driving vehicles already on the market.
Security Boulevard
“Worldwide spending on information security products and services will reach more than $114 billion in 2018, an increase of 12.4 percent from last year, according to the latest forecast from Gartner, Inc. In 2019, the market is forecast to grow 8.7 percent to $124 billion.” That’s good, right? Well maybe-not-so-much.
Security Boulevard
Adobe and Microsoft today each released patches to fix serious security holes in their software. Adobe pushed out a new version of its beleaguered Flash Player browser plugin. Redmond issued updates to address at least 61 distinct vulnerabilities in Microsoft Windows and related programs, including several flaws that were publicly detailed prior to today and one “zero-day” bug in Windows that is already being actively exploited by attackers.
Security Boulevard
Phishing scams are pouring into inboxes in droves. And as the sheer volume of these scams increases, so do the levels of sophistication. Verizon reports that 30% of phishing scam emails get opened by the targeted users, with 12% of those users clicking on the included malicious link or attachment. According to the SANS Institute, 95% of all cyberattacks on businesses are successful spear-phishing attacks — successful in that the specifically-targeted users took the bait and clicked.
Security Boulevard
Security has such a large number of subtopics that it’s sometimes difficult to define what the field looks like as a whole. It means something vastly different to a Security Engineer, a CISO, and a Developer. Realistically, at most companies, Security is the prevention of leaking customer data or exposing secrets.
Security Boulevard
Today SAP released 18 security notes for September’s Security Patch Day. Another five have been published in the last month, making a total of 23 Security Notes this month. One of the highlights of this month’s publication is another critical bug in SAP HANA XS Engine that could be remotely and unauthenticated exploited, causing a Denial Of Service or even a potential remote code execution (RCE).
Security Boulevard
Why do we do what we do? The field of psychology has sought to explain human behavior for more than 100 years. Its breakthroughs have shed light on some of the most baffling, damaging and counter intuitive human habits, from violence, abuse and addiction to self-harm, obsessive compulsion and depression. What can psychology tell us about cybercriminals and how their attacks work? What psychological levers are they exploiting in us to invade our lives, steal our data and disrupt our lives?
SAP Cyber Threat Intelligence report – September 2018 - Security Boulevard
The SAP threat landscape is always expanding thus putting organizations of all sizes and industries at risk of cyber attacks. The idea behind the monthly SAP Cyber Threat Intelligence report is to provide an insight into the latest security vulnerabilities and threats. SAP has released the monthly critical patch update for September 2018. This patch update closes 22 SAP Security Notes (14 SAP Security Patch Day Notes and 8 Support Package Notes).
Security Boulevard
You may have heard about the zero-day vulnerability in the Tor Browser that was disclosed yesterday. It’s a big deal, and not just because of the ethics of buying and selling undisclosed vulnerabilities. Many people who use Tor Browser do so because of the privacy and security protections it offers—protections that the vulnerability had threatened ever since it appeared.
Security Boulevard
As we discussed in the first post of our Making an Impact with Security Awareness Training series, organizations need to architect training programs around a clear definition of success, both to determine the most appropriate content to deliver, and also to manage management expectations. The definition of success for any security initiative is measurable risk reduction, and that applies just as much to security awareness training.
Email Threats Must Take Top Priority in Cybersecurity
Email is the most significant threat vector of a corporate network, and thus should be priority when setting up a risk management strategy IBM’s ban of the use of removable devices a few months ago made a lot of sense as part of a broader risk management strategy and information security plan countering the wide range of security threats facing all organizations. Devices such as USB sticks and flash drives are a genuine threat.
Is The C-Suite Exempt From Cyber-Crime Anxiety?
Reports suggest that the increasingly likely event of a cyber-attack isn’t much of a talking point at board level. It’s time for this to change says Greg Sim, CEO, Glasswall Solutions If recent cyber-attacks are anything to go by, cyber-criminals are capable of causing colossal damage to organisations of all sizes. With vital public services such as the NHS succumbing to attacks, it seems that nothing is off the table when it comes down to cyber-criminals deciding who to target.
New Security Regulations Are Fine
While new security regulation for financial businesses in New York recognises that employees may be the weakest link, there should be a wider acceptance of the role played by new technologies such as file-regeneration, says Greg Sim, CEO at Glasswall Solutions. “Everyone is part of our cyber security team,” said the chief information security officer at a private trust company in New York. “It doesn’t matter what myself or my colleagues do from a technical perspective.
Protecting The Power-Grid From Cyber-Attacks Requires A Change Of Mindset
Energy, transport, water, health and other critical services firms are at risk of being fined up to £17m in May, if they don’t adopt best-practice cyber-security methods. In an attempt to boost the cyber-protection of the UK’s most critical industries, the government is pushing firms to turn to the best standard of cyber defence available. But will these fines be enough to encourage the C-Suite to take action?
Critical national infrastructure is only as vulnerable as the standard of technology protecting it
Critical national infrastructure is only as vulnerable as the standard of technology protecting it Energy, transport, water, health and other critical services firms are at risk of being fined up to £17m in May, if they don’t adopt best-practice cyber-security methods. In an attempt to boost the cyber-protection of the UK’s most critical industries, the government is pushing firms to turn to the best standard of cyber defence available.
Are infrastructure organisations vulnerable to cyber-attacks?
Energy, transport, water, health and other critical services firms are at risk of being fined up to £17m in May, if they don’t adopt best-practice cyber-security methods In an attempt to boost the cyber-protection of the UK’s most critical industries, the government is pushing firms to turn to the best standard of cyber defence available. But will these fines be enough to encourage the C-Suite to take action?
Proxy Cyberwarfare, GDPR And Blockchain - The Prospects For Security In 2018
The last year has been a significant 12 months in the short history of cyber security, with headline security breaches such as Uber and a scramble to come up with new approaches, particularly as the European Union’s General Data Protection Regulation comes into force next May. 2018 will see further developments in this dynamic field that will affect almost every organisation on the planet.
HOW FINANCIAL ORGANISATIONS CAN AVOID INFECTING CLIENTS AND PARTNERS WITH MALWARE
A cyber-attack on a London law firm just before Christmas stands as a stark warning for any financial organisation. Would-be fraudsters penetrated the cyber defences of the London firm Anthony Gold Solicitors and sent out 1,600 phoney emails to clients, pretending to be from the company. With a subject line “Action Required – Matter for Attention” recipients were asked to open an “urgent” attachment in a bid to persuade them to reveal log-in details and thereby open themselves up to fraud.
PROXY CYBERWARFARE, GDPR AND BLOCKCHAIN - THE PROSPECTS FOR SECURITY IN 2018
The last year has been a significant 12 months in the short history of cyber security, with headline security breaches such as Uber and a scramble to come up with new approaches, particularly as the European Union’s General Data Protection Regulation comes into force next May. 2018 will see further developments in this dynamic field that will affect almost every organisation on the planet.
How businesses can unwittingly become launch-pads for malware attacks
In business, reputation is everything. So it is not hard to imagine the conversations that took place inside two law firms when they realised they had potentially become malware hubs spreading malicious code among clients and business-partners. The legal ramifications could have been catastrophic.
Chinese hackers leverage HBO 'Game of Thrones' leaks to deliver trojans
A few weeks before the season finale of popular HBO series “Game of Thrones” Proofpoint researchers spotted a Chinese advance persistent threat (APT) group looking to lure fans with leaked episodes. The APT group sent phishing emails looking to capitalise on the actual HBO hack which made off with approximately 1.5 TB of data by claiming to offer victims a glimpse of the leaked content, specifically the last episode.
Apple contractors based in China caught selling customer data
Authorities in China have unmasked a massive underground market where Apple contractors were selling user data of Apple's Chinese customers, according to a report in the Hong Kong Free Press. Twenty-two people were rounded up in China's southern Zhejiang province, 20 of them employees of a local direct sales and outsourcing company.
Anti-virus defences are leaving global businesses vulnerable to the China syndrome
The news that the China-based APT10 hackers have so devastatingly penetrated the cyber defences of some of the world’s biggest commercial and governmental organisations reveals a sickening reality.
Anti-Virus Defences Are Leaving Global Businesses Vulnerable To The China Syndrome
The news that the China-based APT10 hackers have so devastatingly penetrated the cyber defences of some of the world’s biggest commercial and governmental organisations reveals a sickening reality.
The massive cyber breach by China-based APT10 hackers has exposed the failure of anti-virus defences
It was a sustained, “global operation of unprecedented size and scale” that stole huge amounts of intellectual property and sensitive data from some of the world’s major businesses. APT10’s Operation Cloud Hopper has proved just how vulnerable large companies and governmental organisations are when they put all their faith in anti-virus technologies.
The Apparent Inevitability Of Zero-Day Attacks On Businesses Is Farcical
Anyone would think zero-day attacks are unpreventable following a recent claim from one leading cyber-security vendor. FireEye this year claimed to have discovered “29 of the last 53 zero-day attacks”. 24 exploits remained undetected, yet this was still presented as some kind of monumental achievement. Such a statement leaves little comfort for the businesses who found themselves victims, so is it time to just give up completely and let the cyber criminals take over?
How can businesses stop attacks when traditional security solutions are ineffective?
Anyone would think zero-day attacks are unpreventable following a recent claim from one leading cyber-security vendor. FireEye this year claimed to have discovered "29 of the last 53 zero-day attacks." 24 exploits remained undetected, yet this was still presented as some kind of monumental achievement. Such a statement leaves little comfort for the businesses who found themselves victims, so is it time to just give up completely and let the cyber criminals take over?
PwC Report APT10 Global Attack
Following the news about PwC report APT10 global attack, Greg Sim, CEO at Glasswall Solutions commented below. “The APT10 Operation Cloud Hopper attack revealed in a report by PwC UK and BAE Systems exposes the utter sham of so-called anti-virus defences. The anti-virus companies touting these failed solutions already knew of the malware employed by APT10 yet have proved totally inadequate in protecting managed service providers from it, no matter where on the globe the attack happened.
Politics And International Malware Mayhem - Predictions For 2017
As 2017 approaches, the scale and sophistication of cyber-threats seems only destined to grow as criminals and state-backed groups learn how to exploit the weak-points in businesses and governmental organisations around the globe. If 2016 is anything to go by, unless enterprises change their approaches to cyber-security, 2017 will be another a year of successful ransomware attacks and data-breaches.
Show More
loading
Actions
Is this you?
As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.Get in touch with Greg
Contact Greg, search articles and posts on X, monitor coverage, and track replies from one place.
Learn more about Muck Rack