Security News for the Week Ending Friday August 10, 2018
Lack of Vendor Cyber Risk Management Hurts over 750 Banks
TCM Bank, a company that helps hundreds of small banks issue credit cards had a problem with their third party vendor – the bank’s fourth party vendor risk.
The small bank wants to issue credit cards so they hire TCM and TCM hires someone else and that company leaked the bank’s customer data.
TCM said less than 25% of applicants had their data compromised – fewer than 10,000 consumers. That, I gather, is supposed to make us feel better, but somehow, it doesn’t.
The small community bank, who has the least security expertise is liable for the fourth party breach. The Feds – the FFIEC or the OCC or the FDIC plus the state regulators will be asking lots of embarrassing questions. Those banks, who likely do not have a good vendor cyber risk management program, will be left holding the bag.
Many companies have a fourth party vendor cyber risk management problem. Most are completely unaware. Source: Krebs on Security
It is Amazing What a Potential 20 Million Euro Fine Will Do
In the UK alone, there were about 400 breaches reported to the ICO (information commissioner’s office) in March and another 400 in April. In May, the month that GDPR came into effect at the end of the month, there were 750 breaches reported. In June, the first full month that GDPR was in effect, there were 1,750 breaches reported.
It is unlikely that hackers decided to become more active in alignment with GDPR, so what is likely is that the threat of a massive fine is causing people to report breaches. We shall have to see what the trend looks like and what happens in other countries. Source: Bankinfo Security
The Pentagon is Creating a “Do Not Buy” List
The Pentagon’s Acquisition Chief admitted last week that the Pentagon is creating a secret Do Not Buy list of companies known to use Russian and Chinese software in their products.
The Pentagon plans to work with defense industry trade associations to effectively blacklist those companies.
The new Defense Authorization bill also requires companies to tell if they have less the Ruskies or Chinese look at their source code. Source: Bleeping Computer.
Some Samsung Phones Sending Random Pictures To Random Contacts
Reports started surfacing last month about some Samsung phones sending one or more pictures to contacts in the user’s contact list without the user even being involved. In one reported case the user’s entire gallery was sent.
Given that many people have at least some adult pictures on their phone, if this is really happening, the results could be dicey to say the least.
In addition, if you have any pictures with business proprietary information – say a snap of a white board from a meeting – that could be a problem too.
Samsung said they are aware of it.
T-Mobile, the carrier in at least some of the cases, in a perfect example of taking care of their customers said “It’s not a T-Mobile issue” and told people to talk to Samsung. Note to self – even though T-Mobile may be less expensive, a great customer focused attitude like that goes a long way to kill that value.
Luckily it seems to be happening on new phones which, if Samsung can figure out what is happening, they may be able to develop a patch and those patches would likely be available to the users of the new phones. If this is happening on older phones, users may just be out of luck, since most vendors don’t provide any patches for phones older than about 2 years. This assumes that the users bother to install the patches that are available, which is probably less than a 50/50 bet. Source: Gizmodo.
More Problems for Huawei
While US Gov Tries to Ban Huawei Devices, the UK Gov only said it was “disappointed” at the lack of progress Huawei has made in improving security. Curiously, this is the fourth report over the last 8 years that the UK government has issued and the first three said that any risks had been mitigated. The reason for the change of heart is unknown.
In the meantime, Australia is considering banning Huawei gear, like the U.S. is doing.
One of Britain’s concerns is that Huawei is using third party software – in this case the operating system the gear runs on – that will no longer be supported in two years. Given the normal lifespan of telecom equipment, that is a major problem.
Hauwei said that there were “some areas for improvement”.
Given the concerns over Chinese government influence and possible backdooring of Hauwei equipment, it seems like it would just be a better idea to find another vendor. Source: BBC .
by 