We are now into the final week of October, which is National Cyber Security Awareness Month (NCSAM). Hopefully, you (or your organization) have had a chance to do something that  improves your awareness of cyber security risks. If not, there's still  l time! (See the September SSN issue.)

Stories are the key to engaging and educating people of all levels of responsibility and technical comprehension. I'd love to hear your own experiences, or even any stories you come across.  So let's help others to learn about cyber security by sharing these stories with your family, friends and associates. I hope you enjoy this October 2014 issue of the Streetwise Security News.

See the list of topics on the left for a quick view of this issue's stories and content.

If you're not already a subscriber, and would like to sign up, please click HERE. You'll automatically receive a free copy of my Security Resource Guide that has links and source info for the tools I use on a daily basis.

In early October, we learned that JP Morgan, the largest bank in the USA had been successfully attacked, resulting in the compromise of 76 million household accounts and 7 million business accounts. The good news is, no money was stolen, according to JP Morgan. But this is NOT a good news story. 

 

Having a lot of online friends and posts may seem like a good way to boost your ego. But it can be risky. This past month, Tom Eston, Kevin Johnson and I recorded a special podcast episode that discusses the risks of having too much information online, how to assess your own risks and what you can do to manage your digital footprint online. 

Which type of attack listed below targets an average employee in a specific organization with a message that contains a dangerous link or attachment?

 

a)    Whaling attacks

b)    Spear-phishing attacks

c)    Bulls-eye attacks

It seems that we always get fooled, and should know by now. But whenever a big news story occurs anywhere in the world, scammers and attackers will try to take advantage of it, no matter how sick or low the idea of it is. One of the more popular scams is to start a "fund-raising" initiative to help victims. Click HERE for an example based on the recent shooting of a soldier at the National War Memorial in Ottawa, Canada.

There has definitely been an increase recently in the number of security breaches where criminals are stealing credit card numbers from large retail companies. In the past month, Home Depot was one of the big stories, along with Dairy Queen and Kmart. Now, Staples appears to be in the news regarding a credit card incident. Click HERE for more details, and HERE for a nice column from Forbes that summarizes the past week's various data breaches.

I think it's a little of both, actually. There is a set of security standards called the Payment Card Industry Digital Security Standard (PCI DSS), which anyone processing credit card numbers must follow. If the retailers don't follow the standard, and maintain proper security of their networks and systems, the credit card companies can refuse to process transactions coming from them.

I think we'll see at least a few more stories of huge amounts of damage to retail businesses before the standards are tightened, and it becomes harder for attackers to break into retail systems. But it would be a good time for all business enterprises to start reviewing their network vulnerabilities and start doing a better job of managing risks posed by very capable and innovative hackers. Until they do, we will continue to see our favorite brands being hit, one by one, with criminal cyber attacks for financial gain. It may be time to start paying for purchases using the cash you stashed under your bed (from the first story above).