CSO

Even as the White House is calling on federal agencies to make more use of open source projects, there’s also a federal effort under way to reduce the number of vulnerabilities in those products via better code review tools and bug bounties.By the e…

Companies going through a merger or acquisition, as well as their lawyers, financial advisers, and other associated firms are all tempting targets for cyberattackers, according to a new report from Digital Shadows.The attackers use public sources fo…

Earlier this month, the White House released a draft of an open source code policy for public review which would require agencies to share code with each other and with the public, but some experts are concerned about possible security implications….

Federal government agencies are still fighting the last cybersecurity war, the one where computer networks had a strong, defensible perimeter, according to a new report by 451 Research.The battlefronts have moved, but federal security professionals …

The FBI may have backed off from its demand that Apple build a backdoor to an iPhone security mechanism, for now at least, but experts say that a lasting legacy will remain in terms of the educational impact of the battle.John Oliver’s 18-minute seg…

In a survey released today, 27 percent of of U.S. office workers at large companies would sell their work password to an outsider, compared to a global average of 20 percent.And despite all the recent media attention on data breaches, password hygie…

A new report released by Shape Security yesterday details how the Sentry MBA tool makes credential stuffing attacks more widely available to cybercriminals.The traditional “brute force” method of breaking into a user account requires the attacker to…

The email comes from a trusted source — the CEO, a regular vendor, the company attorney or accountant. It’s part of an ongoing conversation, the format and language is identical to previous emails of the same type.
There might even be phone calls….

The FTC is on a data breach enforcement roll. Last summer, the courts allowed it to fine companies with weak cybersecurity practices. Now, the FTC is taking a closer look at payments processing, checking to see how auditors measure compliance with i…

As little as four years ago, only about a third of companies considered cybersecurity when planning a merger. Today, that percentage has flipped.”When you look at mergers where one big company buys another big company, I’d estimate that the cybersec…

The market for next-generation endpoint security tools has doubled each of the last two years, and will continue to grow at a compound annual growth rate of 67 percent for the next five years — but that growth could skyrocket if more vendors are ce…

In a recent study of a million client devices over the course of 10 months in 2015, every web gateway allowed outbound malicious communications — though some gateways did better than others.The report, released in mid-February by Seculert, showed t…

Cybercriminals and hacktivists face many of the same hiring problems as defending security organizations, but with their own particular twists, according to report released this morning.There is a lack of qualified candidates for jobs such as malwar…

The U.S. Senate recently proposed a cybersecurity disclosure bill that would require public companies to describe what cybersecurity expertise their boards have, or, if they don’t have any, what steps the companies are taking to get some expertise o…

Verizon is known for its huge annual Data Breach Investigations Report, but this morning it released a less data-heavy digest organized by case study.
The digest tells the stories of 18 common scenarios that many attacks fall into, and is intended …