Web Application Firewalls (WAFs) have long served as the front line of defense for web applications, filtering out malicious traffic and enforcing security policies. But as threats grow more sophisticated and application environments become more dynamic, many are questioning whether…
Tag: Blog RSS Feed
How Human Behavior Can Strengthen Healthcare Cybersecurity
Few sectors exemplify the enormous value of data as healthcare does. From the relatively mundane, such as digitalizing patient data for streamlined care, to the extraordinary, like the use of AI to revolutionize prostate cancer diagnosis and care, data is…
Generative AI Is Moving Fast. Are Your Security Practices Keeping Up?
We are in the middle of an AI gold rush. Generative AI (Gen AI) has exploded from research labs into everyday business workflows at breakneck speed. Marketing, software development, customer support, HR, companies across industries deploy Gen AI tools to…
Brace Yourselves: The Game-Changing Impact of India’s DPDP Act, 2023
India’s Digital Personal Data Protection (DPDP) Act, 2023 is a turning point in how personal data is regulated, managed, and protected across the country. As every industry becomes more digital, this law makes it clear who owns data and who…
What’s New in Tripwire Enterprise 9.3?
Protecting your organization from cyber threats and meeting compliance requirements is simpler than ever with the new Tripwire Enterprise 9.3 release, which includes the following enhancements: IPv6 Support IPv6-Only Support: Now fully compatible with environments that operate exclusively on IPv6.…
AI-Powered Attacks and Lack of Cyber Readiness. How Mexico Can Respond
The threat landscape in Mexico is a precarious one. A recent industry report reinforces the severity of Mexico’s cybersecurity challenges, describing the country as having a “high level of cyber vulnerability” and noting that state-backed groups and ransomware gangs increasingly…
Mexico’s Digital Growth Comes with Cybersecurity Challenges
Mexico is in the middle of a digital revolution. Nearshoring, cloud adoption, e-commerce expansion, and AI-driven automation have helped transform everything from manufacturing plants in Monterrey to financial institutions in Mexico City. In just the last five years, Mexico has…
Expanding on ADHICS v2.0: A Closer Look at Healthcare Cybersecurity in the UAE
As digital transformation sweeps across the healthcare sector, there has never been more at stake. Healthcare data is worth a lot on the black market. Unlike financial data, which has a short shelf life (accounts can be frozen, and fraud…
US Offers $10 Million Reward for Tips About State-Linked RedLine Cybercriminals
How would you like to earn yourself millions of dollars? Well, it may just be possible – if you have information which could help expose the identities of cybercriminals involved with the notorious RedLine information-stealing malware. The US Department of…
The Future of Cybersecurity Standards for Global Federal Energy Systems
According to a report, 71% of energy industry professionals consider their organizations more vulnerable to OT cyber events than ever. These are private organizations, but the stakes are much higher for government-owned systems. Government-owned energy systems such as national grids,…
The Rising Tide: Understanding the Surge in Cyber Attacks in India
Over the past year, India witnessed a steep rise in cyberattacks. While news focused on big-ticket data breaches and mainstream ransomware attacks, it ignored how the overall threat landscape has become more sophisticated and ingrained. India detected over 369 million…
The Evolution of Phishing Attacks: Why Traditional Detection Methods Are Failing
If they weren’t so harmful to both businesses and consumers, the sophistication of modern phishing would be quite impressive. Today’s most invasive cybercriminals have moved beyond the old strategies of generic mass-email scams. They’re now leveraging advanced technologies like Artificial…
Is Continuous Deployment Too Risky? Security Concerns and Mitigations
Adopting Continuous Deployment, an extreme form of software delivery automation, can drastically speed up software delivery, but it also introduces critical security challenges. Some of the most severe, global-scale security breaches of recent years (Solarwinds and Kaseya are just two…
Interlock ransomware: what you need to know
What is the Interlock ransomware? Interlock is a relatively new strain of ransomware, that first emerged in late 2024. Unlike many other ransomware families it not only targets Windows PCs, but also systems running FreeBSD. If you are impacted, you…
NIST’s Responsibilities Under the January 2025 Executive Order
While NIST frameworks are typically not mandatory for most organizations, they are still being called on to do some heavy lifting to bolster the nation’s cybersecurity defenses. Under the January 2025 Executive Order (EO) on Strengthening and Promoting Innovation in…
Proposed HIPAA Update Makes Yearly Pen Testing Mandatory
In January of this year, significant changes to the HIPAA Security Rule were proposed by the Office of Civil Rights for the Department of Health and Human Services (OCR). The proposed update to the HIPAA Security Rule, published on January…
The Unique Cybersecurity Risks in the Manufacturing Sector
For the fourth year running, in 2025, the IBM X-Force Threat Intelligence Index crowned the manufacturing sector as the number one targeted industry for cybercrime, representing 26% of incidents. The problem is so bad that manufacturing has even managed to…
What the UK’s New Cyber Resilience Bill Means for Businesses—and How to Stay Ahead
The UK is facing the same evolving digital challenges as the rest of the world, and its new Cyber Security and Resilience Bill is designed to not only help it catch up – but stay ahead. Attackers change their tactics…
3AM Ransomware Attackers Pose as IT Support to Compromise Networks
Cybercriminals are getting smarter. Not by developing new types of malware or exploiting zero-day vulnerabilities, but by simply pretending to be helpful IT support desk workers. Attackers affiliated with the 3AM ransomware group have combined a variety of different techniques…
Health-ISAC 2025 Report: Ransomware Still Reigns as #1 Threat to Healthcare
Health-ISAC recently released their 2025 Health Sector Cyber Threat Landscape Report, a comprehensive outline of the malicious activity aimed at healthcare in the previous year. Not surprisingly, ransomware was cited by security professionals in the industry as the number one…
Key Takeaways from the IBM X-Force 2025 Threat Intelligence Index
Attackers have made a decisive switch toward stealthy, identity-centric attacks. Forget breaking in – modern cybercriminals simply log in. And that should be a concern. According to the IBM X-Force 2025 Threat Intelligence Index, nearly one-third of intrusions in 2024…
Government Organizations Lose Nearly a Month in Downtime for Every Ransomware Attack
Recent research by Comparitech reveals the shocking truth about ransomware attacks on government entities; they have a longer impact than anyone thought. Tracking over 1100 government-targeted ransomware attacks over a period of six years, researchers discovered that each day of…
Preparing for the Quantum Future: Insights from the NCSC’s PQC Migration Roadmap
A new era of inconceivably fast quantum machines is not far away, with computers almost ready to completely transform the way we solve problems, communicate, and compute. However, this transformation is not all positive, and the cybersecurity industry fears that…
Dead Man’s Scripts: The Security Risk of Forgotten Scheduled Tasks in Legacy Systems
There are ghosts in the machine. Not the poetic kind. I mean literal, running-code-with-root-access kind. The kind that was set up ten years ago by an admin who retired five jobs ago. The kind that still wakes up every night…
Compliance Fatigue Is Real—And It’s Putting Cybersecurity at Risk
Adhering to the ever-tightening letter of the law is the cost of doing business these days, and for many companies caught in the crosshairs, that cost is getting too high. New research by Bridewell Consulting revealed that 44% of all…
How to Stay Compliant with the New HIPAA Security Rule Updates
The Health Insurance Portability and Accountability Act (HIPPA) was established to protect patient privacy and secure health information. While it has been around for nearly two decades, it is evolving to keep up with an increasingly digital world and in…
The Forgotten Threat: How Supply Chain Attacks Are Targeting Small Businesses
When people hear “supply chain attack,” their minds often go to headline-grabbing breaches. But while analysts, CISOs, and journalists dissect those incidents, a more tactical and persistent wave of attacks has been unfolding in parallel; one that’s laser-focused on small…
May 2025 Patch Tuesday Analysis
Today’s Patch Tuesday Alert addresses Microsoft’s May 2025 Security Updates. We are actively working on coverage for these vulnerabilities and expect to ship ASPL-1156 as soon as coverage is completed. In-The-Wild & Disclosed CVEs CVE-2025-32706 A vulnerability in the Windows…
Report Reveals BEC Cryptocurrency Scams Rose by 344%
APWG’s Q4 2024 Phishing Activity Trends Report, published March 19 th, revealed that more than eight in ten Business Email Compromise (BEC) attacks last quarter were sent by attackers favoring Google’s free webmail service. By comparison, only 10% used Microsoft’s…
A Subtle Form of Siege: DDoS Smokescreens as a Cover for Quiet Data Breaches
DDoS attacks have long been dismissed as blunt instruments, favored by script kiddies and hacktivists for their ability to overwhelm and disrupt. But in today’s fragmented, hybrid-cloud environments, they’ve evolved into something far more cunning: a smokescreen. What looks like…
Assessment Frameworks for NIS Directive Compliance
According to the NIS Directive, Member States should adopt a common set of baseline security requirements to ensure a minimum level of harmonized security measures across the EU and enhance the overall level of security of operators providing essential services…
Tripwire Patch Priority Index for April 2025
Tripwire’s April 2025 Patch Priority Index (PPI) brings together important vulnerabilities for Microsoft and Google. Up first on the list are patches for Microsoft Edge (Chromium-based) and Google Chromium that resolve 11 issues including remote code execution and improper implementation…
LockBit Ransomware Gang Breached, Secrets Exposed
Oh dear, what a shame, never mind. Yes, it’s hard to feel too much sympathy when a group of cybercriminals who have themselves extorted millions of dollars from innocent victims have found themselves dealing with their own cybersecurity problem. And…
Essential Cybersecurity Controls (ECC-1:2018) – A Comprehensive Guide
Cybersecurity threats continue to evolve, posing very real risks to organizations, and nowhere is this risk more pronounced than in entities that handle a nation’s critical infrastructure, as these attacks put public health and safety at risk, harm the environment,…
PIVOTT Act Revived to Tackle Growing Cybersecurity Workforce Shortages
The cyber workforce gap is one of the most pressing and persistent challenges facing the cybersecurity industry. In 2024, ISC2 found that the gap amounted to 4.8 million people globally, up 19% from the previous year. Both public and private…
As Vishing Gains Momentum, It’s Time to Fight Back
The mechanisms and dangers of email phishing are well known, as are the best practices for hardening organizations against it. Its spin-off, called vishing, is nothing new, but it’s both rapidly evolving, and unlike the more mainstream counterpart, too often…
Getting Email Security Right
Let’s face it: your inbox is a warzone. Email security is a constant battle between evolving threats and the defenses designed to stop them. Every day, attackers bombard user inboxes with increasingly sophisticated phishing attempts, malware, and social engineering attacks.…
Strengthening Cybersecurity Incident Response Part 2: From Detection to Recovery
Cyber incidents are always going to be present. Regardless of whether you’re working for a startup or a corporation, malicious software can target you and your business. This is why it’s important to work closely with cybersecurity incident response teams…
The Growing Threat of Ransomware-as-a-Service (RaaS) on Healthcare Infrastructure
According to the 2024 State of Ransomware report by Sophos, there was a 500% increase in ransom bills in the last 12 months. Moreover, an analysis by Comparitech revealed 181 confirmed ransomware incidents targeting healthcare providers in 2024, with 25.6…
The Growing Threat of Ransomware to the Manufacturing Sector
Ransomware has evolved from a distant “I hope it doesn’t happen to us” threat to an insidious, worldwide crisis. Among the sectors most affected is manufacturing, which has found itself more and more in attackers’ crosshairs. Manufacturing has long viewed…
Ransomware Attacks on Critical Infrastructure Surge, Reports FBI
The FBI is set to report that ransomware was the most pervasive cybersecurity threat to US critical infrastructure during the year of 2024. As Reuters reports, complaints of ransomware attacks against critical sectors have jumped 9% over the previous year.…
New Bill Mandates Cybersecurity Overhaul for Federal Contractors
New cybersecurity legislation is coming thick and fast. And for good reason: cyber threats are becoming more sophisticated, systems are becoming more connected, and geopolitical relationships are becoming more fraught. One of the most recent bipartisan legislations – the US…
Scams 2.0: How Technology Is Powering the Next Generation of Fraud
Technology is transforming the way financial scams operate, making them more sophisticated, automated, and harder to detect. From deepfake impersonations to cryptocurrency fraud and tech support scams, bad actors are leaving no stone unturned and are leveraging every advanced tool…
The Bybit Wake-Up Call: Strengthening Crypto Security Before It’s Too Late
The recent Bybit hack, in which bad actors swooped in and made off with $1.5 billion worth of Ethereum, has sent shockwaves through the cryptocurrency industry. As one of the largest digital heists in history, it lays bare the vulnerabilities…
Smart Africa Unveils 5-Year Cybersecurity Plan to Strengthen Digital Resilience
Africa has made huge strides in digital transformation in the past few years. For example, over 160 million Africans gained broadband internet access between 2019 and 2022. As the continent embraces digitalization, cybersecurity is becoming an increasingly pressing concern. Recognizing…
Digital Hygiene in Healthcare: Where Cybersecurity Is a Matter of Life and Death
The healthcare industry is a prime target for cyberattacks due to the significant value of medical data and the critical nature of patient care. Unlike other sectors, healthcare organizations must balance cybersecurity with the need for immediate access to life-saving…
Latest PCI DSS Standards: Use Third Parties – But at Your Own Risk
Third parties have long been the hidden heroes of the payment card industry, providing specialized, streamlined support to merchants looking to host a website or spin up an app. But that convenience is not without a cost. According to PCI…
The Cyber War on Democracy: Lessons from the 2024 RNC Email Hack
In July 2024, as the Republican National Committee (RNC) geared up for its national convention in Milwaukee, Chinese hackers infiltrated the RNC’s email system. According to The Wall Street Journal, attackers maintained access for several months, trying to get their…
US Senators Push for Stronger Cybercrime and Computer Fraud Legislation
It’s been a pretty divisive few months in US politics. The Trump administration has made sweeping changes in almost all areas of policy, ranging from international relations to domestic regulations and everything in between. However, some areas of American politics…
CNSS Instruction: Why It’s Critical for National Security and Your Organization
As cyber threats evolve, so must the strategies and frameworks that protect the data and systems that are at the heart of national defense, intelligence, and security. At a time when cyber threats are becoming more sophisticated, the need to…
APT Rogues’ Gallery: The World’s Most Dangerous Cyber Adversaries
Advanced Persistent Threat (APT) groups are not a new scourge. These sophisticated, state-sponsored cyber adversaries, with deep pockets and highly advanced technical skills, conduct prolonged and targeted attacks to infiltrate networks, exfiltrate sensitive data, and disrupt critical infrastructure. The stakes…
Best Practices for Transitioning from Security to Privacy
As global privacy requirements evolve, many information security professionals are called upon to enhance or lead information privacy programs. While this transition may seem like a natural progression, I learned five important lessons when I moved from a focus on…
Article 7 of GDPR: Preserving Data Integrity in Image Publication
For all the tremendous opportunities that the digitization of business operations has unlocked, there are also complex security and data privacy challenges that organizations have to navigate. In the interests of business privacy and security, legislation exists to hold organizations…
Energy Under Siege: How the Industry is Fighting Against Cyber Attacks
The energy sector has become a prime target for cyberattacks, with successful breaches posing severe risks to national security, economic stability, and public safety. Luckily, the industry is standing up and taking notice, with two-thirds of energy professionals (65%) now…
Ransomware Reaches A Record High, But Payouts Are Dwindling
Shed a tear, if you can, for the poor, misunderstood cybercriminals hard at work trying to earn a dishonest crust by infecting organisations with ransomware. Newly released research has revealed that the riches to be made from encrypting a company’s…
Cyber Fraud: The Primary Culprit in UK Payment Fraud
Cyber fraud has skyrocketed from a growing concern to the leading driver of payment fraud in the UK, infiltrating most businesses in the country and exposing them to previously unimagined financial and operational risks. This was one of the findings…
The Cost of Ransomware: Shutdowns & Extortion
Ransomware is no longer in its heyday. Evolving, AI-driven cybersecurity tools and global law enforcement efforts have seen to that. But that doesn’t mean ransomware is no longer a threat. In fact, in some ways, the danger is greater than…
April 2025 Patch Tuesday Analysis
Today’s Patch Tuesday Alert addresses Microsoft’s April 2025 Security Updates. We are actively working on coverage for these vulnerabilities and expect to ship ASPL-1151 as soon as coverage is completed. In-The-Wild & Disclosed CVEs CVE-2025-29824 A vulnerability in the Windows…
How CEOs Can Embrace GenAI for Business Growth
It’s well-trodden ground by now, but generative AI is really one of the business world’s most important technologies. Like it or not, it will soon become integral to everyday business operations. Those who learn how to use it effectively will…
Mastering Cybersecurity Incident Communication Part 1: A Proactive Approach
Cybersecurity threats are no longer a matter of “if” but “when.” While companies invest heavily in technical defenses, one important aspect often gets overlooked — communication. How an organization communicates during a cybersecurity incident determines the speed and effectiveness of…
Information Security Risk Management (ISRM) Boosts Compliance by Undermining Configuration Drift
Compliance is a “ticket to entry” for businesses today, and information security risk management (ISRM) makes sure organizations hang on to their ticket. In this blog, we’ll review how ISRM helps organizations not only get compliant but stay compliant. And…
Tripwire Patch Priority Index for March 2025
Tripwire’s March 2025 Patch Priority Index (PPI) brings together important vulnerabilities for Microsoft and Google. Up first on the list are patches for Microsoft Edge (Chromium-based) and Google Chromium that resolve spoofing, out of bounds read, use after free, and…
HellCat Ransomware: What You Need To Know
What is HellCat? HellCat is the name of a relatively new ransomware-as-a-service (RaaS) group that first came to prominence in the second half of 2024. Like many other ransomware operations, HellCat breaks into organisations, steals sensitive files, and encrypts computer…
Top Cybersecurity Considerations When Moving Commercial Premises
When relocating office locations domestically or internationally, organizations must ensure the safe passage and management of more than just their physical assets and hardware. The complex cybersecurity obstacles before, during, and after an operational overhaul can outnumber the physical difficulties…
Japan Passes Active Cyber Defense Bill
Over the past few years, many countries have made considerable efforts to bolster cybersecurity preparedness. These efforts are understandable when put into a geopolitical context: global relationships in the past five years have been among the most tumultuous in decades,…
Federal Desktop Core Configuration (FDCC/USGCB) Compliance
Federal Desktop Core Configuration (FDCC) was mandated by the US Office of Management and Budget (OMB) in 2007 and provides a set of security standards that must be adhered to by all federal workstations and laptops running Windows XP or…
VanHelsing Ransomware: What You Need To Know
What is the VanHelsing ransomware? First reported earlier in March 2025, VanHelsing is a new ransomware-as-a-service operation. Oh, so it’s a relatively new player on the malware scene, then. Why the concern? At least three victims of VanHelsing have already…
How to Build a Mature Vulnerability Management Program
The terms “patch management” and “ vulnerability management“ are not the same. And that difference is a big difference. They may be confused because applying patches is one of the many ways to mitigate cyber risks. However, it is one…
Implementing Privileged Access Workstations: A Step-by-Step Guide
At a time when cyber threats seem to escalate daily, security teams are always on the lookout for new ways to protect their sensitive data and systems. For some, Privileged Access Workstations (PAWs) are being viewed as one solution to…
MAS Compliance 101: Key Regulations for Financial Institutions in Singapore
The Monetary Authority of Singapore (MAS) is both the central bank and chief financial regulator of Singapore. As such, they publish best practices (“Guidelines”) and legally binding regulations (“Notices”) regarding technology risk management and cyber hygiene. Mandatory requirements include: Notice…
An Introduction to Data Masking in Privacy Engineering
Protecting individual privacy is paramount, given the proliferation of Personally Identifiable Information (PII) and other sensitive data collected by enterprises across all industries. One way to protect sensitive data is through PII masking e.g., consistently changing names or including only…
Top 10 Scam Techniques: What You Need to Know
Scammers are highly resourceful and cunning when devising new ways to swindle people. But they often rely on long-standing persuasion techniques for their tricks to work. So, you may hear about a new scam that uses a novel narrative, but…
Cross-Border Data Compliance: Navigating Public Security Regulations in a Connected World
It is a significant benefit that the world is connected the way it is, with the potential for even greater interconnectivity. However, this has come at huge costs, too, considering the rise in the direct involvement of state actors engaged…
BlackLock Ransomware: What You Need To Know
What is the BlackLock ransomware? BlackLock is a relatively new ransomware group. First seen in March 2024, the ransomware operation initially operated under the name El Dorado, before rebranding as BlackLock late last year. BlackLock follows a RaaS (ransomware-as-a-service) business…
CMS ARS: A Blueprint for US Healthcare Data Security and Compliance
Protecting sensitive patient information is more critical than ever. With technologies evolving at a breakneck pace and the number of cyber threats targeting healthcare entities in the United States skyrocketing, healthcare organizations must have robust policies and guardrails in place…
How to Secure Your Information on AWS: 10 Best Practices
About one in three organizations that leverage cloud service providers (CSPs) use Amazon Web Services (AWS), according to November 2024 research from Synergy Research Group. This means two things. One is that when attackers are looking to get the most…
The Intersection of Public Policy and Cybersecurity: Building a Framework for 2025 and Beyond
Introduction In a report published by Statista, cybercrime cost the world over $9 trillion in 2024 and is predicted to rise to nearly $14 trillion by 2028. These figures are a deep source of worry for governments and private businesses…
What is Bundesamt für Sicherheit in der Informationstechnik (BSI)?
Most countries have some sort of government agency dedicated to protecting digital infrastructure and promoting cybersecurity awareness. In the English-speaking world alone, the UK has the National Cyber Security Center (NCSC), the US has the National Institute of Standards and…
The 10 Most Common Website Security Attacks (and How to Protect Yourself)
The Verizon 2023 Data Breach Investigations Report made a startling revelation: Basic Web Application Attacks accounted for nearly one-fourth of the entire breach data set. Although not the most sophisticated threats, common web attacks like credential stuffing and SQL injection…
Strengthening Critical Infrastructure with the NCSC CAF
Critical infrastructure organizations bear an enormous responsibility. The assets, systems, and networks they manage are crucial to the functioning of a healthy society. They provide water, energy, transportation, healthcare, telecommunications, and more—should they fail, they would bring entire countries to…
The Role of Localization in Cybersecurity Threat Mitigation
If your website is targeting multiple states or countries, by default, you face a double-pronged challenge: adapting to regional regulatory demands while defending against sophisticated cyber threats. Tackling this requires localization. But what does the term actually entail? Localization isn’t…
Medusa Ransomware: FBI and CISA Urge Organizations to Act Now to Mitigate Threat
The Medusa ransomware gang continues to present a major threat to the critical infrastructure sector, according to a newly-released joint advisory from the FBI, Cybersecurity and Infrastructure Security Agency (CISA) and the Multi-State Information Sharing and Analysis Center (MS-ISAC). As…
6 Potential Security Concerns With the Eventual Rollout of 6G
6G could be available by the end of the decade, which should decrease latency and connectivity speeds for users. However, these wireless networks present new cybersecurity challenges. What should industry professionals prepare for? What Is 6G? 6G will be the…
What Is SCM (Security Configuration Management)?
Attackers always seek the easiest path to get into our systems and compromise data. System misconfigurations and insecure default settings are often the criminals’ favorite vectors since these errors allow them easy access to critical systems and data. The rise…
Cybersecurity Can’t Wait: Modern Enterprises Must Adapt
Technology is evolving at a startling pace, perhaps faster than ever before. Businesses are scrambling to reap the rewards of these technologies, especially AI. But do they recognize the cybersecurity risks associated with these changes? The World Economic Forum’s latest…
March 2025 Patch Tuesday Analysis
Today’s VERT Alert addresses Microsoft’s March 2025 Security Updates. VERT is actively working on coverage for these vulnerabilities and expects to ship ASPL-1147 as soon as coverage is completed. In-The-Wild & Disclosed CVEs CVE-2025-26633 According to Microsoft, improper neutralization in…
The Growing Importance of Penetration Testing in OT and ICS Security
A critical aspect of manufacturing, energy, and transportation is Industrial Control Systems (ICS) and Operational Technologies (OT). The rapid pace of digital growth makes these systems susceptible to cyberattacks. OT and ICS system security is important, making penetration testing an…
Understanding the Windows Filtering Platform (WFP): A Quick Overview
What is it? The Tripwire Enterprise Critical Change Audit rules provide customers with the ability to monitor for critical events that could have a significant impact on a system. Monitoring for critical events can help administrators identify malicious and/or unexpected…
How to Secure Your Mobile Device: 9 Tips for 2025
Can you imagine a life without your smartphone? For most of us, this is a difficult task, and some younger readers will have never lived in a world without smartphones. The countless functionalities of modern mobile devices – surfing the…
Cactus Ransomware: What You Need To Know
What is the Cactus ransomware? Cactus is a ransomware-as-a-service (RaaS) group that encrypts victim’s data and demands a ransom for a decryption key. Hundreds of organisations have found themselves the victim of Cactus since it was first discovered in March…
Tripwire Patch Priority Index for February 2025
Tripwire’s February 2025 Patch Priority Index (PPI) brings together important vulnerabilities for Microsoft. Up first on the list are patches for Microsoft Edge (Chromium-based) that resolve 4 remote code execution and 2 spoofing vulnerabilities. Next on the list are patches…
ICS Environments and Patch Management: What to Do If You Can’t Patch
The evolution of the cyber threat landscape highlights the need for organizations to strengthen their ability to identify, analyze, and evaluate cyber risks before they evolve into security incidents. Criminals often exploit known unpatched vulnerabilities to penetrate Industrial Control Systems…
Understanding the Abu Dhabi Healthcare Information and Cyber Security Standard
Abu Dhabi is boosting its healthcare system with the introduction of the Abu Dhabi Healthcare Information and Cyber Security Standard (ADHICS). This initiative, driven by the Department of Health—Abu Dhabi (DoH)—has been put in place to protect sensitive healthcare data,…
What is SaaS Security Posture Management (SSPM)?
Over 80% of businesses use at least one Software-as-a-Service (SaaS) application in their operations, per a report by SaaS Academy. It’s easy to see why SaaS applications are the fulcrum of many businesses today. From collaboration tools to CRMs, SaaS…
Enhancing Security Monitoring with Tripwire’s Change Audit: New Rules for Firewalls, WFP, and Microsoft Store Applications
What is it? The Tripwire Enterprise Change Audit rules provide customers with the ability to monitor for change events that could have an impact on a system. Monitoring for change events can help administrators identify malicious and/or unexpected changes within…
Agentic AI: Redefining the Future of Autonomy in Business
The evolution of artificial intelligence (AI) agents signals a profound transformation in how businesses operate. Unlike traditional AI models that process and respond to queries, Google defines that “Agents are autonomous and can act independently of human intervention.” At the…
Are Your VM Scans Testing the Entirety of the Network?
Many organizations have a vulnerability management (VM) problem without knowing it. Vulnerability management is a crucial component of any organization’s cybersecurity program and is required by most major compliance standards because of its sink-or-swim impact on network security. One of…
Beware of Fake Cybersecurity Audits: Cybercriminals Use Scams to Breach Corporate Systems
Companies are being warned that malicious hackers are using a novel technique to break into businesses – by pretending to offer audits of the company’s cybersecurity. With ransomware and other cybersecurity threats high in the mind of many business owners,…
CIS Controls Version 8.1: What you need to know
The latest version of the CIS Controls was released in June 2024. The new version, 8.1, introduces some minor updates via design principles. Context New asset classes are updated to better match the specific parts of an enterprise’s infrastructure that…
How to Achieve Compliance with NIS Directive
The original NIS Directive came into force in 2016 as the EU’s first comprehensive law governing cybersecurity in member states. As part of its key policy objective to make Europe “fit for the digital age,” the European Commission proposed in…