Latest cybersecurity reporting from selected sources.

National Risk Assessment Cites CrowdStrike Lessons Learned, Hybrid Warfare RisksThe British government's latest national security risk register sees a rising threat posed by cyberattacks disrupting operational technology in more critical national infrastructure sectors, and cites the CrowdStrike outage in "digital resilience failure" lessons to be learned.

Appeal Faces Steep Statistical Odds Given Previous Court RulingsPassengers affected by the July 2024 CrowdStrike outage are making a longshot bid to get their case reheard en banc, arguing that claims tied to the vendor's allegedly defective software update involve traditional negligence issues under state law rather than airline services.

CrowdStrike, in partnership with Google and the Shadowserver Foundation, has announced the simultaneous disruption of all command-and-control (C2) channels associated with GlassWorm, a persistent software chain campaign targeting software developers through malicious packages and extensions

From the MGM and Caesars fiasco and MOVEit's patch nightmare to epic business blunders and the jaded reality of living in a post-breach world, Dark Reading looks back at the mistakes, miscalculations, systemic failures, and cringeworthy moments that still have us shaking our heads.

Misstatement Claims Tossed in Class-Action Securities Case After CrowdStrike OutageA U.S. district judge tossed most claims from investors accusing CrowdStrike of misrepresenting its software testing rigor before a July 2024 outage. The judge said two statements about federal compliance could plausibly be misleading, but said plaintiffs failed to establish intent or recklessness.

Investors didn't present a valid claim, says judge, but they're welcome to try again A group of CrowdStrike shareholders who sued the company over losses sustained following its 2024 global outage will have to head back to the drawing board if they hope to recoup losses, as a Texas judge has deemed they failed to adequately state a claim.…

A year after the largest outage in IT history, organizations need to make an active effort to diversify their technology and software vendors and create a more resilient cyber ecosystem moving forward.

The ever-growing volume of vulnerabilities and threats requires organizations to remain resilient and anti-fragile — that is, to be able to proactively respond to issues and continuously improve.

Passengers' Nuisance Claim Against CrowdStrike Barred by Airline Deregulation ActA judge dismissed a suit against CrowdStrike over its 2024 outage, ruling the claims by airline passengers are preempted by the Airline Deregulation Act. The plaintiffs claimed damages for negligence and public nuisance. But the court found those claims were inseparable from the airlines' services.

Also: Privacy on the Line in 23andMe Sale; Google Leads Cyber Aid ChargeIn this week's update, ISMG editors unpacked CrowdStrike's escalating legal troubles following its global outage, the fate of consumer DNA data as 23andMe's assets hit the auction block, and why tech giants are banding together to pressure Washington for faster, smarter foreign cyber aid.

Georgia Court Allows Claims of Fraud, Trespass Over Falcon Software UpdateDelta can proceed with its lawsuit against CrowdStrike over a July 2024 update that allegedly bypassed Microsoft safeguards and crashed thousands of systems. The judge found that Delta sufficiently alleged fraud, computer trespass and gross negligence, allowing key claims to move forward.

Also: Iberian Blackout, Delta Faces Lawsuit Linked to CrowdStrike OutageEvery week, ISMG rounds up cybersecurity incidents and breaches around the world. This week: Mirai Botnet Exploits Flaws in GeoVision, the Iberian blackout under investigation, dueling cybersecurity advisories from India and Pakistan, Delta must face a lawsuit linked to CrowdStrike outage.

Looking Back on the Ransomware Attacks, Resilience Lessons and Tech TrendsIn the latest weekly update, ISMG editors discussed defining cybersecurity moments of 2024, from the CrowdStrike outage and its implications for vendor resilience to ransomware's continued evolution, and the shifting dynamics in the tech industry affecting startups and M&A activity.

Palo Alto, CrowdStrike, Zscaler Eye Firewall, SIEM Replacement, Incident RecoveryThree of the world's largest pure-play cybersecurity vendors recently reported earnings, grappling with SIEM and firewall displacement opportunities along with rebounding from a massive outage. Palo Alto Networks Continues to reap the benefits of buying IBM's QRadar SaaS business.

Regulator Tells Regulators to Enhance Third-Party Service SecurityBritish financial institutions must ensure by this spring that they could reasonably weather a third party tech outage on the scale of July's global meltdown of 8.5 million computers triggered by a faulty update from cybersecurity firm CrowdStrike.

Knee-jerk reactions to major vendor outages could do more harm than good.

Vendor Blames Delta's Outage Severity on Its 'Own Response and IT Infrastructure'CrowdStrike has countersued customer Delta Air Lines, accusing the airline of employing a lawsuit and seeking damages in "a desperate attempt to shift blame" for Delta's own IT inadequacies having exacerbated its outage, unlike "other major airlines" that quickly resumed operations.

Legal action comes months after alleging negligence by Falcon vendor Delta Air Lines is suing CrowdStrike in a bid to recover the circa $500 million in estimated lost revenue months after the cybersecurity company "caused" an infamous global IT outage.…

Also: CrowdStrike Grilled by Congress; Coalition Against Spyware Abuse Is GrowingIn the latest weekly update, ISMG editors discussed Microsoft's major cybersecurity overhaul in the wake of some high-profile breaches, the latest developments from CrowdStrike's global outage hearing and the expanding U.S.-led coalition against spyware abuse in the EU.

Adam Meyers, CrowdStrike VP for counter-adversary operations, appeared before a US congressional committee to answer questions about its July faulty software update