This week’s Department of Know is hosted by Sarah Lane with guests Jason Shockey, CISO, Cenlar FSB, and Mike Lockhart, CISO, Eagleview
Missed the live show? Check it out on YouTube
CISO Series The Department of Know is live every Monday at 4:00 p.m. ET. Join us each week by registering for the open discussion at CISOSeries.com
KNOW OR NO?
Microsoft Defender outage disrupts threats
Microsoft Defender for Endpoint experienced a 10-hour portal outage affecting XDR features, including advanced threat-hunting alerts and device visibility. Microsoft attributed the disruption to a CPU spike from high traffic on portal components. Mitigation steps have restored access for most customers, though some organizations still face issues. Microsoft is collecting additional diagnostics to resolve lingering impacts and continues monitoring system performance. (BleepingComputer)
ShadyPanda turns browser extensions into spyware
Koi Security reports that a China-linked group called ShadyPanda spent seven years turning once-legitimate Chrome and Edge extensions into spyware, affecting more than 4.3 million installs. Several extensions received malicious updates in mid-2024 that allowed hourly remote code execution, full browsing surveillance, encrypted data exfiltration, and adversary-in-the-middle attacks. Another batch of extensions logged every URL visit, query, click, and cookie, with WeTab alone reaching three million installs. (The Hacker News)
Record-breaking DDoS attack
Aisuru just broke the DDoS record again, firing off a massive 29.7-terabit-per-second attack that Cloudflare had to absorb. This botnet is basically a rentable army of up to four million hacked routers and IoT devices, and it’s been hammering targets all year. Cloudflare says nearly half of those attacks are now “hyper-volumetric,” and one recent wave even disrupted parts of the U.S. internet despite not being the intended target.
Ransomware payment denied, unless…
The UK government is moving forward with a proposed ban on ransomware payments for public sector and critical national infrastructure organizations, with national security exemptions to avoid life-or-death dilemmas, says Security Minister Dan Jarvis. The legislation would also require other businesses to notify authorities if they plan to pay a ransom. Jarvis called the current system “not sustainable” and is consulting across government, CNI organizations, and allies in the Five Eyes and G7 to ensure the ban is effective and workable.
Draft US cyber strategy set for January release
Cyberscoop’s sources say the Trump administration plans to release a five-page, six-part national cybersecurity strategy next month. This could also be followed by an executive order that would spur implementation. The six “pillars” in the document continue to focus on offensive cyber operations, making cyber regulations more uniform, strengthening the federal cyber workforce, streamlining procurement, protecting critical infrastructure, and planning for emerging technologies. Currently, the administration is soliciting feedback on the strategy from industry stakeholders, so the final text may change.
Virtual kidnapping scams gaining popularity
A new and rather heinous twist on cyber extortion is the virtual kidnapping scam in which criminals alter social media photos of people as proof of life as they contact family members of the individual with a ransom demand. According to an alert from the FBI, this campaign can also include scraping images from legitimate missing persons alerts, as well choosing regular people as part of what the FBI calls “emergency scams.” Naturally, some of the threat actors use AI to alter the photos into short videos, threatening violence if payment is not forthcoming, and using timed messages that disappear quickly to avoid victims scrutinizing them too closely.
Huge thanks to our sponsor, Adaptive Security
DEEP DIVE
Organizations warned to choose their next CISO wisely
According to an article posted in Dark Reading by David Schwed, COO of SovereignAI, we are enjoying a global CISO hiring spree. This is due to an increase in the number of AI labs, cryptocurrency exchanges, and financial institutions who all need one. The article warns that companies and organizations must choose between two very different archetypes of CISO. This means that choosing an “engineering-focused” CISO over a “holistic” CISO can be risky. In short, he says, an engineering-focused CISO treats security as solely a technical problem which can build clean architecture and preventative controls, but this approach often just moves the risk, with attackers exploiting weaknesses elsewhere, such as human-workflow gaps. A holistic CISO, by contrast, understands security as a broader system involving people, process, and technology, and designs for resilience, not just prevention. A link to the article in all its detail is available in the show notes to this episode.
Legislation would designate ‘critical cyber threat actors’
Rep. August Pfluger reintroduced the Cyber Deterrence and Response Act to let the U.S. formally designate foreign hackers behind major cyberattacks as “critical cyber threat actors” subject to sanctions. The bill directs federal agencies, including the Office of the National Cyber Director, to attribute attacks with input from intelligence and threat firms. Targeted actors include those disrupting networks, stealing sensitive data, or threatening critical infrastructure, finance, energy, or elections. The president may waive sanctions with written explanation to Congress. (CyberScoop)