News

Volume of new vulnerabilities has increased three-fold in a decade

With the right (or wrong, if you’re on the right side of the fence) timing…

New paper: “Lessons Lost: Incident Response in the Age of Cyber Insurance and Breach Attorneys“:

Abstract: Incident Response (IR) allows victim firms to detect, contain, and recover from security incidents. It should also help the wider community avoid similar attacks in the future. In pursuit of these goals, technical practitioners are increasingly influenced by stakeholders like cyber insurers and lawyers. This paper explores these impacts via a multi-stage, mixed methods research design that involved 69 expert interviews, data on commercial relationships, and an online validation workshop. The first stage of our study established 11 stylized facts that describe how cyber insurance sends work to a small numbers of IR firms, drives down the fee paid, and appoints lawyers to direct technical investigators. The second stage showed that lawyers when directing incident response often: introduce legalistic contractual and communication steps that slow-down incident response; advise IR practitioners not to write down remediation steps or to produce formal reports; and restrict access to any documents produced.

So, we’re not able to learn from these breaches because the attorneys are limiting what information becomes public. This is where we think about shielding companies from liability in exchange for making breach data public. It’s the sort of thing we do for airplane disasters.

Qualys identified one instance of privilege escalation and two heap-based buffer overflows

The Palo Alto Networks report also suggests Linux malware emerged as a growing concern last year

Vulcan Cyber’s Voyager18 research team called the technique “AI package hallucination”

Annual Verizon report reveals humans are still a major source of risk

Fallout from Operation Triangulation continues

Boots, BA, the BBC and more have data compromised

Chrome 0-day patched now, Edge patch coming soon.