NewsCast for Tuesday August 30th, 2016

Clinic Won’t pay breach protection for victims

• http://www.zdnet.com/article/clinic-wont-pay-breach-protection-for-victims-ceo-says-it-would-be-death-of-company/
• Are companies required to pay for credit protection? It is common, but is it required?
• Can a class action suit succeed to force it?
• • Will that matter if they just declare bankruptcy?
  • If not.. What is the purpose to filing the suit?

California Bill would add security standards to data breach law

• https://bol.bna.com/california-bill-would-add-security-standards-to-data-breach-law/
• But what is reasonable… it can’t just be what a reasonable company would implement.
• Bill Text - https://legiscan.com/CA/text/AB83/2015
• Is this going too far? Is it too broad? Is it enforceable?

St. Jude stock shorted on heart device hacking fears

• http://www.reuters.com/article/us-stjude-cyber-idUSKCN1101YV
• We were trying to build a relationship between testers and organizations.. This is a step backwards for building that trust.

A Temperature-check on the state of application security

• http://www.darkreading.com/application-security/a-temperature-check-on-the-state-of-application-security/d/d-id/1326727
• Where should appsec budget be? With responsibility being in the application teams, should much of it be there and not accounted for in security?
• • Training, tools, etc?

Important Apple patch for ‘Trident’

• http://www.zdnet.com/article/apple-releases-important-security-update-for-iphone-after-malware-found/
• Key in on: “install spyware and remotely jailbreak without user knowledge” … oye
• The attack sequence, boiled down, is a classic phishing scheme: send text message, open web browser, load page, exploit vulnerabilities, install persistent software to gather information. This, however, happens invisibly and silently, such that victims do not know they’ve been compromised.