This week’s Cyber Security Headlines – Week in Review is hosted by Rich Stroffolino with guests Jack Kufahl, CISO, Michigan Medicine, and Nick Espinosa, host, The Deep Dive Radio Show

Missed the live show? Check it out on YouTube

Cyber Security Headlines – Week in Review is live every Friday at 12:30pm PT/3:30pm ET. Join us each week by registering for the open discussion at CISOSeries.com

Cyberattacks against schools driven by a rise in student hackers, says UK agencies (JAK)

The Information Commissioner’s Office (ICO) warned on Thursday that “student hackers motivated by dares are driving an increasing number of cyberattacks and data breaches affecting schools.” The agency said it identified “a worrying pattern” in the 215 insider threat breach reports from the education sector between January 2022 and August 2024, with 57% of incidents caused by students who were likely motivated by “dares, notoriety, financial gain, revenge and rivalries.” The UK’s National Crime Agency believes that one-in-five children in Britain aged 10 to 16 has engaged in illegal activity online. Some 215 breaches described by the ICO in the education sector were caused by what was described as “poor data protection practices, including staff accessing data without a legitimate need, by devices being left unattended, or by students being allowed to use staff devices.”

(The Record)

CISA seeks control over CVE

CISA has published a two-page summary of its vision for the future of the CVE. According to Nicholas Andersen, CISA’s new Executive Assistant Director for Cybersecurity, the CVE’s desire, through its board of directors, to “transition to a nonprofit entity with true international coordination, rigorous and transparent governance, and multiple funding sources from public, private, and nonprofit organizations,” does not sit well with CISA, who foresees conflicts of interest within that model, which “reinforces the need for CISA to take a more active role in the long-term stewardship of the CVE Program.”

(The Register)

How security practitioners use LLMs

Anthropic released its Economic Index, an in-depth report on who, where, and how its LLMs are used. The report is fairly granular, going to into different use rates across countries and US states, as well as how different professions use it. For “Information Security Analysts” the most popular use case was automating the coordination of computer system plans with stakeholders. Other common use cases were creating documentation, performing risk assessments, and developing incident response plans. Other jobs seeing automation of security functions included web developers, web administrators, and network administrators. There’s lots of great stuff in the report, so be sure to check it out in the show notes. 

(Anthropic)

Huge thanks to our sponsor, Drata

Consumer Reports calls Microsoft ‘hypocritical’ 

Consumer Reports called Microsoft “hypocritical” for ending free Windows 10 support next month, saying it will strand millions of PCs that can’t run Windows 11 and pose national security risks. PIRG, iFixit, and others joined in, arguing users will be forced to pay $30 for extended support, buy new hardware, or face degraded security. Consumer Reports says Microsoft should provide free updates, citing survey data showing most Windows PCs bought since 2019 are still in use, and were expected to last through the next OS cycle. (ZDNet)

Microsoft to force install the Microsoft 365 Copilot app in October

The installation will occur on Windows devices outside the European Economic Area (EEA) region that have the Microsoft 365 desktop client apps. The company is “advising admins to notify their organizations’ helpdesk teams and users before the app is forcibly installed on their devices to reduce confusion and support requests.” The app will be added to the Windows Start Menu and will be enabled by default. Admins will be able to opt out in the Apps Admin Center.

(BleepingComputer)