Screen Shot 2017-02-23 at 11.03.16.png

The cost of a breaches has hit a new level with the current Verizon acquisition of Yahoo that depleted the sale value by $350M;  Google discloses a critical Windows vulnerability that still exists from a previous incomplete patch;  Brian Krebs, a cybersecurity guru, discloses his investigation of an undisclosed breach that potentially hit many Fortune 500 companies.

 

 

 

Cost of a Data Breach

Estimated costs of a breach vary, but a degraded sale acquisition is now a factor.  Cyber-security is an investment after all.

 

Why is this significant?

  • In 2013, Target's breach containing 110M records, including 70M personal details and 40M credit cards were breached, which shocked the world with the total data breach cost of $252 million. 
  • Ponemon Institute’s 2016 report average consolidated total cost of a data breach is $4 million and each breached record is on average $158.  
  • In the Verizon acquisition of Yahoo, the data breaches dropped the acquisition price by $350M, essentially reducing the value of the company as a result of an estimated 500M accounts were compromised.

 

Read the full story on Network World

 

 

Vulnerability Disclosure

Google discloses a Windows vulnerability containing a POC exploit.

 

Why is this signficant?

  • This vulnerability was initially issued on June 9, 2016 and not all issues were addressed in the patch.  This is not the first time there is an incomplete patch. Also the .lnk Stuxnet vulnerability was patched in 2015 when Stuxnet was exposed. In 2015, the .lnk vulnerability was “re-discovered” by Mark Heerklotz.
  • Microsoft’s monthly patch Tuesdaywas pushed back and it could have been due to this critical vulnerability.  Which pushes the question of:  Are monthly patches reigned acceptable with the forever changing threat landscape? 
  • This vulnerability if exploited,  could potentially allow threat actors to dive deep into the memory if any program uses the exploit via Windows' Graphics Device Interface (GDI)
  • Just a few of months ago, Google’s Project Zero received criticism when publically disclosing a Window’s vulnerability prior to the industry’s recognized 90-day grace period.  

 

Read the full story in The Hacker News

 

Cyber Attacks

There is a strong disconnect between company executives and IT decision makers on the responsibility of a cyber- attack.

Why is this signficant?

  •   “71% of these senior executives believe cyber security to be the most significant business challenge facing them. Perhaps more significantly, almost exactly the same proportion of the IT leaders expect to be targeted by a cyber attack in the next 12 months.”
  •  “80% of IT teams report that their cyber security spend is part of a comprehensive strategy, but only half of the senior executives believe this to be the case. “
  • We continue to see that companies need to invest in more than just the first line of defense. A comprehensive endpoint security platform containing a unique post infection protection engine eliminates obvious cyber threats and in addition stops the attacker from freezing data using ransomware, tampering data or simply stealing it. 

**// Interested in comprehensive endpoint security? Prevent the consequences of cyber attacks...  Read more here //**

Read the full story in Forbes

Undisclosed Breach

Brian Krebs connected a vague RSA report on malware campaign, Kingslayer, to a breach in a company that sells software for system administrators. 

 

Why is this significant?

  • Apparently, a website selling software that assists Windows system admins to better understand Windows event logs was compromised from April 9, 2015 – April 25, 2015.  
  • The compromised website potentially allowed the attackers to hack the company’s software update server, translating to any software update with existing software would in turn be compromised.
  • Krebs aligned the Kingslayer RSA report to a June 30, 2016 reported breach of Altair Technologies Ltd. which revealed "supply chain attacks” that hit several Fortune500, companies that do not have any prior released breach reports to date.

Read the full story on KrebsOnSecurity