Newsflash maandag 28 december 2020
Minister: geen voornemen om versleuteling binnen EU te verbieden
(security.nl)

Er is binnen de EU geen sprake van een voornemen om versleuteling te verbieden en het kabinet zal het verbieden van encryptie in de toekomst niet steunen, zegt minister Grapperhaus van Justitie en Veiligheid.

De minister reageerde op een motie van FvD-voorman Thierry Baudet. Volgens Baudet gaan er binnen de Europese Unie stemmen op om het versleutelen van digitale berichten te verbieden, zodat ook overheden mee kunnen lezen.

Daarop diende de FvD-voorman een motie in waarin hij de regering oproep om zich tegen deze ontwikkeling te verzetten en niet akkoord te gaan met enig voorstel om versleuteling van berichtgeving te verbieden. De motie werd met 91 stemmen voor en 59 stemmen tegen door de Tweede Kamer aangenomen. VVD, CDA, ChristenUnie en 50PLUS stemden tegen de motie.

Grapperhaus geeft verkenningsopdracht voor encryptiebackdoor
(agconnect.nl)

Justitie-minister Ferd Grapperhaus drukt zijn verlangen naar een backdoor in encryptie verder door. De bewindsman laat onderzoek doen naar de impact van versleuteling op het opsporingswerk van politie, Justitie en inlichtingendiensten. Die opdracht geeft hij aan een onderzoekscentrum van zijn eigen ministerie.

Het Wetenschappelijk Onderzoek- en Documentatiecentrum (WODC), wat valt onder het ministerie van Justitie en Veiligheid, gaat onderzoeken wat voor effect het gebruik van encryptie heeft op het opsporen van criminelen en misdaden.

Grapperhaus stelt in een brief aan de Tweede Kamer dat (tijdig) inzicht door bevoegde autoriteiten in digitale gegevens wordt bemoeilijkt, vertraagd of zelfs onmogelijk gemaakt door encryptie.

De Jonge gaat coronatest- en traceersystemen beter beveiligen
(security.nl)

Minister De Jonge van Volksgezondheid gaat maatregelen nemen om de coronatest- en traceersystemen beter te beveiligen. Dit moet het risico op datalekken met persoonsgegevens verkleinen. Dat laat de minister in een brief aan de Tweede Kamer weten.

Volgens de minister is een goede it-ondersteuning bij het uitvoeren van bron- en contactonderzoek en coronatests een belangrijke randvoorwaarde. Via verschillende systemen worden binnen de test- en traceerketen door partijen gegevens uitgewisseld.

Het gaat dan om persoonsgegevens, testuitslagen, logistieke en stuurgegevens, alsmede data voor onderzoek en rapportage.

Vietnam targeted in complex supply chain attack
(zdnet.com)

A group of mysterious hackers has carried out a clever supply chain attack against Vietnamese private companies and government agencies by inserting malware inside an official government software toolkit.

The attack, discovered by security firm ESET and detailed in a report named "Operation SignSight," targeted the Vietnam Government Certification Authority (VGCA), the government organization that issues digital certificates that can be used to electronically sign official documents.

Any Vietnamese citizen, private company, and even other government agency that wants to submit files to the Vietnamese government must sign their documents with a VGCA-compatible digital certificate.

Suspected Russian hackers used Microsoft vendors to breach customers
(reuters.com)

The suspected Russian hackers behind the worst U.S. cyber attack in years leveraged reseller access to Microsoft Corp services to penetrate targets that had no compromised network software from SolarWinds Corp, investigators said.

While updates to SolarWinds’ Orion software was previously the only known point of entry, security company CrowdStrike Holdings Inc said Thursday hackers had won access to the vendor that sold it Office licenses and used that to try to read CrowdStrike’s email.

It did not specifically identify the hackers as being the ones that compromised SolarWinds, but two people familiar with CrowdStrike’s investigation said they were.

Ex-NSA Director: SolarWinds Breach Is 'A Call for Action'
(bankinfosecurity.com)

He has commanded armed forces and directed the National Security Agency. Now, he's president of vendor IronNet Cybersecurity. From this unique perspective, retired General Keith Alexander says the SolarWinds breach is "a call for action."

There's plenty of speculation about the breach's scope, damage and attribution. But it's clear to Alexander that the U.S. public and private sectors have been dangerously exposed.

"The breach highlights a strategic vulnerability our nation has, and we should be very concerned," Alexander says. "If we don't fix it, that will eventually be used against us and cause great damage. ... This is a call for action for our nation."

November 2020 Healthcare Data Breach Report
(hipaajournal.com)

For the second successive month, the number of reported healthcare data breaches has fallen; however, it should be noted that the number of breaches reported in October 2020 was almost three times the average monthly number due, in a large part, to the ransomware attack on the cloud service provider Blackbaud.

November saw 47 data breaches of 500 or more healthcare records reported to the HHS’ Office for Civil Rights by HIPAA-covered entities and business associates, 25.39% fewer than October.

Even with that reduction, breaches are still well above the 12-month average of 41 data breaches a month (Median = 38 breaches).

Health to be on cyber-security's front line in 2021
(bbc.com)

Covid-19 catapulted the health sector to the forefront of cyber-security in 2020, but the next year is likely to see the dangers continue and evolve.

Threats from nation states and criminals to the health system are a growing concern. The huge logistical challenge of rolling out vaccines faces the risk of disruption to complex supply chains.

And criminal ransomware poses a threat at a time when the pandemic has increased our reliance on technology.

The Worst Hacks of 2020, a Surreal Pandemic Year
(wired.com)

From ransomware schemes to supply chain attacks, this year melded classic hacks with extraordinary circumstances.

What a way to kick off a new decade. 2020 showcased all of the digital risks and cybersecurity woes you've come to expect in the modern era, but this year was unique in the ways Covid-19 radically and tragically transformed life around the world.

The pandemic also created unprecedented conditions in cyberspace, reshaping networks by pushing people to work from home en masse, creating a scramble to access vaccine research by any means, generating new fodder for criminals to launch extortion attempts and scams, and producing novel opportunities for nation-state espionage.

OCR Issues Guidance on Disclosures of PHI to Health Information Exchanges under HIPAA
(hipaajournal.com)

The Department of Health and Human Services’ Office for Civil Rights has published new guidance on the Health Insurance Portability and Accountability Act (HIPAA) Rules covering disclosures of protected health information (PHI) to health information exchanges (HIEs) for the public health activities of a public health authority (PHA).

An HIE is an organization that enables the sharing of electronic PHI (ePHI) between more than two unaffiliated entities such as healthcare providers, health plans, and their business associates.

HIEs’ share ePHI for treatment, payment, or healthcare operations, for public health reporting to PHAs, and for providing other functions and services such as patient record location and data aggregation and analysis.

Vermont Hospital confirmed the ransomware attack
(securityaffairs.co)

The Burlington-based University of Vermont Health Network has finally admitted that ransomware was behind the October attack.

In October, threat actors hit the Wyckoff Heights Medical Center in Brooklyn and the University of Vermont Health Network. The cyber attack took place on October 28 and disrupted services at the UVM Medical Center and affiliated facilities.

A month later, the University of Vermont Medical Center was continuing to recover from the cyber attack that paralyzed the systems at the Burlington hospital.

In early December, Hospital CEO Dr. Stephen Leffler announced that the attack that took place in late October on the computer systems of the University of Vermont Medical Center is costing the hospital about $1.5 million a day in lost revenue and recovery costs.

REvil gang threatens to release intimate pictures of celebs who are customers of The Hospital Group
(securityaffairs.co)

The Hospital Group has 11 clinics and has a celebrity clientele, but it made the headlines because the REvil ransomware gang, aka Sodinokibi, claims to have hacked its systems and threatens to release before-and-after pictures of celebrity clients.

The Hospital Group has confirmed the ransomware attack and notified the Information Commissioner about the security breach. The Hospital Group also notified via email all customers.

“We can confirm that our IT systems have been subject to a data security breach.” The Hospital Group said in a statement. “None of our patients’ payment card details have been compromised but at this stage, we understand that some of our patients’ personal data may have been accessed.”

Albertville hospital victim of cyber attack
(francebleu.fr)

Since Monday, the Albertville-Moûtiers Hospital Center has been targeted by a cyber attack. His information system was damaged. Consequence: patients who have an appointment after December 28 must reconfirm their arrival.

Since 4 am, this Monday, December 21, the Center Hospitalier Albertville-Moûtiers (CHAM) has been the victim of a cyber attack. Several sites are affected: the two branches in Albertville and Moûtiers, as well as the EHPAD and the Claude Léger and Les Cordeliers long-term care units.

Several equipment, servers, software and part of the computer network are currently unavailable. They are attacked by a "ransomware" type virus as specified by CHAM in a press release, malicious software that takes computer data 'hostage' in exchange for a sum of money.

12 Cybersecurity CEOs On What Each Learned Leading During The Pandemic
(enterpriseirregulars.com)

Bottom Line: Cybersecurity CEOs’ lessons learned from navigating the pandemic provide a valuable framework for leading and growing a business through anxious, uncertain times.

How each cybersecurity CEO responds to the challenges of keeping employees safe, customers secure, and product release cycles on schedule while still achieving customer success – all virtually – provide valuable insights into leading a company during difficult times.

Simon Biddiscombe, former CEO of MobileIron (acquired by Ivanti), exemplifies the empathy all CEOs interviewed have for their employees’ welfare.

5 Tech Trends Keeping CMOs Awake At Night
(forbes.com)

It’s one thing to know which tech trends are coming our way in 2021. It’s another thing altogether to manage the effective implementation of those trends in a way that brings value and insight to your company.

That’s the task CMOs face each new year as an onslaught of technology floods the business landscape. The next big thing of 2020 may or may not still be relevant in 2021.

The last big tech investment may not have paid off. And even if it did—the latest iteration may call for a whole new infrastructure. While technologists flout the coolest digital transformation trends for 2021, the following trends are keeping CMOs up at night, wondering how, when, why, and if they should roll out another new tech venture.

5 Steps to Transform Your IT Org with AI
(tradepub.com)

Forward-thinking organizations combine data and machine learning (ML) for IT monitoring, service desk tasks and automation. Although only a small percentage of large enterprises are doing this today, it is expected to balloon in the future.

“By 2022, 40% of all large enterprises will combine big data and machine learning functionality to support and partially replace monitoring, service desk and automation processes and tasks, up from 5% today.”

This whitepaper will explore the benefits of combining ML (machine learning) with AI (artificial intelligence), and offer 5 steps for implementing this strategy. Download your copy today.

Steps IT pros can take to prioritize interpersonal needs
(helpnetsecurity.com)

Most people in the IT industry are familiar with the phrase “people, process, and technology.” While there are many technology and process standards within organizations, and while they are created by people and supported by people, the innate “people” component of technology development and management is often neglected.

The overemphasis on logic, analytics and process has led to leadership challenges such as poor communication, poor relationship management and poor stakeholder engagement.

Critical IT projects have failed because IT leaders neglect the equally important “people” aspect of these programs. But as IT departments work to plan for 2021, IT leaders will need to reevaluate, prioritize and advocate for the technical and interpersonal needs of their employees.

Quarterbacking Vulnerability Remediation
(darkreading.com)

It's time that security got out of the armchair and out on the field.

Traditional vulnerability remediation occurs in silos — the security team detects vulnerabilities, prioritizes which ones need to get fixed first, and punts the list over the cubicle wall for the IT operations team to handle.

But that approach is no longer tenable. The rate and pace at which vulnerabilities occur requires the strategic alignment of IT functions across the enterprise. Since the security team "owns" vulnerability management, it should be accountable for creating and maintaining that alignment.

DeepMind’s big losses, and the questions around running an AI lab
(venturebeat.com)

Last week, on the heels of DeepMind’s breakthrough in using AI to predict protein-folding came the news that the UK-based AI company is still costing its parent company Alphabet Inc hundreds of millions of dollars in losses each year.

A tech company losing money is nothing new. The tech industry is replete with examples of companies who burned investor money long before becoming profitable. But DeepMind is not a normal company seeking to grab a share of a specific market. It is an AI research lab that has had to repurpose itself into a semi-commercial outfit to ensure its survival.

And while its owner, which is also the parent company of Google, is currently happy with footing the bill for DeepMind’s expensive AI research, it is not guaranteed that it will continue to do so forever.

Are you protected against online tracking? The EFF's Cover Your Tracks site has the answer
(ghacks.net)

Cover Your Tracks is an online test by the Electronic Frontier Foundation (EFF) to determine how well a browser is protecting user data against online tracking.

When you connect to a site using a browser, information is revealed to the site automatically. Sites may run scripts to gather additional information about the device that is used, and all of that may be used to track users across the Internet.

Cover Your Tracks is based on EFF's Panopticlick tool that the organization launched in 2010 and updated in 2015. Panopticlick redirects users to the new Cover Your Tracks tool automatically.

Fascinating Look Back at the 1000HP Oldsmobile Aerotech, a Supercar You Probably Never Knew Existed
(techeblog.com)

Between 1987 and 1992, Oldsmobile built a series of experimental Aerotech supercars that incorporated the latest performance technology with the aim of breaking multiple automobile speed records.

A. J. Foyt, four-time Indy 500 winner, drove the first Aerotech vehicle set a world closed-course speed record of 257.123 mph on August 27, 1987 at the 7.712-mile test track near Fort Stockton Texas. It was powered by a turbocharged 2.3L Quad 4 generating over 1000 hp. Read more for two videos and additional information.

Oldsmobile produced a total of three variants of the original Aerotech to prove the capabilities of the company’s Quad 4 engine.

In California, little robot cars will deliver pizza, groceries, and medicine as a paid service in 2021 for the first time
(businessinsider.com)

Your groceries, pizza, and medicine can now be delivered via robotic vehicles if you live in California, as Nuro received the state's first commercial permit for autonomous delivery.

San Francisco and Silicon Valley's streets have been bustling with self-driving vehicles from an array of companies for years. But those vehicles have only been issued permits for testing on public roads. Now, the robotics-startup Nuro has an official stamp of approval to start its paid service, according to the California Department of Motor Vehicles.

"Issuing the first deployment permit is a significant milestone in the evolution of autonomous vehicles in California. We will continue to keep the safety of the motoring public in mind as this technology develops," said Steve Gordon, DMV director, in a statement.

Game of Thrones games maker dies 'after poisoning'
(bbc.com)

A Chinese tycoon who died on Christmas Day was poisoned, Shanghai police say. Lin Qi, 39, was the chairman and chief executive of games developer Yoozoo, best known for the Game of Thrones: Winter Is Coming strategy game.

The Shanghai police statement pointed to one of Mr Lin's colleagues - identified only by his surname Xu - as the main suspect.

Mr Lin was believed to have a net worth of around 6.8bn yuan (£960m), according to the Hurun China Rich List. Many employees and ex-employees gathered outside Yoozoo's office on Friday to mourn his death.