# data[].attributes.headline
IoT security breach forces kitchen devices to reject junk food

# data[].attributes.subject
IoT security breach forces kitchen devices to reject junk food

# data[].attributes.body
by Jennifer Crane
In 2015 smart kitchen appliances in the UK were hacked to cause havoc when they detected junk food. Toasters refused to toast anything but whole-grain bread. Fridges would shut off when certain unhealthy items were placed inside. Microwaves were setting food on fire.
This article shows the need for better security on smart devices that would seem to be low targets for security breaches.
While this attack may seem like a funny prank (and I did get a big chuckle out of it), it shows that there can be some real damage caused by these devices being exploited.
The article is a great example of the growing trend of the Internet of Things and the security risks associated with them.

# data[].attributes.attachment_link.title
IoT security breach forces kitchen devices to reject junk food

# data[].attributes.attachment_link.description
Exploited flaw could spread to millions of devices worldwide.

# data[].attributes.headline
What Do Hackers Do With Corporate Security Breaches?

# data[].attributes.subject
What Do Hackers Do With Corporate Security Breaches?

# data[].attributes.body
Jorge Lorenzo

This article was more of a public service announcement that was written by the Identity Theft Resource Center (ITRC). However, I felt that it was still relative to the subject of the padlet posting because it not only talks about what hackers do with your information but also describes ways to try to prevent these attacks.

The most common ways of people being subject to cyber attacks, from what I read online, is from businesses being hacked in their POS systems. The article states that you should take extra precautions in reading your bank statements to make sure any unauthorized purchases were made with your card. More importantly, it wanted to make people understand that it's not only money at risk but your social security number and whole identity is at risk. So bank with institutions that have a good track record in fighting these sorts of things.

# data[].attributes.attachment_link.readable_text
Corporate security breaches seem to make news headlines almost daily. Companies like Target, Sally Beauty, eBay, and more have recently been the victims of large-scale security breaches that resulted in millions of customers' personally identifiable information being stolen. That information is usually credit card information-data which is easily and immediately profitable-but can also include names, addresses, emails, Social Security numbers, and more.

In the case of this month's PF Chang's security breach in which millions of credit card numbers were stolen, the company's corporate headquarters wasn't even aware of the hacking event until it was brought to their attention that the credit card numbers were now for sale on a website that specializes in this kind of crime. A site that authorities believe may be based out of Russia is selling entire batches of card numbers to eager thieves, and one of the unifying factors in all of the cards is that they were used in a PF Chang's restaurant location between March and May of this year.

Before you go check out the site to see if your card is listed...don't. First of all, you won't see any credit card information without signing up as one of their underhanded customers and paying for card information. But even going to the site could open you up to malware that infects your computer and retrieves even more of your data.

But what do hackers actually do with the information they steal? They sell it to their own customers. Their customers pay that website for information such as your credit card number, then turn around and use your card number for either online purchases or by attaching your data to the magnetic stripe on the back of a blank card. They can even sell these replicas of your credit card and turn a quick profit.

This is yet another case of corporate theft in which millions of victims did nothing wrong but were still subjected to potential identity theft and financial fraud. Short of never using a credit card or debit card, there isn't a lot that consumers can do to prevent this kind of breach. However, it is certainly an example of the kinds of diligence that consumers must practice in order to protect themselves as much as possible.

First is to always read your credit card statements carefully, looking for any unauthorized charges or suspicious activity. You can also sign up for alerts from your credit card company, which will send you an email or text message any time a charge is made without your card being present. Also, choosing to do business with credit card companies who have a proven track record of watching their customers' accounts for this kind of problem is a good idea.

This kind of awareness can help minimize the damage from a security breach and give you all of the necessary paperwork to file a police report and clear this up with your credit card company. Remember to take all news of a breach seriously, and treat even the hint that your information was compromised as a serious issue.

If you found this information helpful, you may want to consider taking part in the Identity Theft Resource Center's Anyone3 fundraising campaign. For more information or to donate please visit http://www.idtheftcenter.org/anyone-3.

# data[].attributes.attachment_link.title
What Do Hackers Do with Corporate Security Breaches? | Data Breaches | Articles | ID Theft Blog

# data[].attributes.attachment_link.description
Corporate security breaches seem to make news headlines almost daily. Companies like Target, Sally Beauty, eBay, and more have recently been the victims of large-scale security breaches that resulted in millions of customers' personally identifiable information being stolen. That information is usually credit card information-data which is easily and immediately profitable-but can also include names, addresses, emails, Social Security numbers, and more.

# data[].attributes.headline
Home Depot left customers unprotected personal data online

# data[].attributes.subject
Home Depot left customers unprotected personal data online

# data[].attributes.body
Cierra Hodge

The article I decided to pick was one that I'm familiar with. I picked this article because everyone is aware of this happening or was happening. Home depot was hacked in 2014 by a group using vendor data to get access to the customer data servers. The hackers took 56 million customers credit card information. Recently the company had a website that was unprotected that stored photos of home improvement jobs and 13 excel sheets filled with customer data.

This article relates to this class because it teaches us about how not securing data can cause ripple effects. Companies have to be extra cautious when creation website domains. Companies big or small should be careful when putting customers information in the system because anyone could get a hold of them.
https://www.engadget.com/2017/04/28/home-depot-left-customers-unprotected-personal-data-online/

# data[].attributes.body
Erica Noye

I went through and read a couple different articles, but nothing caught my attention quite like this article. When you click on the link, a bunch of different colored bubbles will appear on the screen. Each bubble has a different store name, bank name, internet site, such as Target, JP Morgan Chase, Ebay, you name it and it's there! When you click on a bubble, it gives you a brief summary about different breaches that have occurred within that business. I never would have thought all of those companies would've had something like this happen, and I found it very interesting to go through and read about them all.

This relates to what we have been learning by reimbursing the fact that there are hackers everywhere and no one is ever really safe. It just goes to show that no matter how big the company or how much money the company has, security will always be a problem.
http://www.informationisbeautiful.net/visualizations/worlds-biggest-data-breaches-hacks/

# data[].attributes.headline
Cost of data breaches hits $4 million on average: IBM

# data[].attributes.subject
Cost of data breaches hits $4 million on average: IBM

# data[].attributes.body
Giang Nguyen
The article was written by Lovelace, B. talking about the cost of data breaches. As mentioned in the article, the cost of a data breach has increased year after year. For example, in 2016, “the average cost of a data breach hit $4 million, representing a 29 percent increase since 2013.” And that “cybersecurity incidents continue to grow I both volume and sophistication.” The reason why it costs more for each data breach now is that the process of responding to a breach is extremely complex and time consuming.

How is this article related to our lecture? Since we are studying about information security, and the fact that the data gets hacked happens every single day. Corporates should do something, or have certain plans to deal with a data breach as soon as they can to prevent the expense from increasing, and to protect their clients’ information.

# data[].attributes.attachment_link.readable_text
Scott Eells | Bloomberg | Getty Images

Getting hacked is getting really expensive.

The average cost of a data breach hit $4 million, representing a 29 percent increase since 2013, according to IBM Security, which release a report on the topic Wednesday.

That's approximately $158 for every lost or stolen record. In highly regulated industries like healthcare, the cost of a breach can be as much as $355 per record, $100 more than in 2013, the report said.

"Cybersecurity incidents continue to grow in both volume and sophistication," Amanda Carl, IBM's corporate communications officer wrote in the report, "with 64 percent more security incidents reported in 2015 than in 2014."

The current process of responding to a breach is extremely complex and time consuming if not properly planned for, the report said.

The average time to identify a breach in the study was 201 days, and the average time to contain a breach was 70 days.

According to the study, leveraging an incident response team was the single biggest factor associated with reducing the cost of a data breach, which saved companies nearly $400,000 on average or $16 per record.

Response activities like incident forensics, communications, legal expenditures and regulatory mandates account for 59 percent of the cost of a data breach. Part of these high costs may be linked to the fact that 70 percent of U.S. security executives report they don't have incident response plans in place, according to the report.

The study also found that companies that had predefined business continuity management (BCM) processes in place found and contained breaches more quickly, discovering breaches 52 days earlier and containing them 36 days faster than companies without BCM.

# data[].attributes.attachment_link.title
Cost of data breaches hits $4 million on average: IBM

# data[].attributes.attachment_link.description
Scott Eells | Bloomberg | Getty Images Getting hacked is getting really expensive. The average cost of a data breach hit $4 million, representing a 29 percent increase since 2013, according to IBM Security, which release a report on the topic Wednesday. That's approximately $158 for every lost or stolen record.

# data[].attributes.body
Morgan Blaine

The article I found was actually quite interesting. It talked about the nine biggest data breaches that the United States has experienced. In the beginning, it briefly explains that cybersecurity is not as safe as we think it is. Many companies, including AshleyMadison, Home Depot, J.P Morgan, Target, have all experienced security breaches. Hundreds of thousands of credit card numbers, debit card numbers, addresses, social security numbers, a large number of things all being stolen.
This article is relevant to what we've learned for one main reason--cybersecurity isn't safe. All the information that you store on the internet, whether it be through your dating app, your Amazon account, all of that could be victim to fraud. You have to be very careful as to what you put online. Any company can fall victim to a hack and you never know what information the hackers may be able to collect regarding you.

# data[].attributes.attachment_link.readable_text
The issue of cybersecurity is once again in the spotlight after user data stolen from affair website AshleyMadison.com was published online Tuesday afternoon, exposing personal information for more than 30 million accounts.

This attack is only the latest in a series of super-sized data breaches that have taken place since the early 2000s. A huge number of private corporations, academic institutions and government agencies all around the globe have been attacked by hackers, according to InformationIsBeautiful.com, a site that collects and distills data into easy-to-read infographics and diagrams.

The Ashley Madison hack proves -- as so many incidents before it did -- that our data is all too often not safe, whether we're building a dating profile or shopping on Amazon. "Most people have no idea how vulnerable we are," Rick Holland, a security analyst at advisory firm Forrester Research, told The Huffington Post's Alexis Fitts this week.

How comforting. With that in mind, check out the list below to learn about the nine biggest data breaches ever.
(Note: This list includes only instances of hackers externally accessing a company's records, not leaks or data dumps from individuals within the company.) Lorenzo Ligato covers technology and Internet culture, and is based in New York. You can contact him at lorenzo.ligato@huffingtonpost.com or on Twitter: @lorenzowrites.

# data[].attributes.attachment_link.description
The issue of cybersecurity is once again in the spotlight after user data stolen from affair website AshleyMadison.com was published online Tuesday afternoon, exposing personal information for more than 30 million accounts. This attack is only the latest in a series of super-sized data breaches that have taken place since the early 2000s.

# data[].attributes.headline
What Do Hackers Do with Corporate Security Breaches?

# data[].attributes.subject
What Do Hackers Do with Corporate Security Breaches?

# data[].attributes.body
Keegan Bailey
Although most people who use digital transactions are aware of the existence and danger of fraud caused by hackers, a large portion of those individuals are unaware as to how the fraudulently attained data is utilized. According to the article, "What Do Hackers Do with Corporate Security Breaches?", hackers create websites to sell credit card information. Then, when one of the website's users purchases said information, that individual may pass it on to others by creating duplicate cards. The article then closes by giving precautions that may prevent fraud, such as looking for odd charges and setting up account alerts.

Despite being already aware of the information presented in this article, I was drawn to it due to an experience from last year relating to credit card fraud. Around Christmas of last year, my parents noticed some suspicious charges on their credit card. Within hours of them realizing that they were victims of fraud, charges were being made from gas stations in Vancouver to high-end hotels in Columbia. This relates to this class, because it is an example of misuse of information systems, resulting in serious financial hardship. Despite initial losses, my parents eventually recovered what was lost and are no longer feeling the effects of the fraud, today.

# data[].attributes.attachment_link.readable_text
Corporate security breaches seem to make news headlines almost daily. Companies like Target, Sally Beauty, eBay, and more have recently been the victims of large-scale security breaches that resulted in millions of customers' personally identifiable information being stolen. That information is usually credit card information-data which is easily and immediately profitable-but can also include names, addresses, emails, Social Security numbers, and more.

In the case of this month's PF Chang's security breach in which millions of credit card numbers were stolen, the company's corporate headquarters wasn't even aware of the hacking event until it was brought to their attention that the credit card numbers were now for sale on a website that specializes in this kind of crime. A site that authorities believe may be based out of Russia is selling entire batches of card numbers to eager thieves, and one of the unifying factors in all of the cards is that they were used in a PF Chang's restaurant location between March and May of this year.

Before you go check out the site to see if your card is listed...don't. First of all, you won't see any credit card information without signing up as one of their underhanded customers and paying for card information. But even going to the site could open you up to malware that infects your computer and retrieves even more of your data.

But what do hackers actually do with the information they steal? They sell it to their own customers. Their customers pay that website for information such as your credit card number, then turn around and use your card number for either online purchases or by attaching your data to the magnetic stripe on the back of a blank card. They can even sell these replicas of your credit card and turn a quick profit.

This is yet another case of corporate theft in which millions of victims did nothing wrong but were still subjected to potential identity theft and financial fraud. Short of never using a credit card or debit card, there isn't a lot that consumers can do to prevent this kind of breach. However, it is certainly an example of the kinds of diligence that consumers must practice in order to protect themselves as much as possible.

First is to always read your credit card statements carefully, looking for any unauthorized charges or suspicious activity. You can also sign up for alerts from your credit card company, which will send you an email or text message any time a charge is made without your card being present. Also, choosing to do business with credit card companies who have a proven track record of watching their customers' accounts for this kind of problem is a good idea.

This kind of awareness can help minimize the damage from a security breach and give you all of the necessary paperwork to file a police report and clear this up with your credit card company. Remember to take all news of a breach seriously, and treat even the hint that your information was compromised as a serious issue.

If you found this information helpful, you may want to consider taking part in the Identity Theft Resource Center's Anyone3 fundraising campaign. For more information or to donate please visit http://www.idtheftcenter.org/anyone-3.

# data[].attributes.attachment_link.title
What Do Hackers Do with Corporate Security Breaches? | Data Breaches | Articles | ID Theft Blog

# data[].attributes.attachment_link.description
Corporate security breaches seem to make news headlines almost daily. Companies like Target, Sally Beauty, eBay, and more have recently been the victims of large-scale security breaches that resulted in millions of customers' personally identifiable information being stolen. That information is usually credit card information-data which is easily and immediately profitable-but can also include names, addresses, emails, Social Security numbers, and more.

# data[].attributes.body
Chassie Moore

This article goes over five huge cybersecurity breaches at some of the largest companies we all know and use. This article talks about businesses such as Wal-Mart, Chase bank and even Target. These companies are huge companies that the majority of us use all of the time, maybe even daily. The article also talks about the breaches that happened there and how they believe these breaches came to happen.

This article relates to what we have been learning lately because it goes over the ways breaches can happen and how it is easy even for large companies to have their information hacked. It also relates to what we are learning now because we are learning about how companies can make their systems stronger and less capable of being hacked and there is obviously a need for that, I think there always will be. People are learning every day new ways to hack into businesses and those businesses are just going to have to be smarter and learn faster how to block those hacks from happening.

# data[].attributes.headline
5 Huge Cybersecurity Breaches At Companies You Know

# data[].attributes.subject
5 Huge Cybersecurity Breaches At Companies You Know

# data[].attributes.body
Shelby Wachner
This article explains how even the biggest corporations can have hackers slip through there securities. They say in corporate history the biggest cyber attack was when J.P. Morgan Chase had their information compromised and 76 million households were affected. The article then states that even companies that we use everyday have been compromised and you may not even know it. A big one discussed was Wal-Mart, and the hackers received the information from the cash registers, but somehow it was not required that this information be shared to the public. With other companies such as Home Depot and Neiman Marcus, hackers were able to get away with credit card information. It took months before these companies realized what had happened and how to get it under control. The Apple company is one where hackers were able to get personal information based off of the iCloud and then put private information out for the public to view. Target was also hacked and affected 110 million consumers, which costed the company up to $148 million because of the hacking. This article goes to show that hacking can be done and used in so many ways and that it is happening all around us. We have no way of stopping it so it's up to us to only put out the information that we would want the world to see.

# data[].attributes.attachment_link.readable_text
Let's face it, it's been a scary year in data security for companies and their customers alike. Hackers have been slipping through corporate computer defenses like they're Swiss cheese.

On Thursday, J.P. Morgan Chase (jpm) said that a cyber attack over the summer may have compromised information about 76 million households. That included customer names, addresses, phone numbers and email contact information. In addition, the breach affected about seven million of J.P. Morgan's small businesses customers. Overall, it may have been the biggest cyber attack in corporate history.

Here's a look at some of the biggest breaches at some top companies.

Even Walmart, the top company in this year's Fortune 500 list, hasn't been immune to cybersecurity breaches. According to an investigation by Wired in 2009, hackers broke into the computer system used by the company's (wmt) development team to steal information from cash registers. That data then found its way onto a computer in Eastern Europe.

Unlike other more recent breaches, Wal-Mart was not required to discuss the breach publicly, according to Wired, because the company called it an "internal issue."

In 2009, Wal-Mart's Chief Privacy Officer said the company was doing its best to "segregate the data, to make separate networks" and to "encrypt it fully" to safeguard from future data hacks.

Photograph by Kevork Djansezian-Getty Images

Home Depot (hd) may be your first stop for home improvement needs. But earlier this year, it fell victim to cyberthieves who stole up to 60 million card numbers. The attacks went on for five months before they were discovered. In September, the company said that anyone who used a credit card to shop in the U.S. or Canada over a six month period earlier this year could have been a victim.

At the time, Home Depot CEO Frank Blake called security a "major issue" and tried to reassure customers by saying the retailer had bolstered its lines of defense.

ALBANY, CA - MAY 15: A shopping cart stands in the parking lot of a Target store May 15, 2006 in Albany, California. Target announced a 12 percent rise in profit in its quarterly earnings report, falling short of market expectations. Target stock closed at $50.02, down $2.19. (Photo by Justin Sullivan/Getty Images) Photograph by Justin Sullivan-Getty Images

During last year's holiday season, there was little to cheer about for Target (tgt) shoppers. That's because of a massive security breach in which hackers accessed personal information about as many as 110 million consumers. The aftershocks are still reverberating for Target nearly a year later. In August, Target said the costs associated with the hacking added up to $148 million.

Photo by Spencer Platt-Getty Images

In one of the tech industry's racier scandals of 2014, hackers broke into the iCloud accounts of a number of Hollywood celebrities and made off with nude photos. Celebrities targeted included Jennifer Lawrence of "Hunger Games" fame, model Kate Upton and actress Kirsten Dunst. At the time, Apple (aapl) released a statement saying the breach wasn't system-wide, but rather due to specifically targeting the celebrity accounts. "None of the cases we have investigated has resulted from any breach in any of Apple's systems including iCloud or Find my iPhone," according to a statement. The timing, however, wasn't the best for the company, with its announcement of the new iPhone 6 phones slated for a few weeks later.

Photograph by Joe Raedle-Getty Images

Retailer Neiman Marcus suffered a cyber attack in February in which they culprits accessed the company's customer credit card records. In rifling through the database, the hackers set off 60,000 alerts that notified the retailer of questionable activity. But staff didn't pay much attention. For eight months, the hackers remained undetected and able to access information from cash registers, according to a Businessweek investigation. Originally, Neiman Marcus believed about 1.1 million customer cards were in danger. But the most recent estimate is 350,000, with about 9,000 cards used fraudulently, according to the company.

# data[].attributes.attachment_link.title
5 huge cybersecurity breaches at big companies

# data[].attributes.attachment_link.description
Let's face it, it's been a scary year in data security for companies and their customers alike. Hackers have been slipping through corporate computer defenses like they're Swiss cheese. On Thursday, J.P. Morgan Chase (jpm) said that a cyber attack over the summer may have compromised information about 76 million households.

# data[].attributes.headline
The 10 biggest hacks, breaches, and security stories of 2016

# data[].attributes.subject
The 10 biggest hacks, breaches, and security stories of 2016

# data[].attributes.body
Alexandra Brown
This article discusses the 10 largest hacks, breaches, and security stories of 2016. It goes over the Yahoo!, Ransomware, Dyn DDos, when Apple stoped patching QuickTime, credit card security measures, the Democratic National Committee (DNC) hack, when Russia tried to hack the United State's election, the San Bernardino iPhone, the NSA hacking, and the Society for Worldwide Interbank Financial banks (SWIFT) hack.

All of these stories correlate with what we've been learning because it teaches us that the technology that we use, and may even trust, isn't as protected/secure than we may think.

# data[].attributes.attachment_link.readable_text
From hacks at Yahoo and the DNC to the rise of IoT botnets, these are the biggest security stories of 2016.

It's been a long, depressing, breach-filled year in the world of computer security.

Yahoo broke the record for allowing the largest hack in history-twice. Millions of zombified webcams and DVRs took down the Internet for users in the United States. Russia was accused of "hacking the vote," and a new type of malware earned a tidy profit extorting unsuspecting users for Bitcoin. What was it John Oliver said about 2016 (NSFW), again?

Hackers turn Yahoo into yahoos

In September, Yahoo shocked the world when it revealed that at least 500 million user accounts had been breached. At the time, the breach was believed to be the largest theft of personal data from a major technology company ever. Making matters even worse, Yahoo later disclosed that the hack itself had happened in 2014 but only came to light in 2016, so the attackers had access to user information for years.

But it turns out that was just the warm-up. In mid-December, Yahoo dropped the jaw-dropping revelation that a separate hack occurred around August 2013 that leaked the data of one billion users-double the record-breaking hack from September. This is why strong, unique passwords for every site and service you use is important, people.

The one threat that defined 2016 more than any other has to be ransomware. This nasty malware encrypts your files and then holds them hostage, demanding payment-usually in semi-anonymous Bitcoin-before decrypting your stuff. Many, many, many ransomware variants made headlines in 2016, including Locky, DMA Locker, Surprise, and an amateurish (yet effective) version called Ranscam that takes your money but deletes your files anyway. There was even mobile ransomware, and in July researchers found a version of Locky that could operate offline to be even more effective. In August, a study by Malwarebytes said ransomware was so common it was hitting nearly half of all U.S. businesses.

In September, U.S. investigators looked into the possibility that Russia was trying to undermine or disrupt the election. Toward the end of 2016, the Central Intelligence Agency and other American intelligence agencies concluded with "high confidence" that Russia tried to covertly influence the election. The concern wasn't over hacking voting machines but that Russian hackers had infiltrated the computer systems of both major U.S. political parties, possibly with direct involvement from Russian President Vladimir Putin.

As of mid-December, the Office of the Director of National Intelligence (ODNI)-the head of the American intelligence community-had not endorsed that assessment, according to Reuters.

The San Bernardino iPhone

In December 2015, Islamic extremists committed a terrorist attack in San Bernardino, California, killing 14 people and seriously injuring another 22. The couple later died in a gunfight with police.

In 2016, an iPhone belonging to one of the terrorists took center stage because it used Apple's built-in security tools to protect the device from unauthorized access. The FBI wanted Apple to create special software to allow investigators to get into the phone. Apple refused, arguing the FBI wanted the company to, in effect, "custom-build malware" to undermine the company's own security features.

The FBI eventually dropped its request to Apple after a security firm was able to help investigatorsaccess data on the phone. The case's legacy lives on as lawmakers consider what kind of help companies with encryption-capable products should provide to law enforcement.

In August, an anonymous hacker group called the Shadow Brokers said it had obtained hacking tools from the Equation Group, a cyber-espionage team linked to the National Security Agency. During the infiltration the Shadow Brokers grabbed sophisticated exploits that were reportedly used by the NSA. The tools were capable of infecting device firmware and remaining on an infected system even after a complete operating system refresh. After revealing a portion of their treasure trove, the Shadow Brokers attempted to sell other hacking tools they'd obtained, but as of early October the sale had generated little interest.

It started as a single $81 million malware attack against a Bangladeshi bank targeting the SWIFT (Society for Worldwide Interbank Financial Telecommunications) transaction software. By late May, however, up to a dozen banks around the world were investigating potential hacks against the SWIFT system. In July, SWIFT was seeking help from outside security professionals to control the widening hacking epidemic.

# data[].attributes.attachment_link.title
The 10 biggest hacks, breaches, and security stories of 2016

# data[].attributes.attachment_link.description
From hacks at Yahoo and the DNC to the rise of IoT botnets, these are the biggest security stories of 2016.

# data[].attributes.headline
Once More Unto the [Corporate Data] Breach, Dear Friend. Sarah Moore-Ar-Rasheed

# data[].attributes.subject
Once More Unto the [Corporate Data] Breach, Dear Friend. Sarah Moore-Ar-Rasheed

# data[].attributes.body
“There are only two kinds of companies: those that have been hacked and those that will be” Robert Mueller, Former FBI Director.  This 2012 quote, set the tone of the entire article.  There is no company that is invincible to this threat.  Big companies like JP Morgan Chase and Anthem, which have entire departments dedicated to the prevention of security breaches has recently experienced breaches that compromised a total of over 150 million breached records.  In the article, Once More Unto the [Corporate Data] Breach, Dear Friends Adam Foresman compares data breaches before and after the Private Securities Litigation Reform Act of 1995 (PSLRA).  Customers who are victims of data breaches, what rights do they have?  According to Foresman, data breaches are costly for many corporations.  However, when brought to court the majority of case are dismissed because: “the plaintiffs did not establish an injury in-fact or the plaintiffs did not adequately quantify or prove recoverable damages (i.e. a legally cognizable injury)” (p.347).

This article goes in depth about the financial repercussions for both business and individual consumers as a result of data breaches.  Some data breaches involve thousands and sometimes millions of people, if it were easy to when a suit as a result of a data breach many companies would be nonexistent because of the number of victims associated with data breaches.  In the Wiley, text the financial consequences of data breaches are discussed with respect to corporations or business.  This article additionally, looks at the effects on consumers.

# data[].attributes.attachment_link.title
Once More Unto the Corporate Data Breach, Dear Friends

# data[].attributes.headline
The Best Cybersecurity Investment You Can Make Is Better Training

# data[].attributes.subject
The Best Cybersecurity Investment You Can Make Is Better Training

# data[].attributes.body
Lauren Helwig
HBR’s article on corporate “cyber threats” emphasizes the critical role of people as “first and last line of defense” against breaches. The authors define organizational “people” as employees within the organization as well as its “outsiders”–contractors, consultants, and vendors–as key contributors to corporate security. The article identifies corporate leaders as the main bottleneck in effective security strategies. Leaders tend to throw money at technological solutions and neglect the more important work of educating all organizational participants on security matters.

The article reinforces the course text’s argument that (mostly inadvertent) human error is the weak link in corporate security strategies. It goes further in this claim by suggesting that a new organizational model—the “agile enterprise” —is needed to prevent and minimize attacks. Such an enterprise understands each layer of its organization as part of a coordinated security solution, creating a human-centered “neural safety network” to bolster technical solutions.

https://hbr.org/2017/05/the-best-cybersecurity-investment-you-can-make-is-better-training

# data[].attributes.headline
5 Huge Cyber Security Breaches at Companies you Know- Adrianna Razo

# data[].attributes.subject
5 Huge Cyber Security Breaches at Companies you Know- Adrianna Razo

# data[].attributes.body
The article starts out by explaining the threat of cybersecurity breaches and how they have been growing more recently. Then they go into detail to look at 5 of the biggest security breaches. First is Walmart where hackers broke into the computer system of the companies development team to steal information from cash registers. Second, was home depot who fell victim to cybercriminals who stole over 60 million of their customers' credit card numbers. Third, a massive security breach at target in which hackers accessed personal information of about 110 million customers. Fourth, Apple's ICloud accounts were broken into, specifically celebrities whose personal information and even photos were leaked. Lastly, the retailer Neiman Marcus suffered a security attack last February where hackers were undetected from some time and were stealing customer information from the cash registers.

This article helps me to better understand the importance of security in any business because cyber attacks like this can cause companies to lose customers and it could all be prevented with better use of security.

# data[].attributes.attachment_link.readable_text
Let's face it, it's been a scary year in data security for companies and their customers alike. Hackers have been slipping through corporate computer defenses like they're Swiss cheese.

On Thursday, J.P. Morgan Chase (jpm) said that a cyber attack over the summer may have compromised information about 76 million households. That included customer names, addresses, phone numbers and email contact information. In addition, the breach affected about seven million of J.P. Morgan's small businesses customers. Overall, it may have been the biggest cyber attack in corporate history.

Here's a look at some of the biggest breaches at some top companies.

Even Walmart, the top company in this year's Fortune 500 list, hasn't been immune to cybersecurity breaches. According to an investigation by Wired in 2009, hackers broke into the computer system used by the company's (wmt) development team to steal information from cash registers. That data then found its way onto a computer in Eastern Europe.

Unlike other more recent breaches, Wal-Mart was not required to discuss the breach publicly, according to Wired, because the company called it an "internal issue."

In 2009, Wal-Mart's Chief Privacy Officer said the company was doing its best to "segregate the data, to make separate networks" and to "encrypt it fully" to safeguard from future data hacks.

Photograph by Kevork Djansezian-Getty Images

Home Depot (hd) may be your first stop for home improvement needs. But earlier this year, it fell victim to cyberthieves who stole up to 60 million card numbers. The attacks went on for five months before they were discovered. In September, the company said that anyone who used a credit card to shop in the U.S. or Canada over a six month period earlier this year could have been a victim.

At the time, Home Depot CEO Frank Blake called security a "major issue" and tried to reassure customers by saying the retailer had bolstered its lines of defense.

ALBANY, CA - MAY 15: A shopping cart stands in the parking lot of a Target store May 15, 2006 in Albany, California. Target announced a 12 percent rise in profit in its quarterly earnings report, falling short of market expectations. Target stock closed at $50.02, down $2.19. (Photo by Justin Sullivan/Getty Images) Photograph by Justin Sullivan-Getty Images

During last year's holiday season, there was little to cheer about for Target (tgt) shoppers. That's because of a massive security breach in which hackers accessed personal information about as many as 110 million consumers. The aftershocks are still reverberating for Target nearly a year later. In August, Target said the costs associated with the hacking added up to $148 million.

Photo by Spencer Platt-Getty Images

In one of the tech industry's racier scandals of 2014, hackers broke into the iCloud accounts of a number of Hollywood celebrities and made off with nude photos. Celebrities targeted included Jennifer Lawrence of "Hunger Games" fame, model Kate Upton and actress Kirsten Dunst. At the time, Apple (aapl) released a statement saying the breach wasn't system-wide, but rather due to specifically targeting the celebrity accounts. "None of the cases we have investigated has resulted from any breach in any of Apple's systems including iCloud or Find my iPhone," according to a statement. The timing, however, wasn't the best for the company, with its announcement of the new iPhone 6 phones slated for a few weeks later.

Photograph by Joe Raedle-Getty Images

Retailer Neiman Marcus suffered a cyber attack in February in which they culprits accessed the company's customer credit card records. In rifling through the database, the hackers set off 60,000 alerts that notified the retailer of questionable activity. But staff didn't pay much attention. For eight months, the hackers remained undetected and able to access information from cash registers, according to a Businessweek investigation. Originally, Neiman Marcus believed about 1.1 million customer cards were in danger. But the most recent estimate is 350,000, with about 9,000 cards used fraudulently, according to the company.

# data[].attributes.attachment_link.title
5 huge cybersecurity breaches at big companies

# data[].attributes.attachment_link.description
Let's face it, it's been a scary year in data security for companies and their customers alike. Hackers have been slipping through corporate computer defenses like they're Swiss cheese. On Thursday, J.P. Morgan Chase (jpm) said that a cyber attack over the summer may have compromised information about 76 million households.

# data[].attributes.body
Maryanne Carter
http://www.bankrate.com/finance/banking/us-data-breaches-1.aspx
Even the biggest companies can be comprimised by hackers and cyber attacks. In 2015 the Ponemon Institute and Symantec Corporation did a study that showed 47% of all data breaches are either malicious or criminal acts. in 2015, Anthem had 80 million patient and employee records compromised by a cyber attack on their IT system. Ashley Madison was hacked in 2015 which resulted in 33 million user accounts being made public. Ebay was the victim of a cyber attack in 2014 that resulted in 145 million customer accounts with possible names, passwords, emails, physical addresses, phone numbers and date of births being accessed. JP Morgan Chase had 76 million households and 7 million small business information accessed through a cyber attack in 2014. Home Depot was also a victim in 2014 where hackers obtained information of 56 million credit card accounts and 53 million customer emails, through a stolen vender account. Sony was also a victim in 2014 of a cyber attack where 3000 current and former employee information was compromised. In 2013 Target was also a victim where millions of credit and debit card account numbers were accessed. Other companies that have been a victim were Global Payments INC., Tricare (A military Insurance Provider) Citibank, and Heartland.
This article discuses about cyber attacks, information not being encrypted, and hackers. It pertains to what we have already learned because it discusses how the company is affected by the information being accessed. Where as with the Tricare mishap is discusses how some information can be stolen right out from under your nose and if it is not encrypted the thief can gain access to the Information. I was actually apart of the Tricare information link because i was a military family member with Tricare. I have actually been a victim 2 times through Tricare the first time I was in High School because of my Active Duty Father. It just goes to show you that no one is safe when it comes to being hacked.

# data[].attributes.body
Arthur Denys
80 million people including patients and doctors got their information hacked fro, the healthcare group. Information such as social security numbers, addresses and income Information. This could end up costing Anthem millions and greatly hurts their image.

This relates greatly to what we are learning about because cyber security is very important for both customers as well as businesses. businesses can lose alot  of money when their customers' information gets leaked. As a result, companies lose business and people get their information hacked which could lead to financial and personal life issues as well.

# data[].attributes.headline
GOP Data Firm Accidentally Leaks Personal Details of Nearly 200 Million American Voters.

# data[].attributes.subject
GOP Data Firm Accidentally Leaks Personal Details of Nearly 200 Million American Voters.

# data[].attributes.body
Eric McGuigan

Gizmodo June 19, 2017

Political data that was being stored on a publically-accessible Amazon server was exposed this month. Deep Root Analytics, the conservative data firm that targets audiences for political ads, confirmed to Gizmodo that they owned the data.

According to Chris Vickery of UpGuard, more than a terabyte of data was stored on a cloud server without the protection of a password and could be accessed by anyone who found the URL.

The Republican National Committee paid Deep Root $983,000 last year, according to Federal Election Commission reports.

Vickery used the same process of searching publicly accessible data on Amazon's cloud service last month and found sensitive files tied to a US Defense Department project that was exposed by an employee of a top defense contractor.

https://gizmodo.com/gop-data-firm-accidentally-leaks-personal-details-of-ne-1796211612

# data[].attributes.headline
Virgin Media urges 800,000 customers to reset passwords after router security flaws. Rhonda Schaffer

# data[].attributes.subject
Virgin Media urges 800,000 customers to reset passwords after router security flaws. Rhonda Schaffer

# data[].attributes.body
This Wired magazine article talks about the data hacks discovered in 2017. The types of data compromised were names, emails, address, phone numbers and bank account details. The magazine is keeping an on-going log of all data breaches this year along with how they were breached and how many customers were affected. Most recently was the Virgin Media attack that left 800,000 customers vulnerable, the Super Hub 2 router had been using insecure default passwords. These passwords consisted of eight lower case letters.

While reading through all of the data breaches it is obvious that no one is immune.  The attacks are on every type of business from PlayStation to Chipotle. The way that the data was breached were different as well. Malware, spam, server attacks and even weak passwords. No one is safe from a security breech, no matter the size of the company. We trust the company’s we deal with to keep us protected and that doesn’t always happen.

http://www.wired.co.uk/article/hacks-data-breaches-2017

# data[].attributes.body
David Wardle

Security Breaches are everywhere lately, so I decided to limit my focus to one field the medical field, where there is a lot of information being stolen, breached, lost, taken, etc.  This is important because all people's medical information is private, and certain individual's medical information could be used against them, or allow hackers to profit, off of well off individuals who do not want their personal information leaked.

This article examines the Personal Health Information (PHI) of over 5,000 medicaid patients from 2014-2015.  This breach was due to the main medical companies using faulty online services to create the forms for patients to fill in and store.  These forms were able to be hacked and accessed through the security breach.  Once the breach was investigated, all forms were deleted, and the companies went on to use a better online service for forms with better encryption.

# data[].attributes.attachment_link.readable_text
Recent potential healthcare data breaches include an online security breach and three thefts involving stolen medical devices.

Source: Thinkstock

- On April 7, 2017, officials from the Mississippi Division of Medicaid (DOM) discovered evidence of a potential online security breach exposing the PHI of approximately 5,220 patients.

An investigation into the incident revealed the potential PHI exposure lasted between May 2, 2014 and April 10, 2017, and included patient names, dates of birth, addresses, phone numbers, email addresses, admission and enrollment dates, health insurer names, conditions, Social Security numbers, and Medicare and Medicaid identification numbers.

The security breach occurred as a result of a problem with the online service the agency uses to create forms for its website. Information contained in online forms submitted to the website were not transmitted securely resulting in the possible exposure of any information in the forms.

However, investigators determined emails and accompanying information were stored securely once received.

According to DOM, the incident had no effect on any individual's eligibility determination or Medicaid benefits.

READ MORE: PHI Security Breach Potentially Affects 2K ND Medicaid Patients

DOM has since removed all online forms from its website and no longer uses the online form service involved in the incident.

DOM added it is strengthening existing technological safeguards and revising policies and procedures related to privacy and security regulations to avoid similar incidents in the future.

There is no reason to believe any information was compromised during the occurrence, DOM maintained, but the agency is informing individuals as required.

"It is highly unlikely that the data was compromised, since the typical Internet user would not know how to capture it during transmission," said DOM security officer Keith Robinson in a public statement. "The data storage was secured both at the originating source and the destination [DOM], reducing the risk of the data being compromised."

To date, the agency has no evidence to suggest unauthorized use or access of PHI has occurred as a result of the incident.

READ MORE: 5.5K Patients Affected in Children's Mercy Security Incident
Connecticut health organization breach potentially impacts over 1K
Sound Community Services, Inc. recently informed current and former patients of a security incident involving the unauthorized access of a Sound employee email account.

Sound found evidence of suspicious activity in an employee email account on January 13, 2017 and immediately launched an investigation into the incident. The provider determined that an unauthorized individual had gained access to the account on or around January 12, 2017.

The health organization began notifying potentially impacted individuals of the breach on April 18, 2017.

The information of 1,278 individuals was potentially accessed in the breach, according to the OCR data breach reporting tool.

READ MORE: Unauthorized PHI Access at Coney Island Hospital Impacts 3.4K

Potentially viewed information includes patient name and client numbers. Additionally, referral information relating to one individual may have been accessible to the unauthorized individual.

However, Sound stated no evidence exists at this time suggesting any patient information was accessed or misused in any way.

The organization stated potentially affected individuals can expect to receive further information regarding the incident as well as access to two years of free identity theft protection services.
Medical device stolen from St. Louis medical group
SSM Health Medical Group recently informed all patients who had an electro diagnostic study in Dr. Syed Khader's office of a security breach. The incident occurred at some point between the night of April 12, 2017 and the morning of April 13, 2017.

The breach was discovered when an SSM Health employee noticed a component of an electromyography (EMG) medical device was missing from SSM Health Orthpedics at DePaul Hospital.

The theft was immediately reported to the Bridgeton Police Department and an investigation is currently underway.

According to the OCR data breach reporting tool, 836 patients were potentially impacted in the incident.

SSM officials stated the stolen medical device was used only for patients of Dr. Syed Khader.

Information contained on the device included patient names, dates of birth, medical record numbers, and chief complaints.

"We do not believe you are at risk for identity theft based on the limited information stored on the device," stated SSM officials in a notice issued to potentially impacted patients. "We can assure you that the device did not contain your Social Security number, address, phone number or financial information of any kind. It is likely that the purpose of the theft was to steal the medical device, which resembles a laptop computer, and not health information."

The Missouri health organization stated there currently exists no evidence suggesting the health information contained on the medical device has been accessed or misused in any way.

As a result of the incident, SSM has tightened its security controls through written procedures and further staff training regarding management of patient information.
Medical devices stolen from 2 Southwest Community Health Center sites
On April 8, 2017, Southwest Community Health Center experienced a break in at its Fairfield Avenue location where four desktop computers, one laptop, and other miscellaneous items were stolen.

The health center also fell victim to another break in at a separate location on April 14, 2017, during which two laptops and other miscellaneous items were stolen.

Southwest security alarms were activated in response to the incident and security and law enforcement immediately arrived at the scene.

According to a preliminary investigation, some PHI may have been contained on the local drives or in email accounts locally stored on the devices.

However, health center officials stated there exists no evidence suggesting the individuals that stole the device intend to misuse the information for fraud.

According to the investigation, patient information including names, bank account numbers, Social Security numbers, and medical information such as diagnoses and insurance information may have been included on the stolen devices.

Southwest is issuing advisory notices to all potentially impacted individuals including information regarding how concerned individuals can protect themselves against identity theft and fraud.

Additionally, the health center is providing potentially impacted patients with access to free identity monitoring and restoration services.

Southwest has not revealed how many individuals were potentially affected by the breach.
Hard drive containing patient information stolen from Washington State University
Washington State University (WSU) recently suffered a data breach in which a locked safe containing a hard drive was stolen.

On April 21, 2017, WSU became aware of a theft involving a hard drive used to store back up files from a server. The hard drive belonged to WSU's Social & Economic Sciences Research Center (SESRC).

WSU immediately launched an internal investigation and notified law enforcement of the theft.

Through the investigation, WSU confirmed the stolen hard drive contained personal information from survey participants and has enlisted the help of a computer forensics firm to further assist.

Information contained on the drive included survey participants' names, Social Security numbers, and some personal health information.

Potentially impacted individuals include those who provided data to SESRC, such as members of school districts, community colleges, and other costumers.

WSU is notifying potentially impacted individuals of the breach and offering free credit monitoring and identity theft protection services to concerned individuals.

The WSU statement did not say how many individuals were potentially affected by the incident.

# data[].attributes.attachment_link.title
Online Security Breach Exposes PHI of 5K Medicaid Patients

# data[].attributes.attachment_link.description
Source: Thinkstock - On April 7, 2017, officials from the Mississippi Division of Medicaid (DOM) discovered evidence of a potential online security breach exposing the PHI of approximately 5,220 patients.

# data[].attributes.headline
5 huge cybersecurity breaches at companies you know

# data[].attributes.subject
5 huge cybersecurity breaches at companies you know

# data[].attributes.body
Vendela Hale

This article gives a brief description of 5 major security breaches of major companies. One of the biggest breaches they talked about way with Walmart. It was found that data was developed to seal money from registers. Another major breaches was with Home Depot. During this scandal up to six million card numbers had been stolen. Next on the list is Target, with a breaches so large it accessed over one hundred million customers personal information. In addition it cost $148 million dollars. Next on the list we see Apple and Neiman Marcus two more common places that a lot of people shop with.

This article show just how susceptible companies are to data breaches. The five companies listed about are five major companies that you would think have top security, one is even a technology company. This article helps to put a realistic perspectives of the dangers of data breaches.

# data[].attributes.attachment_link.readable_text
Let's face it, it's been a scary year in data security for companies and their customers alike. Hackers have been slipping through corporate computer defenses like they're Swiss cheese.

On Thursday, J.P. Morgan Chase (jpm) said that a cyber attack over the summer may have compromised information about 76 million households. That included customer names, addresses, phone numbers and email contact information. In addition, the breach affected about seven million of J.P. Morgan's small businesses customers. Overall, it may have been the biggest cyber attack in corporate history.

Here's a look at some of the biggest breaches at some top companies.

Even Walmart, the top company in this year's Fortune 500 list, hasn't been immune to cybersecurity breaches. According to an investigation by Wired in 2009, hackers broke into the computer system used by the company's (wmt) development team to steal information from cash registers. That data then found its way onto a computer in Eastern Europe.

Unlike other more recent breaches, Wal-Mart was not required to discuss the breach publicly, according to Wired, because the company called it an "internal issue."

In 2009, Wal-Mart's Chief Privacy Officer said the company was doing its best to "segregate the data, to make separate networks" and to "encrypt it fully" to safeguard from future data hacks.

Photograph by Kevork Djansezian-Getty Images

Home Depot (hd) may be your first stop for home improvement needs. But earlier this year, it fell victim to cyberthieves who stole up to 60 million card numbers. The attacks went on for five months before they were discovered. In September, the company said that anyone who used a credit card to shop in the U.S. or Canada over a six month period earlier this year could have been a victim.

At the time, Home Depot CEO Frank Blake called security a "major issue" and tried to reassure customers by saying the retailer had bolstered its lines of defense.

ALBANY, CA - MAY 15: A shopping cart stands in the parking lot of a Target store May 15, 2006 in Albany, California. Target announced a 12 percent rise in profit in its quarterly earnings report, falling short of market expectations. Target stock closed at $50.02, down $2.19. (Photo by Justin Sullivan/Getty Images) Photograph by Justin Sullivan-Getty Images

During last year's holiday season, there was little to cheer about for Target (tgt) shoppers. That's because of a massive security breach in which hackers accessed personal information about as many as 110 million consumers. The aftershocks are still reverberating for Target nearly a year later. In August, Target said the costs associated with the hacking added up to $148 million.

Photo by Spencer Platt-Getty Images

In one of the tech industry's racier scandals of 2014, hackers broke into the iCloud accounts of a number of Hollywood celebrities and made off with nude photos. Celebrities targeted included Jennifer Lawrence of "Hunger Games" fame, model Kate Upton and actress Kirsten Dunst. At the time, Apple (aapl) released a statement saying the breach wasn't system-wide, but rather due to specifically targeting the celebrity accounts. "None of the cases we have investigated has resulted from any breach in any of Apple's systems including iCloud or Find my iPhone," according to a statement. The timing, however, wasn't the best for the company, with its announcement of the new iPhone 6 phones slated for a few weeks later.

Photograph by Joe Raedle-Getty Images

Retailer Neiman Marcus suffered a cyber attack in February in which they culprits accessed the company's customer credit card records. In rifling through the database, the hackers set off 60,000 alerts that notified the retailer of questionable activity. But staff didn't pay much attention. For eight months, the hackers remained undetected and able to access information from cash registers, according to a Businessweek investigation. Originally, Neiman Marcus believed about 1.1 million customer cards were in danger. But the most recent estimate is 350,000, with about 9,000 cards used fraudulently, according to the company.

# data[].attributes.attachment_link.title
5 huge cybersecurity breaches at big companies

# data[].attributes.attachment_link.description
Let's face it, it's been a scary year in data security for companies and their customers alike. Hackers have been slipping through corporate computer defenses like they're Swiss cheese. On Thursday, J.P. Morgan Chase (jpm) said that a cyber attack over the summer may have compromised information about 76 million households.

# data[].attributes.headline
The Biggest Cybersecurity Threats are Inside Your Company

# data[].attributes.subject
The Biggest Cybersecurity Threats are Inside Your Company

# data[].attributes.body
Michelle Harrigan
This article describes the ways that employees inside of a company can intentionally or unintentionally cause a security breach. The article states that in the 2016 Cyber Security Intelligence Index, IBM found that 60% of all attacks were carried out by insiders. IBM also found that the the top industries being attacked are manufacturing, health care, and financial services because of their personal data, intellectual property, and financial assets.
The article goes on to cover the primary types of insider risks. The first is human error. Examples include misaddressed emails or stolen electronic devices. The second type is malicious employees that may have a vendetta against the organization. They steal competitive information and sell data. The third type of insider risk is identity theft. This includes cyber criminals that hack the identity of an employee to gain access to sensitive company information. Since these attacks are coming from trusted employees on the inside, they are less likely to be detected.
The article goes on to suggest ways in which a corporation can focus their security efforts. Some examples are giving the strongest defenses to the most valuable company assets, closely monitoring employees, enforcing strong standards for employee usernames and passwords, and collecting data on all devices on your network.
This article related to several topics that we studied in chapter 7, the biggest being deliberate threats to information systems, such as identity theft, theft of equipment, sabatoge, and espionage; and also unintentional security threats, which are human errors such as weak passwords, losing electronic devices, and not monitoring unmanaged devices that may be connected to the network.
https://hbr.org/2016/09/the-biggest-cybersecurity-threats-are-inside-your-company

# data[].attributes.headline
Threats: Social Engineering and Malicious Spam Dominate

# data[].attributes.subject
Threats: Social Engineering and Malicious Spam Dominate

# data[].attributes.body
Aubrey Leppek

This Article was written on June 22, 2017, and is based on social engineering attacks. It's explained that criminals are currently focused on the attacks mentioned above and its malware distribution is a threat for the Unit 42 security research group at Palo Alto Networks. It's also explained that exploit toolkits has made it easy for criminals to infect websites and use them to attack website visitors. Several factors are used to explain why the exploit kits are working. First, is smaller attack surface such as Edge, which is a browser surface, because there's less users. Second, is zero-day famine because the best kits historically had to have the greatest number of zero-day flaws. Third, is domain shadowing blocks due to criminals being able to highjack access to a domain management system.
This article helped me comprehend how some criminals are able to access databases and highjack an individual's computer.

# data[].attributes.attachment_link.readable_text
Anti-Malware , Endpoint Security , Ransomware
Exploits Kits, Once Formidable, Continue to Decline

Social engineering attack: Screenshot shows recent tech-support scam page targeting U.S. users. (Source: Malware-Traffic-Analysis.net)

Good news: Exploits kits remain in decline, thanks in large part to concerted efforts to disrupt their efficacy.

See Also: How the New World of Digital Banking is Transforming Fraud Detection

Unfortunately, criminals are focusing instead on social engineering attacks - including tech-support scams - and malicious spam campaigns as malware distribution mechanisms, as noted by Brad Duncan, a threat intelligence analyst for the Unit 42 security research group at Palo Alto Networks, in a Wednesday blog post.

The decline and fall of exploits kits is significant. Such toolkits made it easy for criminals with scant technical skills to infect legitimate websites and use them to launch drive-by attacks at visitors, often via a malicious inline frame - iframe - added to web pages. Exploit kits typically target known vulnerabilities in Internet Explorer as well as outdated and vulnerable browser plug-ins such as Adobe Flash Player, Oracle's Java Plugin Runtime Environment and Microsoft Silverlight.

Several factors appear to be contributing to exploit kits' fall from grace:

Smaller attack surface: Fewer users today run IE or Edge as their browser of choice. In the past, outdated IE - and a host of outdated plug-ins - remained a top attack vector for exploit-kit builders. But such attack toolkits have been much less effective against the likes of Google Chrome, Duncan says, thanks to rapid code-update cycles designed to eliminate older versions with known flaws from users' PCs. Today, nearly half of all browsers are Chrome, compared with IE 11 at 14 percent and Edge at 5 percent, Duncan reports.

Zero-day famine: The best exploit kits, historically speaking, were the ones that had exploits for the greatest number of zero-day flaws, since that would allow attacks to spread as fast and furiously as possible. But no exploit kit has included exploits for a new zero-day flaw for more than a year, say researchers at security firm Proofpoint.

Domain shadowing blocks: Attackers since 2010 have been using what's now referred to as domain shadowing - "compromising existing domains and using their DNS as a piece of attack infrastructure," as defined by William MacArthur, a threat researcher at RiskIQ. By "hijacking access to the domain management system and injecting rogue records alongside the domain holder's own legitimate resolution records," attackers could create malicious pages that look legitimate, thus bypassing many types of security defenses. But Duncan notes that researchers at security firms - including Cisco Talos and RSA - have been working with hosting providers to successfully block many domain-shadowing attacks.

Exploit Kit Graveyard

Cybercrime is a business. As exploit kits' efficacy has decreased, fewer criminals appear to be subscribing to the services, and that's apparently driven many providers out of business. In 2015, for example, once-dominant players such as Sweet Orange and Fiesta vanished. In 2016, Angler and Nuclear closed up shop. And this year, Neutrino has exited the market, with its developers reportedly blaming poor profits.

Exploit kit activity throughout 2016. (Source: Proofpoint)

Whereas exploit kits charge a subscription fee, attackers today can also access an array of free and powerful attack tools, including keyloggers and remote-access Trojans, or RATs. As anti-malware site Bleeping Computer recently reported, many attackers - including Nigerian crime gangs - distribute these attack tools via phishing emails or spam to help them gather information on targets and run lucrative business email compromise scams. One judge in New York state, for example, reported Friday to police that she lost $1 million to a BEC scam.

Attackers Diversify

Some exploit kits remain. But Palo Alto reports that two big cybercrime operations - EITest and pseudo-Darkleech - ceased using Rig exploit kit, one of the dominant players, for distribution, as of April.

Rig exploit kit activity from December 2016 through May 2017. (Source: Palo Alto Networks)

Security researchers say some recent attack campaigns by groups that relied heavily on exploit kits are now trying to trick U.K. and U.S. users into calling a fake tech-support phone number. Victims in other countries may get hit with banking malware or ransomware instead.

Sometimes, such attacks eventually end up using exploit kits. According to "Brad," aka @malware_traffic, the researcher behind Malware-Traffic-Analysis.net, some recent EITest campaigns target U.S. and British victims with tech-support scams, while directing users in other countries to sites infected with Rig, to try and infect their system with Mole ransomware. The Mole variant that's been seen used in attacks - as recently as June 15 - crypto-locks PCs and demands 0.5 bitcoins, currently worth $1,333, from victims for a decryption key.

Anatomy of a recent EITest attack campaign. (Source: @malware_traffic)

The researcher also reports that attackers continue to target Chrome users, in some cases using a fake "font not found" popup that tries to infect a system with Spora ransomware. Such scams typically claim that a font, such as Hoefler Text, must be downloaded.

A fake HoeflerText notification in Google Chrome that leads to malware. (Source: Palo Alto)

The developers behind Rig, meanwhile, continue to experiment with alternate infection mechanisms, including so-called seamless attacks, which make use of deprecated HTML designed to make an iframe look like it's part of a document.

Some recent seamless attacks, according to Cisco Talos, have been serving the venerable Ramnit banking Trojan.

Malvertising Still a Threat

Some malvertising - malicious advertising - campaigns continue to tap exploit kits. One recent ransomware attack that snared several British universities, including University College London, appears to have been distributed via malvertising that led victims to sites infected with the Astrum, aka Stegano, exploit kit. The Proofpoint security researcher known as Kafeine traced the attacks to a malvertising group known as AdGholas.

Another malvertising campaign, discovered earlier this month and potentially tied to the RoughTed operation that's been running for over a year, also led to Rig.

As that suggests, exploit kits may be diminished, but they are not extinct and remain a component in many attackers' campaigns. Duncan at Palo Alto Networks says exploit kits are now only a "relatively minor factor in today's threat landscape compared to social engineering schemes and malspam." Even so, he adds, security researchers continue to log fresh attacks - launched by the likes of the Rig and Magnitude exploit kits - almost daily.

# data[].attributes.attachment_link.title
Threats: Social Engineering and Malicious Spam Dominate

# data[].attributes.attachment_link.description
Anti-Malware , Endpoint Security , Ransomware Exploits Kits, Once Formidable, Continue to Decline Good news: Exploits kits remain in decline, thanks in large part to concerted efforts to disrupt their efficacy.

# data[].attributes.body
Ryan Pierce

This article talks about four recent data breaches that just happened last month in may 2017. These breaches happened to Sabre Hospitality Solutions, Gmail, Bronx Lebanon Hospital Center, and Brooks Brothers. Some of the data that was compromised from these companies was financial info, personal info, and health info.

I previously knew a little bit about viruses and I knew some of the other was data could be compromised, but I didn't know the technical terminology for them. This article relates to what we're learning because it tells what kind of data was breached and also the way it was breached as well. For instance, in the section talking about the breach at Gmail, you can tell the type of software attack that was used what the phishing attack.
https://www.identityforce.com/blog/recent-data-breaches-may-2017

# data[].attributes.headline
Security Breach Examples and Practices to Avoid Them

# data[].attributes.subject
Security Breach Examples and Practices to Avoid Them

# data[].attributes.body
Michelle Bartus
This article is interesting it goes over how to protect yourself in your workplace.  This article starts with the data breach with VA of which 26.5 million Veterans personal information was stolen.  We all have to be aware of our area, and to make sure physical electronics such as laptops have security on them.
Being aware of what is on your laptop is also a good point, we shouldn't save your passwords to your computer unless you are the only user.  Having complicated passwords not easy ones, are better to make less vulnerable for hackers.  Disposing of old technology, without deleting records is very important this is another example of a data breach.  Old technology can consist of laptops, hard drives, tablets, and even copy machines.
We all need to stop and think especially at the work place, to ensure there is no data breach.  Being aware of suspicious activities, and checking are good precautions.

# data[].attributes.attachment_link.title
Security Breach Examples and Practices to Avoid Them

# data[].attributes.attachment_link.description
A hacker attacked a restricted database on a computer in UC Berkeley's health services center via a public web site on the same server. The database contained the names, Social Security numbers, health insurance information, immunization records, and patient physician information for more than 160,000 UC Berkeley students and alumni as well as former Mills College students.

# data[].attributes.headline
Data Protection: Data Breaches are the New Norm

# data[].attributes.subject
Data Protection: Data Breaches are the New Norm

# data[].attributes.body
Kathy Scherdt
Have we become so numb to the cyber attaches that we do not question it when our banks, credit card companies, or a hospital call/write to tell us that they have been breached and that our personal data may be compromised. From 2015 to 2016 breaches have increased by 40%. US companies and government agencies suffered a record 1,093 data breaches in 2016. In 2018 more stringent EU data protection, will come into effect following a two-year grace period. One can think that the US’s approach to data breaches is relying on the state-level and industry- specific legislation whereas EU relies on comprehensive privacy legislation.

I think that if everyone stopped relying on the WWW and stopped giving out so much information about themselves, we could control this “New Norm” a bit. I think that companies with breaches need to be paying more of the cost to people like you and I for the trouble we go through when the companies we trust have a breach.

# data[].attributes.attachment_link.readable_text
Increased risks

In the context of increasing cyber attacks on major corporate organizations, small businesses and governments, data protection and cybersecurity are hot topics. In 2016, Yahoo spilled 1.5 billion customers' details in two separate incidents, while telecoms companies like Talk Talk - hacked in 2015 - have not been immune from attack. In 2016, US companies and government agencies suffered a record 1,093 data breaches, a 40% increase from 2015, according to the Identity Theft Resource Center. In Europe, the Breach Level Index reported 125 data breaches, a staggering 91 of which involved organizations in the UK. Headline-grabbing hacks, with victims ranging from Wendy's to the Democratic National Committee, are increasing despite regulatory scrutiny and more aggressive cyber-security spending. The International Data Corporation revealed that worldwide, spending on security- related hardware, software, and services rose to $73.7 billion in 2016 from $68.2 billion the year before. A recent survey by the Information Commissioner's Office found that 75% of customers don't trust companies with their personal information.

Protection efforts

Data privacy laws and legislative efforts to secure data from different industries are in the news these days for a variety of reasons and in a variety of countries. For example, the government officials from the EU and the US are currently engaged in a heated debate about the privacy of data that crosses national borders. The Privacy Shield is a new arrangement intended to maintain transatlantic data flows by assuring Europeans that their privacy rights will be upheld when their data is transferred to the US (for example, when Europeans do business with American companies). An even more stringent EU data protection regulation, the General Data Protection Regulation (GDPR) will come into effect in May 2018 following a two-year post- adoption grace period.

With the adoption of the GDPR, it's clear that protecting personal information and consumer integrity has become a high priority for the EU. Every citizen will have the right to know how their personal data is being used. A company that does not comply with the GDPR may be fined up to €20 million or four percent of their global annual turnover. Another challenge posed by these debates and developments is to fully understand the way that data privacy and its legal protections are handled in different jurisdictions. The issue is particularly acute in the US because the level of data privacy protections varies from state to state and there is no over-arching federal data protection legislation.

Since most of the 50 states have some privacy statues of their own, one can interpret the US's approach in a way that relies more on state-level and industry- specific legislation, whilst the EU relies on comprehensive privacy legislation. As a result companies that provide solutions on data breaches would be wise to keep an eye on the GDPR as it makes its way through the EU's legislative process, while in the US private companies must take it upon themselves to introduce a data breach response plan through cyber testing because it is challenging to compromise between the federal and state level.

# data[].attributes.attachment_link.title
Data Protection: Data Breaches Are the New Norm - Leaders League

# data[].attributes.attachment_link.description
In the context of increasing cyber attacks on major corporate organizations, small businesses and governments, data protection and cybersecurity are hot topics. In 2016, Yahoo spilled 1.5 billion customers' details in two separate incidents, while telecoms companies like Talk Talk - hacked in 2015 - have not been immune from attack.

# data[].attributes.headline
Fast Food Chain Arby’s Acknowledges BreachBy: Redha Abu-Rshaid

# data[].attributes.subject
Fast Food Chain Arby’s Acknowledges BreachBy: Redha Abu-Rshaid

# data[].attributes.body
The article discusses a data breach at Arby’s fast food restaurant involving malicious software installed on payment card systems. The data breach involved hundred of the restaurant locations in the US. When reports were made by Arby’s restaurant group Inc. they have started investigations to the payment card systems. Then, they have notified law enforcement and expertise of security system. The restaurant chain Inc. were notified by PSCU, an organization that serve more than 800 credit unions, which received long list of compromised card numbers for more than 355,000 credit and debit cards.

The article helps in increasing my understanding of the importance of security system almost everywhere, because no body could expect such an incidence of breach. Therefore, the article helps in increasing my knowledge of protection, and to regularly check for unusual and suspicious activities.

https://krebsonsecurity.com/2017/02/fast-food-chain-arbys-acknowledges-breach/

# data[].attributes.headline
 15 worst data security breaches in recent memory.

# data[].attributes.subject
 15 worst data security breaches in recent memory.

# data[].attributes.body
-Dante Robinson

Big companies have recently succumb to a ton of big security breaches. A recent example of that is the 2013 holiday season at Target. Apparently, right before thanksgiving, a breach began giving hackers access to Target’s POS card readers. Initially, Target claimed 40 million customers were at risk. By the time it was all over, 110 million estimated customers had been at risk. The breach was so horrific to Target’s image that the CIO resigned in March of the next year, and the CEO resigned in May.

This article proves a point made in the chapter of the textbook. The breach was believed to be caused by the HVAC vendor to target’s POS system. Chapter 7 of the textbook speaks on third party employees like security or maintenance being unsuspected when it comes to theft or hacking. An employee of the HVAC vendor probably gained access for the hackers with no suspicion. I’m sure Target has increased security since this incident, but this is an example of how companies need to adjust every aspect of their business, including cyber security, as the world changes.

http://www.csoonline.com/article/2130877/data-protection/data-protection-the-15-worst-data-security-breaches-of-the-21st-century.html

# data[].attributes.headline
5 Huge Cybersecurity Breaches at Companies You Know

# data[].attributes.subject
5 Huge Cybersecurity Breaches at Companies You Know

# data[].attributes.body
Matthew Schimmelfennig

I chose an article that highlighted some of the biggest data breaches at companies that almost everyone is familiar with. The first data breach discussed is Wal-Mart, data was stolen from cash registers used by the companies developmental team. The second breach discussed was a Home Depot breach in which up to 60 million credit card numbers were stolen. Due to the complexity of cyber crimes, it took over five months to discover the breach. The third breach involved Target. Up to 110 million credit cards were stolen, with the costs associated with the hacking totaling $148 million. The fourth breach discussed involved Apple. Iclouds of celebrities and others were hacked, resulting in personal pictures being leaked to the public. The final company discussed is Neiman Marcus. The company ignored alerts that notified them of potential fraudulent activity, resulting in 350,000 compromised cards.

The data breaches at these major companies shows that no company is immune to data threats. It illustrates how often technology is changing and that what works today for security will be obsolete tomorrow. It also hammers home the potential cost, in both lost customers and real dollars, a data breach can have on a company.

# data[].attributes.attachment_link.readable_text
Let's face it, it's been a scary year in data security for companies and their customers alike. Hackers have been slipping through corporate computer defenses like they're Swiss cheese.

On Thursday, J.P. Morgan Chase (jpm) said that a cyber attack over the summer may have compromised information about 76 million households. That included customer names, addresses, phone numbers and email contact information. In addition, the breach affected about seven million of J.P. Morgan's small businesses customers. Overall, it may have been the biggest cyber attack in corporate history.

Here's a look at some of the biggest breaches at some top companies.

Even Walmart, the top company in this year's Fortune 500 list, hasn't been immune to cybersecurity breaches. According to an investigation by Wired in 2009, hackers broke into the computer system used by the company's (wmt) development team to steal information from cash registers. That data then found its way onto a computer in Eastern Europe.

Unlike other more recent breaches, Wal-Mart was not required to discuss the breach publicly, according to Wired, because the company called it an "internal issue."

In 2009, Wal-Mart's Chief Privacy Officer said the company was doing its best to "segregate the data, to make separate networks" and to "encrypt it fully" to safeguard from future data hacks.

Photograph by Kevork Djansezian-Getty Images

Home Depot (hd) may be your first stop for home improvement needs. But earlier this year, it fell victim to cyberthieves who stole up to 60 million card numbers. The attacks went on for five months before they were discovered. In September, the company said that anyone who used a credit card to shop in the U.S. or Canada over a six month period earlier this year could have been a victim.

At the time, Home Depot CEO Frank Blake called security a "major issue" and tried to reassure customers by saying the retailer had bolstered its lines of defense.

ALBANY, CA - MAY 15: A shopping cart stands in the parking lot of a Target store May 15, 2006 in Albany, California. Target announced a 12 percent rise in profit in its quarterly earnings report, falling short of market expectations. Target stock closed at $50.02, down $2.19. (Photo by Justin Sullivan/Getty Images) Photograph by Justin Sullivan-Getty Images

During last year's holiday season, there was little to cheer about for Target (tgt) shoppers. That's because of a massive security breach in which hackers accessed personal information about as many as 110 million consumers. The aftershocks are still reverberating for Target nearly a year later. In August, Target said the costs associated with the hacking added up to $148 million.

Photo by Spencer Platt-Getty Images

In one of the tech industry's racier scandals of 2014, hackers broke into the iCloud accounts of a number of Hollywood celebrities and made off with nude photos. Celebrities targeted included Jennifer Lawrence of "Hunger Games" fame, model Kate Upton and actress Kirsten Dunst. At the time, Apple (aapl) released a statement saying the breach wasn't system-wide, but rather due to specifically targeting the celebrity accounts. "None of the cases we have investigated has resulted from any breach in any of Apple's systems including iCloud or Find my iPhone," according to a statement. The timing, however, wasn't the best for the company, with its announcement of the new iPhone 6 phones slated for a few weeks later.

Photograph by Joe Raedle-Getty Images

Retailer Neiman Marcus suffered a cyber attack in February in which they culprits accessed the company's customer credit card records. In rifling through the database, the hackers set off 60,000 alerts that notified the retailer of questionable activity. But staff didn't pay much attention. For eight months, the hackers remained undetected and able to access information from cash registers, according to a Businessweek investigation. Originally, Neiman Marcus believed about 1.1 million customer cards were in danger. But the most recent estimate is 350,000, with about 9,000 cards used fraudulently, according to the company.

# data[].attributes.attachment_link.title
5 huge cybersecurity breaches at big companies

# data[].attributes.attachment_link.description
Let's face it, it's been a scary year in data security for companies and their customers alike. Hackers have been slipping through corporate computer defenses like they're Swiss cheese. On Thursday, J.P. Morgan Chase (jpm) said that a cyber attack over the summer may have compromised information about 76 million households.

# data[].attributes.headline
The Biggest Cybersecurity Threats Are Inside Your Company

# data[].attributes.subject
The Biggest Cybersecurity Threats Are Inside Your Company

# data[].attributes.body
Andrew Lovely

The article “The Biggest Cyber Security Threats are Inside Your Company” covers different ways that people can both accidentally and intentionally leak information about companies. There are Three different types of “insiders”. The first one, is simply a person who made a mistake but is otherwise harmless. Either they wrote down a password or someone got a hold of it. Or, They may have accidentally sent an e-mail to someone they shouldn’t have. The Second type of people are those who steal or leak out information from other people being the source. Lastly, you have people that are able to get an employee’s information and gain access to the companies system through their log in.

The article continues on by addressing how to identify if someone is possibly an insider trying to steal information. As well some tips on how to prevent your company from being hacked into. I really love this article because of how well it ties into the book and the things that we have learned. We have learned about different types of ways people are able to hack or get access into companies. But for my it’s interesting to see how real of an issue this is, and how to help counter-act it.

# data[].attributes.attachment_link.readable_text
Marc van Zadelhoff has nearly 20 years of experience in strategy, venture capital, business development, and marketing, in the IT and security space. Currently, Marc is the General Manager of IBM Security. Marc previously served as VP, Worldwide Strategy and Product Management for IBM Security, responsible for overall product management, budget, and positioning for IBM's entire global security portfolio.

HBR Learning

Digital Intelligence Course

Accelerate your career with Harvard ManageMentor®. HBR Learning's online leadership training helps you hone your skills with courses like Digital Intelligence . Earn badges to share on LinkedIn and your resume. Access more than 40 courses trusted by Fortune 500 companies.

Excel in a world that's being continually transformed by technology.

# data[].attributes.attachment_link.title
The Biggest Cybersecurity Threats Are Inside Your Company

# data[].attributes.attachment_link.description
Employees are responsible for 60% of all attacks.

# data[].attributes.body
Brook Andrews

I decided to search corporate security breaches in the dental field, because I currently work in the dental field and find that most interesting and enjoy being able to connect my current studies with my career field.  This article gave a lot of insight on what a lot of offices or practices do not do to prevent these data breaches.  Many offices in our current times are “paperless” and all information is on computers and easily accessible to many people.  Having a recovery/incident response plan in place is key with our current “paperless” technology.  Also, the reason for many places not being fully prepared with a plan is because people are not HIPAA trained, have weak passwords, patient information is not being kept secure, and they do not know if their business insurance covers the expense of a potential data breaches.

I really enjoyed reading this article because it all made sense in both views of being in the dental field for 13 years and the view from this current class.  I have worked for offices on both ends of the spectrum, being fully prepared for a data breach and those where pure chaos would consume the practice because they would not even know where to start with a security breach.  I came to realize how important computer information systems is to all career aspects, especially dental.  Dealing with private patient information that could include all their contact information and more that someone could complete identity theft with if they were able to breach the data.  Things like firewalls, anti-virus, device encryptions, and e-mail filters are all things that could potentially save a dental practice from a data breach.

# data[].attributes.attachment_link.readable_text
Risk Assessment
The very first step (and this is required under HIPAA) is to have a risk assessment. Every company, regardless of size, needs to understand its risks. Only once we understand what our potential threats are can we properly defend against them. If you do only one thing this year that's related to information security it should be a risk assessment.

The risk assessment can be done internally or by a qualified professional, and serves as a road map of what you should do. Below is a short list of items a risk assessment might include:

Business Mission Review

Critical System Identification

Asset Map

Threat Identification

Expected Controls

Administrative Review

Policy

Training

Procedure

Technical Review

Design

Security Testing

Configuration

Physical

Policy

Procedure

Determine Risk

Risk Mitigation

Safeguard Selection

Recommendations

Acceptance

Mitigation

Assignment

It's important to note that each risk assessment is unique. What one company needs will be different from another. Once the risk assessment is completed, you will know what your most likely risks are and how much money it will cost to mitigate against that risk. In some instances it's a wise choice to accept the risk, as mitigation would cost more.

For example, if the risk assessment shows that once a year you will lose a smartphone, and the cost of the loss would be $40,000. However, to mitigate it would cost $60,000. In this example, it is recommended that you accept the risk, as mitigation would cost more.

Create Defense in Depth
Now that you have a risk assessment, you can work on creating defense in depth. Think of security as an onion, and each control you have in place as a layer to that onion. In this example, our onion might look something like this:

1. Firewall

2. Intrusion Prevention

3. E-mail Filter

4. Anti-virus

5. Event Management

6. Device Encryption

7. Vulnerability Scanning

8. Disaster Recovery

As we continue down the layers we begin to see that if one control fails, there are still a number of controls in place. It is important to remember that any control can fail, and sometimes even multiple controls can fail at the same time. Your organizations' security posture should not rely on just a firewall or anti-virus only. It needs to have a layered approach to security. The risk assessment will show you which control you need to have in place, and how quickly you should install it. Every organization should have a firewall and anti-virus, and today most firewalls come with Unified Threat Management (UTM). This means they do more than just filter traffic; they can do things like e-mail filtering, intrusion detection, even vulnerability scanning.

Create Strong Policies
Policies are the driving force to ensure data is properly protected. The dental practice owner needs to create the necessary policies, and ensure that enforcement comes from the top. It is important for employees to understand that policies are mandatory, and that as an employee they do not have the option of not following it. Some policy examples are Acceptable Use, Data Destruction, Business Continuity, System/Network Security Monitoring and Mobile Devices.

All policies are composed of these basic components:

Purpose - describes the need for the policy

Scope - identifies what is covered (people, systems, facilities)

Responsibilities - lays out who is responsible for what

Compliance - defines what happens if a policy is violated, and how to measure the effectiveness of the policy

Keep in mind that policies are high level, and should not dive into specifics. They should be easy for all to understand and read. Once policies are established, then guidelines and procedures further detail specific processes to ensure compliance of the policies. Appropriate controls should be put in place for management and auditors to observe compliance of policies.

Proper Employee Education
From a security prospective, employees are often the weakest link in the chain. Specific attacks referred to as social engineering actively target employees in an attempt to entice them to disclose information or conduct an action (such as clicking on a link in an e-mail or opening a file).

The policies you have in place are the first line of education; however this needs to be followed up with proper training. Additionally, your other security controls (such as encryption) need to be user-friendly. Telling employees to encrypt e-mails or data will not have the right effect if they're not properly trained on how to carry out that action. There are multiple online training classes employees can attend, as well as general literature, which should be given to employees. Organizations should have a formal training policy. Your employee manuals should include your security control information.

Understand the Risk Management Process
Compliance and business continuity is all about managing risk. Whether large or small, you need to understand your overall IT environment and associate risks. Risk management is an ongoing process, not something you just do once a year.

The basic steps involve:

List all your business functions

List all your IT assets

Determine which assets are required to support each function

Categorize each function as low, medium or high with respect to the organization being able to function

List threats than can affect the asset

Determine the likelihood of each threat actually occurring

Evaluate alternatives to manage exposure

There are four basic ways to manage risk:

Avoid risk - don't implement a product or solution that causes undue exposure

Share risk - purchase insurance to cover your liability in the event of exposure

Mitigate risk - implement processes to minimize the chance of exposure

Accept risk - after evaluating alternatives to manage risk, the cost of the solution might outweigh the negative results due to an exposure (cost benefit analysis)

Once you've chosen your risk management strategy, it is important to have a system to manage the implementation of the solutions (controls). These do not have to be elaborate, but they must be in place to assure the owner/manager/board/ auditor that the risk management solution is being implemented. An example of a control for document destruction could be a log sheet indicating what was destroyed and who destroyed it. Then, on a monthly or quarterly basis, that log sheet is reviewed and appropriately filed.

Have Disaster Recovery/Incident Response Plan
Full system backups backup the entire system including the operating system and files, allowing you to fully recover a failed system, including the data and applications. There are many different full system backup solutions on the market offering various options and some of them include off-site remote storage.

Additionally, the time it will take you to recover from a backup is important. Will it take a matter of hours, days, weeks or longer? Regularly testing your backups (both partial and complete) is recommended. This will not only give you an idea of how long it will take to restore, but also if your backups are correctly backing up your data. Remember, every day you're spending trying to restore data and get back to an operational status is money you're losing.

Within the last few years, there have been many new technologies brought to market for the small and medium size dental practices that were only affordable to large corporations. If you are still running a tape back-up solution or any solution that is not an imaging back-up solution (full backup solution), you should contact your IT service provider to look at these technologies.

Conclusion
These topics are a brief introduction to some of the major things an organization can do to help reduce its risk. In the event of a breach that involves personally identifiable information (PII) or protected health information (PHI), it will be important that you're able to demonstrate due care in protecting PHI and PII. You will be in a far better legal position if you're able to show due care and due diligence. For more information or to speak with an information security professional please visit www.quanexus.com. Consider working closely with your practice management consultant to develop a checklist to protect your practice. For more information on dental practice management consulting, please visit www.theparagonprogram.com.

# data[].attributes.attachment_link.title
Data Breaches in the Dental Practice by Molly Singer

# data[].attributes.attachment_link.description
Risk Assessment The very first step (and this is required under HIPAA) is to have a risk assessment. Every company, regardless of size, needs to understand its risks. Only once we understand what our potential threats are can we properly defend against them.

# data[].attributes.headline
Power Grid Malware Platform Threatens Industrial Controls

# data[].attributes.subject
Power Grid Malware Platform Threatens Industrial Controls

# data[].attributes.body
Casandra Whitmore
I was drawn to this article because the assigned videos touched on this topic a few times. The Videos highlighted that it is unlikely that individuals would use malware for such an act. However, this article highlights that the likely culprit (Sandworm) to a December blackout in Ukraine was indeed malware. There are two companies working on this malware problem are calling this Industroyer or Crash Override. They fear the system is quickly customized however it needs direct access to the specific equipment it targets.

The knowledge of the class has made it clear the capabilities of these hackers as they were able to control switches and circuit breakers. If you watched the video’s you may recall them discussing Iran’s Uranium Centrifuges which were controlled by the same software. But these two acts were carried out in different manors. You should read the article to see how.

# data[].attributes.attachment_link.readable_text
Anti-Malware , Risk Management , Technology
The Platform - Possibly Russian-Backed - Said to Have Caused Ukraine Blackouts

Two security firms have investigated what they describe as a malware platform for attacking the industrial control systems that run electricity plants. They warned the platform was the likely culprit behind the December blackouts in Ukraine.

See Also: Spear Phishing, Identity Deception, Ransomware: How to Predict the Future of Crime

The platform could be quickly customized for automated, broader attacks. Security experts have warned that industrial control systems, used in industries such as manufacturing and utilities, are likely to be of increasing interest to hackers.

The two analyses were published on Monday by ESET, which is based in Slovakia, and Dragos, based in Washington. The findings come just seven months after a second cyber intrusion in a year in Ukraine caused power blackouts (see Ukraine Blackout Redux: Hacking Confirmed).

ESET calls the malware Industroyer, while Dragos calls it Crash Override. Both companies say the malware represents a significant, sophisticated engineering effort. ESET shared clues about the malware with Dragos. Dragos says it was contacted by the media regarding a report soon to be published by ESET, which led to it writing its own report.

The malware's developers took pains to understand the arcane protocols used in industrial control systems, a rarely seen effort along similar lines as Stuxnet, the U.S.-Israeli malware that disrupted Iran's nuclear weapons program.

The same day the reports were released, the U.S. Computer Emergency Readiness Team distributed its own warning, in which it ranked the findings as a "medium priority" issue.

"There is no evidence to suggest this malware has affected U.S. critical infrastructure," CERT says in its advisory. "However, the tactics, techniques and procedures described as part of the Crash Override malware could be modified to target U.S. critical information networks and systems."

Deep ICS Knowledge

ESET says it's unlikely the malware could have been developed without access to the specific equipment it targets.

Crash Override module overview including ESET's discoveries. (Source: Dragos)

"The capabilities of this malware are significant," ESET writes in its report. "The gang behind Industroyer are more advanced since they went to great lengths to create malware capable of directly controlling switches and circuit breakers."

That is the same kind of masterful, native control that Stuxnet used to cause Iran's uranium centrifuges, which were controlled by software made by Siemens, to spin out of control.

But there's a key difference between Industroyer/Crash Override and Stuxnet, which was designed to bridge air-gapped networks. To infect its target, Stuxnet used four zero-day vulnerabilities for Microsoft's Windows operating system. Industroyer/Crash Override doesn't appear to use any.

But like Stuxnet, Industroyer/Crash Override manipulates power systems in the way they're intended to be used, making detection and defense difficult. It may have initially infected systems through spear phishing, which are targeted emails with malicious content, or through other social engineering.

"There is no simple fix, as the capability described in this report takes advantage of the knowledge of electric grid systems," Dragos writes in its report. "It is not an aspect of technical vulnerability and exploitation. It cannot just be patched or architected away, although the electric grid is entirely defensible."

Dragos says that Industroyer/Crash Override could be "extended to other industries with additional protocol modules," but there are no signs that development is underway. It also cautiously described the possible damage from such an attack against a utility.

"The scenario is not cataclysmic and would result in hours, potentially a few days, of outages, not weeks or more," Dragos writes.

ESET and Dragos differ somewhat over whether Industroyer/Crash Override is responsible for the blackouts in Ukraine in December 2016. The country's national power company, Ukrenergo, experienced a two-hour blackout after malware affected one transmission substation.

Dragos says Industroyer/Crash Override is that malware. ESET says it is still investigating, but that conclusion seems likely, as the malware has an "activation timestamp" of Dec. 17, 2016, the same day as the outage.

"Nevertheless, we believe that to be a very probable explanation, as the malware is able to directly control switches and circuit breakers at power grid substations using four ICS protocols," ESET says.

About a year prior, on Dec. 23, 2015, about 225,000 customers saw blackout, as at least 30 substations in Ukraine went offline. It's believed the attackers used malware to get inside the networks of two utilities then manually opened circuit breakers, causing a loss of power (see Ukrainian Power Grid: Hacked).

Security analysts suspect malware called Black Energy and a component called KillDisk were used in the 2015 attacks. ESET says that although some components in the newly discovered malware platform are "similar in concept" to the tools used in the 2015 attacks, "we don't see any link between those attacks and the code in this malware."

The Ukrainian power station incidents were speculated to have been spearheaded by Russia, which has kept military pressure on the country since annexing the Crimea in March 2014.

Dragos nicknamed the group that developed Industroyer/Crash Override "Electrum." The company believes that Electrum has close ties to Sandworm, which the security company FireEye believes conducted both Ukraine attacks.

John Hultquist, director of intelligence for FireEye's iSight intelligence unit, tells The Washington Post that Sandworm "is tied in some way to the Russian government - whether they're contractors or actual government officials, we're not sure. We believe they are linked to the security services."

Legacy Hardware Defenses

Many of the defenses recommended in U.S. CERT's advisory will sound familiar, but could stop or at least constrain the ability of attackers using Industroyer/Crash Override.

Among those recommendations is application white listing, which only allows authorized programs to run rather than any executable. "The static nature of some systems, such as database servers and human-machine interface computers, make these ideal candidates to run AWL," U.S. CERT says.

Industroyer/Crash Override exploits ICS protocols that lack authentication and authorization. Legacy hardware may not have the capability to add those controls. But it may be possible to inspect those commands before they reach legacy hardware by using ICS firewalls or stateful inspection, U.S. CERT says.

# data[].attributes.attachment_link.title
Power Grid Malware Platform Threatens Industrial Controls

# data[].attributes.attachment_link.description
Anti-Malware , Risk Management , Technology The Platform - Possibly Russian-Backed - Said to Have Caused Ukraine Blackouts Two security firms have investigated what they describe as a malware platform for attacking the industrial control systems that run electricity plants. They warned the platform was the likely culprit behind the December blackouts in Ukraine.

# data[].attributes.headline
You're Sharing Your Cell Phone Number Too Frequently

# data[].attributes.subject
You're Sharing Your Cell Phone Number Too Frequently

# data[].attributes.body
Wendy Keezer
This article talks about how regardless of how vigilant we are to protect our privacy and security, there will always be new threats. As we continually try to educate ourselves on what to be aware of, scammers seem to always be one step ahead. At my place of employment, they are always sending out training videos about phishing, phone scams, and email scams. This article talks about a new threat that I have never heard of, using our cell phone numbers as a means for identity theft.  Our cell numbers connect us to all of our personal identifiable information; email address, physical address, everything, and companies are not mandated to keep our numbers private like with SS#'s. This new trend is called SMishing.
A few ways to protect yourself from this new trend is to only give your cell number to a company if necessary. Every time you check out at a register, they really do not need your phone number, if you feel the need, google voice offers a virtual phone number free: https://voice.google.com. You can always register on the "do not call" lists, and be selective on what private data you share, especially at retailers. I was personally affected by the breaches with both Yahoo! and Target. Because of this, I have been a victim of identiy theft several times. I continually work with my creditors and the credit reporting agencies to make sure I am aware of any changes happening and if they are fraudulent.
http://www.msn.com/en-us/news/technology/youre-sharing-your-cell-phone-number-too-frequently/ar-BBCWOUn

# data[].attributes.headline
THE ROOT OF THE PROBLEM: how to prevent security breaches.

# data[].attributes.subject
THE ROOT OF THE PROBLEM: how to prevent security breaches.

# data[].attributes.body
Josh Dean
This article starts off by talking about all the different security breaches that have happened not only worldwide, but right here in the united states. The article indicates how security breaches have been aimed more and more at health and medical companies due to the fact that those companies are more likely to hold more private information like social security numbers and other information that would help with stealing someone's identity. the article then goes into what are the causes of these problems. The root of these problems stem from a lack of talent in specialists with capabilities and skills to fend off these types of attacks. this is caused by three main factors. Competition being the first, budget issues being second and outdated technology being the third. the article then points out the two main factors that will help solve this problem. first being education. If we had better education it would increase the amount of talent across the board making it easier to obtain the people needed and secondly it talks about thinking globally. Hiring people from other countries that have the background needed to get the job done.
What this article talks about is one of my core beliefs about a lot of issues that we face today. The world is becoming more and more advanced and we just haven't been able to keep up with the technology and information at the faster rates which we gather them. If we don't focus on bettering our education, then we will not have the people or skills to maintain our infrastructure which will lead to big disasters like the security breaches of late.
https://www.wired.com/insights/2015/02/the-root-of-the-security-problem/

# data[].attributes.body
by Shanna Morse
This article got my attention by mentioning the 2013 Target stores data breach that compromised millions of people’s personal information. I remember this happening because everyone, including myself, who had a Target Visa was then issued a Target Mastercard. This article describes the top ten most destructive data breaches that have occurred so far (that we know of).

#10: Yahoo breach in 2016, affected 500 million users and 1 billion accounts! It took Yahoo three years to realize the breach had happened and the hackers still have not been identified

#9 Friend Finder, a website breach that resulted in 412 million user accounts being compromised

#8 Myspace, year of occurrence is still unknown, 360 million account records, emails, passwords, etc. were leaked

#7 LinkedIn, hacked in 2012- 165 million accounts compromised

#6 Heartland Payment Systems, between 2008 and 2009 130 million records were compromised.

#5 Target stores in 2013, 40 million credit and debit records compromised due to hackers infecting the company’s card readers

#4 Sony online entertainment, hackers targeted the PlayStation network in 2011

#3 Rambler, hacked in 2014 (the Yahoo of Russia) 98 million of its accounts were compromised

#2 National Archives and Records Administration breach in 2008 occurred as a hard drive simply not working which held the names and social security numbers of 76 million military veterans

#1 Anthem, formerly known as WellPoint was hacked in 2015. The second-largest health insurer in the U.S., stolen data included names, addresses, dates of birth, Social Security numbers and employment histories — everything an identity thief might need.

This article builds on my understanding and knowledge in this course so far by demonstrating the many ways in which organizations can be vulnerable to threats that many of us don’t often consider.  It also puts into perspective that if a corporate giant like Target could be so vulnerable to threats, it is happening everywhere, all the time and to probably everyone at some point in their lives.

# data[].attributes.attachment_link.description
The Yahoo data breach may be the biggest, but you've probably never heard of other data breaches that were smaller, but worse.

# data[].attributes.body
Deseree Klann

http://www.itpro.co.uk/security/28740/3-security-skills-every-it-team-needs

In order for corporations and people to protect themselves from possible theft, they must be educated on how to do exactly that. This article covers three very important ways to prevent a  security breach. Corporations need to have the right talent necessary to complete these tasks, but there is a shortage in people educated enough. Companies and people need to work diligently to protect themselves from a possible tragedy. The  three ways stated are to have a fast breach response, constantly run penetration testing and to have high quality security engineering and analysis.

This particular article spoke to me because I find it has very important information. Security breaches are all too common nowadays and criminals are gaining access to our personal information, exploiting our privacy, and using it to their advantage.  This article built on my knowledge of how to protect myself and always keep track of my affairs.

# data[].attributes.attachment_link.readable_text
There is a lack of security expertise and this could affect how able your organisation is in securing vital infrastructure. According to a whitepaper published by Kaspersky, a third of businesses worldwide see improving specialist security expertise as one of the Top 3 drivers of IT security investment. Approximately half of businesses admit there is a talent shortage and growing demand for specialists.

For more reasons to boost your cybersecurity talent, check out Kaspersky's free report 'Lack of security talent, an unexpected threat to Corporate Cybersafety'
Download now
The report also found that organisations that admit a certain insecurity in attracting new talent, end up paying from US$1.2 to $1.47 million. In comparison, large businesses that feel confident about their IT Security team development, pay anywhere from US$100K to 500K to recover from a single breach.

Organisations need a well-trained workforce to make sure defences are adequate; so what are the three security skills that every IT team needs?
Breach response
On your network, you need to be aware of any possible intruders and should a breach occur, you need to be able to respond to it.

While a network intrusion detection system (NIDS) can flag up illicit or anomalous behaviour by passively monitor network traffic, should a breach occur, you need the experience and knowledge to deal with it. That means devising an effective framework to deal with such attacks.

Your team need the wherewithal to update the framework when network components change or new threats emerge. The framework should give IT teams a process for dealing with the breach and what follows. This means you should know what data recovery plans are in place as well as any legal procedures to follow and which partners/customers to inform.

Hiring by hiring new talent has a direct impact on the damage caused from real cybersecurity breaches. In March-April 2016 Kaspersky conducted a Corporate IT Security Risks survey and found that significant amount of the recovery costs is due to additional staff wages - US$14K on average for SMBs, $126K for enterprises - with companies spending more on hiring external experts and paying overtime for their own team.
Penetration testing
Another skill need by IT teams is penetration testing. This is a great way of finding problems with the infrastructure and fixing them before hackers can take advantage of them. It involves carrying out manual or automated processes to access servers, applications, networks, and user's devices, to see if a break-in could happen. With this testing, an IT team can produce a report for auditors as proof of compliance.

This report will also serve as a list of flaws that can be prioritised and fixed. Finding flaws can save time and money by preventing downtime and costs associated with security breaches.

Penetration testing should be carried out on an ongoing basis as an organisation's infrastructure is in a constant state of change.
Security engineering and analysis
Building in security from the get go is important. Making things secure now saves money in the long run. That means designing infrastructure that protects data, information and users in the correct way.

A good security analyst can carry out integration and testing, operation and maintenance of systems security. They should have a deep understanding of all the business systems in the company and know what data an organisation just cannot lose.

Threat data from various sources can be brought together and context understood and insights drawn and implemented from this information. An analyst should also be able to communicate the security position to the rest of the organisation to have buy-in from relevant stakeholders and executives. Information security analysts need strong oral and written communication skills.

According to Sergey Novikov, Deputy Director, Global Research and Analysis Team at Kaspersky ( you can find more of his work in the whitepaper here), a security researcher learns something new every day, while doing their best to analyze new advanced threats.

"Understanding the real scope of threats and at the same time being able to communicate the needs of IT security to top management is very, very difficult," he says.
Further essential reading for IT teams - Kaspersky's free download 'Lack of security talent, an unexpected threat to Corporate Cybersafety' Download now

# data[].attributes.attachment_link.description
There is a lack of security expertise and this could affect how able your organisation is in securing vital infrastructure. According to a whitepaper published by Kaspersky, a third of businesses worldwide see improving specialist security expertise as one of the Top 3 drivers of IT security investment.

# data[].attributes.body
Tara Habeck

Shanthi Rexaline of www.benzinga.com points out the top 5 cyber hacks of 2017’s first trimester: hackers filed a false SEC filing for Stage Stores Inc; Julian Assange leaked how the CIA was unethically hacking into TVs, iPhone and apps; behind the scenes photos of Emma Watson during the filming of Beauty and the Beast were stolen and released; McDonald’s twitter feed was hacked; customer emails and phone numbers were stolen from the owner of Saks Fifth Avenue.

Breaches in cybersecurity are hitting close to home. I use an iPhone and its possible the CIA acquired data from it. Within the last year I shopped at Saks Fifth Avenue. I now have many questions about what I can do to protect myself against cyber crime. What anti-virus software should I have installed on my laptop? How should I store my passwords? What are best practices for safe use of my mobile device?

# data[].attributes.attachment_link.readable_text
The new year breathed fresh life into the markets, as they emerged stronger following the fading of the post-presidential election rally in December last. However, the new year has not treated some companies well, as they fell victims to hacking carried out in varied degrees and on varied scales.

We are only three months into the new year and yet we have a bunch of hacking tales to recount. And with three-fourths of the year spread out before us, if hackers maintain this hyper activity levels, 2017 could go down in history as one of the most notorious years for hacking, which usually results in identity theft, data breaches, etc.

Here is the timeline of hacking events that occurred thus far in the year.

1. Stage Stores Upstaged

Stage Stores Inc (NYSE: SSI) put out a news release through Business Wire on March 2 that the SEC filing done by an entity called HMA Acquisition, Inc. apparently is a fake filing and has not received any offer or other communication from it.

2. CIA's Ignominious Snoop

Julian Assange's WikiLeaks had on March 7 published a scandalous content that exposed the complex software tools employed by the CIA to hack into the devices and applications of companies, including Apple Inc. (NASDAQ: AAPL), Microsoft Corporation (NASDAQ: MSFT), Facebook Inc (NASDAQ: FB), SAMSUNG ELECTRONIC KRW5000 (OTC: SSNLF), etc. The first part named "Year Zero" of a series of leaks code named "Vault 7" was released this month, which vividly discussed how the CIA unethically hacked into the iPhones, Samsung TVs, WhatsApp, etc.

3. Beast Mars Emma's Beauty

Emma Watson, whose recent flick Walt Disney Co (NYSE: DIS)'s "Beauty and the Beast" was recently drawn into a controversy over the leaking of her private photos online. The act, purportedly a hacking exercise, showed photos of her trying on outfits during fittings. The star is taking legal action to bring the perpetrators to book.

4. McDonald's Unsavory Moment

McDonald's Corporation (NYSE: MCD) was in the spotlight recently, not related to its food business, but due to a tweet sent out from its official account that disparaged President Donald Trump. The tweet dated March 16 said, "@realDonaldTrump You are actually a disgusting excuse of a President and we would love to have @BarackObama back, also you have tiny hands."

The company quickly moved in to clear the air by asserting that its account has been compromised. Subsequently, it deleted the tweet and said it has secured the account.
Editor's note, 11:24 a.m. ET: Saks contacted Benzinga to state, "Saks was not hacked."
5. Saks Under Scanner Over Data Breach

HUDSON'S BAY CO COM NPV (OTC: HBAYF), the owner of retailer Saks Fifth Avenue, was a victim of data breach last week after a BuzzFeed article reported e-mail addresses and phone numbers of several of Saks' customers in plain text online. Hudson Bay confirmed the data breach on March 19 but said key data such as credit card information were not exposed, while it also promised speedy resolution of the issue.
Related Links: Study: Hackers Say Mass Surveillance Is Cybersecurity's No. 1 Threat In 2017 The State Of Cybersecurity Stocks

# data[].attributes.attachment_link.title
Some Notable Cybersecurity Breaches In 2017 (And It's Only March)

# data[].attributes.attachment_link.description
The new year breathed fresh life into the markets, as they emerged stronger following the fading of the post-presidential election rally in December last. However, the new year has not treated some companies well, as they fell victims to hacking carried out in varied degrees and on varied scales.

# data[].attributes.headline
Amazon Breach Shows Need for Stronger Third-Party Cybersecurity

# data[].attributes.subject
Amazon Breach Shows Need for Stronger Third-Party Cybersecurity

# data[].attributes.body
Kira Hunter
For this assignment, I chose an article entitled “Amazon Breach Shows Need for Stronger Third-Party Cybersecurity”. This article begins by talking about the data security breach that happened with Amazon and some of its 3rd party vendors in April of 2017. The breach is believed to have happened from stolen 3rd party credentials that allowed hackers to change bank deposit information on the accounts and deposit thousands. While Amazon vowed to reimburse all their vendors hacks like this one show a vulnerability that if it is addressed can damage Amazon’s brand. The breach also highlighted the need for stronger data security for large businesses like Amazon who are especially vulnerable because of the amount of 3rd party vendors they work with all over the globe. The recommendation the article suggested was to use good password management i.e. long, complex, unique passwords that are changed out often.

This article related to what I already knew about cyber security. It makes sense to me that 3rd party vendors might be an easy access point to infiltrate larger more secure businesses like Amazon. Data security as it relates to businesses and even our government are increasingly becoming problematic as hackers can access all kinds of our personal information. Technology has made obtaining and storing information so much easier but at the same time we need to make sure that it is secure.

# data[].attributes.attachment_link.readable_text
The threat actors have reportedly changed the bank-deposit information on the compromised accounts to steal tens of thousands of dollars from the users.

Hackers breached the Amazon accounts of several third party vendors using stolen credentials obtained through the dark web to post fake deals and steal cash.

The threat actors have reportedly changed the bank deposit information on the compromised accounts to steal tens of thousands of dollars from the users, several sellers and advertisers have said.The attackers also targeted accounts that hadn't been recently used to post nonexistent merchandise for sale at steep discounts in an attempt to pocket the cash.

It's unclear how many accounts were compromised and the hack appears to have stemmed from email and password credentials stolen from a previous breach.

A New York-based lawyer representing Amazon told the Wall Street Journal more than a dozen of his clients have reported hacks, and many of them lost about half of their monthly sales ($15,000 to $100,000) as a result. All of the affected Sellers will be made hole. An Amazon spokesperson said that the company has a zero-tolerance policy for fraud.

"We withhold payment to sellers until we are confident that our customers have received the products and services they ordered. In the event that sellers do not comply with the terms and conditions they've agreed to, we work quickly to take action on behalf of customers," the company said in a prepared statement to SC Media. "There have always been bad actors in the world; however, as fraudsters get smarter so do we. Amazon is constantly innovating on behalf of customers and sellers to ensure their information is secure and that they can buy and sell with confidence on Amazon.com."

Some researchers called the incident a high-profile example of how increasingly interconnected businesses have become and that organizations across the world in every industry are undergoing a similar transformation as outsourcing, globalization and the digitization of business expand their digital ecosystems exponentially.

"Amazon has cultivated one of the largest and most impressive third-party ecosystems in the history of global business with more than two million sellers on the site," Fred Kneip, chief executive officer (CEO) at CyberGRX, told SC Media. "With so many potential weak links, it's no surprise that hackers have found a way to exploit the network for financial gain."

He added that companies need to approach third-party cyber risk as a real threat to their business that needs to be continuously managed.

And while the breaches may not affect Amazon immediately, the long terms affects may be corrosive to the brand.

"This is a lesson the SWIFT Network learned after attacks on a member bank led to a costly breach and affected its reputation as a secure network," Kneip said. "The reality today is that the security and perceived integrity of a network or business extends to the security of the third parties using it. Companies need to more proactively ensure the security of their partners, or risk real damage to their reputation and their brand."

Some researchers feel that it's a stretch to call the incident a hack and attribute the incident more to the use of weak passwords and poor cybersecurity hygiene.

"Beyond just the initial breach, the use of these weak passwords and security questions has a far greater impact," Justin Fier, director of cyber intelligence and analysis at Darktrace, told SC Media. "If even a fraction of the stolen passwords were used in any other site, personal and business lives could be at stake."

He added that breaches like this can lead to compromises two, three, or even four degrees out from the initial target, which is very concerning for businesses.

In either case, vendors can also take steps to minimize their own risks in the event of a compromise.

"To avoid needless risk and to protect their identity in the event of a breach, people should take a minute to adhere to some password management best practices to help avoid potential dangers," Kevin Cunningham, president and co-founder of SailPoint, told SC Media. "Some simple measures that people can easily implement right now include using a unique password for every application or account, and making sure the password is long and more complex - the longer and more complex the password, the safer it will be."

He added that the Amazon hack is an example of how identity has become a new attack vector and how it's becoming more common for hackers to use credentials stolen from one breach to access other websites.

# data[].attributes.attachment_link.title
Amazon breach shows need for stronger third-party cybersecurity

# data[].attributes.attachment_link.description
Hackers breached the Amazon accounts of several third party vendors using stolen credentials obtained through the dark web to post fake deals and steal cash.