The Cybersecurity & Infrastructure Security Agency (CISA) and the FBI issued a joint Alert this week, entitled “Reminder for Critical Infrastructure to Stay Vigilant Against Threats During Holidays and Weekends” outlining “actions that executives, leaders and workers in any organization can take proactively to protect themselves against cyberattacks, including possible ransomware attacks, during the upcoming
Privacy Tip #308 – Keep the Holiday Shopping Season Cyber Safe
As we enter the holiday shopping season, cyber criminals are sharpening their cyber-scam strategies. We like to remind our readers about the enhanced risk during the holidays [view related posts here, here, and here]. There has been an increase in online shopping over the years, and particularly since the pandemic began. The holiday
Companies Still Struggling with Implementing Backup Plans
Backup plans continue to be one of the most important ways to respond to a ransomware attack. If you have a backup plan, have tested it, and can migrate to it, you are better equipped to be able to respond when your system is locked by ransomware. If you do not have backups of your
Privacy Tip #307 – Credit Card Skimming Devices Found at Costco
Credit card skimming fraud continues to affect companies and their customers, causing businesses such as Costco to routinely inspect their PIN pads for the devices. According to news reports, following a routine inspection of its PIN pads, five card-skimming devices were found at four Costco stores in the Chicago area.
According to Costco, fewer than
CISA Issues Incident Response + Vulnerability Response Playbooks For Executive Branch
The Cybersecurity & Infrastructure Security Agency (CISA) issued the Cybersecurity Incident & Vulnerability Response Playbooks: Operational Procedures for Planning and Conducting Cybersecurity Incident and Vulnerability Response Activities in FCEB Information Systems (Playbooks) on November 16, 2021, designed to assist Federal Civilian Executive Branch (FCEB) Information Systems agencies in adopting a standard set of procedures related
November’s Patch Tuesday Includes 55 Patches
Staying current with Microsoft’s monthly patches is challenging, yet critical for one’s cybersecurity program. This week, Microsoft’s November Patch Tuesday released 55 patches, six of which were categorized as “critical,” four were previously disclosed (which means that cyber criminals may already be exploiting them), and two are being exploited now. Plugging all of these vulnerabilities
CISA Issues Binding Operational Directive on Patching Vulnerabilities
The Cybersecurity and Infrastructure Security Agency (CISA) recently issued a Binding Operational Directive requiring all federal agencies to apply patches to new and old vulnerabilities that are being exploited in the wild.
The Directive, entitled Reducing the Significant Risk of Known Exploited Vulnerabilities, “establishes a CISA-managed catalog of known exploited vulnerabilities that carry significant
Privacy Tip #306 – Quick Read on Data Privacy Issues in 2020
I’m on vacation this week, and while most people read novels while on vacation, I catch up on data privacy articles and publications that I have set aside and haven’t had a chance to read. I just finished one that I thought was a quick and good summary of current data privacy issues entitled 5
FBI Warning: M&A Activity Targeted by Ransomware Groups
The FBI issued a Private Industry Notification on November 2, 2021, warning companies that “ransomware actors are very likely using significant financial events, such as mergers and acquisitions, to target and leverage victim companies for ransomware infections.”
According to the Notification, ransomware actors are researching publicly available information to pick targets they believe may be
Coveware Confirms Ransomware Attackers Targeting Mid-Market Companies
Coveware recently issued its 2021 Q3 Ransomware blog article, which notes that ransomware attackers are “moving away from big game hunting” and are moving to the middle market. According to the post, “Middle market companies that are not systemically important may not offer up the largest ransoms, but are more cost effective to attack