|
|
Cyber Daily: Damaging Cyberattacks Can Stain CEO Careers | Costly Mistakes in Incident Response
|
|
|
|
|
|
|
|
Good day. When a company is hacked, it isn’t just security and technology executives who could lose their jobs. Major attacks over the past several years show that even chief executives can be vulnerable, WSJ Pro's James Rundle and Catherine Stupp report.
Also today: A rare joint advisory from Australia, Canada, New Zealand, the U.K. and the U.S. warns companies about common mistakes in responding to cyber incidents. We summarize the list and link to the countries' statement.
Other news: Facebook removes accounts it says are tied to Russian hackers; India bans more Chinese apps; and hackers hide malicious activity in Google traffic.
|
|
|
|
|
|
|
|
A cyclist rides by a Target in Chicago. In 2014, the company’s chief executive resigned following a breach that exposed massive amounts of its credit-card data. PHOTO: SCOTT OLSON/GETTY IMAGES
|
|
|
|
Chief executives face rising accountability for cyber lapses. Although it is still a rare outcome, cyberattacks can wound the careers of chief executives.
The burden of responsibility for successful hacks still falls largely on chief information and security officers, rather than chief executives. But experts say the issue of cybersecurity is now front-and-center for the seniormost corporate ranks.
“Almost every CEO we talk to, the words that come out of their mouth are, ‘I lose sleep and our board loses sleep every night due to the fact that we could be compromised,'" said Michael Piacente, co-founder and managing partner at Hitch Partners, a recruiting firm focused on cybersecurity professionals.
That is partly because the fallout of a breach can stretch beyond legal concerns to the very viability of a business. The blending of physical and digital security in critical infrastructure and manufacturing raises the possibility of attacks so damaging that people’s lives could be lost, said Katell Thielemann, an analyst at Gartner Inc. As a result, chief executives’ personal liability will increase, she said.
Read the full story.
|
|
|
|
|
|
|
|
Incident Response: What To Avoid
|
|
|
|
When hackers strike corporate systems, the impulse is to stalk and stop them. But acting rashly can harm a company's effort to determine what went wrong and which data was compromised, according to cybersecurity authorities in Australia, Canada, New Zealand, the U.K. and the U.S. The countries issued a rare joint advisory Sept. 1 about responding to a cyberattack. Here are some of the mistakes they cite:
|
|
|
1:
|
Fixing affected systems before responders can protect and recover data. The adversary may notice and change tactics.
|
|
|
|
2:
|
Preemptively blocking adversary's tools. An adversary can easily change to new tools and you will lose visibility into the malicious activity.
|
|
|
|
3:
|
Resetting user credentials. An adversary likely has more than one set of credentials, or worse, access to your entire directory of credentials.
|
|
|
|
4:
|
Failing to preserve log data that could help identify access to compromised systems. If critical logs aren't collected and kept for at least one year, key information about the incident may be lost.
|
|
|
|
|
|
55,983
|
|
Total number of patients whose data was compromised in a cyberattack at a business partner of Northwestern Memorial HealthCare. The partner, Blackbaud Inc., provides nonprofits with donation-management services. Blackbaud said its systems were accessed by an unauthorized party from Feb. 7 to May 20.
|
|
|
|
|
|
|
Facebook removed accounts it says are linked to Russian hackers. PHOTO: MLADEN ANTONOV/AGENCE FRANCE-PRESSE/GETTY IMAGES
|
|
|
|
Facebook removes accounts tied to Russia’s Internet Research Agency. The detection of the operation ahead of November elections show that the Internet Research Agency, a “troll farm” indicted by federal authorities in 2018, remains a thorn in Facebook’s side. But the company said the recent effort’s small reach—totaling 13 accounts and two pages—shows Facebook is getting better at detecting foreign political manipulation efforts before such content spreads widely, The Wall Street Journal reports. Much of the group's efforts were
tied to a website called PeaceData.net, for which the IRA allegedly tried to recruit freelance journalists as writers.
India bans more apps from China. The Baidu shopping search engine, business-card scanning software and more than 110 other Chinese apps are no longer welcome in India, the BBC reports. Citing national-security concerns, India's technology ministry said the apps could collect users' personal data and identify individuals hostile to India's government. The country previously banned 59 other Chinese apps.
Hackers take aim at technology service providers, disguising malware in Google data. In one scheme, hackers hide malicious code in Gmail traffic, hoping to blend in with typical business activity, SCMagazine reports. Companies aren't likely to block widely used Google sites from employees, according to cybersecurity firm Huntress Labs, which is studying the strategy.
|
|
|
|
|
|
|
|
