IaaS is great except when the vendor offering it has security issues. Identity-as-a-service vendor (Auth0) could allow bad actors to spoof a legitimate website and collect sensitive information from visitors.

Possible consequences - phishing attacks, harvest user credentials, or even possibly launching cryptomining attacks.

https://threatpost.com/auth0-glitch-allows-attackers-to-launch-phishing-attacks/132554/

Where would you like to spend you Cyber Awareness training dollars? - Hint - Employees who engage in the riskiest cyber behavior tend to be sales and marketing professionals, high-level executives and, most surprisingly, millennials.

This comes from Ahold, which operates 21 food chains across 11 countries and collectively employs more than 375,000 associates, conducts periodic internal phishing simulation campaigns to identify workers who fall for such scams, and uses analytics to interpret the results.

Schreiber said sales and marketing professionals tend to be cyber risk-pone because they're "very focused on the customer and just less focused on data protection." Millennials, on the other hand, tend to be more cyber aware, yet still engage in risky behavior, perhaps because they are too comfortable with the digital lifestyle.


https://www.scmagazine.com/supermarket-retailer-ciso-identifies-millennials-sales-and-marketing-pros-as-riskiest-employees/article/769950/

CIS Critical Security Controls version 7 has been available since March. It now has three broad categories and has been modified to align with the latest cyber threat data and reflect today’s current threat environment

You can download the PDF and the EXCEL sheet here (needs email registration)

https://learn.cisecurity.org/20-controls-download

I am sure you know this - end-to-end encrypted messaging app like WhatsApp is that the messages are unreadable to anyone who intercepts them. Are you aware of this (read below)

 If you keep those messages on your device, or worse, you back them up unencrypted to the cloud—be it iCloud or Google Drive—you open the door for authorities to obtain them with court orders, effectively making the original encryption pointless.


Check this incident:
https://motherboard.vice.com/en_us/article/zm8q43/paul-manafort-icloud-whatsapp-bad-opsec-witness-tampering

Do you use Trello? - it is time to check if your admin or your vendor admins have "misconfigured" it to expose credentials.

Examples
Seceon, a Westford, Mass. cybersecurity firm that touts the ability to detect and stop data breaches in real time. But until a few weeks ago the Trello page for Seceon featured multiple usernames and passwords, including credentials to log in to the company’s WordPress blog and iPage domain hosting.

A senior software engineer working for Red Hat Linux in October 2017 posted administrative credentials to two different servers

Maricopa County Department of Public Health (MCDPH) in California used public Trello boards to document a host of internal resources that are typically found behind corporate intranets, such as this board that aggregated information for new hires (including information about how to navigate the MCDPH’s payroll system)

A public Trello page maintained by HealthIT.gov — the official Web site of the National Coordinator for Health Information Technology, a component of the U.S. Department of Health and Human Services (HHS) — that was leaking credentials


https://krebsonsecurity.com/2018/06/further-down-the-trello-rabbit-hole/

The Cyber Hygiene Results - Based on survey of more than 4,000 consumers across all 50 states and Washington, D.C.

• More devices an individual owns, the lower their level of cyber-hygiene.
• Only 24% of Americans are aware of the best practices
• 75% of respondents 30 and under reportedly engage in riskier online behaviors than older respondents.
• 72% of survey respondents living in Florida reported that they share passwords

https://www.infosecurity-magazine.com/news/top-5-riskiest-states-for

Free education poster for Internet Safety Month (June)

Download the full file here

https://www.stopthinkconnect.org/resources/preview/online-cybersecurity-advice-for-all-digital-citizens