Eclypsium launches Automata, a new AI-assisted feature for its digital supply chain security platform. Available now, Automata is an automated binary analysis system that replicates the knowledge and tooling of expert security researchers to discover previously unknown threats, vulnerabilities, and…
Category: Help Net Security
Index Engines CyberSense 8.6 detects malicious activity
Index Engines announced the latest release of its CyberSense software, with version 8.6 delivering a revamped user interface to support smarter recovery from ransomware attacks, new custom Advanced Threshold Alerts to proactively detect unusual activity, and AI-powered detection of ransomware-based…
Concentric AI unveils employee offboarding risk monitoring and reporting module
Concentric AI announced its new employee offboarding risk monitoring and reporting module that delivers critical data detection and response capabilities to identify true risk to data and secure sensitive information when employees leave a company. Concentric AI’s new release also…
IT pros targeted with malicious Google ads for PuTTY, FileZilla
An ongoing malvertising campaign is targeting IT administrators looking to download system utilities such as PuTTY (a free SSH and Telnet client) and FileZilla (a free cross-platform FTP application). “We have reported this campaign to Google but no action has…
Cohesity teams up with Intel to integrate confidential computing into Data Cloud Services
Cohesity has announced it is collaborating with Intel to bring Intel’s confidential computing capabilities to the Cohesity Data Cloud. Leveraged with Fort Knox, Cohesity’s cyber vault service, this data-in-use encryption innovation will be the first of its kind in the…
NICE Actimize enhances Integrated Fraud Management platform to help financial services prevent scams
NICE Actimize announced IFM 11 (Integrated Fraud Management), a new release of its AI-driven fraud management and detection platform. The new release leverages recent advancements in artificial intelligence together with NICE Actimize’s collective intelligence capabilities to introduce fraud detection accuracy,…
Alethea raises $20 million to combat disinformation campaigns
Alethea announced the close of a $20 million Series B funding round led by GV, with participation from Ballistic Ventures, who led Alethea’s Series A funding in 2022. Also participating in the round is Hakluyt Capital, which invests alongside leading…
Upcoming report on the state of cybersecurity in Croatia
Next week, Diverto is set to release a comprehensive report on Croatia’s cybersecurity landscape. This report will provide a detailed summary of the key events from 2023, offer targeted recommendations for managerial strategies, and highlight crucial regulations like NIS2 and…
Why are many businesses turning to third-party security partners?
In 2023, 71% of organizations across various industries reported that their business feels the impact of the ongoing cybersecurity skills shortage. Many companies have been forced to scale back their cybersecurity programs as they struggle to find experienced candidates to…
WEF Cybercrime Atlas: Researchers are creating new insights to fight cybercrime
In early 2023, the World Economic Forum (WEF) launched Cybercrime Atlas, with the intent to map the cybercriminal ecosystem by facilitating collaboration between private and public organizations. What does this collaboration look like in practice? We’ve asked Sean Doyle, the…
AI risks under the auditor’s lens more than ever
According to a recent Gartner survey, widespread GenAI adoption has resulted in a scramble to provide audit coverage for potential risks arising from the technology’s use. In this Help Net Security video, Thomas Teravainen, a Research Specialist at Gartner, discusses…
GSMA releases Mobile Threat Intelligence Framework
GSM Association’s Fraud and Security Group (FASG) has published the first version of a framework for describing, in a structured way, how adversaries attack and use mobile networks, based on the tactics, techniques and procedures (TTPs) that they use. The…
Cybersecurity jobs available right now: April 10, 2024
Application Security Engineer HCLTech | Mexico | Remote – View job details As an Application Security Engineer, you will work on the security engineering team and collaborate with other IT professionals to ensure that user data is protected. Cybersecurity Incident…
Microsoft patches two actively exploited zero-days (CVE-2024-29988, CVE-2024-26234)
On this April 2024 Patch Tuesday, Microsoft has fixed a record 147 CVE-numbered vulnerabilities, including CVE-2024-29988, a vulnerability that Microsoft hasn’t marked as exploited, but Peter Girnus, senior threat researcher with Trend Micro’s Zero Day Initiative (ZDI), has found being…
Microsoft patches actively exploited security feature bypass vulnerability (CVE-2024-29988)
On this April 2024 Patch Tuesday, Microsoft has fixed a record 147 CVE-numbered vulnerabilities, including CVE-2024-29988, a vulnerability that Microsoft hasn’t marked as exploited, but Peter Girnus, senior threat researcher with Trend Micro’s Zero Day Initiative (ZDI), has found being…
LG smart TVs may be taken over by remote attackers
Bitdefender researchers have uncovered four vulnerabilities in webOS, the operating system running on LG smart TVs, which may offer attackers unrestricted (root) access to the devices. “Although the vulnerable service is intended for LAN access only, Shodan, the search engine…
New Google Workspace feature prevents sensitive security changes if two admins don’t approve them
Google is rolling out multi-party approvals for Google Workspace customers with multiple super admin accounts, the company has announced. What does the feature do? Google Workspace (formerly G Suite) is a cloud-based set of productivity and collaboration tools/services aimed at…
ESET Small Business Security offers protection against online fraud, data theft and human error
ESET introduced ESET Small Business Security, which has been specifically designed to meet the cybersecurity needs of Small Office/Home Office business owners. According to the Small Business Administration, out of the 33.3 million small businesses in the United States, over…
TufinMate accelerates network access troubleshooting
Tufin launched TufinMate, an AI assistant that helps organizations troubleshoot network access issues across hybrid and multi-vendor network environments. TufinMate automates the secure network access enablement process across the organization, allowing a broad array of stakeholders, including those outside of…
Gurucul Data Optimizer provides control over real-time data transformation and routing
Gurucul launched Gurucul Data Optimizer, an intelligent data engine that allows organizations to optimize their data while reducing costs, typically by 40% out of the box and up to 87% with fine-tuning. A universal collector and forwarder, Gurucul Data Optimizer…
Sectigo appoints Jason Scott as CISO
Sectigo announced the newest member of its senior executive team with the appointment of Jason Scott as CISO. Jason will oversee all aspects of cybersecurity at Sectigo including data, infrastructure, network, applications, and products. He joins the company with more…
Rocket DevOps simplifies compliance processes
Rocket Software is addressing the growing demand for integrated security, compliance, and automation in software development with its latest release of Rocket DevOps, formerly known as Aldon. With its data validation tool and seamless support of CI/CD pipelines, Rocket DevOps,…
Akamai Shield NS53 protects on-prem and hybrid DNS infrastructure
Akamai launched Akamai Shield NS53, a product that protects on-premises (on-prem) Domain Name System (DNS) infrastructure from resource exhaustion attacks. These attacks overwhelm servers to the point that they can no longer respond to valid DNS queries. The new offering…
New Latrodectus loader steps in for Qbot
New (down)loader malware called Latrodectus is being leveraged by initial access brokers and it looks like it might have been written by the same developers who created the IcedID loader. Malware delivery campaigns “[Latrodectus] was first observed being distributed by…
Darktrace ActiveAI Security Platform helps organizations shift focus to proactive cyber resilience
Darktrace has introduced the Darktrace ActiveAI Security Platform. The platform includes Darktrace’s existing security products supplemented by a set of new innovations and features, including for email and operational technology (OT). The platform uses AI to transform security operations from…
SINEC Security Guard identifies vulnerable production assets
Production facilities are increasingly the target of cyberattacks. Industrial companies are therefore required to identify and close potential vulnerabilities in their systems. To address the need to identify cybersecurity vulnerabilities on the shop floor as quickly as possible, Siemens has…
Cloudflare partners with Booz Allen Hamilton to guide organizations under attack
Cloudflare announced a collaboration with Booz Allen Hamilton to support enterprises under attack by providing expedited Under Attack as a Service (UAaaS) with 30-Day Rapid Response DDoS Mitigation, including continuous monitoring and protection. Under this new agreement, Booz Allen’s Global…
How exposure management elevates cyber resilience
Attackers are adept at identifying and exploiting the most cost-effective methods of compromise, highlighting the critical need for organizations to implement asset identification and understand their assets’ security posture in relation to the whole estate. Instead of asking, “Are we…
Strategies for secure identity management in hybrid environments
In this Help Net Security interview, Charlotte Wylie, SVP and Deputy CSO at Okta, discusses the challenges of managing user identities across hybrid IT environments. She emphasizes balancing and adopting comprehensive security controls, including cloud SSO and MFA technologies, to…
EJBCA: Open-source public key infrastructure (PKI), certificate authority (CA)
EJBCA is open-source PKI and CA software. It can handle almost anything, and someone once called it the kitchen sink of PKI. With its extensive history as one of the longest-standing CA software projects, EJBCA offers proven robustness, reliability, and…
Defining a holistic GRC strategy
End-user spending on security and risk management will total $215 billion in 2024, according to Gartner. In this Help Net Security video, Nicholas Kathmann, CISO at LogicGate, discusses why companies are turning to a holistic GRC strategy. Businesses often consider…
Bitdefender Digital Identity Protection guards against web data leaks
Bitdefender has enhanced Bitdefender Digital Identity Protection, a service that monitors personal data in real-time by proactively scanning the internet including public sites, dark web, and underground forums for unauthorized leaks and data breaches that may put user accounts and…
XZ Utils backdoor: Detection tools, scripts, rules
As the analysis of the backdoor in XZ Utils continues, several security companies have provided tools and advice on how to detect its presence on Linux systems. What happened? The open-source XZ Utils compression utility has been backdoored by a…
Veriato introduces AI-driven predictive behavior analytics platform
Veriato released their next generation Insider Risk Management (IRM) solution. With organizations of all sizes facing a more complex cybersecurity environment, Veriato IRM delivers flexibility and scalability using the power of GenAI. Veriato’s IRM solution offers technology for companies looking…
SymphonyAI unveils SensaAI for Sanctions to detect hidden risk in unstructured data
SymphonyAI announced SensaAI for Sanctions, a platform-agnostic “AI upgrade” for any sanctions solution. It impacts sanctions evasion efforts by optimizing match accuracy with deep, context-aware AI-based matching algorithms. SensaAI for Sanctions, delivered via API, is pre-trained and ready to use…
92,000+ internet-facing D-Link NAS devices accessible via “backdoor” account (CVE-2024-3273)
A vulnerability (CVE-2024-3273) in four old D-Link NAS models could be exploited to compromise internet-facing devices, a threat researcher has found. The existence of the flaw was confirmed by D-Link last week, and an exploit for opening an interactive shell…
How can the energy sector bolster its resilience to ransomware attacks?
Since it plays a vital role in every functioning society, the energy sector has always been a prime target for state-backed cybercriminals. The cyber threats targeting this industry have grown significantly in recent years, as geopolitical tensions have fueled an…
April 2024 Patch Tuesday forecast: New and old from Microsoft
This month, we have a new product preview from Microsoft, and some older products are being prepared for end-of-support. But before we go there, March 2024 Patch Tuesday was pretty mild, with 60 unique vulnerabilities addressed. We saw updates to…
WiCyS: A champion for a more diverse cybersecurity workforce
In this Help Net Security interview, Lynn Dohm, Executive Director at Women in CyberSecurity (WiCyS), talks about how the organization supports its members across different stages of their cybersecurity journey. WiCyS (pronounced Wee-Sis) is an organization dedicated to advancing the…
How malicious email campaigns continue to slip through the cracks
In this Help Net Security video, Josh Bartolomie, VP of Global Threat Services at Cofense, discusses how email will remain a target as long as it remains the predominant form of communication within a business. Cofense researchers have found that…
Threat actors are raising the bar for cyber attacks
From sophisticated nation-state-sponsored intrusions to opportunistic malware campaigns, cyber attacks manifest in various forms, targeting vulnerabilities in networks, applications, and user behavior. The consequences of successful cyber attacks can be severe, ranging from financial losses and reputational damage to potential…
Industrial sectors embrace zero trust for enhanced security
Organizations are leveraging zero trust to enhance the safety, security, and reliability of their enterprise across IT and OT environments, according to Xage Security. Zero trust security implementation in industrial sectors The report analyzes the current status and trajectory of…
Week in review: 73M customers affected by AT&T data leak, errors led to US govt inboxes compromise
Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: Cyber attacks on critical infrastructure show advanced tactics and new capabilities In this Help Net Security interview, Marty Edwards, Deputy CTO OT/IoT at Tenable, discusses…
Trellix ZTS enables organizations to strengthen cyber resilience
Trellix announced the Trellix Zero Trust Strategy (ZTS) Solution, available immediately worldwide. Trellix ZTS is leveraging Trellix’s AI-powered XDR Platform to provide native monitoring, protection, and threat detection. The solution enables organizations to establish security hygiene and strengthen cyber resilience…
Security pros are cautiously optimistic about AI
55% of organizations plan to adopt GenAI solutions within this year, signaling a substantial surge in GenAI integration, according to a Cloud Security Alliance and Google Cloud survey. The survey received 2,486 responses from IT and security professionals. The report…
Cybercriminal adoption of browser fingerprinting
Browser fingerprinting is one of many tactics phishing site authors use to evade security checks and lengthen the lifespan of malicious campaigns. While browser fingerprinting has been used by legitimate organizations to uniquely identify web browsers for nearly 15 years,…
22% of employees admit to breaching company rules with GenAI
Disruptive technologies like AI are heightening the longstanding tension between organizational security and employee productivity, according to 1Password. Employees are under increasing pressure to perform; to boost efficiency they’re embracing generative AI, hybrid and remote work, and unapproved applications and…
New infosec products of the week: April 5, 2024
Here’s a look at the most interesting products from the past week, featuring releases from Fastly, LogRhythm, Owl Cyber Defense Solutions, and TrueMedia.org. Owl Talon 3 provides hardware-enforced, one-way data transfers Owl Cyber Defense Solutions launched next generation of their…
How manual access reviews might be weakening your defenses
As businesses evolve, they often experience changes in roles, partnerships, and staff turnover. This dynamic can result in improper access to data and resources. Such mismanagement leads to superfluous expenses from excessive software licensing fees and heightens the risk of…
Omni Hotels suffer prolonged IT outage due to cyberattack
Texas-based Omni Hotels & Resorts has been responding to a cyberattack that started last Friday, which resulted in the unavailability of many of its IT systems. According to people staying at some of the 50 properties the company operates across…
NIST awards $3.6 million to address the cybersecurity workforce gap
The US Department of Commerce’s National Institute of Standards and Technology (NIST) has awarded cooperative agreements totaling nearly $3.6 million aimed at building the workforce needed to safeguard enterprises from cybersecurity risks. The grants of roughly $200,000 each will go…
Ivanti vows to transform its security operating model, reveals new vulnerabilities
Ivanti has released patches for new DoS vulnerabilities affecting Ivanti Connect Secure (SSL VPN solution) and Ivanti Policy Secure (NAC solution), some of which could also lead to execution of arbitrary code or information disclosure. Also, three months since attackers…
Avast One Silver allows users to tailor their coverage based upon their personal preferences
Avast released a new product tier to the Avast One suite: Avast One Silver. The new offering takes a modular approach to cyber security, allowing people to tailor their coverage based upon their needs, personal preferences, or risk profiles. The…
Six steps for security and compliance in AI-enabled low-code/no-code development
AI is quickly transforming how individuals create their own apps, copilots, and automations. This is enabling organizations to improve output and increase efficiency—all without adding to the burden of IT and the help desk. But while this transformation makes software…
Mantis: Open-source framework that automates asset discovery, reconnaissance, scanning
Mantis is an open-source command-line framework that automates asset discovery, reconnaissance, and scanning. You input a top-level domain, and it identifies associated assets, such as subdomains and certificates. Mantis features The framework conducts reconnaissance on active assets and completes its…
Strengthening defenses against nation-state and for-profit cyber attacks
There is an urgent need to secure tactical, operational, and strategic critical assets from the edge to the core. In this Help Net Security video, Geoffrey Mattson, CEO of Xage Security, discusses the steps enterprises and critical infrastructure must take…
Healthcare’s cyber resilience under siege as attacks multiply
In this Help Net Security interview, Eric Demers, CEO of Madaket Health, discusses prevalent cyber threats targeting healthcare organizations. He highlights challenges in protecting patient data due to infrastructure limitations and the role of employee awareness in preventing insider threats.…
76% of consumers don’t see themselves as cybercrime targets
67% of consumers across the globe are concerned about the security and privacy of AI, according to Bitdefender survey. AI uses personal data to feed its machine learning algorithms, and the rising amount has raised serious concerns about data storage,…
A “cascade” of errors let Chinese hackers into US government inboxes
Microsoft still doesn’t known how Storm-0558 attackers managed to steal the Microsoft Services Account cryptographic key they used to forge authentication tokens needed to access email accounts belonging to US government officials. “The stolen 2016 MSA key in combination with…
Picus Security helps organizations reduce their threat exposure with AI-driven insights
Picus Security announced Picus Numi AI. As the latest innovation of the Picus Security Validation Platform, this generative AI security analyst empowers any member of a security team to access critical, up-to-date information about their security posture to make purposeful…
Bitwarden releases magic links API to improve passwordless user authentication
Bitwarden strengthened Bitwarden Passwordless.dev with the release of a magic links API. This offering empowers developers to incorporate passwordless authentication into their applications, providing a more secure and user-friendly experience for users. The magic links API enables developers to send…
NVD: NIST is working on longer-term solutions
The recent conspicuous faltering of the National Vulnerability Database (NVD) is “based on a variety of factors, including an increase in software and, therefore, vulnerabilities, as well as a change in interagency support,” says the U.S. National Institute of Standards…
Owl Talon 3 provides hardware-enforced, one-way data transfers
Owl Cyber Defense Solutions launched next generation of their flagship data diode software platform, Owl Talon 3. This new release represents the first in a planned series of leaps forward for Owl’s hardware-enforced one-way data transfer technology. With an all-new…
TrueMedia.org introduces deepfake detection tool
TrueMedia.org launched its deepfake detection technology for reporters, and other key audiences to use ahead of the 2024 U.S. elections. The free tool is currently available to government officials, fact checkers, campaign staff, universities, non-profits, and reporters of accredited news…
Location tracking and the battle for digital privacy
While some online privacy issues can be subtle and difficult to understand, location tracking is very simple – and very scary. Perhaps nothing reveals more about who we are and what we do than a detailed map of all the…
How Google plans to make stolen session cookies worthless for attackers
Google is working on a new security feature for Chrome called Device Bound Session Credentials (DBSC), meant to prevent attackers from using stolen session cookies to gain access user accounts. Session (i.e., authentication) cookies are stored by browsers when a…
Cybersecurity jobs available right now: April 3, 2024
Cyber Security Manager Charterhouse Middle East | UAE | On-site – View job details The Cyber Security Manager will identify and address potential security issues, define access privileges, implement control structures, and conduct periodic audits. In addition, you’ll also contribute…
Human risk is the top cyber threat for IT teams
After another year rife with cybercrime, IT and cyber leaders are confronted with a new reality. AI and deepfakes can trick even the most well-trained employee, and executing a strong cyber defense is more important than ever. In this Help…
Cyber attacks on critical infrastructure show advanced tactics and new capabilities
In this Help Net Security interview, Marty Edwards, Deputy CTO OT/IoT at Tenable, discusses the impact of geopolitical tensions on cyber attacks targeting critical infrastructure. Edwards highlights the need for collaborative efforts between policymakers, government agencies, and the private sector…
Fortinet upgrades its real-time network security operating system
Fortinet announced the latest version of its FortiOS operating system and other major enhancements to the company’s cybersecurity platform, the Fortinet Security Fabric. FortiOS 7.6 empowers customers to better mitigate risk, reduce complexity, and realize a superior user experience across…
Fastly Bot Management protects websites, apps, and valuable data from malicious automated traffic
Fastly introduced Fastly Bot Management to help organizations combat automated “bot” attacks at the edge and significantly reduce the risk of fraud, DDoS attacks, account takeovers, and other online abuse. Fastly Bot Management represents an important cybersecurity milestone for the…
AT&T data leaked: 73 million customers affected
AT&T has confirmed that the data set leaked on the dark web some two weeks ago does, indeed, contain “AT&T data-specific fields”. The company is reaching out to affected customers and offering credit monitoring services. What type of data has…
LogRhythm Axon enhancements improve data management and operational efficiency
Recent global research reveals 61% of organizations still rely on manual and time-intensive methods for sharing security status updates. In response, LogRhythm announced its 8th consecutive quarterly release. The latest innovations to LogRhythm Axon facilitate seamless dashboard and search import/export…
Veracode acquires Longbow Security to help organizations reduce application risk
Veracode announced the acquisition of Longbow Security, a pioneer in security risk management for cloud-native environments. The acquisition marks the next exciting phase of Veracode, underscoring the company’s commitment to help organizations manage and reduce application risk across the growing…
What the ID of tomorrow may look like
Few joys remain untouched by the necessity of identity verification. With its ubiquitous presence, the call for heightened security, improved accessibility, and seamless authentication resonates loudly for businesses and individuals alike. In response, a tool, or perhaps a reinvented vision…
Cloud Active Defense: Open-source cloud protection
Cloud Active Defense is an open-source solution that integrates decoys into cloud infrastructure. It creates a dilemma for attackers: risk attacking and being detected immediately, or avoid the traps and reduce their effectiveness. Anyone, including small companies, can use it…
Why AI forensics matters now
In this Help Net Security video, Sylvia Acevedo, who serves on the Boards of Qualcomm and Credo, discusses why companies should invest in forensic capabilities and why forensics will be such an important topic as AI continues to be integrated…
73% brace for cybersecurity impact on business in the next year or two
Only 3% of organizations across the globe have the ‘mature’ level of readiness needed to be resilient against modern cybersecurity risks, according to Cisco. The 2024 Cisco Cybersecurity Readiness Index highlights that readiness is down significantly from one year ago,…
6 keys to navigating security and app development team tensions
There will always be a natural tension between cybersecurity teams and developers. After all, it’s the developer’s role to “develop.” They want and are paid to create and ship new applications and features that help move the organization forward. It’s…
How to design and deliver an effective cybersecurity exercise
Armed forces have always utilized war-gaming exercises for battlefield training to prepare for times of conflict. With today’s digital transformation, the same concept is being applied in the form of cybersecurity exercises – tests and simulations based on plausible cyber-attack…
Escalating malware tactics drive global cybercrime epidemic
Evasive, basic, and encrypted malware all increased in Q4 2023, fueling a rise in total malware, according to WatchGuard. Threat actors employ diverse tactics The average malware detections rose 80% from the previous quarter, illustrating a substantial volume of malware…
Infosec products of the month: March 2024
Here’s a look at the most interesting products from the past month, featuring releases from: Appdome, AuditBoard, Bedrock Security, Cado Security, Check Point, CyberArk, Cynerio, DataDome, Delinea, Drata, Exabeam, GitGuardian, GitHub, GlobalSign, Legato Security, Legit Security, Malwarebytes, Ordr, Pentera, Portnox,…
Securing privacy in the face of expanding data volumes
One of the primary concerns regarding data privacy is the potential for breaches and unauthorized access. Whether it’s financial records, medical histories, or personal communications, individuals have a right to control who can access their data and for what purposes.…
XZ Utils backdoor update: Which Linux distros are affected and what can you do?
The news that XZ Utils, a compression utility present in most Linux distributions, has been backdoored by a supposedly trusted maintainer has rattled the open-source software community on Friday, mere hours until the beginning of a long weekend for many.…
Week in review: Backdoor found in XZ utilities, weaponized iMessages, Exchange servers at risk
Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: Beware! Backdoor found in XZ utilities used by many Linux distros (CVE-2024-3094) A vulnerability (CVE-2024-3094) in XZ Utils, the XZ format compression utilities included in…
Beware! Backdoor found in XZ utilities used by many Linux distros (CVE-2024-3094)
A vulnerability (CVE-2024-3094) in XZ Utils, the XZ format compression utilities included in most Linux distributions, may “enable a malicious actor to break sshd authentication and gain unauthorized access to the entire system remotely,” Red Hat warns. The cause of…
Stream.Security unveils threat investigation and AI-powered remediation capabilities
Stream.Security announced new threat investigation and AI-powered remediation capabilities. The new real-time attack path detection and generative AI-powered remediation tools are part of the real-time exposure management features that the cloud security company is rolling out. With these capabilities, customers…
AI abuse and misinformation campaigns threaten financial institutions
Though generative AI offers financial firms remarkable business and cybersecurity utility, cyberthreats relating to GenAI in financial services are a consistent concern, according to FS-ISAC. Cybercriminals exploit AI for data exfiltration The cybersecurity community’s current consensus is that adversarial usage…
How much does cloud-based identity expand your attack surface?
We all know using a cloud-based identity provider (IdP) expands your attack surface, but just how big does that attack surface get? And can we even know for sure? As Michael Jordan once said, “Get the fundamentals down, and the…
Advanced cybersecurity strategies boost shareholder returns
Companies demonstrating advanced cybersecurity performance generate a shareholder return that is 372% higher than their peers with basic cybersecurity performance, according to a new report from Diligent and Bitsight. Boards under pressure to fortify cyber oversight The escalation in the…
New infosec products of the week: March 29, 2024
Here’s a look at the most interesting products from the past week, featuring releases from Bedrock Security, CyberArk, GitGuardian, Legit Security, and Malwarebytes. GitGuardian SCA automates vulnerability detection and prioritization for enhanced code health GitGuardian SCA is specifically designed for…
Zero-day exploitation surged in 2023, Google finds
2023 saw attackers increasingly focusing on the discovery and exploitation of zero-day vulnerabilities in third-party libraries (libvpx, ImagelO) and drivers (Mali GPU, Qualcomm Adreno GPU), as they can affect multiple products and effectively offer more possibilities for attack. Another interesting…
Snowflake Data Clean Rooms helps organizations preserve the privacy of their data
Snowflake introduced Snowflake Data Clean Rooms to customers in AWS East, AWS West, and Azure West, revolutionizing how enterprises of all sizes can securely share data and collaborate in a privacy-preserving manner to achieve high value business outcomes in the…
AppViewX partners with Fortanix to address critical enterprise security challenges
AppViewX and Fortanix announced a partnership to offer cloud-delivered secure digital identity management and code signing. Together the companies make it easy to address critical enterprise security challenges with comprehensive, robust and scalable platforms for certificate lifecycle management automation and…
NHS Scotland confirms ransomware attackers leaked patients’ data
NHS Dumfries and Galloway (part of NHS Scotland) has confirmed that a “recognised ransomware group” was able to “access a significant amount of data including patient and staff-identifiable information,” and has published “clinical data relating to a small number of…
Patch actively exploited Microsoft SharePoint bug, CISA orders federal agencies (CVE-2023-24955)
The Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2023-24955 – a code injection vulnerability that allows authenticated attackers to execute code remotely on a vulnerable Microsoft SharePoint Server – to its KEV catalog and is demanding that US federal…
Enterprises increasingly block AI transactions over security concerns
Enterprises must secure a transformation driven by generative AI (GenAI) bidirectionally: by securely adopting GenAI tools in the enterprise with zero trust while leveraging it to defend against the new AI-driven threat landscape, according to Zscaler. AI has already become…
Debunking compliance myths in the digital era
Despite recent economic fluctuations, the software-as-a-service (SaaS) market isn’t letting up. The industry is set to grow annually by over 18% and be valued at $908.21 billion by 2030. It’s evident the industry is fueled by an increasing reliance on…
How CISOs tackle business payment fraud
In this Help Net Security video, Shai Gabay, CEO of Trustmi, discusses why payments are a source of cyber worry for CISOs. CISOs are worried about Business Email Compromise (BEC), cyber attackers’ use of AI, and securing the supply chain.…
AI weaponization becomes a hot topic on underground forums
The majority of cyberattacks against organizations are perpetrated via social engineering of employees, and criminals are using new methods including AI to supercharge their techniques, according to ReliaQuest. Some 71% of all attacks trick employees via the use of phishing,…