A security researcher has uncovered what may rank as one of the most significant iOS weaknesses ever discovered: a flaw that enables bypassing the security protections present in most Apple mobile devices. While the vulnerability can't be patched, an attacker would need physical access to exploit it.
What are some of the most important aspects in managing vendor security risk when taking on third parties to handle sensitive data? Mitch Parker, CISO of Indiana University Health, explains the critical steps his organization is taking in its approach to vendor risk.
Delayed enforcement of the "strong customer authentication" requirements for online transactions under the European Union's PSD2 regulation is hampering efforts to enhance security. That's why the European Banking Authority should act quickly to develop a new timeline.
The city of Baltimore's ransomware outbreak - $18 million in costs and counting - led to many crypto-locked files being lost forever, because no IT policy mandated centralized file backups. But effective IT solutions exist to help solve this challenge, provided they're deployed in advance of an attack.
More proof that when it comes to crime, there's nothing new under the sun: Federal prosecutors have charged two men with attempting to extort cryptocurrency worth more than $12 million from a startup firm planning to undertake an initial coin offering, in part via physical intimidation.
Two Kazakhstan nationals have pleaded guilty to charges stemming from their role in helping to run a $29 million online advertising fraud scheme that the FBI worked with several security firms to shut down in 2018.
Food delivery startup DoorDash says 4.9 million customer, contractor and merchant records were breached after "unusual activity" by a third-party service provider. Even aside from the usual identification data, experts say certain data - such as food allergies - could pose risks in the wrong hands.
The latest edition of the ISMG Security Report features an analysis of Donald Trump's comments about "the server" in a discussion with the president of Ukraine. Also: insights on "privacy by design" and highlights of ISMG's Cybersecurity Summit in Toronto.
A threat group has been targeting U.S. veterans through a spoofed website promising help for those looking for jobs, according to research from Cisco Talos. Instead of providing job links, however, the phony website installs malware and spyware on a victim's device.
The Russia-based cyberespionage group Fancy Bear, which has led high-profile cyberattacks against governments and embassies over the last several years, has launched a phishing campaign that includes a redesigned backdoor, according to research from security firm ESET.
Why did U.S. President Donald Trump discuss cybersecurity firm CrowdStrike with the president of Ukraine, saying "the server, they say Ukraine has it"? Experts say Trump appears to be referring to one or more conspiracy theories, none of which have a basis in reality.
APT groups that are backed by the Russian government rarely share code with each other, fostering a competitive landscape, according to a new report. This shows that Russia is willing to push the limits of its sophisticated cyber capabilities, researchers conclude.
Did the gang behind GandCrab fake its retirement? Security experts say there's mounting evidence that the operators of the notorious ransomware-as-a-service operation only announced their retirement after ramping up the rival Sodinokibi/REvil service.