Security Operations

PwC UK partners with ReversingLabs to bring software supply chain security to third-party risk management

Blackbaud penalized $3M for not disclosing the full scope of ransomware attack

The company detected unauthorized access to its systems in May 2020 that impacted 13,000 customers.

PayPal sued for negligence in data breach that affected 35,000 users

Alleged data breach victims have sued PayPal in federal court for failing to safeguard their personal data, and are asking for class-action certification.

Malicious package flood on PyPI might be sign of new attacks to come

The PyPI package flood is just the latest in a string of attacks on public repositories with the intent to plant malicious code.

What CISOs need to know about the renewal of FISA Section 702

Section 702 of the Foreign Intelligence Surveillance Act sets out the rules for the US intelligence community around gathering information abroad—but is it inadvertently being used at home too?

New “MITRE ATT&CK-like” framework outlines software supply chain attack TTPs

The OSC&R Framework aims to help security professionals better understand and measure software supply chain risk.

US DOJ applies carrot-and-stick approach to Foreign Corrupt Practices Act policy

Corporations (and their CISOs) that discover wrongdoing or corruption within their own business are well-advised to self-report such activities and cooperate with prosecutors. The stakes are high for those who don’t.

US Supreme Court leak investigation highlights weak and ineffective risk management strategy

The court’s inability to find out who leaked the draft decision and how they did it is a cautionary tale for CISOs about safeguarding sensitive information and intellectual property.

US Maritime Administrator to study port crane cybersecurity concerns

Recently passed legislation might have been spurred by supply chain disruption and surveillance concerns enabled by Chinese-made cranes.

The BISO: bringing security to business and business to security

Even the most tech-savvy leaders can use an effective liaison between corporate and cybersecurity—the business information security officer (BISO) bridges communications gaps and acts as a security evangelist and gatekeeper.