This week’s Cyber Security Headlines – Week in Review is hosted by Rich Stroffolino with guest Andrew Wilder, CISO, Vetcor
Missed the live show? Check it out on YouTube
Cyber Security Headlines – Week in Review is live every Friday at 12:30pm PT/3:30pm ET. Join us each week by registering for the open discussion at CISOSeries.com
Apple pulls iCloud end-to-end encryption in the UK
In the latest development in a story we’ve been following on Cyber Security Headlines, Apple has made iCloud end-to-end encryption unavailable in the United Kingdom. The move stems from the UK government’s request for encryption backdoor access under its Investigatory Powers Act. End-to-end encryption is an optional setting for most iCloud data, including iCloud Backup, Photos, and Notes, ensuring only users can access their data even in the event of a cloud breach. Even after this update, Apple’s communication services (iMessage and FaceTime) and Health and iCloud Keychain data will remain end-to-end encrypted. The Washington Post said the British government’s mandate, “has no known precedent in major democracies.” Apple said they are “gravely disappointed” that these data protections will not be available to UK customers given the continued rise of data breaches and privacy threats.
(Security Affairs and Bleeping Computer)
Anagram takes a gamified approach to employee cybersecurity training
Anagram, formerly known as Cipher, is revamping employee cybersecurity training with a gamified approach. Instead of annual, lengthy sessions, Anagram is offering more frequent, interactive lessons, including phishing simulations. The startup pivoted in 2024 after realizing non-security employees were the weakest link. It has since landed major clients like Disney and Thomson Reuters (TechCrunch).
US employee screening firm confirms breach
DISA Global Solutions provides employment screenings and background checks to a third of the Fortune 500. This week it submitted a filing with Maine’s attorney general confirming it detected a “cyber incident” on April 22, 2024. After investigation, it was found the illicit network access began on February 9th. In a filing with the Massachusetts attorney general, it was confirmed that attackers obtained Social Security numbers, credit cards, and other financial information, as well as scanned ID documents from some screened individuals. The filing also states that DISA “could not definitively conclude the specific data procured,” so it can’t name specific victims. No word on who orchestrated the attack or why it waited almost a year to disclose it.
Thanks to today’s episode sponsor, Conveyor
What are you going to do?
Here’s a better question: what would Sue do?
Sue is Conveyor’s new AI Agent for Customer Trust. She handles the entire security review process like answering every customer request for a SOC 2 from sales, completing every questionnaire or executing every communications and coordination task in-between.
No more manual work. Just a quick review when she’s done.
Ready to let Sue take the reins? Learn more at www.conveyor.com.
Firing of 130 CISA staff worries cybersecurity industry
The dismissal of over 130 cybersecurity professionals at CISA is a major blow to U.S. and allied security, warns expert David Shipley, CEO of Beauceron Security. He criticizes the cuts as reckless, likening them to accelerating toward an iceberg. The move, orchestrated by Elon Musk’s Department of Government Efficiency (DOGE), may strain international alliances and reduce trusted information sharing. Shipley notes that while security personnel have maintained stability despite political turmoil, these layoffs threaten that continuity. Frank Dickson of IDC also highlights the lack of transparency regarding the impact on national security and CISA’s operations.
(CSOOnline)
Thousands of exposed GitHub repositories, now private, can still be accessed through Copilot
Security researchers at Israeli cybersecurity company Lasso found that Microsoft Copilot retains access to thousands of once-public GitHub repositories, even after they’ve been set to private. Using Bing’s cache, Lasso identified over 20,000 affected repositories, exposing sensitive data from major companies like Google, IBM, and Microsoft. Microsoft classified the issue as “low severity.”
OpenAI Bans ChatGPT Accounts Used by Chinese Group for Spy Tools
In its most recent threat intelligence report, the makers of ChatGPT describe two operations believed to belong to Chinese threat actors in which “ChatGPT was used to edit and debug code for what appeared to be AI tools designed to ingest and analyze posts and comments from social media platforms such as Facebook and X in search of conversations on Chinese political and social topics. In addition, the threat actor used ChatGPT to generate descriptions and sales pitches for these tools.