The U.S. Transportation Security Administration (TSA) issued its second Security Directive to the pipeline industry on July 20, 2021, following the Colonial Pipeline cybersecurity incident. The first Directive on May 27, 2021, required pipeline owners and operators to notify CISA of cyber incidents, designate a cyber coordinator for the company, and review their cybersecurity program.
FBI Issues Cyber Attack Alert Against Tokyo Olympics Service Providers
On July 19, 2021, the Federal Bureau of Investigations issued a Private Industry Notification to service providers and “entities associated with the Tokyo 2020 Summer Olympics that cyber actors who wish to disrupt the event could use distributed denial of service (DDoS) attacks, ransomware, social engineering, phishing campaigns, or insider threats to block or disrupt
Privacy Tip #293 – Location, Location, Location-Based Services
This is not the first post discussing location-based services on mobile phones [see posts here]. And it won’t be the last. After reading my colleague’s post on the priest who resigned from his high-profile position after his location was tied to Grindr, I thought it would be useful to remind readers to think
White House Focused on Combating Ransomware
Ransomware attacks are frequent and escalating as we speak. Double extortion scams are hitting companies at a dizzying pace, and catching companies, large and small, off-guard. U.S. President Joseph Biden warned Russian President Vladimir Putin to knock it off during their first summit [view related post]. Nonetheless, and not surprisingly, the attacks continue, particularly
Privacy Tip #292 – Some Mint Mobile Users’ Information Compromised
Mint Mobile notified a “small number” of customers last weekend that their personal information was compromised between June 8 and June 10, when a threat actor ported the phone numbers of those customers to another carrier without authorization.
According to the breach notification sent to those customers, “While we immediately took steps to reverse the
Microsoft Issues Emergency Software Update for PrintNightmare Zero Day Vulnerability
Following the release of a U.S. Cybersecurity & Infrastructure Security Agency (US-CERT) Coordination Center VulNote “for a critical remote code execution vulnerability in the Windows Print spooler services” on June 30, 2021, Microsoft issued new guidance for the vulnerability (CVE-2021-34527) on July 1, updated guidance on July 2, 2021, and an emergency patch on July
Kaseya Ltd Hit with Ransomware Affecting MSPs
The most recent in a long list of IT security firms that have been hit with ransomware in the past year, Miami-based Kaseya Ltd disclosed late last week that it was hit with a ransomware attack that may affect hundreds, even thousands, of U.S.-based companies.
Kaseya has publicly stated that it is investigating the attack
HHS Warns Hospitals to Fix Security Vulnerability in PACs
In a rare move, the Department of Health and Human Services (HHS) has issued a warning to hospitals and health systems to prioritize the patching of a two-year-old vulnerability in picture archive communication systems (PACs). PACs are used for the exchange and storage of health scans and images, such as MRIs, CT Scans, breast imaging,
Privacy Tip #291 – Cryptomining Apps Offer Fake Services for a Fee
Although app platforms guard against fake apps, criminals are working hard to get around app platform rules to scam victims out of a cryptobuck. Apple and Google throw apps off their platforms if they don’t play by the rules, yet fake and scam apps have proliferated and continue to scam victims.
Recently, security researchers at
Law Enforcement Takes Down DoubleVPN
I love seeing another win for law enforcement in the cyber context.
Servers and web domains owned by DoubleVPN, a virtual private network, were seized recently following a collaborative law enforcement effort involving the Dutch National Police, the FBI, Europol, and the U.K.’s National Crime Agency.
DoubleVPN is a security tool that has been used