Is this you? As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.
Claim your profile
Articles by Tom Gilheany
Building a Security Operations Center to Reinforce Trust
By Tom Gilheany, portfolio manager for security training and certifications, Cisco Services To succeed in today’s digital economy requires a new level of trust. Digitization is now the way enterprises innovate and grow. But it also gives bad actors many more means to disrupt operations and destroy trust. Trust is hard to earn, easily broken, and difficult to restore once it is lost. And not only trusts even harder to earn, but the impact of lost trust is also magnified in today’s digital world.
#2018InReview Healthcare Cybersecurity
The healthcare industry is one of the biggest targets for hackers and other bad actors, given the massive amount of personal data these organizations have in their possession and the critical nature of the environment. To put this into context, in 2017, more than 5.6 million patient records were breached, according to the Protenus Breach Barometer.
Security Boulevard
Due to popular demand, my women in information security interview series is back for autumn! This marks the second anniversary since I started. Some of my subjects in this round have been waiting since last spring, so getting to chat with them has been long overdue. Let’s start with Sharka, a penetration tester who is full of enthusiasm.
Security Boulevard
Most of us have experienced an overheated cell phone, particularly that radiating warmth after a conversation that went on extra-long. But what are some of the other causes why phones get so hot? Sometimes to the point where it won’t function until it cools down? In this next segment of The Avast Guide to Android Apps, we look at the most common reasons phones get hot, and tell you what you can do to stop your phone from overheating. Unfortunately, there’s no single answer to this question.
Security Boulevard
The recent hack of social media giant Reddit underscores the reality that all too many organizations — even high-visibility ones that ought to know better — are failing to adequately lock down their privileged accounts. An excerpt from Reddit’s mea culpa says it all: “On June 19, we learned that between June 14 and June 18, an attacker compromised a few of our employees’ accounts with our cloud and source code hosting providers.
Security Boulevard
If you’re thinking of donating money to help victims of Hurricane Florence, please do your research on the charitable entity before giving: A slew of new domains apparently related to Hurricane Florence relief efforts are now accepting donations on behalf of victims without much accountability for how the money will be spent.
Week 38 Cyberattack Digest 2018 – GovPayNow.com, Port of Barcelona, SingHealth and others - Security Boulevard
Today is Monday and this means that we are ready to present you this week’s cyber attack digest. The U.S. GovPayNow.com payment system has over 14 million customer records stolen. Currently, the system is used by thousands of federal and state government agencies and recently acquired by Securus Technologies. The leak was discovered by Brian Krebs; the stolen data included digits of payment cards, names, phone numbers, and addresses.
Security Boulevard
Cybersecurity is the central challenge of our digital age. Without it, everything from our personal email accounts and privacy to the way we do business, and all types of critical infrastructure, are under threat. As attackers evolve, staying ahead of these threats is getting harder. Microsoft can help. We focus on three areas: running security operations that work for you, building enterprise-class technology, and driving partnerships for a heterogeneous world.
Security Boulevard
It is a common trend now to see most of the organizations opting for the cloud. Growing business demands, competition and the growth of Software-as-a-Service (SaaS) have helped propel this trend. While everything looks smart in the cloud, what about security? Does that look smart, too? Now that organizations use different kinds of cloud environments, […]… Read More The post Cloud Security: A Cloud Provider-User Partnership appeared first on The State of Security.
Security Boulevard
Just as you wouldn’t give your house keys to someone you just met, organizations don’t want to do business with those they don’t trust. As digital transformation becomes the norm, it provides opportunities for growth and exposes vulnerabilities with the potential to breach the trust that businesses work so hard to build with their customers.
Security Boulevard
Michael Roling’s last day in Missouri Government will be September 28, 2018. He is leaving for another private sector position as the “lead technical project manager at a company that has several SaaS offerings.” Coverage of his announcement has been widespread with related articles in Government Technology Magazine and StateScoop and other publications.
Security Boulevard
It is now free in every U.S. state to freeze and unfreeze your credit file and that of your dependents, a process that blocks identity thieves and others from looking at private details in your consumer credit history.
Security Boulevard
Almost every week for over a decade, I’d tap some words out on a keyboard and push the story out for folks to read. And much to my glee, you did engage, share, comment and seemed to genuinely enjoy what I had to say. I wrote about technology topics like information security, IoT, mobile, access, high availability, application delivery and many others tied to my job at F5.
Security Boulevard
For many start-ups, DevOps has proven to be a magical formula for increasing business velocity. Speed and agility is the name of the game — especially for Software as a Service (SaaS) companies. Related: How DevOps enabled the hacking of Uber DevOps is a process designed to foster intensive collaboration between software developers and the IT operations team, two disciplines that traditionally have functioned as isolated silos with the technology department.
Security Boulevard
A self-propagating malware mashup has been found lurking online. Called Xbash, the all-in-one malware is thought to be made by crime syndicate Iron Group and boasts of botnet, ransomware, diskwiper, cryptojacker, and worm features.
Security Boulevard
Anyone out there dealing with the DoD implementation of the NIST 800-37 RMF? Just in case, it’s the “Guide for Applying the Risk Management Framework to Federal Information Systems” developed by the Joint Task Force Transformation Initiative Working Group. I have been knee deep in it now since it got rolled out and wanted to share some of the insights I have had as I worked with systems to get them authorized under the RMF. No matter what, don’t stress the RMF.
Security Boulevard
Located between Cleveland and Akron, Richfield-based DIS Computers has been providing IT and security services for small businesses and enterprises in northeast Ohio for more than 27 years. With 90% of its business dedicated to managed services, Founder and President Robert Najjar says the company’s success is largely due to the team’s passion for customer service. “Our customer retention rate is 99.9%,” says Robert.
Security Boulevard
If you’re in your 40s or 50s, you probably remember a TV series called The Twilight Zone. (Millennials, think Netflix’s Black Mirror.) Every show was its own stand-alone story that took viewers into an alternate reality where things got weird in a hurry followed by twists and turns culminating in a surprise ending. These types of winding plots aren’t unheard of in the real world. I headhunt in executive-level security positions.
Security Boulevard
The concept of "packing" or "crypting" a malicious program is widely popular among threat actors looking to bypass or defeat analysis by static and dynamic analysis tools. Evasion of classification and detection is an arms race in which new techniques are traded and used in the wild.
Security Boulevard
In the bustling industry of cybercrime, ransomware has always been a popular weapon of choice…until this year. In 2018, illicit cryptomining (AKA cryptojacking) took the title, surging 459%. Cryptojacking is the crime of using somebody else’s computer processing power to mine cryptocurrency. Victims may not even notice, as there are no outward signs that the mining is occurring, save possible slowing down or overheating of the system.
Security Boulevard
This year at Microsoft Ignite, we will be making some exciting announcementsfrom new capabilities for identity management and information protection to powerful artificial intelligence (AI) innovations that can help you stay ahead of an often overwhelming surge in threats and security alerts. Join us as we share best practices for current products, reveal highlights of our new offerings, and give you a glimpse of our future product vision. Start by attending Satya Nadellas keynote.
Security Boulevard
“Malware Data Science: Attack Detection and Attribution” (MDS) is a book every information security professional should consider reading due to the rapid growth and variation of malware and the increasing reliance upon data science to defend information systems. Known malware executables have expanded from 1 million in 2008 to more than 700 million in 2018.
Security Boulevard
Trojan installers delivering adware and unwanted applications (PUPs) have been the most prevalent security nuisance on the macOS platform in recent years. To date, these have engaged in little more than low-level scraping of user data and browsing habits, but their potential to be far more threatening is only awaiting the right monetary incentive.
Security Boulevard
As netizens [citizens of the web – ], you probably know about computer viruses and hacking incidents. The new technology and market development have contributed to new forms of cyber-attacks and cryptojacking is one of them. These are often more difficult to detect and handle. Cryptojacking may occur when a website is infected with a JavaScript code that automatically uploads in the browser, or a malicious link is sent via e-mail.
SSD Advisory – ASUSTOR NAS Devices Authentication Bypass - Security Boulevard
Vulnerabilities Summary An ASUSTOR NAS or network attached storage is “a computer appliance built from the ground up for storing and serving files. It attaches directly to a network, allowing those on the network to access and share files from a central location”. In the following advisory we will discuss a vulnerability found inside ASUSTOR NAS which lets anonymous attackers bypass authentication requirement of the product.
Security Boulevard
Previously in Part 1 of The Avast Guide to Android Apps, we covered all the common malware and how to deal with it. In part 2 of our ongoing series, we take a closer look at the murky world of Android viruses, how they can infect your smartphone, and what you can do to amp up its immunity against them. Let’s dive in. For the longest time, the mobile virus was considered somewhat of a myth.
Security Boulevard
In recent years, there have been many studies related to compromised cloud hosting services. It has been reported that these services are increasingly being abused by hackers and malware authors for their malicious online activities. The services enable bad actors to open an inexpensive hosting account, allowing them to hide malicious content in the cloud-based domains of well-known brands, mixing the bad content among the good to prevent the malware from being blacklisted.
Security Boulevard
Citing “extraordinary cooperation” with the government, a court in Alaska on Tuesday sentenced three men to probation, community service and fines for their admitted roles in authoring and using “Mirai,” a potent malware strain used in countless attacks designed to knock Web sites offline — including an enormously powerful attack in 2016 that sidelined this Web site for nearly four days.
Security Boulevard
POS compromise remains alarmingly prevalent among hotel businesses, restaurants and retailers today. Although security breaches involving point-of-sale terminals received a great deal of mainstream media attention back in 2013 and 2014, attackers continue to target hotels and restaurants with malware-based attacks on POS systems in 2018, still seeking to extract valuable credit card data. Recent industry reports show that these attacks are successful far too often.
The Internet of Things (IoT) and Digitally Stored PII: Avoidable or Inevitable? - Security Boulevard
The Internet of Things (IoT) is rapidly showing up in all facets of daily life and collecting personally identifiable information (PII) in massive quantities. From smart home thermostats to one-click purchasing, IoT devices collect PII to personalize experiences for consumers. In an increasingly digital and connected world, unprecedented immersion into environments of convenience, knowledge, and accessibility has become the norm.
Security Boulevard
The Alliance for Telecommunications Industry Solutions (ATIS) (http://ATIS.org) and TCG (https://trustedcomputinggroup.org) have entered into a Memorandum of Understanding (MoU) to advance information and communications technology (ICT) cybersecurity. Under the new agreement, the two organizations will work together to create new cybersecurity specifications, guidance and best practices, with initial collaboration around network equipment security, mobile device security and related applications.
Security Boulevard
Despite having sailed through the core components of this year’s Talk Like A Pirate Day R post time has been an enemy of late so this will be a short post that others can build off of, especially since there’s lots more ground to cover from the data. Since this is TLAPD, I’ll pilfer some of the explanation from GitHub itself: The Digital Millennium Copyright Act (DMCA) “provides a safe harbor for service providers that host user-generated content.
Security Boulevard
FireEye has been tracking a campaign this year targeting web payment portals that involves on-premise installations of Click2Gov. Click2Gov is a web-based, interactive self-service bill-pay software solution developed by Superion. It includes various modules that allow users to pay bills associated with various local government services such as utilities, building permits, and business licenses.
Week 37 Cyberattack Digest 2018 – Fetal Diagnostic Institute of the Pacific, kayo.moe, University of Edinburgh and others - Security Boulevard
We hope you like our tradition to post our weekly cyber attack digest and today, we have something new for you. An enormous database containing email addresses, passwords in clear text, and financial data has been found on the anonymous file hosting service kayo.moe. The total number of exposed records amounted to 41,826,763. A representative of the service directed the set to Troy Hunt, Australian security researcher and creator of the Have I Been Pwned data breach index site.
Security Boulevard
With individuals, businesses and critical infrastructure increasingly becoming the target of cyber-attacks, cybersecurity today is a multifaceted challenge.
Security Boulevard
New vulnerabilities found in NUUO surveillance software can put cybercriminals in the director’s chair. When exploited through a stack buffer overflow, the Peekaboo vulnerability grants hackers full control over the surveillance video. Assuming control remotely, a hacker can tamper with the recording, tamper with the feed itself, and generally execute any code he or she wants in the software.
Security Boulevard
We are surrounded by technology. Our devices are always on and always connected, and therefore, so are we. We scroll through our smartphone notifications in the morning, listen to podcasts on our commute, spend an entire workday in front a computer screen, ending, finally, with the end-of-day ritual of watching the latest offering from our favorite streaming services. This may sound like an ancient ritual, which highlights how rapidly we get used to new technology and take it for granted.
Security Boulevard
As a small enterprise owner, it’s easy to fall into the trap of assuming that cybercriminals won’t target you. After all, why would anyone waste their time going after your business when there are much juicier fish in the sea? Well, the truth is that criminals love to prey on small and medium-sized enterprises.
Security Boulevard
With all the advertisements, flashing lights and screens grabbing at us, attention spans are shorter than ever. This is just one of the reasons that everyone is shying away from phone calls, and that messaging has blossomed. When a phone call is made from one party to the next, the receiving party has to make a commitment to answer that call, and focus on that one call until it’s over. Ugh. But – if you miss the call, you also miss the information and an opportunity to ask questions.
Security Boulevard
Ten second security tech go. Question base assumptions. Data is everywhere and devices are everywhere. Most security models that we know or have in place are just not really adequate anymore. We sometimes insist on doing something just because it was done in the past and it seems like the norm but the norm is changing and infrastructure is evolving in record speeds. Imagine or reimagine what your network would look like if there were no boundaries. Don’t separate between and on tram.
Security Boulevard
All too many companies lack a full appreciation of how vital it has become to proactively manage and keep secure “unstructured data.” One reason for the enduring waves of ransomware is that unstructured data is easy for hackers to locate and simple for them to encrypt. Ironically, many victimized companies are paying hefty ransoms to decrypt unstructured data that may not be all that sensitive or mission critical.
Security Boulevard
ProStratus has been providing IT services and solutions for small businesses throughout the Springfield, Ohio area since 1992. With a combined 60 years of IT and data center experience, ProStratus strives to provide its customers with cost-effective, top-notch support and solutions. ProStratus serves a variety of client types, including schools, elderly assistance homes, and medical institutions. Bryce Holland is one of the IT Directors/Project Managers at ProStratus.
Security Boulevard
In this post, we’re continuing our theme of vertical market success for MSPs. In a densely populated industry, making your business stand out is more than a challenge. One potentially successful approach is to specialize in a particular vertical market. This way, you acquire specific knowledge and expertise about the objectives, processes, and IT issues related to that type of business. You become an expert and specialist rather than a generalist.
Security Boulevard
Cyberattacks hit record highs last year, with nearly 160,000 cyber incidents reported and seven billion records exposed in the first three quarters of 2017, according to Online Trust Alliance’s Cyber Incidents and Breaches Trends Report. With the ubiquity of cyberattacks comes a need for more professionals. However, skilled individuals who are not already in the field and who have an interest in cybersecurity careers remain scarce.
Security Boulevard
Iron Bastion’s cybersecurity expert Gabor Szathmari, recently published novel research on abandoned internet domains, and how they are a significant cyber risk which threatens businesses and in particular the Australian legal profession. This article was first published on Iron Bastion’s security blog and was written by Nicholas Kavadias and Emily Williams. A domain name is a name you can register to identify your business on the internet.
Security Boulevard
The package has had an update to more efficiently retrieve mementos and added support for working with the Internet Archive’s advanced search+scrape API. The search/scrape interface lets you examine the IA collections and download what you are after (programmatically). The main function is but you can also paginate through results with the helper functions provided. To demonstrate, let’s peruse the IA NASA collection and then grab one of the images.
Security Boulevard
Government Payment Service Inc. — a company used by thousands of U.S. state and local governments to accept online payments for everything from traffic citations and licensing fees to bail payments and court-ordered fines — has leaked more than 14 million customer records dating back at least six years, including names, addresses, phone numbers and the last four digits of the payer’s credit card.
Security Boulevard
Juniper Research predicts that by 2022 more than half the homes in the U.S. will contain smart speakers like today’s popular Amazon Alexa and Google Home, and it’s easy to see why. Providing the answer to any question we can dream up, producing music and other entertainment on demand, handling our online shopping, they are one giant step towards the personal droid assistants we’ve all been craving since meeting C-3PO and R2-D2.
Q&A: The troubling implications of normalizing encryption backdoors — for government use - Security Boulevard
Should law enforcement and military officials have access to a digital backdoor enabling them to bypass any and all types of encryption that exist today? We know how Vladmir Putin, Xi Jinping and Kim Jung-un would answer: “Of course!” The disturbing thing is that in North America and Europe more and more arguments are being raised in support of creating and maintaining encryption backdoors for government use.
Security Boulevard
In November 2017, Google Chrome began rolling out an experimental feature to warn users about apps that might be causing instability in the browser. These alerts are designed to help you identify and remove software on your computer that is injecting code into Chrome, with the aim of making your browser more stable.As the name implies, injecting code is the act of introducing code to an application.
Show More
loading
Actions
Is this you?
As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.Get in touch with Tom
Contact Tom, search articles and posts on X, monitor coverage, and track replies from one place.
Learn more about Muck Rack