Monday morning, so it must be time for some breach notifications. Over the weekend, a threat actor released around 599 million Facebook users data, which is spreading widely online. It includes phone numbers, full names, locations, emails, and biographical information. It dates back to 2019 and a bug in the Add Friend feature. The breach has been added to the Have I Been Pwned database.
While on the security beat, US Department of Homeland security is focusing on a series of 60-day sprints to address ransomware, industrial control systems, transportation and election security, and capacity building.
Why do we care?
The advice here remains that data release like this is very long tail – this will be used over and over again for a long time. That’s a lot of phone numbers out there, and all the basics for use with attacks.
I highlighted the spring approach because of the application of agile development to security practices. Couple that with the four principles.
- We’ve never seen this before is not an excuse.
- Never Trust, always Verify
- Always assume the attackers are already inside
- And don’t chase bad, ensure good.