At the Intersection of Technology and Real Life

The Security Ledger

Critical Flaws in VxWorks affect 200 Million Connected Things

Michael York Reading, PA

Serious and exploitable security flaws in VxWorks, a commonly used operating system for embedded devices, span 13 years and could leave hundreds of millions* of connected devices vulnerable to remote cyber attacks and hacks. The security firm Armis on Monday published a warning about 11 critical, zero day vulnerabilities in the VxWorks operating…Read the whole entry… »Related StoriesOpinion: We need a way to talk about Cyber Physical RiskBreathe Deeply: DHS warns of Flaw in Hospital Anesthesia MachinesBreath Deeply: DHS warns of Flaw in Hospital Anesthesia Machines …

Episode 154: Richard Clarke on Defending the Fifth Domain

Episode 154: Richard Clarke on Defending the Fifth Domain

Michael York Reading, PA

The Pentagon calls cyberspace “the fifth domain” of conflict. But what does that mean? And how do you defend a human-made space that’s everywhere and nowhere? In this episode of the podcast, Richard Clarke joins us to discuss his new book, The Fifth Domain: Defending Our Country, Our Companies, and Ourselves in the Age of Cyber Threats. The post…Read the whole entry… » Related StoriesFirm Uncovers Major Cyber-Espionage Campaign Against TelcosEpisode 153: Hacking Anesthesia Machines and Mayors say No to RansomsAhead of Black Hat: Fear and Pessimism in Las Vegas …

Spotlight Podcast: To Fix Remote Access, CyberArk Alero Ditches Passwords and VPNs

Spotlight Podcast: To Fix Remote Access, CyberArk Alero Ditches Passwords and VPNs

Michael York Reading, PA

In this Spotlight edition of The Security Ledger Podcast, sponsored by CyberArk*, we interview serial entrepreneur Gil Rapaport about his latest creation: Alero, a new remote authentication tool that promises to fix remote vendor access by doing away with passwords…and agents…and VPNs. If that sounds like a tall order, check out our podcast to…Read the whole entry… » Related StoriesResearcher warns DevOps Security is Back to the FutureSpotlight: as Attacks Mount, how to secure the Industrial InternetRobot Account Apocalypse: RPA Risk Exploding with Adoption …

Researcher warns DevOps Security is Back to the Future

Michael York Reading, PA

The deployment of DevOps tools and platforms at many organizations recalls the bad old days of the 1990s, with lax control of authentication, loose configuration and scant attention to security, experts warn. The post Researcher warns DevOps Security is Back to the Future appeared first on The Security Ledger. Related StoriesOpinion: We need a way to talk about Cyber Physical RiskBreathe Deeply: DHS warns of Flaw in Hospital Anesthesia MachinesBreath Deeply: DHS warns of Flaw in Hospital Anesthesia Machines …

Robot Account Apocalypse: RPA Risk Exploding with Adoption

Michael York Reading, PA

Robotic Process Automation is taking over mundane tasks in the workplace. But those bots may pose a serious security risk, according to researchers from the firm CyberArk. Robotic Process Automation (RPA) may be the Holy Grail for enterprises these days, but all those bots pose a serious risk to enterprise security, according to research by the…Read the whole entry… »Related StoriesTaking the Long View of Breach FalloutPodcast Episode 135: The Future of Passwords with Google Account Security Chief Guemmy KimEU calls for End to Default Passwords on Internet of Things …

Opinion: We need a way to talk about Cyber Physical Risk

Michael York Reading, PA

How does a flaw potentially affecting the integrity of printer management application get a “critical” severity rating and one affecting the integrity and operation of anesthesia machines get a “moderate” severity rating? It has to do with our evolving and still immature system of rating (and therefore thinking about) cyber risk. The post…Read the whole entry… »Related StoriesIntroducing Securepairs.org: Fighting Infosec FUD for the Right to RepairEpisode 153: Hacking Anesthesia Machines and Mayors say No to RansomsBreathe Deeply: DHS warns of Flaw in Hospital Anesthesia Machines …

Episode 153: Hacking Anesthesia Machines and Mayors say No to Ransoms

Episode 153: Hacking Anesthesia Machines and Mayors say No to Ransoms

Michael York Reading, PA

In this week’s podcast episode (#153): The researcher who discovered serious remote access security flaws in anesthesia machines by GE says such security holes are common. Also: the US Conference of Mayors voted unanimously to swear off paying ransoms for cyber attacks. But is that a smart idea? We’re joined by Andrew Dolan of the Multi State…Read the whole entry… » Related StoriesDo Cities deserve Federal Disaster Aid after Cyber Attacks?Dark Web Looms Large as Enterprise ThreatPodcast Episode 151: Ransoming the City with Cesar Cerrudo of IOActive …

Breathe Deeply: DHS warns of Flaw in Hospital Anesthesia Machines

Michael York Reading, PA

GE learned of a serious vulnerability affecting two brands of anesthesia machines in October. The company on Tuesday advised customers to take steps to protect them from being remotely tampered with. The post Breathe Deeply: DHS warns of Flaw in Hospital Anesthesia Machines appeared first on The Security Ledger. Related StoriesBreath Deeply: DHS warns of Flaw in Hospital Anesthesia MachinesExpert: Patch Bluekeep Now or Face WannaCry ScenarioForty Year Old GPS Satellites tell us lots about securing the Internet of Things …

Ahead of Black Hat: Fear and Pessimism in Las Vegas

Michael York Reading, PA

A survey of security professionals who have attended Black Hat reveals fears for From the 2020 Election, U.S. infrastructure The post Ahead of Black Hat: Fear and Pessimism in Las Vegas appeared first on The Security Ledger. Related StoriesPodcast Episode 125: Long After The Election Kremlin’s Computational Propaganda Campaign Rolls OnFirm Uncovers Major Cyber-Espionage Campaign Against TelcosRussian Cyber Criminal Named as Source of Massive Collection 1 Data Dump …

Episode 152: What the Silex Malware says about IoT Insecurity and Cloud Security CEO Steve Mullaney on Amazon ReInforce

Episode 152: What the Silex Malware says about IoT Insecurity and Cloud Security CEO Steve Mullaney on Amazon ReInforce

Michael York Reading, PA

In this week’s podcast episode, #152: we talk with Akamai researcher Larry Cashdollar about his discovery of Silex, a new example of IoT killing malware allegedly authored by a 14 year old. Also: Steve Mullaney, the CEO of the cloud security start up Aviatrix joins us to talk about Amazon’s new cloud security conference: Re:Inforce. The post …Read the whole entry… » Related StoriesEpisode 149: How Real is the Huawei Risk?Podcast Episode 151: Ransoming the City with Cesar Cerrudo of IOActiveExpert: Patch Bluekeep Now or Face WannaCry Scenario …

Podcast Episode 151: Ransoming the City with Cesar Cerrudo of IOActive

Podcast Episode 151: Ransoming the City with Cesar Cerrudo of IOActive

Michael York Reading, PA

In this week’s episode, #151: Cesar Cerrudo, the head of research at the firm IOActive joins us to talk about the recent spate of massive ransomware payouts and why municipal government networks are the favorite target of hackers these days. The post Podcast Episode 151: Ransoming the City with Cesar Cerrudo of IOActive appeared first on …Read the whole entry… » Related StoriesEpisode 149: How Real is the Huawei Risk?Expert: Patch Bluekeep Now or Face WannaCry ScenarioDark Web Looms Large as Enterprise Threat …

Firm Uncovers Major Cyber-Espionage Campaign Against Telcos

Michael York Reading, PA

The security firm Cybereason has uncovered a persistent cyber espionage attack on telecommunications companies worldwide to steal data on high-profile users and then spy on them. The post Firm Uncovers Major Cyber-Espionage Campaign Against Telcos appeared first on The Security Ledger. Related StoriesDark Web Looms Large as Enterprise ThreatChinese APT Group, Used Stolen NSA Hacking Tools Before Shadow BrokersEpisode 149: How Real is the Huawei Risk? …

Expert: Patch Bluekeep Now or Face WannaCry Scenario

Michael York Reading, PA

The flaw known as BlueKeep could be as dangerous as EternalBlue, the basis of recent malware like WannaCry, according to a report by BitSight. The post Expert: Patch Bluekeep Now or Face WannaCry Scenario appeared first on The Security Ledger. Related StoriesMicrosoft ‘Bluekeep’ Flaw threatens Medical Devices, IoTDark Web Looms Large as Enterprise ThreatResearchers Hack Aircraft Landing System with $600 Radios …

Attack on Tesla Autopilot highlights Bigger Risk of Insecure Sensors

Michael York Reading, PA

Researchers from the firm Regulus Cyber say that they demonstrated a type of GPS spoofing attack that caused vehicles by Tesla to veer off the road. The impact could be much broader than just Tesla, however. The post Attack on Tesla Autopilot highlights Bigger Risk of Insecure Sensors appeared first on The Security Ledger. Related StoriesHackers Remotely Steer Tesla Model S Using Autopilot SystemForty Year Old GPS Satellites tell us lots about securing the Internet of ThingsDHS Warns That Drones Made in China Could Steal U.S. Data …

Podcast Episode 150: Microsoft’s Tanya Janca on securing Azure and Armor Scientific’s CTO on Life after Passwords

Podcast Episode 150: Microsoft’s Tanya Janca on securing Azure and Armor Scientific’s CTO on Life after Passwords

Michael York Reading, PA

In this week’s episode, #150: Microsoft cloud evangelist Tanya Janca joins us to talk about securing Azure and the challenges of pushing security left. Also: we continue our series on life after passwords as we speak with Nick Buchanan, CTO of Armor Scientific joins us to talk about the imminent demise of the password and what might replace it….Read the whole entry… » Related StoriesPodcast Episode 142: On Supply Chains Diamond-based Identities are foreverEpisode 149: How Real is the Huawei Risk?Forty Year Old GPS Satellites tell us lots about securing the Internet of Things …

Cognitive Bias is the Threat Actor you may never detect

Michael York Reading, PA

Cognitive bias among workers can undermine security work and lead to critical misinterpretations of data, warns Forcepoint X-Labs research scientist, Dr. Margaret Cunningham. The post Cognitive Bias is the Threat Actor you may never detect appeared first on The Security Ledger. Related StoriesDark Web Looms Large as Enterprise ThreatEpisode 148: Joseph Menn on Cult of the Dead Cow also Veracode CEO Sam King on InfoSec’s Leaky Talent PipelineHackers Remotely Steer Tesla Model S Using Autopilot System …

1 2 3 4 5 >»