Posted January 9, 2018
This weekly brief highlights the latest threat intelligence news to provide insight into the latest threats to various industries.
“The Homeland Security department’s internal auditor said on Wednesday that personal information of more than 247,000 Department employees and other people connected with the agency was compromised in 2014. The statement did not describe what personal information was compromised. Personal information can range from less sensitive information, such as names and phone numbers, to highly sensitive information, such as Social Security numbers and financial data. The department is offering free credit monitoring to employees and other people whose information was compromised. Employees were informed about the breach in a Wednesday letter, but the department won’t directly notify non-employees because of “technological limitations.”
Information Security Risk
“A social news aggregation, web content rating, and discussion website has confirmed it is investigating a possible internal security threat after several members of a cryptocurrency page reported their accounts were purportedly hacked and emptied of their funds. While the initial string of suspicions breaches allegedly began in December, several more users noted that their accounts were compromised recently. According to multiple reports, victims became aware of the security threat when they received emails that the password for their accounts had been changed. Shortly after that, affected users noticed the balance on their donation software accounts designed to facilitate cryptocurrency exchanges had been withdrawn without their consent.”
Legal, Litigation, + Regulatory Risk
“After a bevy of cyber heists in 2017 – one at a Bangladesh bank that raked in $80 million, the SWIFT Customer Security Controls Framework went into effect January 1, 2018 requiring all 11,000 SWIFT member banks in more than 200 countries to comply or face regulatory and economic consequences. Another 11 advisory, or optional, controls, such as vulnerability scanning, could become mandatory down the line as the framework – and threats to member institutions – evolve. “The first steps [in the framework’s evolution] would be making optional controls mandatory,” said a SWIFT official, who noted, “I don’t think we’ll ever be done” because bad actors never rest and new threats spring up with regularity. While organizations often drag their feet in adopting new cyber requirements, playing the odds that either they won’t be breached or found out by regulators, a bank’s compliance with the SWIFT framework is transparent to other members of the global messaging platform.”
“France’s president has said he plans to introduce new legislation aimed at curbing the spread of online fake news during election periods. Concern about how social media platforms are being misappropriated to channel and amplify disinformation has rocketed up the political agenda in recent years, most especially in the wake of the 2016 US presidential election and as more details have emerged about the extent of Russian-backed online content meddling. Speaking at a media briefing yesterday, Emmanuel Macron told journalists: “In election times content on the Internet will have to follow slightly different rules. As you know, propagating fake news on social media only requires a few tens of thousands of euros and can be done with total anonymity.” (via The Guardian) Macron was himself the target of attempted online smear campaigns ahead of his election last year. Including after hackers leaked campaign emails hours ahead of the vote, mixing some genuine emails with fake info such as false claims he was operating off-shore accounts in the Cayman Islands in an attempt to impact his electoral chances. He said the planned legislation will impose stricter transparency requirements on online platforms vis-a-vis advertiser content during election periods — by making it a requirement that advertisers’ identity be made public. He also suggested there will be caps on the amount of money that can be spent on sponsored content during these periods.”