Sunday, January 21, 2018

infosec quotes - the basics

“... It's not about buying the latest cool tech.  Security is about fundamentals, plain and simple...” says CISO of Lyft

Saturday, January 20, 2018

Infosec quotes - script kiddie botnet

Crazy that almost anybody nowadays can do this with very little technical skill requires.

“... Alex Bessell, 21 ... was convicted ... police raided his home and found that Bessell had seized remote control of at least 9,083 computers, without their owner's permission, to create a massive botnet...”


https://www.scmagazine.com/british-hacker-arrested-for-selling-malware-and-launching-cyberattacks-against-pokemon-google-and-skype/article/738288/ 

Infosec quotes - remote portal

Having 2FA is important on remote portals!

“... gained access to hospital systems by logging in with a third-party vendor's credentials into the Hancock Hospital remote access portal...”


http://www.zdnet.com/article/us-hospital-pays-55000-to-ransomware-operators/ 

Infosec quotes - let the business manage users

@lorettodave Says “...Today, managers approve access requests, and IT implements them without knowing *why* a user needs access. The approach outlined here would help transfer risk ownership back to data/asset owners (and away from IT/InfoSec)...”


https://twitter.com/swiftonsecurity/status/954442160333557762 

Infosec quotes - termed employee access

How confident are you that your termed employee’s accounts are actually disabled ?

“... an ex-employee is suspected of viewing data of 52 New York students from Dec. 30 to Jan. 2...”


http://www.wtva.com/content/news/Breach-at-testing-vendor-exposes-Mississippi-students-data-470207903.html 

Infosec quotes - PoS hunting

Seems like PoS businesses should find ways to be a bit more pro-active hunting and find the intrusions instead of getting told about them.

“... Cybercriminals successfully install RAM-scraping malware onto one or more point-of-sale devices ... The breached business discovers the intrusion only after card issuers spot patterns of payment fraud that traced back to their organization...”


https://www.bankinfosecurity.com/blogs/jasons-deli-hackers-dine-out-on-2-million-payment-cards-p-2584

Infosec quotes - hacked by Wordpress

Should the Wordpress admin page have been accessible to the world ? Should there have been 2FA ? Was the password guessable ?

“... Cyberattackers used valid login details to access Carphone Warehouse's system through an out-of-date version of content platform Wordpress...”


https://www.reuters.com/article/us-britain-carphonewarehouse-fine/britain-fines-carphone-warehouse-400000-pounds-over-data-breach-idUSKBN1EZ11G