Companies are facing growing calls to share information about how hackers broke into their networks and accessed confidential data, as The Wall Street Journal reports. Organizations typically stay quiet about what specifically went wrong, contending that the details could guide other cyber attacks. Now, some cybersecurity experts say public disclosure could help other companies shore up their defenses.
Meanwhile, the “Internet of Things” increasingly presents a new source of cybersecurity risks, as The Economist reports. Finnish cyber attackers stole about 100 gigabytes of data from an unnamed casino in 2017 by hacking into an Internet-connected water tank, according to Darktrace, even though the tank was theoretically insulated from any sensitive computer systems. A piece of IoT-oriented malware called Mirai blocked millions of people from logging into popular websites in 2016.
As more devices become connected, hackers will have more targets, The Economist notes. Some of these targets will put physical property and lives at risk. In 2015, security researchers remotely took control of a car, prompting the recall of 1.4 million Fiat Chrysler vehicles. More recently, researchers showed that insulin pumps could be vulnerable to hackers.
Biometric data also continues to draw more scrutiny. The top Democrat on the Senate Intelligence Committee, Mark Warner of Virginia, recently called for more details about two recent biometric data breaches, as The Hill reports. Warner wrote a letter demanding answers from security company Suprema about an August breach involving more than 1 million fingerprint records, facial recognition images and other sensitive data. In another letter, he condemned a June cyber attack on a U.S. Customs and Border Protection contractor that compromised more than 100,000 images of travelers.
In the United States and beyond, many companies appear unready to handle the regulatory impact of breaches. Ponemon Institute, on behalf of law firm McDermott Will & Emery, recently surveyed more than 1,200 organizations in America, Europe, China and Japan about their compliance with the EU’s General Data Protection Regulation. As Compliance Week reports, only 18% of respondents indicated they were highly confident in their ability to communicate a GDPR-reportable data breach to the appropriate regulators within 72 hours.
On the plus side, according to a Forrester study (PDF) on behalf of Bank of America, 80% of small businesses now accept credit cards with so-called EMV chips, which are seen as a data security measure. With the number of data breaches in the first half of the year up by 54% to more than 3,800, 2019 is on track to be the worst yet for breaches, according to a report by Risk Based Security.