State of Cybercrime

We’re living in exciting times. Today, if you have an idea as well as a small budget, you can most likely create it. This is particularly true in the technology space, which is why we’ve seen the explosion of IoT devices on the marketplace. However, what’s uncertain is the byproduct of our enthusiastic making, innovating, and disrupting. Hypothetical questions that used to be debated on the big sc...

We continue with our series with John Carlin, former Assistant Attorney General for the U.S. Department of Justice’s National Security Division. This week, we tackle ransomware and insider threat. According to John, ransomware continues to grow, with no signs of slowing down. Not to mention, it is a vastly underreported problem. He also addressed the confusion on whether or not one should engage l...

In part two of our series , John Carlin shared with us lessons on economic espionage and weaponized information. As former Assistant Attorney General for the U.S. Department of Justice’s National Security Division, he described how nation state actors exfiltrated data from American companies, costing them hundreds of billions of dollars in losses and more than two million jobs. He also reminded us...

After WannaCry, US lawmakers introduced the Protecting Our Ability to Counter Hacking Act of 2017, or PATCH Act . If the bill gets passed, it would create a Vulnerabilities Equities Process Review Board where they would decide if a vulnerability, known by the government, would be disclosed to a non-government entity. It won’t be an easy law to iron out as they’ll need to find the right balance bet...

Even though it feels like France’s presidential election happened ages ago, it was a very public security win. The Inside Out Security show panelists – Cindy Ng, Kris Keyser, Mike Buckbee, and Kilian Englert synthesize how it all unfolded. They also weighed in on the FBI director’s release from his duties. What’s relevant in this story in the infosec space is what happens after someone leaves an o...

Sue Foster is a London-based partner at Mintz Levin. In the second part of the interview, she discusses the interesting loophole for ransomware breach reporting requirements that's currently in the GDPR However, there's another EU regulation going into effect in May of 2018, the NIS Directive, which would make ransomware reportable. And Foster talks about the interesting implications of IOT device...

Last week, when the world experienced the largest ransomware outbreak in history, it also reminded me of our cybersecurity workforce shortage. When events like WannaCry happen, we can never have too many security heroes ! There was an idea floating around that suggested individuals with a music background might have a promising future in security. The thinking is: if you can pick up music, you can...

Sue Foster is a London-based partner at Mintz Levin. She has a gift for explaining the subtleties in the EU General Data Protection Regulation (GDPR). In this first part of the interview, she discusses how US companies can get caught up in either the GDPR's extraterritoriality rule or the e-Privacy Directive's new language on embedded communication. She also decodes the new breach notification rul...

Last week, John P. Carlin, former Assistant Attorney General for the U.S. Department of Justice’s (DOJ) National Security Division, spent an afternoon sharing lessons learned from the DOJ. And because the lessons have been so insightful, we’ll be rebroadcast his talk as podcasts. In part one of our series, John weaves in lessons learned from Ardit Ferizi, Hacktivists/Wikileaks, Russia, and the Syr...

Rather than referring our weekly podcast panelists as security experts, we’re now introducing them as security practitioners. Why? A popular business article on mindset brought to our attention the perils of having self-proclaimed titles, such as experts and gurus. It signals our “thirst for knowledge in a particular subject has been quenched.” That is far from reality! Security is a constantly ev...

There’s been a long held stigma amongst our infosec cohort and it’s getting in the way of doing business. What’s the stigma, you ask? “Know-it-all” techies who are unable to communicate. Unfortunately, this shortcoming also puts our jobs at stake. According to a recent cybersecurity survey , the board of directors polled said that IT and security executives will lose their jobs because of their fa...

As sleep and busyness gain prominence as status symbols, I wondered when or if good security would ever achieve the same notoriety. Investing in promising security technology is a good start. We’ve also seen an upsurge in biometrics as a form of authentication. And let’s not forget our high school cybersecurity champs ! However, as we celebrate new technologies, sometimes we remain at a loss for v...

If you want to be an infosec guru, there are no shortcuts to the top. And enterprise information security expert, Christina Morillo knows exactly what that means. When she worked at the help desk, she explained technical jargon to non-technical users. As a system administrator, Christina organized and managed AD, met compliance regulations, and completed entitlement reviews. Also, as a security ar...

It was only last week that we applauded banks for introducing cardless ATMs in an effort to curb financial fraud. But with the latest bank heists, it may help to turn up the offense and defense. Why? Hackers were able to drill a hole , connect a wire, cover it up with a sticker and the ATM will automatically and obediently dispense money. Another group of enterprising hackers changed a bank’s DNS...

Recently, the Pew Research Center released a report highlighting what Americans know about cybersecurity. The intent of the survey and quiz was to understand how closely Americans are following best practices recommended by cybersecurity experts. One question on the quiz reminded us that we’re entitled to one free copy of our credit report every 12 months from each of the three nationwide credit r...

Besides talking to my fav security experts on the podcast, I’ve also been curious with what CISOs have been up to lately. Afterall they have the difficult job of keeping an organization’s network and data safe and secure. Plus, they tend to always be a few steps ahead in their thinking and planning. After a few clicks on Twitter, I found a CISO at a predictive analytics SaaS platform who published...

Over the past few weeks , we’ve been debating a user’s threshold for his personal data seen in the public domain. For instance, did you know that housing information has always been public information? They are gathered from county records and the internet has just made the process of gathering the information less cumbersome. However, if our personal information leaks into the public domain - due...

In our "always-on" society, it's important that our conversation on IoT security continues with the question of data ownership. It's making its way back into the limelight when Amazon, with the defendant’s permission, handed over user data in a trial . Or what about a new software that captures all the angles from your face to build your security profile? Your face is such an intimate as...

As more physical devices connect to the internet, I wondered about the responsibility IoT manufacturers have in building strong security systems within devices they create. There’s nothing like a lapse in security that could potentially halt the growth of a business or bring more cybersecurity awareness to a board . I discussed these matters with this week’s Inside Out Security Show panel – Cindy...

I recently came across an article that gave me pause, “ Why Data Breaches Don’t Hurt Stock Prices .” If that’s the case and if a breach doesn’t impact the sale of a company, does security matter? So I asked the Inside Out Security Panel – Cindy Ng, Forrest Temple, Mike Buckbee and Kilian Englert. They gently reminded me that there’s more than just the stock price to look at – brand, trust, as well...

The debate between users volunteering their data for better service versus being perceived as a creepy company who covertly gathers user data remains a hot topic for the Inside Out Security panel –Cindy Ng, Kris Keyser, Mike Buckbee, and Kilian Englert. There were two recent stories that triggered this debate. Recently, a smart television manufacturer agreed to pay a $2.2 million fine to the Feder...

In part two of my  interview  with Angela Sasse, Professor of Human-Centred Technology, she shared an engagement she had with British Telecom(BT). The accountants at BT said that users were resetting passwords at a rate that overwhelmed the helpdesk's resources, making the cost untenable. The security team believed that the employees were the problem, meanwhile Sasse and her team thought otherwise...

This week, we continue our ongoing ransomware discussion with the Inside Out Security Show panel - Cindy Ng, Kilian Englert, Mike Buckbee, and Mike Thompson. But before we launched into our conversation, as an icebreaker, I asked the panel what their advice would be to this tired sysadmin who deleted the wrong directory on the wrong server? Buckbee: Do exactly what they did to fix the problem. Eng...

Inspired by this tweet , I asked the Inside Out Security Show panel – Cindy Ng, Kilian Englert, Mike Buckbee, and Alan Cizenski -  if they could add an extra factor of authentication, what would it be? Plus, we covered a few hot topics: The risks of replacing passports and manned desks with biometric scanning and automation What would it take to set up AD for 28 million users ? Buying technology i...

Adam Tanner is the author of "Our Bodies, Our Data", which tells the story of a hidden dark market in drug prescription and other medical data. In recent years hackers have been able to steal health data on a massive scale -- remember Anthem? In this second part of our interview, we explore the implications of hacked medical data. If hackers get into a data brokers' drug databases and co...