Twitter data breach reported in August may have affected 100M users, not 5M / Four Cisco flaws tracked / Canada to invest in cyber, challenges China for Indo-Pacific region

Plus: Companies are being rejected for cyber insurance more than ever before

Inside.com Part of   Network November 28, 2022

Presented by

A Twitter data breach reported a few months ago may have affected 100 million users, not 5 million as previously thought. Twitter has yet to confirm the new reports that have come from a cybersecurity researcher named Chad Loder. More: Back in August 2022, Twitter confirmed that hackers had breached a flaw that allowed them to tie a specific account with other details, such as phone numbers, regardless of the account's privacy settings. According to Twitter, the security flaw was abused in June 2021. The researcher who found the flaw was paid a $5,000 bounty, a sign that the social media giant had likely underestimated the impact that this flaw had. While initial reports claimed that hackers had breached the details of 5 million accounts, a new report now says that the number could be as high as 100 million. While the threat actors remain unidentified, it is known that the hackers stole information such as usernames, display names, profile descriptions, locations, email addresses, and phone numbers.

Four security flaws that could be used by hackers to gain remote access and execute commands have been found in Cisco ISE. Out of the four bugs found, one of them has a high-severity ranking. More: The tracked flaws could allow an authenticated, remote attacker to inject arbitrary operating system commands, bypass security protections, and conduct cross-site scripting attacks. The company stated that the flaws are not connected but could each be used to cause damage to the company and its devices. Out the four flaws (CVE-2022-20964, CVE-2022-20966, CVE-2022-20967, and CVE-2022-20965) CVE-2022-20964 has the highest CVSS ranking. The latter could be used to allow the attacker to execute arbitrary operating system commands on the underlying operating system with the privileges of the web services user and to gain root shell access. There are currently no workarounds available for the flaw, as Cisco says it is working to provide its users with a solution in Q1 2023. The other flaws could allow hackers to release cross-site scripting attacks, store malicious HTML or script code, etc.

A message from SECURITY COMPASS The only secure developer training that is accredited by (ISC)²  Our role-based, language-specific, secure developer training meets developers where they are in their knowledge and learning style to ensure they successfully develop and apply secure coding skills. Go beyond secure coding training. Retain talent, remain competitive, and stay compliant. We offer over 49 courses covering topics including: ● Defending AWS, .NET, Angular, Java, and more ● DevSecOps Fundamentals and DevSecOps for Managers ● Defending Containers, Kubernetes, Docker ● Secure Software Requirements, Design, Testing Explore language-specific, role-based, (ISC)² accredited secure developer training.  Visit our page to browse our curriculum, try a free course, or speak to the team. Browse our curriculum

Canada is set to invest $1.7B in its cybersecurity and overall security as it officially unveiled its security strategy for the Indo-Pacific region. The strategy highlights China as a disruptor in the region and vows to deal with the issue. More: The report mentions China over 50 times, highlighting its role as a disruptor and as a proponent of miscommunication between the 40 Indo-Pacific countries. According to analysts, Canada and China are fighting to have control over a valuable region that sees $37.3T in annual economic activity. To ensure that Canada maintains its economic power, it needs to have a positive balance of trade. Due to recent decisions made by the U.S. government, the country is now struggling to balance the ideas of increasing its trade with China and asserting its dominance over the Indo-Pacific region.  The Canadian government stated that the 26-page strategy establishes that it intends to reply to Chinese pressure regardless of external economic factors. Measures that are expected to be implemented in the near-term future include an increased budget for cybersecurity defense systems and cybersecurity training, an increased naval presence in the Indo-Pacific region, more intelligence capacities, etc.

Companies are being rejected for cyber insurance more than ever before, according to a study. The drop in coverage is blamed on the increase in the number of cyber attacks. More: U.S. cyber insurance prices have reportedly increased 79% from a year earlier, according to Marsh's Global Insurance Market Index. While the average company only has coverage for $600,000 in damages, the frequent number of cases in cyberattacks has led cyber insurance companies to deny a record number of coverage applications. In order to increase the chances of having their application accepted, companies are now showing proof to cyber insurance companies that they have the necessary expertise to detect and recover from a cyberattack. These new developments in the cyber industry space may be a reason why only 25% of companies have cyber insurance, a statistic that is likely to make hackers attempt to breach them even more. Average weekly attacks per organization worldwide reached a peak of 1,200 attacks, a 32% YoY. The Education/ Research sector continues to be the most heavily attacked industry, seeing a 53% rise YoY. Globally, 1 out of 40 organizations was impacted by ransomware attacks, while 2/3 of all companies have been involved in some way with cyberattacks.

The EU Council has adopted new cybersecurity legislation named NIS2 as it aims to make its cyber defense more capable of withstanding the increasing number of cyberattacks. The legislation enforces its competencies on more companies than ever before. More: In the NIS1 directive, all member states of the EU chose what organizations met their own criteria to qualify as potential providers of essential services. Under the new NIS2 rules, the scope of the competencies provided by the legislation to its enforcers applies to all middle-sized and large corporations.  The legislation makes an exception for certain organizations and institutions such as central banks, defense institutions, the judiciary, etc. EU countries are obliged to implement the directives from this legislation 21 months from the moment it is officially published, which is likely to happen before 2023.  One of the world's largest economic and political powers, the EU has been hit with numerous cyberattacks. Most famously, a number of top-level EU diplomats, such as the Spanish prime minister, were either spied on by foreign actors or spied on others using the Pegasus spyware. Since the event, the institution has gone on to have public hearings with company representatives, while some diplomats have vowed to ban the company altogether.

Quick Hits: HubSpot and Brandwatch partnered this year to survey over 1,000 individuals across the U.S. to better understand consumer purchasing habits, thoughts, and behaviors.* Cybersecurity software platform Sensato Cybersecurity has been acquired by healthcare data security company CloudWave for an undisclosed amount. The Department of Industry, Science, and Resources has disbursed over $25M in grants from the cybersecurity skills fund. The grants come only days after the institution was charged with making applicants wait for too long for funding. Microsoft has stated that there has been a 74% increase in estimated password attacks YoY, a worrying sign that cyberattacks are continuing to grow. *This is sponsored content.

Upcoming events at Inside: January 10 - Inside Startups Coffee Break (Register Here) January 17 - Inside Marketing Coffee Break (Register Here) January 31 - Growth Summit'23 (Register Here)

Arbër is an Inside writer who also has experience in entrepreneurship. He has experience covering Consumer Tech, Venture Capital, NFTs, Crypto, etc. Arbër holds a Bachelor's degree in Business from XAMK University in Finland. When he is not reading(and writing) business news, he chooses to watch sports or anime...and then read news about sports or anime. Editor Aaron Crutchfield is based in the high desert of California. Over the last two decades, he has spent time writing and editing at various local newspapers and defense contractors in California. When he's not working, he can often be found looking at the latest memes with his kids or working on his 1962 and 1972 Fords.

Security Compass delivers best-practice, role-based, accredited eLearning solutions.

767 Bryant St. #203, San Francisco, CA 94107 Copyright © 2022 Inside.com

Did someone forward this email to you? Head over to inside.com to get your very own free subscription! You received this email because you subscribed to Inside Security. Click here to unsubscribe from Inside Security list or manage your subscriptions.