Content by Jeremy Kirk

Paying Ransomware Actors: 'It's a Business Decision'

Jeremy Kirk  •  June 22, 2022

Having to decide whether to pay a ransom to cybercriminals is a decision no one wants to make. But Gartner's Paul Furtado and Hearing Australia CISO Daniel Smith say practitioners should stay objective and leave the decision - and the subsequent moral implications - to the business.

The Ransomware Files, Episode 8: Travelex

Jeremy Kirk  •  June 20, 2022

Ransomware struck global currency exchange and remittance company Travelex on New Year's Eve 2019. Don Gibson, a security architect at Travelex, became publicly linked with the incident, and the undesired attention he received contributed to a health situation that nearly led to a tragic outcome.

The Ransomware Files, Bonus Ep. 1: REvil Is Foiled

Jeremy Kirk  •  May 30, 2022

If software has a dangerous security flaw, should its maker tell customers to shut it down until it’s fixed? It's a tough call, but Dutch company Hoppenbrouwers says the software vendor Kaseya should have done so last year to prevent a massive supply chain attack by the REvil ransomware gang.

Detection and Response: Closing Gaps Adversaries Exploit

Jeremy Kirk  •  May 27, 2022

Fabio Fratucello, CTO for Asia-Pacific and Japan at CrowdStrike, says, "Defenders need to continue to advance their defensive capabilities. They need to be able to streamline operation and reduce time when performing detection and response functions." He discusses XDR, SIEM and automated workflows.

Okta's Data Breach Debacle After Lapsus$ Attack: Postmortem

Jeremy Kirk  •  May 11, 2022

A hacking group called Lapsus$ caused major headaches for identity vendor Okta in March when it dropped incriminating but misleading screenshots of a security breach. Brett Winterford of Okta breaks down what happened and discusses why visibility into third-party support operations is important.

The Ransomware Files, Episode 7: Ryuk's Rampage

Jeremy Kirk  •  May 6, 2022

Rockford Public Schools in Rockford, Illinois, was hit by Ryuk ransomware days after the school year started in September 2019. The attack encrypted more than 6 million files, wrecked applications and locked up servers. But the district kept classes running while mounting a mighty recovery effort.

Battling Ransomware in Healthcare

Jeremy Kirk  •  April 29, 2022

The healthcare industry continues to be targeted by ransomware gangs, but there are efforts underway to help improve the health sector's information security resiliency. Errol Weiss of Health-ISAC says the industry as a whole lacks resources.

The Ransomware Files, Episode 6: Kaseya and REvil

Jeremy Kirk  •  April 4, 2022

The REvil ransomware gang's attack against the U.S. software company Kaseya in July 2021 is one of the largest and most intriguing ransomware attacks of all time. Here's the inside story of how the attack went down and how organizations recovered.

UK Police Arrest 7 Allegedly Tied to Lapsus$ Hacking Group

Jeremy Kirk , Devon Warren-Kachelein  •  March 25, 2022

Police in London say they've arrested seven people that the BBC reports are tied to the Lapsus$ hacking group, which has claimed responsibility for data breaches involving Okta, Microsoft, Nvidia, Ubisoft and more. The names of the suspects, who are mostly teenagers, have not been released.

Sanctions Halt Rewards for Bug Hunters in Belarus, Russia

Jeremy Kirk  •  March 16, 2022

Sanctions levied against Russia and Belarus for the invasion of Ukraine are affecting security researchers signed up with bug bounty platforms, which can no longer legally make payments. A researcher in Belarus says he's locked out from accessing $25,179 in his HackerOne account.

Conti Gang Members Fretted Over Putin's Ukraine Invasion

Jeremy Kirk  •  March 3, 2022

A newly released conversation between two members of the Conti ransomware gang reveals concern about the war in Ukraine and its potential to disrupt their lucrative extortion racket. The conversation took place just a day before a massive data leak exposed the gang's inner workings.

Ukrainian Researcher Leaks Conti Ransomware Gang Data

Jeremy Kirk  •  February 28, 2022

A Ukrainian cybersecurity researcher has released a huge batch of data that came from the internal systems of the Conti ransomware gang. The researcher released the data after the notorious ransomware gang expressed support for Russia after its invasion of Ukraine.

The Ransomware Files, Episode 5: Texas and REvil

Jeremy Kirk  •  February 22, 2022

In 2019, 23 cities across Texas were struck by one of the largest ransomware attacks ever in the U.S. The attack, which involved the REvil ransomware, started with a compromised managed service provider. While the cities recovered quickly, the MSP sustained irreparable damage.

CyberEd Board Profiles in Leadership: Elrich Engel, AMP

Jeremy Kirk  •  February 17, 2022

What security functions should be kept in house, and which ones should be outsourced? The sands are shifting: the days of a fully in-house security operations center are probably gone now, says Elrich Engel, CISO and director of data and architecture at AMP, an Australian financial services company.

Improving Cybersecurity Defenses for Schools

Jeremy Kirk  •  February 11, 2022

Schools in the United States have been under siege from ransomware and other kinds of cyber incidents. But the K12 Security Information Exchange, an organization launched in 2020, is helping schools improve their defenses.