Human Risk Management Blog

NIST Releases Voluntary Cybersecurity Compliance Framework

Online social engineering scams flourish around Valentine's Day

Michael Cooney at Network World summarized the current scams doing the rounds related to online dating and romance sites. A good reminder that heartless con artists use social engineering ...

What Is The Deep Web 101

Pierluigi Paganini wrote a great blog post today. The Deep Web (or Invisible Web) is all the information on the World Wide Web not reported by normal search engines. It's HUGE. According ...

Scam Of The Week: "Held For Ransom"

FBI’s Internet Crime Complaint Center Ransomware

Citadel 'Shutdown' Just A Microsoft PR Move

Knowbe4 - CyberheistNews Vol 3, #14

Industrial Control Systems The Next Twin Towers

[caption id="" align="aligncenter" width="588"] Shodan Network[/caption] Eugene Kaspersky a few days ago wrote a hair-raising blog post about the reality of our Industrial Control Systems ...

Scam Of The Week Payroll Phish

The nakedsecurity blog over at Sophos highlighted a new phishing scam that would be good to alert your employees about. The bad guys are pretending to be payroll processing company ADP. ...

Malware Metastasizes

A few days ago I wrote about a 60 million Euro cyberheist. I have been digging into this a bit more, as it's the most advanced attack yet. Cybercrime is not revolutionary, it clearly ...

Bank Settles With California Cyberheist Victim

Finally, a positive outcome in a cyberheist lawsuit. Brian Krebs reported that a Professional Business Bank settled with a Village View Escrow Inc, a California cyberheist victim. A ...

Why pill pushing spam pays off

Brian Krebs is on a roll. Here is why pill pushing spam pays off. "Consumer demand for cheap prescription drugs sold through spam-advertised Web sites shows no sign of abating, according ...

OMG - I did not know it was THIS horrible.

More from Brian Krebs's astounding blog post today. "As the chart I compiled above indicates, attackers are switching the lure or spoofed brand quite often, but popular choices include ...

Double-check that cashiers check

The fake cashier's check scam has gotten more sophisticated. Cathy Bussewitz at the pressdemocrat site reported on this one: "It usually starts when a seller posts a big-ticket item on ...

Gmail Security Hole Allows Hackers To Automate Social Engineering Trick

Christopher Mims over at Technology Review was the first one to report on this. A large Gmail security hole could lead to mass harvesting of accounts, as hackers can automate this social ...

Weak passwords STILL subvert IT security

Jaikumar Vijayan over at Computerworld observed correctly: "A recent data breach that exposed the Social Security numbers of more than 280,000 people served as yet another reminder of the ...

Cost of penetration testing < cost of security incident :)

The Cost of a Security Incident Is Usually Much Greater Than Preventing It This is a blog post by John Pescatore, July 24, 2009, and still as valid today as it was then. "A few years ago ...

Message For The Owner: "Your Bank Account Emptied By Cyber Thieves"

Editor's Corner

Facebook Malware Scam Of The Week

Editor's Corner Facebook Malware Scam of the Week A "worrying number" of Facebook users are sharing a link to a malware-laden fake CNN news page reporting the U.S. has attacked Iran and ...

The Security Earthquake That Nobody Felt

Editor's Corner

And The #1 Security Risk for 2012 Is...

Humans are the weakest link that needs to be healed. New laws aimed at improving IT data security are being written by the bushel, loaded with penalties for non-compliance and security ...