SSL.com DCV Issues Unvalidated Certificates; Blue Shield of California Leaks 4.7M Members' Data; Verizon 2025 Data Breach Investigations Report

SSL.com revoked the misidentified certificates within 24 hours of discovery. Strong validation of the FQDN/email address is in their certificate practices statement, so these actions are consistent with that and should avoid any motions to make their CA untrusted. With shortened certificate lifecycles, automation is key to survival, which includes automated DCV, which needs to remain both scalable and fraud resistant, which can be opposing forces. Expect providers to be working on these to improve security. Double check your validation mechanism to be sure it's active and consistent with your provider's requirements.

Lee Neely

Issues in implementing the domain ownership verification correctly keep coming up. This should be functionality that is thoroughly tested and reviewed. A lot of effort has been spent in the past to improve the CA ecosystem in recent years, but basic code and implementation quality issues still appear to be a big problem.

Johannes Ullrich

The DCV seems still in flux. I am somewhat surprised, as we do have a working reference protocol for this with ACME, but these things do tend to happen. It's software. Interesting that it's even being looked at and caught. That is the most fascinating part of the story.

Moses Frost

Sensitive websites must not use Google Ads or Google Analytics. These and similar tools are designed to record browsing data that often includes PII and other sensitive data.

Johannes Ullrich

This is not the first data leak attributed to usage tracking. Be careful with trackers and analytics on pages with sensitive information. A free service needs to be paid for somehow; find out how and where your information fits into the equation. If you're not actively using the analytics, remove the trackers.

Lee Neely

This was preventable, but then, that is often the case with cybersecurity incidents. Use of website analytics or any software app that 'touches' user data should be a risk register entry and regularly reviewed as part of one's risk management program. At a minimum, notice should be given that online tracking technology is employed on the website.

Curtis Dukes

The DBIR began the current era of open source intelligence and continues to be valuable. Avail yourself of it.

William Hugh Murray

As always, a huge shout out to the folks at Verizon for publishing the investigations report. Two things, among many, stand out to me: 1) the increase in attacks via a third-party provider; and 2) time to remediate a vulnerability. For the first, bring third-party providers into you risk management review, and that means more than simply sending them a questionnaire. For the second, if we don't find a way to automate patching, the adversary will always win.

Curtis Dukes

It's getting safe to assume a breach will, de facto, include ransomware. At the same time, the need to pay is not required to recover, indicating people have taken mitigation and advance planning to heart. If you don't know what your response plan and mitigations are, find out now. If nobody knows, assume that needs to be addressed and get on it.

Lee Neely

While not all cybercrime is reported to IC3, the numbers are significant, not only in the type and volume of attacks, but also in prevention. It is estimated that since 2022, over 800 million USD have been saved by their services, which include providing free decryption keys. If IC3 is not in your resource list, they need to be: establish contact before you need them.

Lee Neely

IC3 is the latest addition to the FBI's storied history of crime measurement and reporting. When looking at the loss number, keep in mind that direct loss is only a portion of the cost. Some of the other components, for example reputation or lost business, are difficult to quantify but real nonetheless.

William Hugh Murray

A recurring theme here is these are remotely exploitable with low complexity. Beyond applying relevant updates, you need to validate access is limited to authorized systems, and don't expose control systems to the internet. Next, verify your monitoring can detect unwelcome advances, just in case.

Lee Neely

As our infrastructure becomes more and more automated, the distinction between IT and OT will disappear. Indeed, the distinction between cyber and infrastructure may well disappear.

William Hugh Murray

While it doesn't appear to be the case in this attack, connecting IT and OT systems can have a deleterious effect on critical infrastructure. Organizations should use as a risk management tabletop exercise and actively discuss the threats posed to critical infrastructure.

Curtis Dukes

While it doesn't appear to be the case in this attack, connecting IT and OT systems can have a deleterious effect on critical infrastructure. Organizations should use as a risk management tabletop exercise and actively discuss the threats posed to critical infrastructure.

Lee Neely

Two big lessons to learn from this item: (1) Invariably, successfully using AI software requires involvement of domain experts in design and verification/validation, and (2) Independent verification and validation (IVV) means independent from the creator/developer/consultancy that was paid to create the system/software. Failure in these areas guarantees Garbage In, Garbage Out (GIGO).

John Pescatore

The process of generating certification exam questions is expensive (been there, done that, have the T-shirt). Like almost all composition processes, it will become increasingly reliant upon LLMs and generative AI. Those who use a computer for such processes - not the computer, not the process - are responsible for all the properties of the result.

William Hugh Murray

That the third party contracted questions were developed by AI rather than lawyers, while still being subject to the same review process, seems like a distractor from issues with California's new state bar exam system, implemented last year, which is having technical challenges that need to be resolved. Make sure you understand how third parties meet deliverables, including the use of AI, and make sure you have sufficient QA in place to ensure your standards are met. Consider your actions if even so these donÕt meet customer expectations.

Lee Neely

Is the concern really about the fact that AI generated the questions or that the platform used to administer the test was faulty? Seems like the California Bar, and its surrogate, did the right thing by having the AI generated questions reviewed prior to their inclusion in the test. Whether we like it or not, AI is going to displace some jobs that were typically done by humans.

Curtis Dukes

I imagine we will see AI writing more items; this shouldn't surprise us. The interesting part is the invalidation of the questions,

Moses Frost

Given the rapid change in which services are available, from no credit card, to no contactless, to fully working, M&S customers need to keep an eye on the website; clearly customer-facing service restoration is their priority.

Lee Neely

Point of sale systems continue to be a major target and dependency. Contactless payments are increasing as a percentage of revenue. For those of us who no longer carry physical cards, the backup for contactless is to key in the account data, a very inefficient process.

William Hugh Murray

Residents can still pay bills in person by check or cash, or online via debit/credit or e-check. While they aren't acting on past due accounts, don't assume this won't change. Keep an eye on the city-provided page for updates and contact information.

Lee Neely

It's been a rough year for municipalities in the State of Texas. It's time for the State to establish a minimum cybersecurity baseline and have all Texas municipalities be measured against it. While I know that municipalities want to keep their independence, they simply don't have the resources available to protect themselves. I would look to Implementation Group 1 of the CIS Critical Security Controls for that minimum baseline.

Curtis Dukes

"Anything worthy of being called a plan says who will do what and when they will do it." Maintain liaison with those on whom you will call in the event of an attack or breach. This includes, just for example, legal, insurance claims, law enforcement, and computer forensics.

William Hugh Murray

Fines are not only related to data breach, but also for delays in reporting. Make sure you not only know your reporting interval to regulators, but also have the reporting process, including assigned responsibility and templates, defined. Include reporting in your tabletop exercises.

Lee Neely

HIPAA Violations are so rare still in the grand scheme of things, I wonder what caused this one.

Moses Frost