The new rules do not give a "free pass" for those acting in bad faith, the DOJ says. (Source: U.S. Department of Justice)

DOJ Revises Policy for Good-Faith Security Researchers

Mihir Bagwe • May 20, 2022

The U.S. Department of Justice has revised its policy on who it charges with violations under the Computer Fraud and Abuse Act. The DOJ now specifies that good-faith security research and researchers cannot be charged under the CFAA because they help improve cybersecurity standards.

3rd Party Risk Management

Trusting Our Global Supply Chain

Profiles in Leadership: Octavia Howell, Equifax Canada

Latest

Application Security

Pathlock-Appsian Deal Combines App Governance, ERP Security

Michael Novinson • May 20, 2022

Pathlock has merged with Appsian to form a 500-person vendor that secures users and data across SAP and Oracle's ERP apps. Bringing Pathlock, Appsian and Security Weaver together will allow the firm to take a larger bite out of the $110 billion market focused on compliance testing for business apps.

Business Continuity Management / Disaster Recovery

ISMG Editors: The Case of the 'Dr. Evil' of Ransomware

Anna Delaney • May 20, 2022

In the latest update, four ISMG editors discuss the alarming, bizarre case of a cardiologist in Venezuela charged with developing malware and recruiting affiliates, recent ransomware and data leak incidents in healthcare and how the economy is causing mature cybersecurity startups to slow hiring.

3rd Party Risk Management

Canada Bans Huawei, ZTE to Secure Telecom Systems

Prajeet Nair • May 20, 2022

Canada says it will no longer allow the use of products and services from China's Huawei Technologies and ZTE Corp. in its telecommunications systems. The government says its decision is based on reviews by independent security agencies and was made in consultation with its "closest allies."

Endpoint Detection & Response (EDR)

Palo Alto CEO: Vendor Consolidation Is Fueling Our Growth

Michael Novinson • May 19, 2022

Palo Alto Networks' product portfolio is paying dividends as customers look to reduce their vendor footprint, says CEO Nikesh Arora. He says despite pressures in the global economy, enterprises aren't currently stressing about their IT budgets.

Fraud Management & Cybercrime

Ransomware Attack Vectors: RDP and Phishing Still Dominate

Mathew J. Schwartz • May 19, 2022

Attackers who successfully infect targets with ransomware primarily first gain access by exploiting poorly secured remote desktop protocol or VPN connections or by using malware-laden phishing emails, reports security firm Group-IB, based on more than 700 attacks it investigated in 2021.

Critical Infrastructure Security

Ransomware Ecosystem: Big Changes Since Colonial Pipeline

Anna Delaney • May 19, 2022

The latest edition of the ISMG Security Report analyzes the changes in the ransomware landscape one year after the attack on Colonial Pipeline. It also revisits the Ryuk ransomware attack on a school district in Illinois and examines common culprits hindering effective Zero Trust adoption.

Access Management

Proof of Concept: Apple/Microsoft/Google Back Passwordless

Anna Delaney • May 16, 2022

In the latest "Proof of Concept," Lisa Sotto, Jeremy Grant and ISMG editors discuss the significance of Apple, Google and Microsoft supporting the FIDO protocol's passwordless sign-in standard, progress made on Biden's cybersecurity executive order and updates on U.S. cybersecurity and privacy laws.

Next-Generation Technologies & Secure Development

Late-Stage Startups Feel the Squeeze on Funding, Valuations

Michael Novinson • May 13, 2022

Mature cybersecurity startups are beginning to slow hiring and prune operating expenses as macroeconomic storm clouds obscure future funding sources. Emerging vendors must grapple with an IPO market that has essentially dried up and investors unwilling to offer valuations anywhere near 2021 levels.

3rd Party Risk Management

A $150 Million Plan to Secure Open-Source Software

Brian Pereira • May 13, 2022

The Linux Foundation and the Open Source Security Foundation have put forth a nearly $150 million investment plan, spread across two years, to strengthen open-source security in the U.S. The plan was announced at the Open Source Software Security Summit II in Washington, D.C., on Thursday.

Blockchain & Cryptocurrency

ISMG Editors: What Have We Learned From the Conti Leaks?

Anna Delaney • May 13, 2022

In the latest update, four editors at Information Security Media Group discuss the intriguing insights exposed by the leak of ransomware gang Conti's internal communications, the U.S. Treasury's first-ever sanctions on a cryptocurrency mixer and the latest cyber activity in Russia's hybrid war.

3rd Party Risk Management

Tips to Improve Medical Device Vulnerability Communications

Marianne Kolbasuk McGee • May 13, 2022

New Health Sector Coordinating Council guidance aims to help medical device makers improve their communications regarding security vulnerabilities in their products, says Matt Russo, a security leader at Medtronic and a member of the task group that developed the document.

Healthcare

Profiles in Leadership: Dennis Leber

Tom Field • May 12, 2022

Dennis Leber, CISO and CTO at the University of Tennessee Health Science Center, says cybersecurity is not just a profession - it's a lifestyle. And as he leads this life, he finds one of today's biggest cybersecurity threats is not ransomware or IP theft - it's "the buzzword mentality."