Checkpoint has a nice article on ‘Why Visibility Is Critical To Your Security Management Program, where I feel there are a lot of overlaps on ‘Why Visibility Is Critical To Your Third Party Risk Management Program’.

Google just open sourced their Vendor Security Assessment Questionnaire system, which they use to automate their vendor survey process of hundreds of vendors each year.

For those interested in a VPN, one reddit user has compiled a giant list of datapoints on over 100 VPN services.

High Scalability has an article on backdoors and code reviews.

Use your fingerprint to unlock your smartphone? You might want to watch this video.

My co-worker Bennet has pointed out that Akamai has released their Q4 State of the Internet report, detailing the attacks they are seeing on their customers. Overall DDOS was up 150% YoY. Application level attacks increased 28% QoQ, with 59% of application level attacks targeted retailers.

Following up on the previous Locky news, Checkpoint has some more information, including volume (100K attempts on their clients in 2 weeks), data collection analysis, server identification and some DGA analysis.

Because it is tax season, phishing scams are going after W-2 forms. And unfortunately companies are forking them out by the thousands, including Seagate.

Wordpress powers tens of millions of websites, and hacking them is big business. Recently, Sucuri noticed that popular, but largely abandoned plugins have been taken over to inject vulnerabilities. Of course, not upgrading plugins means you are open to being attacked by old vulnerabilities like this old RevSlider vulnerability. Google dorking is being used to find this vulnerability, and the culprit is leveraging Google’s large number of TLDs to get around the captcha search limits.