Proofpoint and the Ponemon Institute say the costs of phishing attacks has tripled since 2015.
T-Mobile announced a breach last week – more than 40 million people had records stolen. The attack is noted as a straightforward data theft one, with an intention to sell the data. Another group claims to have stolen 70 million users worth of data from AT&T, which has denied the breach. This breach too, to sell the data.
Microsoft, too, feeling their name close to a data breach. This related to data leaks of a COVID-19 contact tracing database in Indiana over the use of Power Apps, exposing 37 million data records. Key to this – default permissions inadvertently set incorrect permissions. Not a vulnerability, and instead what could be termed bad user interface design.
Huntress Labs reported on scanning Microsoft Exchange servers – in tracking about 1900 Exchange servers they track.. all are missing patches for at least two active exploits.
The Verge has a piece covering research on hospital ransomware attacks – yes, CISA has been able to show that did worse in hospitals navigating a cyberware attack than in hospitals that didn’t.
Two more CEOs of insurance companies have cited price increases – and are worried about them. AIG’s CEO said rates raised 40%, and Chubb’s CEO noted that price raises still don’ reflect the risk of a catastrophic cyber event. Quoting CyberScoop, Ransomware now accounts for 75% of all cyber insurance claims, up from 55% in 2016, according to the credit ratings agency AM Best. The percentage increase in claims is outpacing that of premiums, said a June report which concluded that “the prospects for the cyber insurance market are grim.” Fitch Ratings in April found that the ratio of losses to premiums earned was at 73% last year, jeopardizing the profitability of the industry.
Client take-up rate — or the proportion of existing clients opting for cyber coverage — rose 46% in 2020, according to the Government Accountability Office.
And here’s a hiring tidbit for security professionals. Alyssa Miller, a security offier and speaker on cyber security, researched entry level jobs. Almost three-quarters of entry-level job vacancies she looked at ask for a Certified Information Systems Security Professional (CISSP) certification, something which takes years of training, costs money to take an exam – and isn’t realistic for someone looking for their first job in the industry.
Let’s work backwards – we need more security expertise, and most organizations and IT providers are going to need to build it. So be realistic about that – entry level jobs are needed to train and build more expertise.
The insurance companies are clearly starting to close ranks on this issue. Those rates and loss levels are clearly unsustainable, and policies will begin to be changed
Amid a landscape of impacting business. There’s not a lot of data on patient care impacts, so this CISA data, which is still unpublished, will be scrutinized and reviewed.