Podcasts about Phishing

Guest: Matthew Rosenquist, CISO at Eclipz.ioOn LinkedIn | https://www.linkedin.com/in/matthewrosenquist/On Twitter | https://twitter.com/Matt_RosenquistOn Medium | https://matthew-rosenquist.medium.com/____________________________Host: Sean Martin, Co-Founder at ITSPmagazine [@ITSPmagazine] and Host of Redefining CyberSecurity Podcast [@RedefiningCyber]On ITSPmagazine | https://www.itspmagazine.com/itspmagazine-podcast-radio-hosts/sean-martin____________________________This Episode's SponsorsImperva: https://itspm.ag/imperva277117988HITRUST: https://itspm.ag/itsphitweb___________________________Episode NotesIn the last episode on this topic, Matthew gave us some insights into how and where he expected cybersecurity to take us in 2022. During the conversation he said, “Cybersecurity will continue to rapidly gain in both relevance and importance in 2022 as the world relies more upon digital technologies and unknowingly embraces the increasing accompanying risks of innovation. 2022 will see the rise of government orchestrated cyber-offensive activities, the growth of cybercriminal impacts at a national level, and the maturity of new technology used as powerful tools by both attackers and defenders. Overall, 2022 will be a more difficult and trying year for cybersecurity than its predecessors.”In this episode, we take a look back at the year of cybersecurity that was 2022, including the predictions, the outcomes, and the misses. It's a wild ride that you won't want to miss, even if you experienced some of it first-hand in your own InfoSec programs.____________________________ResourcesPrevious Episode #844 - It Is 2022: Here Are Some Cybersecurity Predictions And Their Impact On Business, Governments, Citizens, And Society: https://itsprad.io/redefining-security-844Original 10 Predictions: https://www.linkedin.com/pulse/10-cybersecurity-predictions-2022-matthew-rosenquist/____________________________To see and hear more Redefining CyberSecurity content on ITSPmagazine, visit:https://www.itspmagazine.com/redefining-cybersecurity-podcastWatch the webcast version on-demand on YouTube: https://www.youtube.com/playlist?list=PLnYu0psdcllS9aVGdiakVss9u7xgYDKYqAre you interested in sponsoring an ITSPmagazine Channel?

On this week's show Patrick Gray and Adam Boileau discuss the week's security news, including: Google's search results have become a malware-riddled sh*tshow Ransomware payment values dropped by 40% YoY in 2022 Kraken takes over Solaris the old school way Grand Theft Auto RCE is wreaking havoc ManageEngine customers are all getting owned So you know, pretty much business as usual This week's show is brought to you by Kroll. Jim Hung co-leads the special projects and applied research team at Kroll and joins us to talk about the big changes happening in the incident response discipline. Links to everything that we discussed are below and you can follow Patrick or Adam on Mastodon if that's your thing. Show notes Risky Biz News: Google Search and Ads have a major malware problem Justice Department Sues Google for Monopolizing Digital Advertising Technologies | OPA | Department of Justice Hackers push malware via Google search ads for VLC, 7-Zip, CCleaner A Sneaky Ad Scam Tore Through 11 Million Phones | WIRED Risky Biz News: Crypto-crime volumes went down in 2022, ransomware payments too International Counter Ransomware Task Force kicks off - The Record from Recorded Future News Risky Biz News: Dark web mega-hack as Kraken takes over Solaris Congressman ‘coming for answers' after ‘no-fly list' hack - The Record from Recorded Future News Hackers Demand $10M From Riot Games to Stop Leak of ‘League of Legends' Source Code CVE - CVE-2023-24059 GoTo says hackers stole encrypted backups during November cyberattack - The Record from Recorded Future News Costa Rica's Ministry of Public Works and Transport crippled by ransomware attack - The Record from Recorded Future News Pakistani authorities investigating if cyberattack caused nationwide blackout - The Record from Recorded Future News Royal Mail trials ‘operational workarounds' following suspected ransomware attack - The Record from Recorded Future News Ransomware attack hits nearly 300 fast food restaurants in UK, including KFC and Pizza Hut - The Record from Recorded Future News Canada's largest alcohol retailer infected with card skimming malware twice since December - The Record from Recorded Future News Nearly 35,000 PayPal users had SSNs, tax info leaked during December cyberattack - The Record from Recorded Future News Samsung investigating claims of hack on South Korea systems, internal employee platform - The Record from Recorded Future News Electronic health record giant NextGen dealing with cyberattack - The Record from Recorded Future News Cyberattack on Nunavut energy supplier limits company operations - The Record from Recorded Future News More than 100 Mailchimp accounts accessed via social engineering cyberattack - The Record from Recorded Future News New T-Mobile Breach Affects 37 Million Accounts – Krebs on Security Suspected Chinese hackers exploit vulnerability in Fortinet devices - The Record from Recorded Future News More than 4,400 Sophos firewall servers remain vulnerable to critical exploits | Ars Technica CVE-2022-47966: Rapid7 Observed Exploitation of Critical ManageEngine Vulnerability | Rapid7 Blog AWS patches bypass bug in CloudTrail API monitoring tool | The Daily Swig 2022 Microsoft Teams RCE Git security audit reveals critical overflow bugs | The Daily Swig U.S. arrests Bitzlato cofounder, alleges $700 mln of illicit funds processed | Reuters FBI Confirms Lazarus Group Cyber Actors Responsible for Harmony's Horizon Bridge Currency Theft — FBI

In the construction business, the engine of your economy is the technology that allows you to get the work done. With the constant risk of hacking, phishing, and fraud, your tools must always be protected by proper cybersecurity measures. If you fail to protect your data in today's easy-to-access digital world, your business could be taken down even with one swift online attack. Join Eric Anderton as he talks to Nick Espinosa, Founder and Chief Security Fanatic of Security Fanatics. Discover why your construction business needs the highest level of cybersecurity right now. Find out how IT and cybersecurity are different, the best ways to protect your business through silos, and how to assess online risks without delay. Discover all you need to know about cybersecurity and keep your data safe at all costs!

Link to Blog Post This week's Cyber Security Headlines - Week in Review, January 16-20, is hosted by Rich Stroffolino  with our guest, George Finney, CISO, Southern Methodist University Thanks to our show sponsor, Cerby   Did you know that over 60% of the cloud applications used by your company don't support identity standards like single sign-on? And that these applications are the leading cause of breaches? Cerby can help. Cerby discovers new applications, eliminates manual security tasks like offboarding, and addresses misconfigurations like disabled 2FA while increasing employee productivity. Wait. A security tool that increases productivity? Yup. Learn more at cerby.com. All links and the video of this episode can be found on CISO Series.com  

Ransomware hits Costa Rican government systems, again. A Chinese threat actor deploys the BOLDMOVE backdoor against unpatched FortiOS. Credential stuffing afflicts PayPal users. T-Mobile discloses a data breach. A cyberattack hits a remote Canadian utility. The Wagner Group sponsors a hackathon. Malek Ben Salem from Accenture describes prompt injection for chatbots. Our guest is Paul Martini of iboss with insights on Zero Trust. And the FSB's Gamaredon APT runs a hands-on Telegraph phishing campaign against Ukrainian targets. For links to all of today's stories check out our CyberWire daily news briefing: https://thecyberwire.com/newsletters/daily-briefing/12/13 Selected reading. Bolster Your Company Defenses With Zero Trust Edge (Forrester) MICITT detecta incidente informático en el MOPT, el cual ya se encuentra contenido (MICITT) MOPT mantiene habilitados todos los servicios de manera presencial (MICITT) Costa Rica's Ministry of Public Works and Transport crippled by ransomware attack (Record) Suspected Chinese Threat Actors Exploiting FortiOS Vulnerability (CVE-2022-42475) (Mandiant)  Attackers Crafted Custom Malware for Fortinet Zero-Day (Dark Reading) Chinese hackers used recently patched FortiOS SSL-VPN flaw as a zero-day in October (Security Affairs)  PayPal accounts breached in large-scale credential stuffing attack (BleepingComputer) PayPal Confirms Over 34,000 Customer Accounts Were Breached (EcommerceBytes) 35,000 PayPal accounts hacked, and users could've prevented it (PCWorld) Thousands Of PayPal Accounts Hacked—Is Yours One Of Them? (Forbes) Nearly 35,000 PayPal users had SSNs, tax info leaked during December cyberattack (The Record from Recorded Future News) T-Mobile Says Hacker Stole Data for 37 Million Customers (Bloomberg) T-Mobile Says Hackers Stole Data on About 37 Million Customers (Wall Street Journal) T-Mobile Says Hackers Used API to Steal Data on 37 Million Accounts (SecurityWeek) Cyberattack hits Nunavut's Qulliq Energy Corp. (CBC News)  Nunavut power utility's servers hit by cyber attack | IT World Canada News (IT World Canada) Russian War Report: Russian hacker wanted by the FBI reportedly wins Wagner hackathon prize  (Atlantic Council) Gamaredon (Ab)uses Telegram to Target Ukrainian Organizations (Blackberry) Gamaredon Group Launches Cyberattacks Against Ukraine Using Telegram (The Hacker News)  Hitachi Energy PCU400 (CISA)  Bolster Your Company Defenses With Zero Trust Edge (iBoss)

Ok – so I think what is going on now.  The payment fraud that happened during the rush of year-end is starting to be found.  I get the calls or emails – but the problem is – there is no tip or set of tips I can say on a phone call or in an email that will fix the problem – because the problem is bigger than that.  So, on today's episode is what I think every vendor team needs to do to prevent payment fraud.  Keep listening.  Check out my website www.debrarrichardson.com if you need help cleaning your vendor master file or implementing authentication techniques, internal controls, and best practices to prevent fraudulent payments, regulatory fines or bad vendor data.  Subscribe today to be entered in the subscriber-only monthly drawing to win a free Putting the AP in hAPpy Coffee Mug.  Links mentioned in the podcast:    Webinar:  20 Tips in 20 Minutes:  How Vendor Teams Can Avoid Business Email Compromise in 2023Webinar:  How Vendor Teams Can Avoid Check Payment Fraud in 2023Webinar:  The Evolution of Card and Payment TechnologiesVendor Process ReDesign:  Consulting 2-Week ProjectVendor Setup Forms/Templates:  Vendor ToolkitVendor Process Training Center: Vendor Process Training Sessions – Live Online and On Demand.  New Live Training Every Wednesday and Thursday.  Vendor Validation Reference List with Resources Links: www.debrarrichardson.com/vendor-validation-download Vendor Master File Clean-Up:  https://www.debrarrichardson.com/cleanupYouTube Channel:  https://www.youtube.com/channel/UCqeoffeQu3pSXMV8fUIGNiw Prevent Fraudulent Payments.  Get Your Own Copy of the 3 Step Vendor Setup and Maintenance Process eGuide.  (Includes Authentication Reference Template and Vendor Validation Reference List)More Podcasts/Blogs/Webinars www.debrarrichardson.comMore ideas?  Email me at debra@debrarrichardson.com Music Credit:  www.purple-planet.com

In Plain Sight is a Cybercrime Magazine podcast series brought to you by Conceal. In this episode, host Hillarie McClure is joined by Brian Stone, Chief Revenue Officer at Conceal, and Anthony Johnson, Founder & Managing Partner at Delve Risk. Together, they discuss the use of imposter domains in phishing attack campaigns, how social media has changed these types of attacks, and more. Conceal is a zero-trust network privacy and security company that disguises and protects your enterprise's online presence and privacy. To learn more about our sponsor, visit https://conceal.io

A Phishing campaign impersonates DHL. Conscription and mobilization provide criminals with phishbait for Russian victims. Norton LifeLock advises customers that their accounts may have been compromised. Trends in data protection. Veracode's report on the state of software application security. Ben Yelin looks at NSO group's attempt at state sovereignty. Ann Johnson from Afternoon Cyber Tea speaks with Microsoft's Chris Young about the importance of the security ecosystem. And Ukraine calls for a "digital United Nations." For links to all of today's stories check out our CyberWire daily news briefing: https://thecyberwire.com/newsletters/daily-briefing/12/10 Selected reading. Cloud 9: Top Cloud Penetration Testing Tools (Bishop Fox) Our Top Favorite Fuzzer crowdsourcing pen testing tools (Bishop Fox) DHL Phishing Attack. Simply Delivered. (ArmorBlox)  Credential phishing campaign impersonates DHL. (CyberWire) Phishing scam invites Russian Telegram users to check ‘conscription lists' to see if they'll be drafted in February (Meduza) NortonLifeLock warns that hackers breached Password Manager accounts (BleepingComputer) Norton LifeLock says thousands of customer accounts breached (TechCrunch). NortonLifeLock notifies thousands of users about compromised Password Manager accounts (Computing)  Data Protection Trends Report 2023 (Veeam) Trends in data protection. (CyberWire) How Orca Found Server-Side Request Forgery (SSRF) Vulnerabilities in Four Different Azure Services (Orca Security) Orca describes four Azure vulnerabilities. (CyberWire) State Of Software Security (Veracode)  A look at the state of software security. (CyberWire) Ukraine calls for ‘Cyber United Nations' amid Russian attacks (POLITICO) 

Artificial Intelligence is changing the world. Right Now! In just a few years, it's possible that you might be chatting with a support agent who doesn't have a human body. You'll be able to ask them anything you want and get an answer immediately. Not only that, but they'll be able to help you with things like scheduling appointments, making payments, and booking flights—without any human intervention necessary. This is just one of the many ways that Artificial Intelligence will change our lives this year. We will see more businesses using AI technology to make their processes more efficient and effective. And if you think this is just another boring news story about how artificial intelligence is taking over everything… well, sorry to tell you that most of these "news stories" are probably written by computers anyway! Cars… Touch Screens on Dashboards Found to be Dangerous Evidence suggests that touch screens in cars may be more distracting than traditional controls such as knobs or buttons. This is because touch screens require drivers to take their eyes off the road and focus on the screen to interact with them, which can increase the risk of a crash. In contrast, traditional controls such as knobs or buttons can often be operated by feel, allowing drivers to keep their eyes on the road while adjusting settings such as the radio or the climate control. https://futurism.com/the-byte/study-finds-that-buttons-in-cars-are-safer-and-quicker-to-use-than-touchscreens Study Finds That Buttons in Cars are Safer and Easier to Use Than Touchscreens. It turns Out That Slapping a Giant iPad Onto Your Dashboard Isn't An Ideal Way To Control Your Car +++++++ BMW starts selling heated seat subscriptions for $18 a month https://www.theverge.com/2022/7/12/23204950/bmw-subscriptions-microtransactions-heated-seats-feature A monthly subscription to heat your BMW's front seats costs roughly $18, with options to subscribe for a year ($180), three years ($300), or pay for “unlimited” access for $415. BMW has slowly been putting features behind subscriptions since 2020, and heated seat subscriptions are now available in BMW's digital stores in countries including the UK, Germany, New Zealand, and South Africa. However, it doesn't seem to be an option in the US. For some software features that might lead to ongoing expenses for the carmaker (like automated traffic camera alerts, for example), charging a subscription seems more reasonable. But that's not an issue for heated seats. Tesla… I've driven more than 1,000 miles in Teslas — and I'll never buy one https://www.tomsguide.com/opinion/ive-driven-more-than-1000-miles-in-teslas-and-ill-never-buy-one My biggest problem with the Tesla design is the extreme minimalism employed throughout the cabin. In the Model 3 and Model Y, this means virtually everything is condensed into a single central touchscreen. In fact, only a handful of features don't employ the touchscreen in some way, and those are relegated to a few levers and dials around the steering column. The thing that always baffles me most is that Tesla's two cheapest cars don't have a dedicated driver display or gauge cluster behind the steering wheel. Instead, you must glance at the central display if you want something as simple and important as your current speed. The overreliance on the touchscreen is my biggest issue. Not only because of the lack of tactile feedback, ensuring you can't use the smooth and glossy device without looking, but also because any fault in the screen will render your car completely useless. My Leaf's infotainment display died recently, taking a bunch of useful car functions with it. But a functional driver display meant I could still drive around safely and know how fast I was going. Twitter… Hackers leak email addresses of 235 million Twitter users https://nypost.com/2023/01/06/hackers-leak-email-addresses-of-235-million-twitter-users-report/ Hackers obtained the email addresses of more than 235 million Twitter users and published them on an internet forum. The breach “will unfortunately lead to a lot of hacking, targeted phishing and doxxing,” Alon Gal, co-founder of Israeli cybersecurity-monitoring firm Hudson Rock. “This database is going to be used by hackers, political hacktivists and of course governments to harm our privacy even further.” Phishing is a tactic used by cybercriminals who send emails or text messages claiming to be from reputable companies. These messages ask their targets to send them personal information, including credit card numbers, passwords, and other sensitive data. Jobs… Amazon Layoffs to Hit Over 18,000 Workers, the Most in Recent Tech Wave https://www.wsj.com/articles/amazon-to-lay-off-over-17-000-workers-more-than-first-planned-11672874304 Cuts focused on the company's corporate staff exceed earlier projections and represent about 5% of the company's corporate workforce. Amazon.com Inc.'s layoffs will affect more than 18,000 employees, the highest reduction tally revealed in the past year at a major technology company as the industry pares back amid economic uncertainty.

If any of you are buying a home, bought a home you're a target two times over.  Fraud scams are hitting the Real Estate Industry just like Accounts Payable to steal funds.  They do however have two tips that I never talk about but might help us in Accounts Payable and at the end I'll talk about a free webinar with an avalanche of fraud prevention tips in a short period of time that you don't want to miss. Keep listening. Check out my website www.debrarrichardson.com if you need help cleaning your vendor master file or implementing authentication techniques, internal controls, and best practices to prevent fraudulent payments, regulatory fines or bad vendor data. Subscribe today to be entered in the subscriber-only monthly drawing to win a free Putting the AP in hAPpy Coffee Mug.  Links mentioned in the podcast:   Webinar:  20 Tips in 20 Minutes:  How Vendor Teams Can Avoid Business Email Compromise in 2023Real Estate Articles/InfographicsFlorida man loses $15K to business email compromise in real estate scheme Mortgage Closing Scams: How to protect yourself and your closing funds Protect Your Money When Buying a Home From Wire Fraud SchemesVendor Process Training Center: Vendor Process Training Sessions – Live Online and On Demand.  New Live Training Every Wednesday and Thursday.  Vendor Validation Reference List with Resources Links: www.debrarrichardson.com/vendor-validation-download Vendor Master File Clean-Up:  https://www.debrarrichardson.com/cleanupYouTube Channel:  https://www.youtube.com/channel/UCqeoffeQu3pSXMV8fUIGNiw Prevent Fraudulent Payments.  Get Your Own Copy of the3 Step Vendor Setup and Maintenance Process eGuide.  (Includes Authentication Reference Template and Vendor Validation Reference List)More Podcasts/Blogs/Webinars www.debrarrichardson.comMore ideas?  Email me at debra@debrarrichardson.com Music Credit:  www.purple-planet.com 

Iranian VPN users are afflicted by Trojanized installation apps. Phishing on the static expressway. NoName057(16) hacktivist auxiliaries target NATO. Yesterday's flight outage appears not to have been caused by a cyberattack. Royal Mail is disrupted by a "cyber incident." Carole Theriault thinks Meta needs to step up their game when blocking financial scams. Our guest is Mark Sasson from Pinpoint Search Group to discuss why cybersecurity may no longer be a candidate-driven market. And HR phishbait dangles raises, and some employees bite. For links to all of today's stories check out our CyberWire daily news briefing: https://thecyberwire.com/newsletters/daily-briefing/12/7 Selected reading. EyeSpy - Iranian Spyware Delivered in VPN Installers (Bitdefender Labs) Phishing on the Static Expressway. (CyberWire) NoName057(16) - The Pro-Russian Hacktivist Group Targeting NATO (SentinelOne)  Not a cyberattack, but an IT failure. (CyberWire) FAA NOTAM Statement (FAA) Canadian Pilot-Alert System Reports Outage Hours After U.S. Grounding Order (Wall Street Journal) US air travel resumes but thousands of flights delayed after planes grounded - live updates (The Telegraph)  US Flights Latest: Departures Resume After FAA Lifts Ground Stop (Bloomberg) Royal Mail suffers ‘severe service disruption' after cyber incident (Glasgow Times) Royal Mail issues major disruption warning after 'cyber incident' (Computing)  Parcels and letters stuck in limbo as Royal Mail is hit by a suspected hack (The Telegraph)  Cyber Incident Hits UK Postal Service, Halts Overseas Mail (SecurityWeek)

"We got very good at testing things to failure" Virginia “Ginger” Wright is the Energy Cybersecurity Portfolio Manager for Idaho National Laboratory's Cybercore division within its National and Homeland Security directorate. She leads programs focused on cybersecurity and resilience of critical infrastructure for the Department of Energy, DARPA [Defense Advanced Research Projects Agency] and other government agencies. Her recent research areas include cyber supply chain for operational technology components,  instant response, critical infrastructure modeling and simulation and nuclear cybersecurity. Some quotes from this episode:"Idaho National Laboratory is the only national laboratory that is focused on nuclear energy. Part of that legacy was in testing what are today normal commercial nuclear installations and understanding where the boundaries of either operational resilience were, or the boundaries of particular material and installation methods that would cause that infrastructure to fail. We have, of course, taken that ability to turn things into failure and use that to develop our own adversary guided thinking about defensive cybersecurity.""In the energy infrastructure, we have devices that are in regular use today that are decades old. In the IT world, I have Patch Tuesday where every week my critical infrastructure is updated. Then after about three years. I toss it and I get another one that is completely and wholly built on the more modern incarnation of technology.  When we think about operational technology, applications, energy or water, we certainly can't re-engineer those systems on that cycle of replacement. So often we may not be able to patch or the technology that we are using is so old that the vendor is now no longer supporting patches.""I think a lot of engineers understand materials that they build with. They understand wood,  concrete,  but they don't often get taught to think about digital systems in the same way they think about materials -  that these systems have stress points and failure points and they can be trusted to a certain level but after that we need to build protections into our system to protect us from the ways that they can fail or be brought to failure by an adversary"

Listen to tales of online scams, zapping mosquito bites, and sperm that can smell, in this episode from the 2014 archives. Hosted and produced by Ian Woolf Support Diffusion by making a contribution Support Diffusion by buying through affiliate links

ABC News Correspondent, Jim Ryan. Phishing attacks soared 61% in 2022 compared to the previous year.

Telegram impersonation affects a cryptocurrency firm. Phishing with Facebook termination notices. Russian phishing continues to target Moldova. The IEEE on the impact of technology in 2023. Glass ceilings in tech leadership. Seattle Schools sue social media platforms. Malek Ben Salem from Accenture explains coding models. Our guest is Julie Smith, identity security leader and executive director at IDSA, with insights on identity and security strategies. And dealing with the implications of ChatGPT.  For links to all of today's stories check out our CyberWire daily news briefing: https://thecyberwire.com/newsletters/daily-briefing/12/5 Selected reading. Breaking the glass ceiling: My journey to close the leadership gap (CyberWire's Creating Connections: Wrapping up the Year) Impact of Technology in 2023 and Beyond (IEEE) Telegram insider server access offered to Dark Web customers (SafetyDetectives) Moldovaʼs government hit by flood of phishing attacks (The Record from Recorded Future News)  OPWNAI : Cybercriminals Starting to Use ChatGPT (Check Point Research) Hackers exploiting ChatGPT to write malicious codes to steal your data (Business Standard) Armed With ChatGPT, Cybercriminals Build Malware And Plot Fake Girl Bots (Forbes)  Hackers Exploiting OpenAI's ChatGPT to Deploy Malware (HackRead) Cybercriminals are already using ChatGPT to own you (SC Media) Threat Report: Impersonation Detected in Telegram Chats to Deliver Malware (Safeguard Cyber)  Seattle schools sue tech giants over social media harm (ABC News)  Seattle Public Schools sues TikTok, YouTube, Instagram and others, seeking compensation for youth mental health crisis (GeekWire) Ghost Writer: Microsoft Looks to Add OpenAI's Chatbot Technology to Word, Email (The Information) Microsoft plans to use ChatGPT in Bing. Here's why it could be a threat to Google. (Freethink)  ChatGPT Hits Ethical Roadblock; Blocked (Analytics India Magazine) A College Kid Built an App That Sniffs Out Text Penned by AI (The Daily Beast)  A Princeton student built an app which can detect if ChatGPT wrote an essay to combat AI-based plagiarism (Business Insider)

GuestLance SpitznerDirector, SANS Senior Instructor - SANS Technical Institute [@sansinstitute]On LinkedIn | https://www.linkedin.com/in/lance-spitzner-0ab0ba1/On Twitter | https://twitter.com/lspitznerHostSean MartinCo-Founder at ITSPmagazine [@ITSPmagazine] and Host of Redefining CyberSecurity Podcast [@RedefiningCyber]On ITSPmagazine | https://www.itspmagazine.com/itspmagazine-podcast-radio-hosts/sean-martin____________________________This Episode's SponsorsPentera | https://itspm.ag/penteri67aAsgardeo | https://itspm.ag/asgardeo-by-wso2-u8vc___________________________Episode NotesThere are many security frameworks, maturity models, and best practices to leverage when developing ‘user friendly' security policies to foster greater adoption and behavioral change. How these new policies are effectively communicated to ensure both compliance and collaboration across the organization (including remote workers) is equally important.____________________________ResourcesSANS: https://www.sans.org/NIST CSF: https://www.nist.gov/cyberframework____________________________To see and hear more Redefining CyberSecurity content on ITSPmagazine, visit:https://www.itspmagazine.com/redefining-cybersecurity-podcastAre you interested in sponsoring an ITSPmagazine Channel?

La nuova campagna di phishing sfrutta il presunto accredito di un rimborso da parte di Agenzia delle Entrate. È l'allarme lanciato dalla Polizia Postale. «La comunicazione, ricevuta tramite email, induce la vittima a inviare i dati della sua carta di credito per consentire l’emissione di un presunto rimborso. Si ricorda che l’Agenzia delle Entrate, così come qualunque altro Ente, non invia mai comunicazioni di posta elettronica contenenti allegati da scaricare o link cliccabili, né richiede mai dati personali e bancari tramite email o sms. La Polizia Postale ricorda che è possibile consultare le proprie informazioni fiscali consultando l’area personale presente sul sito di Agenzia delle Entrate», avverte la Polizia. «Nel caso in cui si dovesse ricevere un sms o una e-mail sospetta, si raccomanda di non fornire alcun dato personale, di non aprire gli allegati e di non cliccare su link eventualmente presenti. Si consiglia, infine, di eliminare immediatamente il messaggio ricevuto. Per ridurre la ricezione di posta indesiderata aggiornare frequentemente il sistema operativo e installare un programma antivirus e antispam su tutti i dispositivi», è il consiglio della Polizia.

Es war eine Mail, die täuschend echt nach Instagram aussah. Zwischen Tür und Angel beantwortet - und schon war es zu spät: Der Instagram-Account eines Fotografen war in fremden Händen. Es klingt wie ein Krimi, was der «Espresso»-Hörer erzählt. Er ist auf Phishing reingefallen, hat sein Passwort in fremde Hände gegeben und wurde dann erpresst. Per WhatsApp melden sich die Erpresser: «I want to return it to you for money», heisst es in der Nachricht. Dem «Espresso»-Hörer zieht es den Boden unter den Füssen weg. Auf Hilfe von Instagram hofft er als gehackter User vergebens. Weitere Themen: - Rechtsfrage: «Was kann ich tun, wenn der Lohn nicht kommt?»

Password manager LastPass had a data breach, and users' vaults are at risk; TikTok spied on US journalists; and two new phishing attempts showing how complex techniques are used to try to fool people. And we begin our look at the year in Apple security and privacy. Show Notes: LastPass security breach update: Customer password vaults were obtained LastPass password vaults crackable for $100, alleges 1Password TikTok Spied On Forbes Journalists TikTok is now banned on mobile devices issued by U.S. House of Representatives Warning: Advanced phishing attack. Got a pop up on both my iPhone & Apple Watch about password reset. I didn't take action. Then received call from 1-800-MY-APPLE. Here's what ensued: The Year in Apple Security & Privacy 2022: The Year in Review Intego Mac Premium Bundle X9 is the ultimate protection and utility suite for your Mac. Download a free trial now at intego.com, and use this link for a special discount when you're ready to buy.

A caller alerts the Bonfire about a troubling incident a member of Phish had in his past. Andy Fiori defends his band!

If your company is a US entity, then there are at least five free validations that you should be doing when you onboard vendors.  Three of the five can help you with 1099 and 1042 distribution and filing – which ones are those?Keep listening. Check out my website www.debrarrichardson.com if you need help cleaning your vendor master file or implementing authentication techniques, internal controls, and best practices to prevent fraudulent payments, regulatory fines or bad vendor data. Subscribe today to be entered in the subscriber-only monthly drawing to win a free Putting the AP in hAPpy Coffee Mug.  Links mentioned in the podcast:   On-Demand Webinar:  5 Free Vendor Validations US Entities Should Be Doing https://debrarrichardson.com/webinarlisting/live-webinar-5-free-vendor-validations-us-entities-should-be-doing  Vendor Process Training Center: Vendor Process Training Sessions – Live Online and On Demand.  New Live Training Every Wednesday and Thursday.  Vendor Validation Reference List with Resources Links: www.debrarrichardson.com/vendor-validation-download Vendor Master File Clean-Up:  https://www.debrarrichardson.com/cleanupYouTube Channel:  https://www.youtube.com/channel/UCqeoffeQu3pSXMV8fUIGNiw Prevent Fraudulent Payments.  Get Your Own Copy of the3 Step Vendor Setup and Maintenance Process eGuide.  (Includes Authentication Reference Template and Vendor Validation Reference List)More Podcasts/Blogs/Webinars www.debrarrichardson.comMore ideas?  Email me at debra@debrarrichardson.com Music Credit:  www.purple-planet.com

Phishing attacks create stories to fool people into acting foolishly. One of the defenses you can help learn and teach is how the real world works around these stories. This episode talks about a real-world tax cheat and how the government process works to help identify the fake phishing stories. Be aware, be safe. Support the show and get access to behind the scenes content as a patron - https://www.patreon.com/SecurityInFive *** Support the podcast with a cup of coffee *** - Ko-Fi Security In Five Mighty Mackenzie - https://www.facebook.com/mightymackie Where you can find Security In Five - https://linktr.ee/binaryblogger Email - bblogger@protonmail.com

This Morning's Headlines 1. Drones cross border 2. Accounting practices 3. Jeonse scams 4. Korea-Japan talks 5. Phishing countermeasures

This episode reports on ransomware number for November and trouble in open-source repositories

In this episode I talk with Javvad Malik about what it is like to work at one of the most well known security companies in the world. We had a fantastic conversation and when you enjoy the episode please leave a review and share the podcast!Javvad's Links:LinkedIn: https://www.linkedin.com/in/javvad/Website: https://www.knowbe4.com/Dev InterruptedWhat the smartest minds in engineering are thinking about, working on and investing in.Listen on: Apple Podcasts Spotify The Objective JERKJERK is a "Liberal hearted with a Conservative mind" Army veteran, with 15 years of law...Listen on: Apple Podcasts SpotifySupport the showFollow the Podcast on Social Media!Instagram: https://www.instagram.com/secunfpodcast/Twitter: https://twitter.com/SecUnfPodcastPatreon: https://www.patreon.com/SecurityUnfilteredPodcastTikTok: Not today China! Not today

I know, Noam and Jen have discussed Elon to death, but the drama continues. Speaking of drama, JoJo from Jerz lost control of her beloved Twitter account due to a phishing scam and they want to point and laugh Download the Callin app for iOS and Android to listen to this podcast live, call in, and more! Also available at callin.com

Are you just starting to clean your vendor master file in preparation for distributing and filing 1099s and 1042s?  I have some tools and resources that may help you validate vendor data, find missing vendor data, and identify duplicates– so…. Keep listening.  Check out my website www.debrarrichardson.com if you need help cleaning your vendor master file or implementing authentication techniques, internal controls, and best practices to prevent fraudulent payments, regulatory fines or bad vendor data.  Subscribe today to be entered in the subscriber-only monthly drawing to win a free Putting the AP in hAPpy Coffee Mug.  Links mentioned in the podcast:    On-Demand Webinar:  Vendor Master File Clean-Up Tools  - Validate Vendor Data / Find Missing Vendor Data / Identify Duplicates https://debrarrichardson.com/webinarlisting/webinar-vendor-master-file-clean-up-tools-validate-vendor-data-/-find-missing-vendor-data-/-identify-duplicates Vendor Process Training Center: Vendor Process Training Sessions – Live Online and On Demand.  New Live Training Every Wednesday and Thursday.  Vendor Validation Reference List with Resources Links: www.debrarrichardson.com/vendor-validation-download Vendor Master File Clean-Up:  https://www.debrarrichardson.com/cleanupYouTube Channel:  https://www.youtube.com/channel/UCqeoffeQu3pSXMV8fUIGNiw Prevent Fraudulent Payments.  Get Your Own Copy of the3 Step Vendor Setup and Maintenance Process eGuide.  (Includes Authentication Reference Template and Vendor Validation Reference List)More Podcasts/Blogs/Webinars www.debrarrichardson.comMore ideas?  Email me at debra@debrarrichardson.com Music Credit:  www.purple-planet.com

Could an AI chatbot like ChatGPT help you co-author the next great cyberpunk novel? Or craft a phishing email and generate sock puppets - for ethical hacking research, of course! Join our security research team - incident responder Marc Balingit and adversary emulator Matt Mullins - as we wade into the fun (and sometimes ethically ambiguous) areas of AI tech in cybersecurity. Keep the conversation going as we explore how AI tools can impact productivity, learning, skill shortages, and more. Check out the podcast on Youtube to wat ch Will, Matt, and Marc demo ChatGPT. Explore ChatGPT in Cybrary's FREE challenge activity!   Read all about the potential impact of A.I. chatbots on the cybersecurity world!   Learn more about OpenAI on their website! See How OpenAI became an AWS Certified Cloud Practitioner! Follow us on Social!! ~Twitter ~Instagram ~FaceBook ~YouTube ~LinkedIn Jump-start you cybersecurity career today at Cybrary!

There seems to be no shortage of new tactics that cybercriminals are trying in the past few weeks and months. In this week's episode, cybersecurity experts Bryan Hornung, Reginald Andre, Randy Bryan, and Ryan O'Hara discuss some of these new tactics and what they could mean for businesses in the future. The cybersecurity experts discuss an interesting twist around the Knox College ransomware attack that is becoming a favorite tactic for cybercriminals. Cybercriminals have devised a new way to evade Spam filters and trick your employees. Check out this new tactic and how to protect yourself. Then the cyber security experts dive into various topics around the Draft Kings data breach, the Seven Rooms data breach, and the new ways hackers are using Microsoft Windows to attack your business. Please share & subscribe to our Podcast and as always find us on social media if you ever have any questions or comments.

As if we don't have enough holidays to worry about at this time of year, I offer the following possibilities for additional cheer and or punishment. These include: National Emo Day; Look for an Evergreen Day; National Hard Candy Day; Goa Liberation Day; It's also time to celebrate the 473rd installment of Charlottesville Community Engagement, a newsletter and podcast that is not capable of having any feelings about your presence, but I'm Sean Tubbs and I'm glad you're reading or listening. On today's program:* Highlights from the latest report from interim Charlottesville City Manager Michael C. Rogers, including news that the cost estimate for a replacement of the fire station on the U.S. 250 bypass is over budget * A quick look at legislation pre-filed in the General Assembly, including a cap on the total amount of money one person can give to a political candidate* The first of several segments from the December 13, 2022 Charlottesville Planning Commission on comments made before meeting actually began * The second Planning Commission segment covers recent planning updates, including a preview of next year's public review of a new zoning code intended to make it easier to build new housing and other buildings  This is a public episode. If you'd like to discuss this with other subscribers or get access to bonus episodes, visit communityengagement.substack.com/subscribe

Or Katz from Akamai sits down with Dave to discuss research on highly sophisticated phishing scams and how they are abusing holiday sentiment. This particular threat, most recently has focused on Halloween deals, enticing victims with the chance to win a free prize, including from Dick's Sporting Goods or Tumi Backpacks. It then requests credit card details to cover the cost of shipment. From mid-September to the end of October 2022, Akamai's research were able uncover and track this threat. This kit mimics well known retail stores in hopes to hijack credit card information, feeding off of people's holiday spirit. The research can be found here: Highly Sophisticated Phishing Scams Are Abusing Holiday Sentiment

Or Katz from Akamai sits down with Dave to discuss research on highly sophisticated phishing scams and how they are abusing holiday sentiment. This particular threat, most recently has focused on Halloween deals, enticing victims with the chance to win a free prize, including from Dick's Sporting Goods or Tumi Backpacks. It then requests credit card details to cover the cost of shipment. From mid-September to the end of October 2022, Akamai's research were able uncover and track this threat. This kit mimics well known retail stores in hopes to hijack credit card information, feeding off of people's holiday spirit. The research can be found here: Highly Sophisticated Phishing Scams Are Abusing Holiday Sentiment

Holiday Tips and Scams not to fall for during the holiday season. We talk about how to avoid getting scammed during the holiday season. You must know about different scams, retail, phone, and e-commerce. The game is changing regarding buy now, pay later - banks are fighting back. A lot is going on with Crypto and regulation and new bills in Congress. A lot is going on with friendly fraud - this time of the year. Phishing scams are at an all-time high right now thru email, phone, and text messages. Happy Holidays and look for new products and services that are coming in 2023! Carpe Diem

Roger Grimes is an industry expert and the Data Driven Defense Evangelist for KnowBe4. In this episode, Roger and host Hillarie McClure discuss the recent phishing infographic released by CISA, which covers data collected, lessons learned, and recommendations learned from simulated phishing attacks that CISA has conducted for organizations, as well as the news that Apple will have to start allowing outside app stores on iPhones and iPads, what this means for the company, and more. KnowBe4 is the world's first and largest New-school security awareness training and simulated phishing provider that helps you manage the ongoing problem of social engineering. To learn more about our sponsor, KnowBe4, visit https://knowbe4.com

Microsoft Patch Issues: https://support.microsoft.com/en-us/topic/december-13-2022-kb5021249-os-build-20348-1366-d5fe7608-bc9d-4055-a88c-fb2fd3d5fd45 https://techcommunity.microsoft.com/t5/ask-the-directory-services-team/so-you-say-your-dc-s-memory-is-getting-all-used-up-after/ba-p/3696318 Critical Remote Code Execution Vulneraiblity in SPNEGO Extended Negotiation Security Mechanism https://securityintelligence.com/posts/critical-remote-code-execution-vulnerability-spnego-extended-negotiation-security-mechanism/ VMWare EHCI Controller Vulnerability CVE-2022-31705 https://www.vmware.com/security/advisories/VMSA-2022-0033.html Veem Vulnerability now Exploited https://www.veeam.com/kb4288 nuget / npm / pypi used to host phishing pages https://checkmarx.com/blog/how-140k-nuget-npm-and-pypi-packages-were-used-to-spread-phishing-links/

Scammers are brilliant at targeting the vulnerable and then often using the fear of exposure to extort even more out of them. Education about these manipulators isn't enough. Can we do more to make a global impact knowing that less than 0.1% of scammers are ever prosecuted? Today's guest is Jorij Abraham. Jorij Abraham is the Managing Director of the Global Anti-Scam Alliance with a mission of preventing consumers worldwide from getting scammed. He is also the General Manager at ScamAdvisor.com, the global blacklist for malicious websites. In addition, Jorij is an ecommerce professor at University of Applied Sciences TIO. Show Notes: [1:01] - Jorij shares his current roles and background in the field. [2:27] - He fell into ScamAdvisor when working in ecommerce. [3:42] - Scammers are remarkably smart when it comes to marketing fake sites. [5:12] - Subscription scams are specifically successful in getting quite a lot of money from victims. [6:18] - Scammers tend to take advantage of current events such as the energy crisis and abortion and then extort their fear of exposure. [7:26] - ScamAdvisor.com sees over 4 million visitors per month and they are from all over the world. [8:24] - In most countries, victims of scams are unable to get any help. [9:49] - Jorij explains how the laws work regarding scammers and the pitfalls of the process. [11:40] - It's important to educate consumers, but there's only so much that can be learned. [12:56] - The tips and tricks that helped just a few months ago are already not working all the time. [14:33] - Jorij describes a Ponzi scheme that took down the government in Albania. [16:10] - One little bump in supply and demand has drastic ripple effects. [17:32] - Scams are not simple anymore. The marketing power is extremely impactful and mostly successful. [19:11] - Even in the Netherlands, FBI phone scams are successful. [21:00] - Jorij predicts that legislation will be necessary. [22:10] - Awareness is good, but consumers need more protection. [23:35] - Phishing scams are created to filter out specific groups of people. [24:37] - Jorij shares his thoughts on retraining scammers to do good, especially since they are skilled hackers. [26:34] - How can we reduce scams? [27:41] - The Global Anti-Scam Alliance is a networking organization with the goal of pushing everyone together to define new ways to combat scams. [29:17] - Jorij describes the changes coming to ScamAdvisor. Thanks for joining us on Easy Prey. Be sure to subscribe to our podcast on iTunes and leave a nice review.  Links and Resources: Podcast Web Page Facebook Page whatismyipaddress.com Easy Prey on Instagram Easy Prey on Twitter Easy Prey on LinkedIn Easy Prey on YouTube Easy Prey on Pinterest Jorij Abraham on LinkedIn ScamAdvisor.com Global Anti-Scam Alliance

It's time for another episode of Tell me it's Friday! Continuing on with our scammer series...this week we're talking about the art of Smishing, Vishing and Phishing! Say that 10 times fast! Good luck! But more importantly LISTEN UP because the 4Front Risk team has more great info on how not to fall victim!

Uber sustains a third-party breach. A phishing campaign hits Ukrainian in-boxes. The enduring riddle of why Russian offensive cyber operations have failed in Ukraine. Joe Carrigan on credit card skimming. Carole Theriault describes a UK food store chain that uses facial recognition technology to track those with criminal or antisocial behavior. And 2023's ransomware-as-a-service leader board. For links to all of today's stories check out our CyberWire daily news briefing: https://thecyberwire.com/newsletters/daily-briefing/11/237 Selected reading. Uber suffers new data breach after attack on vendor, info leaked online (BleepingComputer) Uber has been hacked yet again with code and employee data released online (SiliconANGLE) Uber hit by new data breach — what you need to know (Tom's Guide) Uber's data breach. (CyberWire) Ukrainian railway, state agencies allegedly targeted by DolphinCape malware (The Record by Recorded Future) Cyber Operations in Ukraine: Russia's Unmet Expectations (Carnegie Endowment for International Peace)  The most prolific ransomware groups of 2022 (Searchlight Security)

Over 90% of all cyber attacks start with a phishing email to an unsuspecting victim. As cyber criminal techniques become more sophisticated, how can businesses keep their communication channels safe? On this episode, David Raissipour, Chief Technology and Product Officer at the cloud-based cybersecurity company Mimecast, discusses the importance of cyber protection education and shares how his engineering team innovates to give businesses the upper hand over cyber threats.Tune in to learn:The importance of cybersecurity education (07:11)How Mimecast innovates for new kinds of cyber crime (13:56)How the current economy is impacting the cybersecurity industry (28:01)The demand for cybersecurity jobs (33:20)Mentions:“Closing the Cybersecurity Skills Gap” (IT Visionaries podcast; Episode 425)IT Visionaries is brought to you by Salesforce. With Salesforce's low-code app dev tools, you can be more efficient, more productive and save money by reducing development time by up to 90%. Get Salesforce's Low-Code Playbook and increase time to value for your team and your customers. Download the free playbook today.Mission.org is a media studio producing content for world-class clients. Learn more at mission.org

GuestsJavvad MalikLead Security Awareness Advocate at KnowBe4 [@KnowBe4]On LinkedIn | https://www.linkedin.com/in/javvad/On Mastodon | https://infosec.exchange/@JavvadOn Twitter | https://twitter.com/J4vv4DOn TikTok | https://www.tiktok.com/@j4vv4dOn YouTube | https://www.youtube.com/infoseccynicMarco CiappelliCo-Founder at ITSPmagazine [@ITSPmagazine] and Host of Redefining Society PodcastOn ITSPmagazine | https://www.itspmagazine.com/itspmagazine-podcast-radio-hosts/marco-ciappelliHostSean MartinCo-Founder at ITSPmagazine [@ITSPmagazine] and Host of Redefining CyberSecurity Podcast [@RedefiningCyber]On ITSPmagazine | https://www.itspmagazine.com/itspmagazine-podcast-radio-hosts/sean-martin____________________________This Episode's SponsorsAsgardeo | https://itspm.ag/asgardeo-by-wso2-u8vcPentera | https://itspm.ag/penteri67a___________________________Episode NotesSecurity awareness and security culture are talked about a lot in the community. In this episode, we get into the nitty gritty of both of these topics, hearing about them via real-world stories and discussing them in the context of real-life analogies. A program is just a program unless it can be understood, measured, and defended from all angles.As one example discussed in this episode, there's no point in just teaching people to spot a phishing email because phishing now comes in text messages, on social media, direct messages on Twitter or Instagram, on Discord channels, even in your WhatsApp messages. There's no way you can train everyone on every single channel out there. A better option is to teach them about the red flags, give them knowledge about how the bad actors will approach their targets, and what some of the signs are to look out for. Help them understand that if you're careful, then you won't fall victim to it. One analogy used to help illustrate this point comes in the form of the crosswalks in London where information is shared with the street crosser at the point when/where they are crossing as opposed to trying to train the traveler weeks in advance of visiting London.This is one of the many, many points that our guest, Javvad Malik, shares with us during this episode.Enjoy and learn!____________________________Resources____________________________To see and hear more Redefining CyberSecurity content on ITSPmagazine, visit:https://www.itspmagazine.com/redefining-cybersecurity-podcastAre you interested in sponsoring an ITSPmagazine Channel?

HPR NEWS News for the community, by the community. TAGS: Ransomware, Malware, Phishing, Security Breach Microsoft Confirms Server Misconfiguration Led to 65,000+ Companies' Data Leak Microsoft “misconfigured” an Azure Blob Storage server causing a security breach. Attackers were able to access unauthorized customer data; business transactions and other interactions between Microsoft and its customers. SOCRadar, a cyber security company, is calling the security breach “BlueBleed”. SOCRadar discovered the breach on September 24, 2022 Microsoft is downplaying the security breach but security researcher Kevin Beaumont isn't buying it. Mr. Beaumont suggest Microsoft dropped the ball on informing its customers, and federal regulators, of the security breach in a timely manner. HiddenAds malware affects 1M+ Android users McAfee’s Mobile Research Team identified multiple apps containing malware on the Google Play Store. After install, the malicious android apps automatically run services without the user knowing or interacting with the app. That’s right, they auto run after install. These malicious apps then disguise themselves by changing their icon to the “Google Play” icon and renaming to themselves to “Google Play” or “Settings”. The malicious apps quickly create permanent malicious services. McAfee’s Mobile Research Team demonstrates the resilience of the malware by using kill -9 on the service processes. More malicious processes generate immediately as if nothing happened. Fully undetectable PowerShell backdoor disguised as part of a Windows update Director of security research at SafeBreach, Tomer Bar stated, "The covert self-developed tool and the associated C2 commands seem to be the work of a sophisticated, unknown threat actor who has targeted approximately 100 victims." Based on the metadata found within a malicious document, this seems to be a LinkedIn-based spear-phishing attack, which ultimately leads to the execution of a PowerShell script via a piece of embedded macro code. "The Macro drops 'updater.vbs' creates a scheduled task pretending to be part of a Windows update, which will execute the updater.vbs script from a fake update folder under '%appdata%localMicrosoftWindows,'"said Tomar. Currently 32 security vendors and 18 anti-malware engines have flagged the decoy document and the PowerShell scripts as malicious. The findings come as Microsoft has taken steps to block Excel 4.0 (XLM or XL4) and Visual Basic for Applications (VBA) macros by default across Office apps, prompting threat actors to pivot to alternative delivery methods. Millions of patients compromised in hospital data leak. Nearly 3 million Illinois & Wisconsin patients are caught in a hospital data breach. Advocate Aurora Health, which operates 27 hospitals, said in a statement, “the breach may have exposed information including a patients' medical provider, type of appointments, medical procedures, dates and locations of scheduled appointments, and IP addresses”. The system blamed the breach on its use of pixels, computer code that collects information on how a user interacts with a website, including products developed by Google and Facebook's parent company Meta that make the collected data accessible to those companies. The health care industry's use of pixels has come under wide criticism from privacy advocates who warn that the technology's use violates federal patient privacy law. A report published in June by The Markup found many of the country's top-ranked hospitals used the Meta Pixel, collecting and sending sensitive patient information to the social media company. User space. Texas sues Google for biometric data collecting Texas has filed a lawsuit against Google claiming the tech behemoth took users’ biometric data without permission. Texas Attorney General Ken Paxton, claims Google is illegally data harvesting Texans using features and devices such as: Google Photos, Google Assistant, and Nest Hub Max. Google spokesman José Castañeda is willing to take the argument to court, “AG Paxton is once again mischaracterizing our products in another breathless lawsuit,”.

Practical Prepping QuickTips, # 14  "Don't Get Hooked By Phishing"QuickTips are mini-episodes that will be designed toward efficiency, cost savings, and new ideas. These will be primarily prepping related, but we will pass on any great tips we come across.In this episode, we discuss recognizing and handling phishing scam texts and emails.E-mail to us any tips you would like to share at info@practicalprepping.infoPractical PreppingWebsite: www.practicalprepping.infoEmail at info@practicalprepping.info Join us for regular episodes on Mondays and Thursdays, and for QuickTips on Tuesdays, Wednesdays, and Fridays.

Guests: Nikhil Sinha, Group Product Manager, Workspace Security Kelly Anderson, Product Marketing Manager, Workspace Security Topics: We are talking about Google Workspace security today. What kinds of threats do we have to care about here? Are there compliance-related motivations for security here too? Is compliance in the cloud changing? How's adoption of hardware keys for MFA going for your users, and how are you helping them?  Is phishing finally solved because of that?  Can you explain why hardware security FIDO/WebAuthn is such a step function compared to, say, RSA number generator tokens?  Have there been assumptions in the Workspace security model we had to change because of WFH? And what changes with RTO and permanent hybrid? Resources: Google BeyondCorp Enterprise “Make zero trust a reality with Google Workspace security solutions” Next 2022 video “2021: Phishing is Solved?” (ep40) “Zero Trust: Fast Forward from 2010 to 2021” (ep8)

Tax Deferred Services, whose CEO was arrested in what the California Department of Insurance called a “$4 million securities fraud scheme,” blankets teacher email inboxes with deceptive message. TDS CEO: Arrested Development "Set up" a Zoom Appointment with TDS Learned by Being Burned Meridian Wealth Management 403bwise.org

Emotet's return. LodaRAT improvements. Callback phishing leads to data theft extortion.

Luna Moth's callback phishing offers an unpleasant and less familiar form of social engineering. New activity by China's Mustang Panda is reported. DEV0569 is using malvertising to distribute Royal ransomware. US indicts 10 in a business email compromise case. Developing a cyber auxiliary. Dave Bittner sits down with AJ Nash from ZeroFox to discuss holiday scams. Our own Rick Howard speaks with us about cloud security. And beware of Black Friday scams. For links to all of today's stories check out our CyberWire daily news briefing: https://thecyberwire.com/newsletters/daily-briefing/11/223 Selected reading. Threat Assessment: Luna Moth Callback Phishing Campaign (Unit 42)  DEV-0569 finds new ways to deliver Royal ransomware, various payloads (Microsoft Security)  Earth Preta Spear-Phishing Governments Worldwide (Trend Micro)  EXCLUSIVE: Rounding up a cyber posse for Ukraine (The Record by Recorded Future)  Tech for good: How the IT industry is helping Ukraine (Computing)  10 Charged in Business Email Compromise and Money Laundering Schemes Targeting Medicare, Medicaid, and Other Victims (US Department of Justice)  Black Friday and Cyber Monday risks. (CyberWire)

Arrrrr mateys! This week Dr.Doug will keel-haul a first-rate plunder of yarns including: pirate booty, phishing kits, CSC, Hive, HHS, Z-library, Iran, FTX, and more on the Security Weekly News!   Visit https://www.securityweekly.com/swn for all the latest episodes! Follow us on Twitter: https://www.twitter.com/securityweekly Like us on Facebook: https://www.facebook.com/secweekly   Show Notes: https://securityweekly.com/swn257

There's no sign that cyberattacks affected US vote counts. NATO meets to discuss the Atlantic Alliance's Cyber Defense Pledge. A new APT41 subgroup has been identified. FSB phishing impersonates Ukraine's SSCIP. A look at Cozy Bear's use of credential roaming. Caleb Barlow shares tips on removing implicit bias from your hiring process. Our guests are Valerie Abend and Lisa O'Connor from Accenture with a look at the difference in how women and men pursue the top cyber leadership roles. And an update on Phishing trends and API threats. For links to all of today's stories check out our CyberWire daily news briefing: https://thecyberwire.com/newsletters/daily-briefing/11/217 Selected reading. Statement from CISA Director Easterly on the Security of the 2022 Elections (Cybersecurity and Infrastructure Security Agency): No ‘Specific or Credible' Cyber Threats Affected Integrity of Midterms, CISA Says (Nextgov.com) U.S. vote counting unaffected by cyberattacks, officials say (PBS NewsHour)  What's 'Putin's chef' cooking up with talk on US meddling? (AP NEWS) NATO's 2022 Cyber Defense Pledge Conference - United States Department of State (United States Department of State) Japan joins NATO cyber defense centre (Telecoms Tech News) China casts wary eye as Japan signs up for Nato cybersecurity platform (South China Morning Post)  Hack the Real Box: APT41's New Subgroup Earth Longzhi (Trend Micro) New hacking group uses custom 'Symatic' Cobalt Strike loaders (BleepingComputer) They See Me Roaming: Following APT29 by Taking a Deeper Look at Windows Credential Roaming (Mandiant) APT29 Exploited a Windows Feature to Compromise European Diplomatic Entity Network (The Hacker News) CAUTION‼️ russian hackers are sending emails with malicious links from the SSSCIP (State Service of Special Communications and Information Protection of Ukraine)  Russian hackers send out emails under the name of Ukraine's State Service of Special Communications and Information Protection (Yahoo) Research Report | The State of Email Security 2022 (Tessian)  DevOps Tools & Infrastructure Under Attack (Wallarm)