Cyber Security Roundup for April 2016

The European General Data Protection Regulation (GDPR) was finally approved by the European Parliament this month. Coming into force in 2018, the GDPR has serious teeth with an up to 4% global turnover fine for non-compliance, and 72 hour mandatory data breach reporting amongst ground breaking data protection changes geared at improving EU citizen's privacy rights. The new data protection regulation will have significant impact all businesses in UK, even if the UK votes to leave the EU. 

An updated version of PCI DSS was also released; there are a number of minor changes to requirements within V3.2 which PCI DSS compliant businesses need to be aware of in order to avoid being caught out during compliance assessments. 

There were several huge data breaches from around world, with entire country populations personal data being compromised.  There was what could be a very defining UK lawsuit by 6,000 Morrisons staff against their company, after an employee stole and posted their personal details online.

News

• European Parliament approves GDPR
• PCI DSS V3.2 Released
• 6,000 staff join data breach lawsuit against Morrisons
• National Childbirth Trust suffers major Data BreachWorldpay Merchant Portal allowed Merchants to view Customer Card Data
• Personal Details of 50 million Turkish Citizens Leaked Online
• Huge data breach leaves details of 55 million Filipino voters exposed
• 93.4 million Mexican voters exposed in massive Database Leak
• BeautifulPeople.com hack exposes data of 1.1 million users
• Facebook hacker discovers traces of other intruder
• Sixth teen arrested in breach of UK ISP TalkTalk
• German Nuclear Plant hit by Computer Viruses
• Emergency Patch for Critical Adobe Flash Zero-Day
• Apple stops Patching QuickTime for Windows despite Two Security Flaws
• Cisco flags five product vulnerabilities that could trigger Denial of Service

Reports

• Axelos study finds UK Cyber Security Awareness Training Outdated
• 48% of UK Residents Fear Stolen Identities and Bank details
• DDoS attacks can cost a company over £703K per hour
• Ransomware and Phishing Attacks are up, once again
• Over half of companies feel investment in DDoS protection is justified

Cyber Security Roundup for March 2016

Ransomware attacks continue soar across all UK industry sectors, Trustwave SpiderLabs provided a excellent overview of how one of the most prolific ransomware strains works in How the Locky Ransomware Works. 

March saw media headlines dominated by Apple refusal to co-operate with the FBI in breaking the iPhone’s security, which concluded with the FBI successfully hacking iPhone via an anonymous third party, sparking the old but much needed Privacy V Security debate. 

There were also notable hacks of Law Firms and a major ‘Cyber Heist’ at the Federal Reserve Bank of New York by hackers. Another major TLS vulnerability named ‘DROWN’, highlights the importance of patching OpenSSL and not using weak crypto.

News

• DrownAttack could break TLS for a Third of Websites
• MassiveCyber Heist pulled on Bangladesh's Central Bank NY Fed Account
• USteam find Zero Day to hack Apple iCloud photo
• NatWest online banking suffers SMS 'smishing'scams
• FBIcracks iPhone, no longer needs Apple's Assistance
• Cyber Criminals 'Hacked Law Firms'
• Threemore US hospitals hit by Ransomware
• SAP software download App exposed passwordsthanks to serious Vulnerability
• Googlepatches Chrome 49 Vulnerabilities
• MassiveVolume of Ransomware Downloaders being Spammed
• Locky Ransomware 'on the rampage' Globally
• DarkWeb Forums found offering Cerber 'Ransomware as a Service'
• How the Locky Ransomware Works

Reports

• Third of UK Universities Victimised by Cyber Attacks – Vmware Survey
• CyberFraud losses increased by 26% in 2015 - Financial Fraud Action UK Report