Every so often the week’s security news lines up around a single idea without really trying to. This week, that idea is trust — specifically, what happens when the things you assume are safe turn out not to be.
Start with the software you download. Researchers found fake installers for LastPass’s Authenticator app being distributed through GitHub, a popular platform developers use to share code. Instead of installing a password manager, victims got a Windows kernel driver (a low-level piece of software with deep access to the operating system) that quietly disabled antivirus and EDR tools — EDR stands for ’endpoint detection and response,’ the software many businesses rely on to spot malicious activity on laptops and servers. With defenses turned off, a password-stealing program called Rapuncel moved in. Attackers reportedly impersonated at least 40 companies using this same trick. The lesson isn’t ’never download software’ — it’s that even familiar, well-known brand names can be spoofed convincingly, so it’s worth having a simple, consistent process for how your team verifies and installs new software, rather than relying on individual judgment in the moment.
Then there’s the trust businesses place in their vendors. BigCommerce notified merchants that attackers used stolen credentials for third-party ’Ribon’ apps to inject malicious code into online stores — meaning the breach didn’t start with BigCommerce itself, but with a connected app. Separately, a breach at United Language Group, a translation vendor, has affected UnitedHealthcare plan members, along with a couple of other healthcare-related organizations. Neither of these breaches originated with the company whose name is on the front door. That’s the pattern worth sitting with: your own security practices can be solid, and you can still be exposed through a vendor, plugin, or app you’ve given access to your systems or data. If you haven’t looked recently at which third parties can touch your website, customer data, or internal systems, this is a reasonable nudge to do so.
Finally, regulators reminded everyone this week that privacy rules have real financial teeth. Google was fined 403 million euros (about $463 million) by EU regulators for mishandling users’ location data under GDPR — Europe’s General Data Protection Regulation, a privacy law that applies to many businesses handling data from EU residents, not just companies based in Europe. Most small and mid-sized businesses aren’t handling data at Google’s scale, but the case is a useful reminder that location data, in particular, gets treated as sensitive personal information in a lot of privacy frameworks — worth keeping in mind if your business collects it through apps, marketing tools, or point-of-sale systems.
None of this is about assuming everything is dangerous. It’s about recognizing that trust — in a download, a vendor, or a data practice — is exactly what attackers and regulators are both testing right now. A little bit of structure around how you vet software, manage vendor access, and think about the personal data you collect goes a long way toward keeping that trust well-placed.
If any of this has you wondering how it applies to your own business, that’s what we’re here for.