Tag Archive for: final

Ransomware the final nail in coffin for small US university • The Register

/in


A December attack against a long-standing college in Illinois has pushed the institution to permanently close. 

After 157 years, Lincoln College, the rural university with an average of 1100 students, is shutting its doors following years of rapid decline triggered by COVID-19 and compounded by the ransomware attack.

The ransomware assault that hit in December 2021 originated in Iran, college president David Gerlach told the Chicago Tribune. According to Lincoln’s closure letter, the attack hindered access to all institutional data, interrupted admissions and took retention, fundraising and recruitment systems offline.

The College said that no personal identifying information was exposed.

Gerlach told the Tribune that it cost Lincoln an unspecified amount less than $100,000 to restore the systems. “Once fully restored in March 2022, the projections displayed significant enrollment shortfalls, requiring a transformational donation or partnership to sustain Lincoln College beyond the current semester,” the College said.

Attempts to raise funds, sell assets, consolidate jobs and other money-making schemes failed to materialize the $50 million Gerlach said the university would have needed to keep going.

Now, after surviving “the economic crisis of 1887, a major campus fire in 1912, the Spanish flu of 1918, the Great Depression, World War II, the 2008 global financial crisis, and more,” it’s lights out, lost jobs and students left to hunt for new schools.

Lincoln’s shutdown: Avoidable?

Lincoln College has been light with specifics about the attack, which raises a big question: Was the university doing all it could to secure its systems and users? 

“The economic burdens initiated by the pandemic required large investments in technology and campus safety measures, as well as a significant drop in enrollment with students choosing to postpone college or take a leave of absence,” the university stated in the…

Source…

Final Rule Places New Cybersecurity Reporting Requirements On Banks – Finance and Banking

/in



United States:

Final Rule Places New Cybersecurity Reporting Requirements On Banks

09 March 2022


Crowe & Dunlevy



To print this article, all you need is to be registered or login on Mondaq.com.

Last month, the Federal Reserve System’s Board of Governors,
the Federal Deposit Insurance Corporation and the Office of the
Comptroller of the Currency approved a final rule that places
reporting requirements on banks and banking service providers.
Under this new rule, banks must report cybersecurity incidents
within 36 hours to federal regulators. In addition, banking service
providers must notify banks as soon as possible after suffering a
computer security incident. This new rule also requires banks to
inform customers of any computer security incident lasting more
than four hours.

This new rule is part of a current trend of requiring critical
infrastructures to report cybersecurity incidents. This rule goes
into effect starting April 1, 2022, and banks are required to be in
compliance by May 1, 2022. While the rule doesn’t go into
effect until next year, there are several ways that banks and
service providers can get prepared.

  1. Determine who will be responsible for reporting the
    incident to the regulators.     Cybersecurity incidents are
    stressful. While the rule provides a more extended deadline than
    the 12-hour reporting requirement for pipelines, 36 hours is still
    a quick turnaround. Taking the time now to identify the person
    responsible will…

Source…

Ransom DDoS attacks surged in final quarter of 2021

/in


Ransom DDoS attacks increased by 29% YoY and 175% QoQ in the last quarter 2021, according to new research from Cloudfare.

The first half of 2021 witnessed massive ransomware and ransom DDoS attack campaigns that interrupted aspects of critical infrastructure around the world (including one of the largest petroleum pipeline system operators in the US) and a vulnerability in IT management software that targeted schools, public sector, travel organisations, and credit unions.

The second half of the year recorded a growing swarm of one of the most powerful botnets deployed (Meris) and record-breaking HTTP DDoS attacks and network-layer attacks observed over the Cloudflare network. This besides the Log4j2 vulnerability (CVE-2021-44228) discovered in December that allows an attacker to execute code on a remote server — arguably one of the most severe vulnerabilities on the Internet since both Heartbleed and Shellshock.

Prominent attacks such as the ones listed above are but a few examples that demonstrate a trend of intensifying cyber-insecurity that affected everyone, from tech firms and government organisations to wineries and meat processing plants.

According to Cloudfare,Q4 21 was the busiest quarter for attackers in 2021. In December 2021 alone, there were more than all the attacks observed in Q1 and Q2 21 separately. And one out of every three survey respondents reported being targeted by a ransom DDoS attack or threatened by the attacker.

While the majority of attacks were small, terabit-strong attacks became the new norm in the second half of 2021. Cloudflare automatically mitigated dozens of attacks peaking over 1 Tbps, with the largest one peaking just under 2 Tbps — the largest the company says it has ever seen.

The Manufacturing industry was the most attacked in Q4 21, recording a whopping 641% increase QoQ in the number of attacks. The Business Services and Gaming/Gambling industries were the second and third most targeted industries by application-layer DDoS attacks.

Q4 21, and November specifically, recorded a persistent ransom DDoS campaign against VoIP providers around the world.

 

For the fourth time in a row this year, China topped the charts with the…

Source…

Federal Trade Commission publishes final updated Safeguards Rule | Thompson Coburn LLP

/in


On October 27, 2021, the Federal Trade Commission (“FTC”) announced significant updates to the Safeguards Rule. The FTC asked for comments on the Rule in 2019, and held a public workshop on the Rule in 2020. The Final Rule was published in the Federal Register on December 9, 2021. The Rule is effective on January 10, 2022, however, most of the substantive provisions of the Rule take effect a year from the publication date.

Per the final rule summary, the amended Rule contains five primary changes:

  • “First, it adds provisions designed to provide covered financial institutions with more guidance on how to develop and implement specific aspects of an overall information security program, such as access controls, authentication, and encryption. 
  • Second, it adds provisions designed to improve the accountability of financial institutions’ information security programs, such as by requiring periodic reports to boards of directors or governing bodies. 
  • Third, it exempts financial institutions that collect less customer information from certain requirements. 
  • Fourth, it expands the definition of ‘financial institution’ to include entities engaged in activities that the Federal Reserve Board determines to be incidental to financial activities. This change adds ‘finders’–companies that bring together buyers and sellers of a product or service– within the scope of the Rule. 
  • Finally, the Final Rule defines several terms and provides related examples in the Rule itself rather than incorporate them by reference from the Privacy of Consumer Financial Information Rule (‘Privacy Rule’).”

Substantively, the amended Rule generally follows the approach outlined in the 2019 proposal with certain amendments and clarifications.

The 2021 changes to the Safeguards Rule passed by a 3-2 vote by the FTC with the three “yes” votes coming from Democrats and 2 “no” votes from Republicans. Commissioners Noah Joshua Phillips and Christine S. Wilson dissented. Commissioner Rebecca Kelly and Chair Lina M. Khan also released a joint statement. The split vote on the final Rule, as well as on the 2019 proposed Rule, reflect a change from prior rulemakings in the security…

Source…