Article by Evan Francen, CISM, CISSP, CEO of SecurityStudio originally appeared on Help Net Security

Spreadsheets are dumb. Okay, it’s not that spreadsheets are dumb, or that the people who use them are dumb. That’s not at all what I’m saying. What’s dumb is using spreadsheets to manage third-party information security risk. If I’m going to call something dumb, I’d better have some logic to back it up. Good thing. I do.

Read the full article

In the July issue of SECURITYSTUDIO News Brief, we bring you the top news and information about cybersecurity breaches across the globe. These not only have lasting effects for individuals and businesses, but also highlights the need for third-party risk management and tighter security protocols.

Employees Struggle

Third-Party Risk Management

  • New research shows more than one in 10 companies worldwide will lose more than $10 million after falling victim to a cyber attack. As a result, companies are boosting cybersecurity investments in the next fiscal year. Experts advise business leaders to pay close attention to the risks associated with their supply chain and partners, as they further increase the attack surface substantially.
  • A global survey recently revealed that IT managers are inundated with cyber attacks coming from all directions and are struggling to keep up due to a lack of security expertise, budget and up-to-date technology. As part of the report, only 16 percent of respondents consider supply chain a top security risk, exposing an additional weak spot.
World Computer Patch

World News

  • The cyber warfare threat is rising as Iran and China agree to a “united front” against the U.S. Experts claim this is the beginning of a cyber war between countries and the Cybersecurity and Infrastructure Security Agency (CISA) within the DHS issued a blanket warning about a recent rise in malicious cyber activity directed at U.S. industries and government agencies by Iranian regime actors and proxies.

Business Impact

Computer Patch Update
  • Many organizations around the world haven’t patched older Windows systems against the BlueKeep vulnerability that could let attackers take over devices. This is despite warnings from Microsoft, government agencies and cybersecurity companies. Many organizations may not know they have a system with the vulnerability.
  • With the 2020 election upon us, the Federal Election Commission ruled that a cybersecurity company could legally offer discounted services to presidential campaigns hoping to protect themselves from cyberattacks. Cybersecurity is on the forefront of this campaign, given the U.S. intelligence community’s warnings of Russia’s intentions to escalate its interference.
  • Apple has taken an extraordinary move and released a silent update to protect its users from a yet-to-be-disclosed vulnerability that could compromise Macs that have the Zoom video conferencing software installed. The silent update removes a clandestine web server Zoom installed in older versions of its software that can’t be removed through a standard uninstall process.
  • Security researchers have uncovered a new vulnerability in a Siemens software platform for industrial control systems in large critical infrastructure facilities, such as nuclear power plants. An attacker could gain access to these systems for espionage or cause widespread physical damage.

Personal Impact

Credit Card Phishing
  • A new type of phishing campaign is specifically targeting American Express card holders after attackers send a hyperlink as part of a phony account update. This phishing attack is different because instead of using a hyperlink to send victims to a malicious landing page, the scheme deploys an embedded “base href” URL to help hide from anti-virus and other security tools.

SecurityStudio® is the easiest, most comprehensive information security toolkit to measure, mitigate and manage risk. Our goal is to help all organizations build and maintain a strong information security program. We do this by helping organizations understand the need for strong information security, identifying and prioritizing their risks and implement secure methods to address those risks. https://securitystudio.com

Article by Evan Francen, CISM, CISSP, CEO of SecurityStudio originally appeared on Security Today

Some third-parties (or vendors) will think of every excuse in the book for not completing your information security risk assessment. The fact is, there are very few valid excuses.

In this article, I’ll cover a recent real-world example where a vendor used came up with no less than 10 excuses. It takes some creativity to come up with so many excuses for not completing one questionnaire!

We’ll take each excuse and address it with a rebuttal, one by one. Use this article as a reference for your own third-party due diligence.

The foundation of every third-party relationship is just that, the relationship. Relationships with third-parties are just like relationships between people. A good relationship is based upon mutual trust and transparency.

When someone in a relationship fails to provide clear answers to legitimate questions you have about the nature of the relationship, it should erode trust and force you to act.

This is especially true in a customer/vendor relationship where the customer is supposed to be the one in power. As a customer, you deserve answers, NOT excuses.

What better way to demonstrate a point than to use a real-world scenario? In this scenario, the vendor came up with at least 10 excuses over the course of nearly four months for not complying with their customer’s request. Ready? Here we go.

Read the full article

In the June issue of SECURITYSTUDIO News Brief, we bring you the top news and information about cybersecurity breaches across the globe. These not only have lasting effects for individuals and businesses, but also highlights the need for third-party vendor risk management and tighter security protocols.

Third-Party Risk Management

Third Party Vendor Risk Management
  • Most organizations work with hundreds, if not thousands, of third parties, which creates new risks that must be actively managed. Although businesses know that managing third-party cyber risk is critical, a lack of continuous monitoring, consistent reporting and other blind spots are creating challenges that could leave organizations vulnerable to data breaches and other consequences.
  • According to the National Cyber Security Alliance, healthcare companies have increasingly become a target for hackers given the vast amounts of information collected and stored. Robust vendor management strategies are necessary as part of a comprehensive approach to cybersecurity.

World News

World News
  • Amid escalating tensions with Iran, the U.S. military cyber forces launched a strike against Iranian military computer systems. These cyberattacks targeted Iran’s Islamic Revolutionary Guard Corps computer system and disabled the computer systems that controlled its rocket and missile launchers.
  • The Kremlin warned that reported American hacking into Russia’s electric power grid could escalate into a cyberwar with the United States, but insisted that it was confident in the system’s ability to repel electronic attacks. The program, as described by current and former unidentified American officials, would enable an attack on the Russian power grid in the event of a major conflict between Moscow and Washington

Business Impact

Florida Data Hack
  • Attacks against municipalities continue as the city of Riviera Beach, FL, has agreed to pay hackers roughly $600,000 in bitcoin to end a ransomware attack that crippled the city’s IT infrastructure for nearly a month. Reports indicate it may have started when someone in the city’s police department opened a phishing email.
  • The Cybersecurity and Infrastructure Security Agency (CISA), the cybersecurity wing of the Department of Homeland Security, issued an alert regarding BlueKeep, which had used BlueKeep to remotely run code on a Windows 2000 computer. This means that the code can be used for more than just a denial-of-service condition, but can be used to remotely run code or malware on an unpatched computer.
  • A urology practice in Ohio and an eye care provider in Indiana are among the latest victims of ransomware attacks in the healthcare sector. The urology practice reported a revenue loss between $30,000 and $50,000 per day as a result of the attack. The ransomware attack in Indiana is listed among the 10 top largest breaches added thus far in 2019 to the Department of Health and Human Services HIPAA Breach Reporting Tool.

Personal Impact

Venmo Transactions
  • A computer science student, Dan Salmon, has been scraping Venmo transactions for the past six months to prove that Venmo’s public activity is not hard to obtain, even after last year, when a privacy researcher showed that Venmo needed to curb its privacy issue. The result is that seven million Venmo transactions were obtained by Salmon in this six-month period.
  • The personal data of more than 650,000 clients of Oregon’s Department of Human Services was compromised during a January data breach. The department announced in March that more than 350,000 clients had been impacted, but they were doing an investigation and had not finished yet. When the department completed the investigation this week, they concluded that the number of clients affected was much higher than the original figure released.
  • Cyber security experts have warned that strange invitations are showing up in people’s Google calendars as part of a dangerous scam to trick them into being attacked. Users could see their data or money stolen after clicking on a link to a URL included in the calendar event.

SecurityStudio® is the easiest, most comprehensive information security toolkit to measure, mitigate and manage risk. Our goal is to help all organizations build and maintain a strong information security program. We do this by helping organizations understand the need for strong information security, identifying and prioritizing their risks and implement secure methods to address those risks. https://securitystudio.com