Tag Archive for: significant

Report identifies phishing, ransomware attacks as most significant security incidents for healthcare

/in


The HIMSS Healthcare Cybersecurity Survey found that across the board, healthcare organizations identified phishing and ransomware attacks as the most significant security incidents in 2021.

Financial information was the most frequent target of such cyber attacks, according to the report. Cyber threats such as ransomware attacks against the industry have grown over the years amid challenges it already confronts: aging infrastructures and tight budgets.

The report, sponsored by Carahsoft, surveyed 167 professionals to assess the state of healthcare cybersecurity. Of those surveyed, 54% worked for healthcare provider organizations, 28% for consulting/vendor organizations, and 19% for other types of organizations. Most (61%) of those surveyed had primary responsibility for cybersecurity programs at their respective healthcare organization and 23% had some responsibility. Further, of those surveyed, 90% said they had a management role in healthcare cybersecurity.

A substantial —67% — number of those who responded stated that in the past 12 months their healthcare organization combated significant security incidents, the report said. When considering how severe the security threat was that the organization faced, 12% considered it critical and 32% considered it a high threat.

 

Further, healthcare organizations said phishing attack were the first most common form of threat, accounting for 45% of security incidents. Ransomware attacks ranked second, comprising 17% of incidents.

Additionally, phishing often played a major role in the security incidents. For example, 57% of those surveyed said the most significant security incident included phishing. Respondents indicated the percentage of each type of phishing that occurred: email phishing (71%), spear-phishing (67%), voice phishing/vishing (27%), whaling (27%), business e-mail compromise (23%), SMS phishing (21%), phishing websites (20%) and social media phishing (16%), according to the report.

When exploring the initial point of contact that compromised cybersecurity, phishing was the most common, at 71%, the report said. Additionally, human error (19%) and social engineering (15%) as well as legacy software (15%) were the…

Source…

BIS issues significant new export controls on certain cybersecurity items and related guidance

/in


On October 21, 2021, the Bureau of Industry and Security (BIS) published an interim final rule (IFR) to implement significant new controls regarding certain cybersecurity items. The rule contains new and updated Export Control Classification Numbers (ECCNs) and new License Exception Authorized Cybersecurity Exports (ACE). On November 12, 2021, BIS issued Frequently Asked Questions (FAQs) to provide guidance on the IFR and License Exception ACE.

On October 21, 2021, the Bureau of Industry Security (BIS) published an Interim Final Rule (IFR) to implement controls on certain “cybersecurity items” that can be used for malicious cyber activities. Most notably, the IFR defines “cybersecurity items” to include the new and updated Export Control Classification Numbers (ECCNs) and creates a new License Exception Authorized Cybersecurity Exports (ACE). This IFR follows BIS’s original proposal to implement the addition of cybersecurity items to the Wassenaar Arrangement (WA) in 2015. However, the 2015 proposed rule received substantial industry scrutiny, including concerns that the rule was overly broad, would impose a heavy burden on licensing for legitimate transactions, and could cripple legitimate cybersecurity research. In response to those and other concerns, BIS suspended implementation of the 2015 proposed rule and, instead, renegotiated changes to the WA control lists in 2017, intending to define more precisely the scope of the cybersecurity controls. BIS released the October 2021 IFR to implement the 2017 WA decisions. Public comments on the IFR are due December 6, 2021, and the IFR is set to go into effect on January 19, 2022.

On November 12, 2021, BIS issued Frequently Asked Questions (FAQs) that provide guidance on this IFR.

New Export Control Classification Numbers 

“Cybersecurity items” are defined to include the new and updated ECCNs referenced below and certain related ECCNs in Categories 4 and 5.

Category 4 includes two new ECCNs related to “intrusion software”:

  • 4A005 “Systems,” “equipment,” and “components” therefor, “specially designed” or modified for the generation, command and control, or delivery of “intrusion software.”
  • 4D004…

Source…

Rule requires banks report significant ‘computer-security incidents’ within 36 hours | Article

/in


The Office of the Comptroller of the Currency (OCC), Federal Reserve, and Federal Deposit Insurance Corp. (FDIC) approved the policy, which also requires service providers for financial institutions to notify affected bank customers of any service outage caused by a computer-security incident that lasts longer than four hours.

The rule is effective April 1, 2022, and compliance is required by May 1, 2022.

A computer-security incident is described in the rule as an “occurrence that results in actual harm to the confidentiality, integrity, or availability of an information system or the information that the system processes, stores, or transmits.” Such incidents can be caused by a variety of factors, including cyberattacks launched by hackers with “destructive malware or malicious software” as well as “non-malicious failure of hardware and software, personnel errors, and other causes.”

A “notification incident” is defined in the rule as a computer-security incident “that disrupts or degrades, or is reasonably likely to disrupt or degrade, the viability of the banking organization’s operations; result[s] in customers being unable to access their deposit and other accounts; or impact[s] the stability of the financial sector.”

The rule requires any bank services provider subject to the Bank Service Company Act (BSCA) to notify at least two individuals within the affected banking organization of a computer-security incident that it “believes in good faith could disrupt, degrade, or impair services provided subject to the BSCA for four or more hours.” The bank organization would then determine if the incident rises to the level of a notification incident and inform its regulators if that is the case.

“The notification requirement for bank service providers is important because banking organizations have become increasingly reliant on third parties to provide essential services,” the rule said. “… [A] banking organization needs to receive prompt notification of computer-security incidents that materially disrupt or degrade, or are reasonably likely to materially disrupt or degrade, these services because prompt notification will allow the banking…

Source…

Computer Security Market 2021 SWOT Analysis, Competitive Landscape and Significant Growth

/in


This report studies the Computer Security Market with many aspects of the industry such as market size, market status, market trends and forecast. The report also provides brief information on competitors and opportunities for specific growth with the key market drivers. Find the comprehensive analysis of the Computer Security market segmented by company, region, type and applications in the report.

The report provides valuable insight into the development of the Computer Security market and related methods for the Computer Security market with analysis of each region. The report then examines the dominant aspects of the market and examines each segment.

The report provides an accurate and professional study of the global trading scenarios for the Computer Security market. The complex analysis of opportunities, growth factors and future forecasts is presented in simple and easy-to-understand formats. The report covers the Computer Security market by developing technology dynamics, financial position, growth strategy and product portfolio during the forecast period.

Get FREE Sample copy of this Report with Graphs and Charts at: https://reportsglobe.com/download-sample/?rid=280529

The segmentation chapters enable readers to understand aspects of the market such as its products, available technology and applications. These chapters are written to describe their development over the years and the course they are likely to take in the coming years. The research report also provides detailed information on new trends that may define the development of these segments in the coming years.

Computer Security Market Segmentation:

Computer Security Market, By Application (2016-2027)

Computer Security Market, By Product (2016-2027)

  • Hardware Security
  • Software Security

Major Players Operating in the Computer Security Market:

  • Cisco
  • IBM
  • GarrettCom
  • Siemens
  • CyberArk
  • Symantec
  • Honeywell
  • Cybercon
  • MAVERICK
  • Check Point
  • Waterfall
  • Parsons
  • Wurldtech
  • Weinute Technology
  • TOFINO
  • HUACON
  • NSFOCUS

Company Profiles – This is a very important section of the report that contains accurate and detailed profiles for the major players in the global Computer Security market. It provides information on the main…

Source…