Uncategorized

Apple hires ex-OLPC security architect

Former director of security architecture at One Laptop per Child (OLPC) Ivan Krstic has joined Apple to help thwart hacker attacks against the Mac operating system.

Krstic, a well-respected innovator who designed the Bitfrost security specification for the OLPC initiative, joined Cupertino this week and will work on core OS security.  His hiring comes at a crucial time for a company that ties security to its marketing campaigns despite public knowledge that it’s rather trivial to launch exploits against the Mac. Read the full story [zdnet.com]

How employees evade IT security controls

By Matt Keil, Palo Alto Networks
Prior to January of 2007, I had very little exposure to the vast array of applications that employees use while at work. Sure, I used IM, webmail and listened to music online, but I was being paid to do a job, not entertain myself. After joining Palo Alto Networks, and analyzing 18 months worth of customer traffic, it has become clear to me that my application exposure is outdated. I say this because I am surprised by the broad range of applications we find running on corporate networks – business and end-user oriented. Examples include inappropriate web surfing (obviously), watching HD movies, streaming music, file sharing or running a side business. The bottom line is that employees are using their favorite applications whenever they want with little regard to the associated business and security risks.

Who decides what health data is sensitive?

The massive UC Berkeley data breach reported last week exposed the sensitive health information of more than 160,000 Berkeley students, alumni and others who used the school’s health system. Berkeley officials said that the breach did not expose the victims’ treatment information, an assertion that is leaving some security experts wondering exactly what constitutes sensitive data.

More than 160,000 affected by data breach at UC Berkeley

by Dennis Fisher

Hackers had access to a database for about six months at the University of California at Berkeley and stole health-related data on more than 160,000 students and other people who used the school’s health services center. College officials said that the attack on the health center’s database was discovered last month and that they are just now beginning to notify the affected people.

Study: Women more affected by ID fraud

by Ryan Naraine

From CNet (Elinor Mills)

Women are more affected by identity fraud then men are, according to a new survey that also found that it takes women longer to restore their identities but they also tend to change their behavior afterward.
In a survey of 808 U.S. households, half of which reported fraud, 28 percent of women said they had been victims of identity fraud compared with 21 percent for men. Read the full story [cnet.com]

Data-sniffing attack costs Heartland $12.6m

by Ryan Naraine

From The Register (Dan Goodin)

Electronic payments processor Heartland Payment Systems said Thursday it has allocated $12.6m to cover a security breach that exposed sensitive card holder data crossing its network.

More than half that amount involves a fine MasterCard has assessed banks that did business with Heartland, said company CEO Robert Carr, according to this conference-call transcript [seekingalpha.com]. The remainder covers legal costs and other expenses related to the breach, which was discovered in January. Read the full story [theregister.co.uk]

Prediction: Apple will recommend security software

by Ryan Naraine

From CNet (Jon Oltsik)
As an analyst, it is my job to follow the industry, internalize trends, and then use this information to make predictions. OK, here goes: Within the next 18 months, Apple will begin recommending that Macintosh users install Internet security software on all systems.
Now I realize that this statement is blasphemy to dedicated Mac users, so let me start with a few qualifying statements. I am not comparing Mac OS with Windows, or Apple with Microsoft, and my prediction should not be interpreted as an attack on Apple, its developers, or the security of its code. Read the full story [cnet.com]

Security breach affects 15,487 Honolulu students

by Ryan Naraine

More than 15,000 students at Kapiolani Community College in Honolulu face an identity theft risk because of an Internet security breach, school officials said.

School officials found a computer on April 15 with the personal information of 15, 487 students who applied for financial aid between January 2004 and April 15 that was infected with malware that can steal sensitive data. The computer did not have sensitive information, but it was hooked up to a network that had access to names, addresses, phone numbers dates of birth and Social Security numbers. Read the full story [kitv.com]

Hackers break into database, demand ransom

by Ryan Naraine

From WaPo Security Fix (Brian Krebs)

Hackers last week broke into a Virginia state Web site used by pharmacists to track prescription drug abuse. They deleted records on more than 8 million patients and replaced the site’s homepage with a ransom note demanding $10 million for the return of the records, according to a posting on Wikileaks.org, an online clearinghouse for leaked documents. Read the full story [washingtonpost.com]

USPS probes possible mass security breach

by Ryan Naraine

CBS News is reporting word about another data breach potentially compromising the personal information of thousands of people. Companies Lexis Nexis and Investigative Professionals have sent up to 40,000 letters to customers whose “sensitive and personally identifiable” information may have been viewed by individuals who should not have had access.  Read the fully story [cbsnews.com]

Cybersecurity for your growing business
Cybersecurity for your growing business

Topics

Show all

Authors

Threatpost

InfoSec Insider

Infosec Insider Post

Infosec Insider content is written by a trusted community of Threatpost cybersecurity subject matter experts. Each contribution has a goal of bringing a unique voice to important cybersecurity topics. Content strives to be of the highest quality, objective and non-commercial.

Sponsored

Sponsored Content

Sponsored Content is paid for by an advertiser. Sponsored content is written and edited by members of our sponsor community. This content creates an opportunity for a sponsor to provide insight and commentary from their point-of-view directly to the Threatpost audience. The Threatpost editorial team does not participate in the writing or editing of Sponsored Content.