This week’s Cyber Security Headlines – Week in Review is hosted by Rich Stroffolino with guest Nick Espinosa, Host, The Deep Dive Radio Show, also chack Nick out at Forbes, SoundCloud and YouTube
Missed the live Week In Review show? Check it out on YouTube
Edit the YouTube Live paragraph to: Cyber Security Headlines – Week in Review is live every Friday at 12:30pm PT/3:30pm ET. Join us each week by registering for the open discussion at CISOSeries.com
ONCD set to consolidate power in U.S. cyber
The Office of the National Cyber Director (ONCD) is poised to gain strength and will operate as the executive branch for cybersecurity policy. Sean Cairncross was selected by the president to lead the office. While he has no experience as a cybersecurity leader, it is believed his “close personal ties to the president are … a significant asset for the office, which until now has been overshadowed by the National Security Council (NSC).” This is the position previously held by Harry Coker. The ONCD is being described as the pinnacle, guiding the NSC which does foreign policy and offensive cyber, and CISA, which takes care of doing domestic and defensive.
Undocumented commands found in Bluetooth chip used by a billion devices
As described in BleepingComputer, “the ubiquitous ESP32 microchip made by Chinese manufacturer Espressif and used by over 1 billion units as of 2023, contains undocumented commands that could be leveraged for attacks. The undocumented commands allow spoofing of trusted devices, unauthorized data access, pivoting to other devices on the network, and potentially establishing long-term persistence.” Researchers from Tarlogic Security, speaking at RootedCON in Madrid point out that ESP32 is “one of the world’s most widely used chips for Wi-Fi + Bluetooth connectivity in IoT (Internet of Things) devices, so the risk is significant.”
DoJ seeks to break up Google
As posted in The Cyberwire, “on Friday, the Department of Justice (DOJ) submitted a request that would aim to break up Google by forcing the company to sell Chrome. In its filing, the DOJ stated that Google’s illegal conduct has created an economic goliath, one that wreaks havoc over the marketplace to ensure that no matter what occurs, Google always wins.” These filings follow a 2023 antitrust case in which “Google was found guilty of monopolistic practices regarding the company’s search engine services,” as well as a second antitrust lawsuit from 2024 that is “examining whether the company has also engaged in monopolistic behaviors related to its advertising business.” The ruling, expected this summer, “has the potential to significantly impact how Google operates, how users interact with its services, and the overall landscape of the search engine business.”
UK banks ordered to compensate customers for outages
Nine major UK banks and building societies (the UK version of a credit union) were found to have accumulated the equivalent of 33 days of tech outages in the past two years, according to figures published by a parliamentary Treasury group, and must now deliver compensation payments amounting to £12.5m. The data does not include the Barclays Bank outage in January or the Lloyds Bank outage last week. The committee’s chair, Dame Meg Hillier, sympathized with working people and companies for whom “losing access to banking services on payday can be a terrifying experience.” But Patrick Burgess of the UK’s Chartered Institute for IT, says the findings “once again highlight that the traditional banking sector hasn’t kept pace with the investment needed to modernize its infrastructure.”
(BBC News)
Thanks to today’s episode sponsor, Vanta
We know that real-time visibility is critical for security, but when it comes to our GRC programs…we rely on point-in-time checks.
But more than 9,000 companies have continuous visibility into their controls with Vanta. Vanta brings automation to evidence collection across over 35 frameworks, like SOC 2 and ISO 27001. They also centralize key workflows like policies, access reviews, and reporting, And helps you get security questionnaires done 5 times faster with AI.
Now that’s…a new way to GRC. Get started at Vanta.com/headlines
UK calls for improvements to open source supply chain security
A new report from the UK’s Department for Science, Innovation & Technology (DSIT) outlined weakness in the open source supply chain, citing a lack of industry-specific practices, a lack of formal process for judging component trustworthiness, and dominant influence of large tech companies. As best practices, it recommends organizations create “internal OSS policy that details the criteria for evaluating the trustworthiness and maturity of OSS components,” develop software bill of materials, or SBOMs for their products, and actively engage and contribute to the open source community.
China’s Volt Typhoon hackers lurked in US grid for 300 days
Security firm Dragos published a case study revealing that the Chinese hacker group Volt Typhoon infiltrated the U.S. electric grid through a breach at Littleton Electric Light and Water Departments (LELWD) in Massachusetts. The hackers had access to the utility’s network for over 300 days, collecting sensitive operational technology (OT) data, including information on energy grid operations. This data could be used for future targeted attacks. Volt Typhoon, linked to the Chinese government, has been previously associated with espionage and attacks on U.S. critical infrastructure.