The move by retailers to online and mobile selling to survive the pandemic has resulted in a significant increase in digital fraud activity. The "2020 True Cost of Fraud Study: E-commerce/Retail Edition" by LexisNexis Risk Solutions found this to be partly because some fraud control systems are outdated, and partly because of increased transaction volume.

If you are a Windows or Linux user, brace yourself for a long siege of vulnerability nightmares. The fix will be long and treacherous and could brick your computers. Eclypsium researchers have detailed a set of newly discovered vulnerabilities dubbed "BootHole" that opens up billions of Windows and Linux devices to attacks.

Garmin on Monday confirmed that many of its online services have been disrupted by a cyberattack on its systems that occurred on July 23, 2020. Services disrupted by the attack, which encrypted data on the systems, included website functions, customer support, customer facing applications, and company communications.

With billions of dollars of federal contracts at stake, information technology providers are being swept up in the tide of a new U.S. Department of Defense information security requirement that will become mandatory for IT providers and other companies doing business with DoD. While IT companies already incorporate data protection elements in the products and services they provide to DoD, the department is raising the bar on the way vendors should handle information security.

Twitter had a data security problem last week that might sound trivial. Email addresses, phone numbers, and the last four digits of the credit cards used to buy ads on Twitter were left in browser cache after the transaction, and that cache was not secured. This may seem trivial, but the consequences could be far more significant than you might think. Let's explore how.

Open Source Software is becoming much more commonplace within organizations, bringing a different set of risks and perceived challenges compared to closed source or proprietary software. The Information Security Forum has released a report to help security professionals recognize the benefits and perceived challenges of using Open Source Software.

The next generation of Intel mobile processors will include malware protection built into the chip. The protection, provided by Intel's Control-Flow Enforcement Technology, will first be available in the company's "Tiger Lake" mobile processors. CET is designed to protect against the misuse of legitimate code through control-flow hijacking attacks, which is widely used in large classes of malware.

Two separate teams of academic researchers have published papers describing flaws in Intel's Software Guard Extensions. SGX enhances application security by letting developers partition sensitive information into enclaves with hardware-assisted enhanced security protection. The aim is to protect application code and data from disclosure or modification.

U.S. government agencies and cloud technology providers are heading toward a reset in how they cooperate on cybersecurity challenges. The expected growth of cloud use will create a more complex federal security landscape, according to a report from Thales. Federal agencies actually have moved ahead of businesses in cloud adoption, with 54 percent of agency data already embedded in the cloud.

Outdated or abandoned open source components are persistent in practically all commercial software, putting enterprise and consumer applications at risk from security issues, license compliance violations, and operational threats, concludes the Synopsys 2020 Open Source Security and Risk Analysis Report. The report highlights trends and patterns in open source usage within commercial applications.

A Dutch researcher has revealed a novel way to crack into a PC through a Thunderbolt port. The method, dubbed "Thunderspy" by researcher Björn Ruytenberg, sidesteps the login screen of a sleeping computer, as well as its hard disk encryption, to access all its data. "Thunderspy is stealth, meaning that you cannot find any traces of the attack. It does not require your involvement," he explained.

Warren Buffet once said, "Only when the tide goes out do you discover who's been swimming naked." You can cover over a host of sins when times are good, but bad or unsafe practices will be exposed when times are rough. Time and experience have borne out the accuracy of this witticism in the financial arena -- and we're now seeing its applicability to the intersection of infosec and COVID-19.

Like conventional criminals, criminal hackers choose easy, lucrative targets. One group in the crosshairs is made up of companies that have data on millions of users, such as private sector entities with a Web presence. Why go after one user at a time when data is collected in one place? Criminal hackers also like to hunt small organizations that have modest capital but weak information security.

Consumers and companies worldwide have ramped up online ordering for software products and digital goods as they struggle to improve productivity and security while working remotely and spending more time at home. The sharp spike in online commerce aligns with the timing of the current global pandemic. Software-based offerings accounted for the highest levels of growth.

Canonical, the parent company of Ubuntu, has announced the general availability of Ubuntu 20.04 LTS, codenamed "Focal Fossa." This major upgrade places particular emphasis on security and performance. Released once every two years, the new long-term support version provides a platform for enterprise IT infrastructures and workloads across all sectors for five years.

Zoom's paying customers will be able to choose the region they want to use for their virtual meetings. Paying customers will be able to opt in or out of a specific data center region, although they won't be able to change their default, which for most customers is the United States. Zoom has data centers in the U.S., Canada, Europe, India, Australia, China, Latin America, and Japan/Hong Kong.

Life as we knew it before the coronavirus is gone forever, and many changes will manifest in the pandemic's aftermath. How will it impact privacy laws around the globe? No one knows for sure, and we will not know until after the coronavirus is behind us. Cybercriminals long have been taking advantage of the Internet, and now the spread of COVID-19 has sped up their evil work.

Under ordinary circumstances, the average consumer can order a latte on the way to the coffee shop, book a last-minute trip to the coast, and come home to find groceries delivered -- all with the click of a button. What makes these transactions so smooth and effortless? It starts with account creation. Consumers increasingly are willing to create accounts with sites they interact with regularly.

As COVID-19 continues to spread, states and cities across the U.S. have imposed restrictions -- from banning large gatherings to lockdowns, with citizens ordered to stay home except for essential jobs and errands, or get outdoor exercise. These steps came as infection numbers mounted, and the World Health Organization stated that COVID-19 was in fact a global pandemic.

As companies send employees home in an effort to curb the spread of COVID-19, cybersecurity experts are warning that telecommuting could be putting company assets and data at risk. There are a number of precautions that employees working from home should consider to ensure that sensitive data isn't compromised by cybercriminals taking advantage of the health crisis.

Microsoft and partners have disrupted the Necurs botnet group blamed for infecting more than 9 million computers globally. There are 11 botnets under the Necurs umbrella, all apparently controlled by a single group, according to Valter Santos, security researcher at Bitsight, which worked with Microsoft on the takedown. Four of those botnets account for about 95 percent of all infections.

Open source vulnerabilities rose by nearly 50 percent in 2019 over the previous year, based on a new report. Common vulnerabilities rated as high or critical severity were found in all of the most popular open source projects, according to the WhiteSource 2020 annual report, "The State of Open Source Security Vulnerabilities." The vulnerability rate is expected to continue rising.

The United States Office of Personnel Management last week urged agencies to prepare to allow federal employees to telework -- that is, work remotely.This came on the heels of the Department of Homeland Security closing its facilities in Washington state, after learning an employee had visited the Life Care facility in the city of Kirkland, which is ground zero for the state's COVID-19 outbreak.

We're only two months into a new year and already hundreds of millions of personal records have been compromised, including 123 million records from sporting retailer Decathlon and another 10.6 million records from MGM Resorts hotels. These announcements followed fuel and convenience chain Wawa's revelation that it was the victim of a nine-month-long breach of its payment card systems.

Two things are happening simultaneously: The RSA Security Conference is in full swing and so is COVID-19. It's a strange juxtaposition. There is geographic proximity in that the conference is going on undeterred just a few blocks from where the mayor declared a state of emergency, during the event, due to the ongoing spread of the virus. There's also topical alignment.

After several years of building and testing previews, Microsoft has announced the general availability of its Azure Sphere secure IoT service. Microsoft first introduced Azure Sphere in 2018, opting to use its own version of a Linux operating system instead of Windows 10 to drive its new Azure Sphere OS to securely connect Internet of Things devices.

There's a major myth about "going paperless." A paperless office doesn't mean that paper is outright banned. There likely will be a need for physical paper in business for a long time, so don't throw out your printer just yet. Rather, being paperless means being able to embrace a shift from traditional paperwork processes to those that take advantage of documents that can be in a digital state.

Eclypsium has released research that identifies and confirms unsigned firmware in WiFi adapters, USB hubs, trackpads and cameras used in Windows and Linux computer and server products from Lenovo, Dell, HP and other major manufacturers. Eclypsium also demonstrated a successful attack on a server via a network interface card with unsigned firmware used by each of the big three server manufacturers.

Ransomware hit at least 966 U.S. government agencies, educational establishments and healthcare providers in 2019, at a cost possibly exceeding $7.5 billion. The victims included 113 state and municipal governments and agencies; 764 healthcare providers; and 89 universities, colleges and school districts. Operations at up to 1,233 individual schools potentially were affected.

For the second time since Windows 7 reached the end of support on Jan. 14, a bug is causing trouble for users still clinging to the operating system. The first bug, related to setting a wallpaper image, turned desktops black. This new bug prevents Windows 7 users from shutting down or rebooting their computers. Microsoft's Windows 7 support now is limited to eligible paid plans.