Tag: Part | Page 5

Greetings and Felicitations – Aly McDevitt on Ransomware Case Study, Part 1 | Thomas Fox – Compliance Evangelist

March 22, 2022/in Internet Security

Welcome to the Greetings and Felicitations, a podcast where I explore topics that might not seem directly related to compliance but influence our profession. In this episode, I begin a two-part series with Aly McDevitt, Data & Research Journalist at Compliance Week, and deep dive into her series case study on a ransomware attack on a fictional company.

Highlights include: (1) Why this subject matter for a deep dive? (2) The research that went See more +

Welcome to the Greetings and Felicitations, a podcast where I explore topics that might not seem directly related to compliance but influence our profession. In this episode, I begin a two-part series with Aly McDevitt, Data & Research Journalist at Compliance Week, and deep dive into her series case study on a ransomware attack on a fictional company.

Highlights include: (1) Why this subject matter for a deep dive? (2) The research that went into the piece. How many people were interviewed, and how long was the research process? (3) Writing style. Locked yourself in a room and not coming out until it’s done or more collaborative approach with an editor? (4) Story Synopsis- how common is Betty’s mistake? (5) What is the role of the CIRT and MSSP? How critical was VE’s preparation to its ability to respond?

Tune in to the Greetings and Felicitations podcast for the 2-part series with Aly McDevitt on Ransomware Case Study in Compliance Podcast Network. #GreetingsandFelicitations #RansomwareCaseStudy #AlyMcDevitt #CPN See less –

Source…

Conti Ransomware Group Diaries, Part IV: Cryptocrime

March 8, 2022/in Internet Security

Three stories here last week pored over several years’ worth of internal chat records stolen from the Conti ransomware group, the most profitable ransomware gang in operation today. The candid messages revealed how Conti evaded law enforcement and intelligence agencies, what it was like on a typical day at the Conti office, and how Conti secured the digital weaponry used in their attacks. This final post on the Conti conversations explores different schemes that Conti pursued to invest in and steal cryptocurrencies.

When you’re perhaps the most successful ransomware group around — Conti made $180 million last year in extortion payments, well more than any other crime group, according to Chainalysis — you tend to have a lot digital currency like Bitcoin.

This wealth allowed Conti to do things that regular investors couldn’t — such as moving the price of cryptocurrencies in one direction or the other. Or building a cryptocurrency platform and seeding it with loads of ill-gotten crypto from phantom investors.

One Conti top manager — aptly-named “Stern” because he incessantly needled Conti underlings to complete their assigned tasks — was obsessed with the idea of creating his own crypto scheme for cross-platform blockchain applications.

“I’m addicted right now, I’m interested in trading, defi, blockchain, new projects,” Stern told “Bloodrush” on Nov. 3, 2021. “Big companies have too many secrets that they hold on to, thinking that this is their main value, these patents and data.”

In a discussion thread that spanned many months in Conti’s internal chat room, Stern said the plan was to create their own crypto universe.

“Like Netherium, Polkadot and Binance smart chain, etc.,” Stern wrote. “Does anyone know more about this? Study the above systems, code, principles of work. To build our own, where it will already be possible to plug in NFT, DEFI, DEX and all the new trends that are and will be. For others to create their own coins, exchanges and projects on our system.”

It appears that Stern has been paying multiple developers to pursue the notion of building a peer-to-peer (P2P) based system for “smart contracts” — programs…

Source…

Part Five: Reviewing Key U.S. Insurance Decisions, Trends, & Developments | Hinshaw & Culbertson – Insights for Insurers

March 7, 2022/in Computer Security

Cyber Security And Privacy Insurance Claims

This is the fifth installment of our series of articles reviewing some of the key trends and developments currently impacting the U.S. insurance industry.

To date, the vast majority of cyber coverage decisions have involved traditional first-party, third-party, and crime/fraud policies. Claims under these policies are commonly referred to as silent cyber claims. Most insurers in the cyber-insurance market have now issued several iterations of cyber-specific policies. Rulings under these policies are expected to be rendered with increasing frequency over the next couple of years.

Indeed, cyber-insurers experienced a steep increase in claims over the past couple of years, driven primarily by ransomware, often coupled with data extraction and business email compromise events. The costs associated with ransomware claims, in particular, have risen dramatically due to increased ransom demands, threats to disclose extracted data, and related business interruption costs. The pandemic-driven massive shift to remote work spurred additional cyber claims activity. As a result, industry leaders are anticipating a hardening of the cyber-insurance market, as well as increased premiums and underwriting scrutiny.
Zurich and Advisen’s 11th Annual Information Security and Cyber Risk Management Survey was released in October 2021.^[1] Among the interesting finding, 83% of respondents now buy cyber insurance, with 66% carrying stand-a-lone cyber policies.^[2] The survey concluded that triple-digit premium increases, vanishing capacity, shrinking coverage, and shifted expectations around baseline controls have joined long-term frustrations over inconsistent policy language to create a truly challenging renewal process for insurance buyers. Uncertainties around risk assessment and incident response are major concerns.^[3]
According to the survey, ransomware has risen to the top of priority lists worldwide. For the first time, cyber extortion/ransomware has pulled even with data breach, with 95 percent of respondents selecting it as a coverage they expect to be included in their policies.^[4] It was followed by data restoration at 90 percent, business…

Source…