Summary Bullets:

• Verizon’s annual Payment Security Report captures a snapshot of organizations struggling to continue successful controls and best practices over time.
• The evidence shows those who do are rewarded with a better fortified defense against breaches.

Fifteen years after the payment card industry settled on a single data security standard with PCI DSS, there are indications that too many organizations’ security practices haven’t risen to the level of maturity which would have been anticipated at this point.  In Verizon’s annual survey of payment card industry security practices, only 37% of the 302 surveyed enterprises sustain full compliance with the 12 specifications outlined in PCI DSS consistently over time.  Effectively, most organizations are focusing on meeting the basic requirements rather than developing consistent and effective security practices – not unlike a procrastinating student who is just looking to pass the test.  Just 18% check to see if they are meeting PCI DSS specifications more often than what the standard mandates. Continue reading “Verizon Payment Security Research Exposes Execution Issues” →

Summary Bullets:

• After a protracted legal battle that spanned nearly a decade, Cisco settled a lawsuit accepting accountability for a security flaw in a video surveillance system sold to Homeland Security, the Secret Service, and other U.S. government agencies.

• As part of the settlement, the partner’s employee who originally reported the vulnerability will receive $1.5 million.

Eight years after the filing of a lawsuit against Cisco on behalf of U.S. public sector customers and more than a decade after a Cisco contractor initially called attention to a serious security flaw in one of the vendor’s video surveillance solutions, the IT equipment maker reached an $8.6 million settlement with the aggrieved parties and admitted culpability. In a blog posted in late July, Cisco General Counsel Mark Chandler wrote that software developed by Broadware – a company acquired by Cisco – used an open architecture that could be vulnerable to a breach. The settlement amount equates to a partial refund to the U.S. federal government and 16 states that bought products between 2008 and 2013. And the $8.6 million settlement included a $1.6 million payment to the person who first identified the vulnerability, although ultimately, no breach ever occurred. Continue reading “Cisco’s Settlement Over Video Surveillance Flap Signifies a New Era in Vendor Accountability” →

Summary Bullets:

• Due to their privileged access to high-value corporate assets, executives are in the crosshairs of cyber attackers, according to the latest Verizon Data Breach Investigations Report.
• The Verizon report found that the combination of access and the need to make quick decisions made C-level executives more vulnerable to social engineering attacks.

Enterprising cyber attackers driven by a money motive are setting their sights on objects that will deliver the highest returns. Thanks to their access to high-value systems and data, C-level executives are a prime target for social engineering hacks. This year’s Verizon Data Breach Investigation Report (DBIR) found social attacks, including business e-mail compromises (BECs) against enterprise executives, are on the rise. Speculating that the combination of proximity to high-value assets and the intensive pressure of their roles, which limits executive time to scrutinize messages, makes them more vulnerable than most employees with less critical roles, the Verizon DBIR claimed that staffers in leadership are 12 times more likely to be the victims of credential theft or other social incidents, such as being tricked into transferring money to an adversary’s bank account. Continue reading “New Research Reveals C-Level Execs Are Prime Targets for Cyber Attackers” →

Summary Bullets:

• Amazon Alexa is relaying recorded consumer speech for analysis by Amazon staff and contractors for product improvements.
• There is a simple workaround to turn off the default communications between Alexa and Amazon employees.

Alexa apparently needs a little help from human sources to better decipher user requests. Amazon acknowledged that individual staff and contractors in a number of countries including Romania, India, Costa Rica, and the U.S. each evaluate as many as 1,000 recorded requests to Alexa during their nine-hour shift. The staffers feed notes into software that provides better context to requests, which Amazon said will ultimately produce a better user experience. Continue reading “Amazon Catches Heat for Alexa’s Dependence on Human Intellect” →

Summary Bullets:

• Google is under fire for failing to disclose that its Nest Secure home alarm system has an embedded microphone.
• Privacy advocates are calling for significant change in light of the digital giant’s checkered data handling history.

When Google announced in early February that the company had added a feature to its Google Nest Secure system that allows it to work with Google Assistant to become a smart speaker, some consumers were surprised to learn the home security and alarm system has an embedded microphone. Google copped to failing to disclose the integrated microphone, admitting that detail should have been included in product information. Continue reading “Google in Hot Water Over Latest Privacy Misstep” →