Newsroom

Stay informed on the latest news from Infosec.

All news

Demystifying CMMC: How It Can Help Counter Current Cyberattacks

The publicly available Cybersecurity Maturity Model Certification (CMMC) is getting a lot of attention these days, both within and outside the public sector. Developed by the U.S. Department of Defense in response to escalating cyberattacks aimed at the defense industrial base and DoD supply chain, CMMC has broader appeal for any organization determining the maturity of its IT security controls.

Certified ethical hacker: CEH certification cost, training, and value

Certified Ethical Hacker (CEH) is an early-career certification for security pros who want to demonstrate that they can assess weaknesses in target systems, using techniques often associated with hackers to help identify vulnerabilities for employers or clients.

These Are The 6 Things You Must Do Right Now To Secure Your Company’s Data

I have a client who was the victim of a ransomware attack. As a result of this attack, all her files were locked and encrypted. She was told that if she paid $100, she would get a “key” with a special code to decrypt her files. They wanted the $100 to be paid in Bitcoin. She didn’t know what to do. However, the ransomware attackers provided a toll-free number for her to call.

Cybersecurity Begins With Employee Wellness

An effective cybersecurity strategy requires a multi-layered approach. Employee security awareness is not a “silver bullet,” but it plays a significant role in mitigating security risk regardless of your operating environment — at the office, hybrid or work from home,” says Jack Koziol, President & Founder, Infosec, in an exclusive interview with ITSecurityWire.

Security in Software Development 2021: Guide for IT Business Leaders

Security is one of the most important aspects of software development, and will only become more so over time. With new technologies coming out every day, it's hard to keep up with all the security updates that are needed. This blog post will give you a guide for security in 2021, to help you stay ahead of the game.

Building an Effective Cybersecurity Culture

You can have a top-notch cybersecurity defense in place, but if employees aren't taking their responsibilities seriously, your organization will still be at risk. That's why a strong cybersecurity culture is a must.

Reaction to Social Engineering Indicative of Cybersecurity Culture

During COVID-19, threat actors used fear of the virus and hope of a vaccine to trick unwitting victims into downloading malware or giving up their credentials. It was a master class in social engineering, one that put an organization’s security posture at risk.

Cyberbullying Insurance Is Here. Do You Need It?

If you’re a victim of cyberbullying, you might be entitled to compensation. That’s the pitch insurance companies are selling to families and individuals, as cyberbullying among adults, tweens and teens becomes more common.

Study Reveals an Urgent Need to Quantify Cybersecurity Culture

Studies have shown that organizations with strong cybersecurity cultures experience increased visibility into potential threats, reduced cyber incidents and greater post-attack resilience among other benefits. However, cybersecurity culture has historically been seen as an abstract concept and difficult to quantify.

A series of unfortunate events… Or more? What story the recent cybersecurity attacks could be telling

Recently there has been a dizzying number of major breaches disclosed within just months and sometimes weeks of each other. I’ve been paying close attention and doing a bit of research into the most recent data breaches, especially the more notable ones. The most recent heavily covered incident, the JBS hack, is already having an impact on the food industry.

10 old software bugs that took way too long to squash

In 2021, a vulnerability was revealed in a system that lay at the foundation of modern computing. An attacker could force the system to execute arbitrary code. Shockingly, the vulnerable code was almost 54 years old—and there was no patch available, and no expectation that one would be forthcoming.

7 ways technical debt increases security risk

Shoddily developed and deployed projects can leave your enterprise vulnerable to attacks. Here's how to stop technical debt from sending your organization to the cyber-poorhouse.

Employees Can Be Major Contributors To Your Cyber Defense: Infosec Security Awareness Training

Tyler Schultz, product marketing manager at Infosec, talks to us about Infosec IQ, current trends in cyber security, and the importance of building a strong cybersecurity culture with employees at the heart of it.

Wisdom From The Women Leading The Cybersecurity Industry, With Andrea Harston of Infosec

The cybersecurity industry has become so essential and exciting. What is coming around the corner? What are the concerns we should keep an eye out for? How does one succeed in the cybersecurity industry? As a part of this interview series called “Wisdom From The Women Leading The Cybersecurity Industry”, we had the pleasure of interviewing Andrea Harston, Curriculum Director of Content,

Infosec IQ release: Yeti Escape teaches remote work security

The third installment in our Pick Your Path security awareness series is here. Play Yeti Escape today and see what else is new in Infosec IQ.

Securing The Next Generation Of 911

Shifting from an analog to digital operating environment — the next generation of 911 — will require strategic investments into three key areas: people, processes and technology. As call center technology evolves nationwide, the need for greater cybersecurity in the public safety space has never been more important.

McDonald's suffers cyberattack in US, South Korea and Taiwan

McDonald's is the latest company to fall victim to a cyberattack exposing customer and other data in the U.S., Taiwan and China, The Wall Street Journal has reported. The restaurant giant reportedly told the paper that it has hired external investigators to analyze unauthorized activity on an internal security system.

Department of Justice recovers more than half ransom paid by Colonial Pipeline

The Department of Justice recently recovered more than half of the ransom Colonial Pipeline paid to hackers after shutting down its East Coast pipeline for six days. Still, other corporate ransomware victims should not count on getting similar assistance.

Should You Invest in Cardano?

Ethereum – the name of the blockchain platform itself is often used interchangeably with its native cryptocurrency token, Ether (ETH) – is the second most valuable cryptocurrency project out there, only trailing Bitcoin (BTC). Yet, even as Ethereum seeks to overtake Bitcoin, it has a newer rival coming up to try to take its place.

Data Protection is Security: 4 Ways MSPs Can Sell the Value of BDR

Managed Service Providers (MSPs) and their clients are growing numb to the ransomware threat, but that doesn’t change the very real situation that remains. As you know, not only have ransomware attacks been rising year after year, but since remote work became a must, it continues to spike. No, this is not another ransomware article.

9 Modern-Day Best Practices for Log Management

Log management is nothing new. But doing so smartly, correctly, and concisely in today's data-driven world is another story.

ROUNDTABLE: Experts react to President Biden’s exec order in the aftermath of Colonial Pipeline hack

As wake up calls go, the Colonial Pipeline ransomware hack was piercing. The attackers shut down the largest fuel pipeline in the U.S., compelling Colonial to pay them 75 bitcoins, worth a cool $5 million.

Wi-Fi Design, Implementation Flaws Allow a Range of Frag Attacks

Every Wi-Fi product is affected by at least one fragmentation and aggregation vulnerability, which could lead to a machine-in-the-middle attack, researcher says.

The Colonial Pipeline Attack is Emblemic of Bigger IIoT Woes

With the regularity of cyberattacks, it comes as a surprise the attention the hack of the Colonial Pipeline has received. It’s not because the attackers had a nefarious plan to disable critical infrastructure like we’ve seen in the past with PLC attacks like Stuxnet and DDoS attacks like WannaCry – they didn’t.