.png?width=200&height=78&name=CH%20Diligence%20(thicker%20line).png "CH Diligence (thicker line).png")
The Target: Thomson Reuters, a multi-national media conglomerate.
The Take: Exposure of sensitive company login credentials, including plain-text passwords to some third-party vendors, corporate and legal information, and logs which contain the email addresses of account holders who recently reset their passwords.
The Vector: A misconfigured Elasticsearch server was accessible over the internet to anyone with a connection.
This breach is critical reminder that authentication controls are an important piece in an overall robust cybersecurity posture, especially maintaining correct access configurations. The data exposed here can also lead to pivot attacks and targeted phishing. Multi-factor authentication, reasonably regular forced password resets, and password length and complexity rules are all effective strategies to mitigate these kinds of breaches to protect a firm’s data.
Techcrunch: Networking and cybersecurity firm Versa announced that it raised $120 million in a mix of equity and debt led by BlackRock, with participation from Silicon Valley Bank. CEO Kelly Ahuja tells TechCrunch that the proceeds, which bring Versa’s total capital raised to $316 million, will be put toward go-to-market efforts and scaling the company. He demurred when asked what percentage of the financing was equity versus debt.
Financier Worldwide: Amid ongoing economic and geopolitical challenges, the cyber security sector remains strong, according to a new report from ICON Corporate Finance.
ZDNet: A global study of 1,100 cybersecurity professionals by Mimecast found that one-third are considering leaving their role in the next two years due to stress and burnout.
Global Newswire: AI-powered systems can be set up to automatically respond to dangers and combat online threats more quickly. Analyzing and improving cyber risks as well as cyber-attacks is no more a task on a human scale as the business attack surface develops and changes. To accurately quantify risk, up to highly-varying signals must be handled, based on the scale of the organization.
S&P Global: Global cybersecurity transaction volume dropped to 33 deals between July 1 and Sept. 30, compared to 45 deals in the second quarter and 58 in the third quarter of 2021, according to data from 451 Research.
World Economic Forum: New United States Securities and Exchange Commission (SEC) rulemaking makes cyber risk reporting and business resilience planning a key component of effective board governance.
CNBC: In a new proposed settlement, the Federal Trade Commission is seeking to hold a tech CEO accountable to specific security standards, even if he moves to a new company.
The Target: Microsoft, one of the world’s leading computer hardware and software companies.
The Take: Exposure of Personally Identifiable Information belonging to over 65,000 business entities. The data included: names, email addresses, email content, company name, phone numbers, Statement of Work documents, product offers, and more.
The Vector: A misconfigured Microsoft server was accessible over the internet to anyone with a connection.
This breach is a stark reminder that authentication controls are a critical piece in an overall robust cybersecurity posture, including maintaining correct access configurations. In addition, multi-factor authentication, reasonably regular forced password resets, and password length and complexity rules are all effective strategies to mitigate these kinds of breaches to protect a firm’s data.
The Guardian: The US secretary of state visited Silicon Valley this week, on a trip that experts say highlights the Biden administration’s growing concerns over cybersecurity and officials’ push to collaborate more closely with the US’s powerful tech industry.
Dark Reading: Banco Santander, one of the largest banks in the world with over 157 million customers, and Forgepoint Capital, one of the world’s leading venture capital firms focused on cybersecurity, announced today a strategic alliance to drive cybersecurity investment and innovation globally.
Infosecurity: The global cybersecurity workforce gap has increased by 26.2% compared to 2021, with 3.4 million more workers needed to secure assets effectively, according the (ISC)2 2022 Cybersecurity Workforce Study.
ZDNet: While Google, Microsoft and Apple roll out passwordless passkey functionality for their platforms, most people are still dependent on passwords.
U.S. News: Australia's biggest health insurer said a criminal had apparently stolen customers' medical information as part of a massive breach of data, fuelling concern about a wave of high-profile cyber attacks.
Global News: A new research report says federal cybersecurity legislation is so flawed it would allow authoritarian governments around the world to justify their own repressive laws.
Dark Reading: A new survey shows Generation Z and millennials, younger workers who have grown up as digital natives, are surprisingly more careless about their employer's cybersecurity than their senior Gen X and baby boomer colleagues.
The target: Optus, an Australian Telecommunications company
The take: Personal information for up to 10 million customers, including names, email addresses, postal addresses, phone numbers, dates of birth, and some passport numbers, driver’s license numbers and Medicare numbers.
The attack vector: Reports suggest that an application programming interface (API) was exposed to the public internet and did not enforce any kind of authentication to access customer data.
Where sensitive data is handled, controls must be put in place to authenticate access, and verify an individual’s authorization to access that data. Failing to ensure that such access is carefully controlled is akin to leaving the window open.
ZDNet: The UK's cybersecurity agency has told firms to do more to protect themselves from attacks on their supply chains.
BNN Bloomberg: At least $718 million has been stolen so far in October alone, taking the gross tally for the year past $3 billion and putting 2022 on course to be a record for the total value hacked, according to blockchain specialist Chainalysis Inc.
Private Equity Wire: Vista Equity Partners (Vista) is to acquire KnowBe4, the provider of the world’s largest security awareness training and simulated phishing platforms, in an all-cash transaction valued at approximately $4.6 billion on an equity value basis.
FCW: In an Oct. 11 fact sheet, the White House teed up plans to host a meeting with stakeholders including companies and trade associations to discuss "a common label for products that meet U.S. government standards and are tested by vetted and approved entities."
AP News: Arne Schoenbohm, who heads the BSI agency, co-founded a cybersecurity group a decade ago that brings together experts from public institutions and the private sector. German media reported that one of its members is a company founded by a former Russian intelligence agent.
U.S. News: "The investigation has concluded that no evidence of any compromise was found and as such Lloyd's has been advised that its network services can now be restored," a company spokesperson said in an email.
Castle Hall helps investors build comprehensive due diligence programs across hedge fund, private equity and long only portfolios More →
Montreal
1080 Côte du Beaver Hall, Suite 904
Montreal, QC
Canada, H2Z 1S8
+1-450-465-8880
Halifax
84 Chain Lake Drive, Suite 501
Halifax, NS
Canada, B3S 1A2
+1-902-429-8880
Manila
Ground Floor, Three E-com Center
Mall of Asia Complex
Pasay City, Metro Manila
Philippines 1300
Sydney
Level 36 Governor Phillip Tower
1 Farrer Place Sydney 2000
Australia
+61 (2) 8823 3370
Abu Dhabi
Floor No.15 Al Sarab Tower,
Adgm Square,
Al Maryah Island, Abu Dhabi, UAE
Tel: +971 (2) 694 8510
Copyright © 2021 Entreprise Castle Hall Alternatives, Inc. All Rights Reserved.
Terms of Service and Privacy Policy