Don’t Skip Data Discovery During Your Compliance Program

If your business collects customer data of any kind, it’s safe to assume you’re also aware of the multitude of new privacy and security mandates. While these regulations are an ideal driver of investment for bolstering your security programs, it’s important not to forget about one of the most...

Thinking about the balance between compliance and security

Today, many organizations still struggle to adhere to General Data Protection Regulation GDPR mandates even though this landmark regulation took effect nearly two years ago. A key learning for some: being compliant does not always mean you are secure. Shifting privacy regulations, combined with...

News Wrap: Hotel Robot Hacks, FTC Stalkerware Crackdown

Threatpost editors break down the top news stories for the week ended Oct. 25. The biggest stories include: An unsecured NFC tag opening a door to trivial exploitation of robots that are used inside Japanese hotels. The FTC has banned the sale of three apps – marketed to monitor children and...

Akamai's 3 Takeaways from the Gartner CIAM Solution Comparison

We have eagerly awaited Gartner's analysis of the growing CIAM industry. According to Gartner, in its August 2019 Solution Comparison for Customer Identity and Access Management Capabilities of 9 Vendors, "CIAM offerings are expanding and are now key business enablers for unifying customer...

Operational resilience begins with your commitment to and investment in cyber resilience

Operational resilience cannot be achieved without a true commitment to and investment in cyber resilience. Global organizations need to reach the state where their core operations and services won’t be disrupted by geopolitical or socioeconomic events, natural disasters, and cyber events if they...

Policy Compliance Library Updates, July 2019

Qualys' library of built-in policies makes it easy to comply with the security standards and regulations that are most commonly used and adhered to. Qualys provides a wide range of policies, including many that have been certified by CIS as well as the ones based on security guidelines from OS an...

Understanding CCPA: It's Time to Action a Plan for Compliance

Notice to all procrastinators: The final countdown to the California Consumer Privacy Act CCPA has begun. On January 1, 2020, companies or organizations that do business in California will be required to comply with the state's strict new privacy legislation that establishes a legal and enforceab...

Leaky Server Exposes 419M Phone Numbers of Facebook Users

Phone numbers linked to the Facebook accounts of hundreds of millions of users has been found online on an insecure server in the latest privacy gaffe for the social media giant. The server, which lacked password protection, contained more than 419 million records over several databases of Facebo...

4 Critical Elements Your Next Security Solution Must Have

Security is essential to the success of any digital business. But there's one thing you can always count on: security-related incursions are inevitable. And the results can be devastating. Security breaches erode trust and damage reputation. As a CIO, CISO, or other security or IT leader, you kno...

Qualys Policy Compliance Notification: Policy Library Updates (June)

Qualys’ library of built-in policies makes it easy to comply with the security standards and regulations that are most commonly used and adhered to. Qualys provides a wide range of policies, including many that have been certified by CIS as well as the ones based on security guidelines from OS an...

Vercel: User personal data disclosure via API

Summary: As a normal user, the API allows me to obtain information about other users by passing their email address as a query parameter which then returns their name, username, uid, avatar hash, and email in the HTTP response body. Under GDPR regulations this information disclosure is categorize...

Canada Uses Civil Anti-Spam Law in Bid to Fine Malware Purveyors

Canadian government regulators are using the country's powerful new anti-spam law to pursue hefty fines of up to a million dollars against Canadian citizens suspected of helping to spread malicious software. In March 2019, the Canadian Radio-television and Telecommunications Commission CRTC --...

Safeguard your most sensitive data with Microsoft 365

I am Security Operations’ SecOps worst nightmare. Or at least I used to be. As an industrious product marketer, I often share intellectual property think: details of new product capabilities or spreadsheets that contain customer personal identifying information PII with colleagues and vendors. We...

CVE-2019-11687

An issue was discovered in the DICOM Part 10 File Format in the NEMA DICOM Standard 1995 through 2019b and continuing in current implementations. The 128-byte preamble of a DICOM file that complies with this specification can contain arbitrary executable headers for multiple operating systems,...

Sophisticated threats plague ailing healthcare industry

The healthcare industry is no longer circling the drain, but it's still in critical condition. While many organizations in healthcare have aimed at or made positive strides toward a more robust cybersecurity and privacy posture, they still have a long way to go. In 2018, healthcare had the highes...

Maintaining Privacy in the Cloud [Podcast Discussion]

Not long ago I joined Brian Contos, CISO and VP of Product Innovation at Verodin, for one of his Verodin Cybersecurity Effectiveness Podcasts. It’s been about 10 years since I worked with Brian at Imperva when he was the Chief Security Strategist. Back then, he was the one traveling the world,...

Ubiquitous Bug Allows HIPAA-Protected Malware to Hide Behind Medical Images

A bug in a 30-year-old standard used for the exchange and storage of medical images has been uncovered; it allows an adversary to embed fully-functioning executable code into the image files captured by medical devices such as CT and MRI machines. This results in hybrid files that allow malware...

Fake Instagram Apps on Google Play Harvest User Logins

Three apps on Google Play claiming to help Instagram users amass followers have been found stealing usernames and passwords for the social photo service. The fake apps were uncovered by Malwarebytes, and are still available, according to Nathan Collier, a security researcher with the firm. “As th...

Qualys Policy Compliance Notification: Policy Library Update

Qualys’ library of built-in policies makes it easy to comply with the security standards and regulations that are most commonly used and adhered to. Qualys provides a wide range of policies, including many that have been certified by CIS as well as the ones based on security guidelines from OS an...

FTC Demands Broadband Providers Reveal Data Handling Practices

The Federal Trade Commission FTC is putting pressure on internet broadband providers to reveal exactly what data they’re collecting – and how they are using it. The FTC on Tuesday issued orders to seven U.S. ISPs requesting that they detail how they collect, retain, use and disclose information...