Content by Mathew J. Schwartz

Visual Journal: Infosecurity Europe 2017

Mathew J. Schwartz  •  June 8, 2017

Infosecurity Europe 2017 in London drew an estimated 18,000 attendees. Here are 13 visual highlights from the annual information security conference, ranging from tchotchkes and keynotes to 19th century architecture and live hacks of internet-connected devices.

Preview: Infosecurity Europe in London

Mathew J. Schwartz  •  June 5, 2017

The annual Infosecurity Europe conference returns to London this week, offering discussions of the latest information security practices, procedures and technologies as well as deep-dives into privacy, cybercrime, policing, surveillance, GDPR and more.

NHS Denies Widespread Windows XP Use

Mathew J. Schwartz  •  May 14, 2017

The massive WannaCry outbreak has led to allegations that some sectors and organizations, such as Britain's National Health Service, were widely infected because of widespread Windows XP use. In fact, unpatched Windows 7 systems may be partly to blame.

13 Hot AppSec Sessions in Belfast, Northern Ireland

Mathew J. Schwartz  •  May 10, 2017

Hot sessions at this week's OWASP AppSec Europe 2017 conference in Belfast, Northern Ireland, cover everything from the EU's General Data Protection Regulation and fostering better SecDevOps uptake, to quantum-computing resistant crypto and ransomware economics.

Data Privacy After Brexit: Keep Calm and GDPR On

Mathew J. Schwartz  •  April 20, 2017

Right now in Britain three things remain certain: Death, taxes and having to comply with the EU's General Data Protection Regulation. But legislators have promised U.K. organizations will have a say in how some GDPR provisions get enacted.

Yes, I Have Been Pwned

Mathew J. Schwartz  •  March 17, 2017

With apologies to Troy Hunt, the last thing you want to see in the morning as you're having your first cup of coffee and scanning the interwebz for cat videos is a notice from his "Have I Been Pwned" breach-alert service.

Verizon: Most Breaches Trace to Phishing, Social Engineering

Mathew J. Schwartz  •  March 3, 2017

With Verizon's data breach investigations team finding that 90 percent of breaches trace to a phishing or other social engineering attack, lead investigator Chris Novak says that using multifactor authentication should be a no-brainer for all organizations.

Yahoo Defends Information Security Mojo to Senators

Mathew J. Schwartz  •  February 27, 2017

What did Yahoo executives know about multiple data breaches and attacks that the company suffered, and when did they know it? Those questions have continued to dog Yahoo as it negotiates its sale to Verizon for the now-discounted price of $4.5 billion.

LeakedSource's Demise: Lessons Learned

Mathew J. Schwartz  •  February 24, 2017

Paid breach notification site LeakedSource has disappeared. Given the site's business model - selling access to stolen credentials to any potential buyer - breach notification expert Troy Hunt says the site's demise is no surprise.

Report: US Data Breaches Reach Record Levels

Mathew J. Schwartz  •  January 20, 2017

The number of reported U.S. data breaches hit an all-time high in 2016, according to Identity Theft Resource Center. But for half of all breaches, the number of exposed records isn't known. And what about all of the breaches that just haven't come to light?

Verizon Reportedly Demands $1B Yahoo Discount After Breach

Mathew J. Schwartz  •  October 7, 2016

In a rare case of potential breach accountability, Verizon is reportedly demanding a $1 billion discount to acquire Yahoo as a result of the search giant's failure to more rapidly spot a data breach that compromised at least 500 million users' accounts.

TalkTalk Slammed with Record Fine Over Breach

Mathew J. Schwartz  •  October 5, 2016

Britain's privacy watchdog agency has slammed the telecommunications company TalkTalk with a record fine of £400,000 ($511,000) for multiple information security failings that allowed a hacker to bypass access controls and exfiltrate customer data "with ease."

Irony Alert, Brexit Britain: Comply With EU Privacy Law

Mathew J. Schwartz  •  October 3, 2016

Even though the U.K. is preparing to exit the EU, British businesses must prepare to comply with GDPR, the EU's new data privacy law. That's the message from the new U.K. information commissioner, who oversees enforcement of the country's privacy laws.

Why PCI Security Standard Adoption Is Growing in Europe

Mathew J. Schwartz  •  July 14, 2016

While many banks and merchants in Britain, France and Germany have long complied with the PCI Data Security Standard, deregulation has led organizations in other European countries to start taking PCI compliance more seriously and use it for competitive advantage.

Europe's New Privacy Shield: Will It Hold?

Mathew J. Schwartz  •  July 13, 2016

Businesses on both sides of the Atlantic are lauding the new U.S.-EU Privacy Shield, which gives them a legal way to handle Europeans' personal data. But privacy rights groups have criticized the agreement for falling short of the EU's own privacy protections.