Known vulnerabilities – those for which patches have already been made available – are the primary vehicle for cyberattacks, according to Tenable. The Tenable report categorizes important vulnerability data and analyzes attacker behavior to help organizations inform their security programs…
Tag: Help Net Security
The role of human insight in AI-based cybersecurity
To unleash the power of AI, it’s essential to integrate some human input. The technical term is Reinforcement Learning from Human Feedback (RLHF): a machine-learning technique that uses human feedback to train and improve the accuracy of an AI model.…
New infosec products of the week: March 3, 2023
Here’s a look at the most interesting products from the past week, featuring releases from Appdome, Fastly, Forescout, ManageEngine, and Veeam Software. Forescout XDR enables SOC teams to reduce the attack surface Forescout XDR is an eXtended detection and response…
ManageEngine adds security and risk posture management dashboard to Log360
ManageEngine has added a security and risk posture management dashboard to Log360, its unified security information and event management (SIEM) solution with integrated DLP and CASB capabilities. Enterprises can leverage this new feature to implement proactive security strategies and prevent…
WatchGuard ThreatSync equips organizations with XDR capabilities
WatchGuard launched ThreatSync, a comprehensive XDR solution included as part of WatchGuard’s Unified Security Platform architecture that provides XDR technology for WatchGuard Network and Endpoint Security products. WatchGuard ThreatSync equips organizations with XDR capabilities to centralise cross-product detections and orchestrate…
Fastly Managed Security Service protects enterprises from web application attacks
Fastly introduced Fastly Managed Security Service, a service for threat detection and response available around the clock, aimed at assisting businesses in mitigating the risk of web application attacks and minimizing the costs incurred due to lost transactions. Available to…
Forescout XDR enables SOC teams to reduce the attack surface
Forescout revealed Forescout XDR, a solution designed to aid enterprises in detecting, investigating, and responding to an extensive range of sophisticated threats throughout their extended enterprise. A typical SOC is flooded with 450 alerts per hour, and analysts waste precious…
ML practitioners push for mandatory AI Bill of Rights
The AI Bill of Rights, bias, and operational challenges amid tightening budgets are pressing issues affecting the adoption of ML as well as project and initiative success, according to Comet. “Our latest survey comes as ML practitioners are facing a…
Attackers increasingly using transfer.sh to host malicious code
For many years now, unsecured internet-facing Redis servers have been steadily getting co-opted by criminals to mine cryptocurrency, so the latest cryptojacking campaign spotted by Cado Labs researcher cannot be considered news. But one its elements points to a new…
US government puts cybersecurity at forefront with newly announced National Strategy
The National Cybersecurity Strategy was unveiled today by the Biden-Harris Administration. The Strategy recognizes that government must use all tools of national power in a coordinated manner to protect national security, public safety, and economic prosperity. The United States will…
BlackLotus UEFI bootkit disables Windows security mechanisms
ESET researchers have published the first analysis of a UEFI bootkit capable of circumventing UEFI Secure Boot, a critical platform security feature. The functionality of the bootkit and its features make researchers believe that it is a threat known as…
Appdome ThreatScope Mobile XDR provides threat intelligence for mobile apps
Appdome has released its next generation ThreatScope product, delivering Extended Detection and Response (XDR) for consumer mobile apps and brands globally. Mobile brands gain the power and agility of XDR to address any cyber, fraud and other attacks in the…
Cyber resilience in focus: EU act to set strict standards
With the EU Cyber Resilience Act (CRA), the industry is dealing with one of the strictest regulatory requirements. Manufacturers, importers and even distributors of products with digital elements – in other words, anything with a microchip – will be required…
Don’t be fooled by a pretty icon, malicious apps hide in plain sight
Apps, whether for communication, productivity or gaming, are one of the biggest threats to mobile security, according to McAfee. The end of 2022 saw the release of some game-changing applications such as OpenAI’s ChatGPT chatbot and DALL-E 2 image generator.…
Moving target defense must keep cyber attackers guessing
A cybersecurity technique that shuffles network addresses like a blackjack dealer shuffles playing cards could effectively befuddle hackers gambling for control of a military jet, commercial airliner, or spacecraft, according to Sandia National Laboratories and Purdue University researchers. However, the…
Uncovering the most pressing cybersecurity concerns for SMBs
In this Help Net Security video interview, James Edgar, CISO at Fleetcor, discusses what consequences SMBs are most concerned about when it comes to cyberattacks, what technology SMBs are most interested in, and much more. The post Uncovering the most…
ThreatNG Cloud and SaaS Exposure Module empowers users with a proactive outside-in perspective
ThreatNG announced its agentless Cloud and SaaS Exposure Module as a part of its External Attack Surface Management (EASM) and Digital Risk solution. The ThreatNG “Cloud and SaaS Exposure” Module supports the following vendors and technology categories: Amazon Web Services…
ReasonLabs FamilyKeeper enables parents to monitor social media conversations
ReasonLabs FamilyKeeper parental control app helps make parenting easier in the digital world by equipping parents with the tools they need to protect their kids online. Data shows that kids face numerous significant risks online. For example: 51% of teenagers…
Radiant Logic’s redesigned platform helps organizations improve their overall security posture
Radiant Logic announced redesigned Identity Data Platform, offering an identity-first approach to security and business decisions. To drive confident policies, enterprises need real-time access to a tremendous amount of data, synchronized across hybrid and complex environments. It must be accurate,…
Pliant Observability Solution accelerates device and data onboarding
Pliant launched Observability Automation solution developed specifically for leading performance monitoring vendors and their customers. The Pliant Observability Solution elevates performance monitoring for operations teams at large enterprises, carriers, and managed service provider organizations. This new offering revolutionizes how teams…
Appdome ThreatScope Mobile XDR tracks Android and iOS attacks in real time
Appdome has released its next generation ThreatScope product, delivering Extended Detection and Response (XDR) for consumer mobile apps and brands globally. Mobile brands gain the power and agility of XDR to address any cyber, fraud and other attacks in the…
HCLSoftware and SolarWinds join forces to build AI-based telecom observability platform
HCLSoftware and SolarWinds are expanding their partnership to build an end-to-end 5G network observability platform from Cloud to RAN (Radio Access Network). This joint AI-based solution combines HCLSoftware’s Augmented Network Automation (HCL ANA) platform, HCL DRYiCE iObserve powered by SolarWinds,…
Axis Communications and Genetec introduce an enterprise-level access control solution
With access control as a cornerstone of physical security, and today’s businesses requiring more advanced tools, Axis Communications and Genetec have partnered to introduce an enterprise-level access control solution. Axis Powered by Genetec combines Axis network door controllers and Genetec…
Otorio partners with Compugen to enhance security for OT operations
Otorio and Compugen have formed a business partnership to protect customers against industrial cyber threats to OT environments. Through the alliance, Otoeio’s comprehensive OT solution and Compugen’s professional services will empower global industrial customers with a powerful way to combat…
InQuest appoints Darren Spruell as Chief Intelligence Officer
InQuest appointed Darren Spruell, a seasoned information security professional, as its Chief Intelligence Officer. Darren brings an array of technical skills bolstered by intense curiosity and a passion for continual mastery. Darren’s career includes specialties in several areas of cybersecurity,…
Visualize change with an out-of-the-box configuration report
Your technology is always changing, and you often end up playing catchup to secure it. This is difficult in the cloud when you share security responsibility with the cloud service providers (CSP). You need to know what’s changing so that…
Google Cloud Platform allows data exfiltration without a (forensic) trace
Attackers can exfiltrate company data stored in Google Cloud Platform (GCP) storage buckets without leaving obvious forensic traces of the malicious activity in GCP’s storage access logs, Mitiga researchers have discovered. GCP data exfiltration attack (Source: Mitiga) Covert data exfiltration…
DNS abuse: Advice for incident responders
What DNS abuse techniques are employed by cyber adversaries and which organizations can help incident responders and security teams detect, mitigate and prevent them? The DNS Abuse Techniques Matrix published by FIRST provides answers. The Domain Name System (DNS) is…
5 open source Burp Suite penetration testing extensions you should check out
When it comes to assessing the security of computer systems, penetration testing tools are critical for identifying vulnerabilities that attackers may exploit. Among these tools, Burp Suite stands out as one of the most popular and widely used options among…
Developers can make a great extension of your security team
Developers care about the quality and security of their code, and when empowered to help, developers make great security advocates who can help harden your supply chain security while reducing the burden on DevOps and security teams. Introducing security tools…
Dormant accounts are a low-hanging fruit for attackers
Successful attacks on systems no longer require zero-day exploits, as attackers now focus on compromising identities through methods such as bypassing MFA, hijacking sessions, or brute-forcing passwords, according to Oort. “The vast majority of successful breaches in the past year…
Covert cyberattacks on the rise as attackers shift tactics for maximum impact
2022 was the second-highest year on record for global ransomware attempts, as well as an 87% increase in IoT malware and a record number of cryptojacking attacks (139.3 million), according to SonicWall. “The past year reinforced the need for cybersecurity…
A modern-day look at AppSec testing tools
In this Help Net Security video, Frank Catucci, CTO, and Dan Murphy, Distinguished Architect at Invicti Security, break down the different types of application security testing tools, explore the strengths and tradeoffs, and provide you with the information you need…
AlertEnterprise reveals Guardian AI Chatbot powered by OpenAI ChatGPT
AlertEnterprise revealed the launch of its Guardian AI Chatbot powered by OpenAI ChatGPT. The Guardian AI Chatbot is developed with the world-renowned GPT-3 platform created by OpenAI and is designed to instantly deliver security operators the physical access and security…
CIS Hardened Images List
Your technology is always changing, and you often play catchup to secure it. This isn’t easy in the cloud when you share security responsibility with the cloud service providers (CSP). You need to know what’s changing so that you can…
Infosec products of the month: February 2023
Here’s a look at the most interesting products from the past month, featuring releases from: Arkose Labs, Cequence Security, CyberGRX, CyberSaint, Deepwatch, DigiCert, Finite State, FireMon, Hornetsecurity, HYCU, KELA, Lacework, Malwarebytes, Netography, Neustar Security Services, Nudge Security, OPSWAT, SecuriThings, Trulioo,…
VMware extends SD-WAN to OT with new software client offering
VMware has delivered new and enhanced remote worker/device connectivity and intelligent wireless capabilities to its SD-WAN and SASE customers. Relatedly, VMware announced an expanded collaboration with Intel to deliver new edge appliances featuring 5G connectivity allowing support for additional SD-WAN…
Veeam Backup for Microsoft 365 v7 strengthens data protection
Veeam Software has released new Veeam Backup for Microsoft 365 v7, backup and recovery solution for Microsoft 365 including Microsoft Exchange Online, SharePoint Online, OneDrive for Business and Microsoft Teams. The latest version of Veeam Backup for Microsoft 365 strengthens…
Thales and Qualcomm join forces to launch GSMA certified iSIM
Thales and Qualcomm Technologies have announced the certification of the commercially deployable iSIM (Integrated SIM) on the Snapdragon 8 Gen 2 Mobile Platform, enabling the functionality of a SIM within a smartphone’s main processor. Such GSMA’s security certification2 confirms the…
Cyolo unveils partner program to accelerate adoption of zero-trust access
Cyolo introduced partner program designed to help organizations enhance their cybersecurity capabilities for protecting sensitive systems and applications. The newly redesigned program will provide partners with a high profit margin through a simplified reseller structure and richer tools, including access…
LastPass breach: Hacker accessed corporate vault by compromising senior developer’s home PC
LastPass is, once again, telling customers about a security incident related to the August 2022 breach of its development environment and subsequent unauthorized access to the company’s third-party cloud storage service that hosted backups: “The threat actor leveraged information stolen…
The power of community participation with Faye Francy, Executive Director, Auto-ISAC
The old phrase “sharing is caring” is something that Faye Francy has seen revolutionize entire industries. From her years as a Boeing Commercial Airplanes Cybersecurity ONE team leader, to Aviation-ISAC, and ultimately becoming the Executive Director of Automotive-ISAC, Faye has…
Security teams have no control over risky SaaS-to-SaaS connections
Employees are providing hundreds to thousands of third-party apps with access to the two most dominant workspaces, Microsoft 365 and Google Workspace, according to Adaptive Shield. With no oversight or control from security teams, companies have no way to quantify…
Expert strategies for defending against multilingual email-based attacks
BEC (Business Email Compromise) attacks have become increasingly prevalent in recent years, with cybercriminals using a variety of tactics to gain access to sensitive information and steal money from businesses. While many people may assume that these attacks are primarily…
It only takes one over-privileged identity to do major damage to a cloud
While moving to the cloud increases efficiency and business agility, security strategies haven’t been adapted to account for this shift and traditional tools can’t effectively manage the unique associated risks. CISOs that ignore the risks are left completely exposed and…
10 US states that suffered the most devastating data breaches in 2022
Cyber attack risks faced by businesses across states and reported data breaches are relative to the respective state governments’ cybersecurity investment, according to Network Assured. Study methodology Network Assured compared data from State Attorneys Generals and the Department of Health…
Vouched raises $6.3 million to enhance its platform
Vouched announced $6.3 million financing led by BHG VC and SpringRock Ventures, as well as prior investors Darrell Cavens and Mark Vadon. Vouched’s expansion plans build upon the company’s rapid growth over the past year. The company now serves more…
Red Hat and Samsung partner on new 5G RAN solution
Red Hat extend partnership with Samsung to introduce a virtualized radio access network (vRAN) solution that offers advanced integration and automation features. The technology will be designed to help service providers better manage networks at scale while also addressing the…
LiveRamp enhances identity resolution services on Snowflake
LiveRamp has expanded its partnership with Snowflake to upgrade its product capabilities built natively on Snowflake and increase data connectivity for next-generation, post-cookie marketing in the cloud. By building LiveRamp’s data activation solutions using Snowflake’s Native Application Framework, currently in…
Microsoft Exchange admins advised to expand antivirus scanning
After having stressed the importance of keeping Exchange servers updated last month, Microsoft is advising administrators to widen the scope of antivirus scanning on those servers. Microsoft Exchange servers in attackers’ crosshairs Cyber attackers love to target Microsoft Exchange servers,…
QNAP starts bug bounty program with rewards up to $20,000
QNAP Systems, the Taiwanese manufacturer of popular NAS and other on-premise storage, smart networking and video devices, has launched a bug bounty program with rewards of up to US $20,000. QNAP’s NAS devices, in particular, have been getting hit in…
FTC reveals alarming increase in scam activity, costing consumers billions
Newly released Federal Trade Commission (FTC) data shows that consumers reported losing nearly $8.8 billion to fraud in 2022, an increase of more than 30 percent over the previous year. Losing money to investment and imposter scams Consumers reported losing…
Resecurity identified the investment scam network Digital Smoke
Resecurity identified one of the largest investment fraud networks by size and volume of operations created to defraud Internet users from Australia, Canada, China, Colombia, European Union, India, Singapore, Malaysia, United Arab Emirates, Saudi Arabia, Mexico, the U.S. and other…
Wiper malware goes global, destructive attacks surge
The threat landscape and organizations’ attack surface are constantly transforming, and cybercriminals’ ability to design and adapt their techniques to suit this evolving environment continues to pose significant risk to businesses of all sizes, regardless of industry or geography. Destructive…
Stay one step ahead: Cybersecurity best practices to prevent breaches
In this Help Net Security video, Caroline Wong, Chief Strategy Officer at Cobalt, offers valuable insight into what leaders can do to instill stronger cybersecurity practices from the bottom up and prevent breaches. The post Stay one step ahead: Cybersecurity…
Foiling intellectual property theft in a digital-first world
In today’s data-driven world, the expectations and demands faced by many organizations worldwide are reaching unseen levels. To meet the challenge, a data-driven approach is necessary, with effective digital transformation needed to improve operational efficiency, streamline processes, and get more…
Third-party risks overwhelm traditional ERM setups
Enterprise risk management (ERM) teams are struggling to effectively mitigate third-party risk in an increasingly interconnected business environment, according to Gartner. ERM struggles to elevate the right issues In a Gartner survey of 100 executive risk committee members in September…
Contrast Security adds Microsoft Azure Functions support to evaluate serverless risks
Contrast Security expands Contrast Serverless Application Security offering to support Microsoft Azure Functions and enable customers to scan for security vulnerabilities on multi-cloud environments. Organizations are rapidly adopting serverless and cloud-native development due to their inherent benefits. However, companies struggle…
Week in review: ChatGPT and cybersecurity, hidden vulnerabilities in Docker containers
Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: Google Protected Computing: Ensuring privacy and safety of data regardless of location In this Help Net Security interview, Royal Hansen, VP of Engineering for Privacy,…
Microsoft announces automatic BEC, ransomware attack disruption capabilities
Last year, Microsoft announced automatic attack disruption capabilities in Microsoft 365 Defender, its enterprise defense suite. On Wednesday, it announced that these capabilities will now help organizations disrupt two common attack scenarios: BEC (business email compromise) and human-operated ransomware attacks.…
Edgio enhances its security platform with DDoS scrubbing and WAAP capabilities
Edgio has enhanced its Security platform enabling enterprises to better detect and respond to emerging threats while ensuring confidentiality, integrity and availability of their data and applications. These new capabilities are aimed at reducing the damage caused by the increase…
Defenders on high alert as backdoor attacks become more common
Although ransomware‘s share of incidents declined only slightly from 2021 to 2022, defenders were more successful detecting and preventing ransomware, according to IBM. Despite this, attackers continued to innovate with the report showing the average time to complete a ransomware…
What to expect at BSidesNYC 2023
In this Help Net Security video interview, Huxley Barbee, lead organizer of BSidesNYC 2023, talks about the upcoming event. BSidesNYC 2023 will take place at the John Jay College of Criminal Justice on April 22, 2023. The post What to…
Malicious actors push the limits of attack vectors
The war in Ukraine has seen the emergence of new forms of cyberattacks, and hacktivists became savvier and more emboldened to deface sites, leak information and execute DDoS attacks, according to Trellix. “Q4 saw malicious actors push the limits of…
New infosec products of the week: February 24, 2023
Here’s a look at the most interesting products from the past week, featuring releases from CyberGRX, Lacework, Malwarebytes, Netography, Nudge Security, and Xcitium. Malwarebytes Application Block restricts access to outdated and unsafe apps Malwarebytes has added Malwarebytes Application Block to…
Employees bypass cybersecurity guidance to achieve business objectives
By 2025, nearly half of cybersecurity leaders will change jobs, 25% for different roles entirely due to multiple work-related stressors, according to Gartner. “Cybersecurity professionals are facing unsustainable levels of stress,” said Deepti Gopal, Director Analyst, Gartner. “CISOs are on…
Darktrace Newsroom monitors open-source intelligence sources
Darktrace has launched Darktrace Newsroom, an AI-driven system that continuously monitors open-source intelligence sources for new critical vulnerabilities and assesses each organization’s exposure through its in-depth knowledge of their unique external attack surface. Darktrace’s knowledge of “self” means it can…
Edgio enhances its Security platform with DDoS scrubbing and WAAP capabilities
Edgio has enhanced its Security platform enabling enterprises to better detect and respond to emerging threats while ensuring confidentiality, integrity and availability of their data and applications. These new capabilities are aimed at reducing the damage caused by the increase…
Netography Fusion enhancements provide real-time visibility of all social media traffic
Following recent U.S. state government and other organization bans on TikTok and other social media platforms, Netography announced enhancements to Netography Fusion’s operational governance dashboards, providing analysts with real-time comprehensive views of all social media traffic. These capabilities enable customers…
Atos 5Guard strengthens 5G security posture for organizations
Atos has launched its new ‘5Guard’ security offering for organizations looking to deploy private 5G networks and for telecom operators looking to enable integrated, automated, and orchestrated security to protect and defend their assets and customers. A new end-to-end 5G…
Deloitte and Cyberbit partner to improve cyber readiness across industries
Deloitte EMEA-LATAM Cybersphere Center (ECC) and Cyberbit have announced a strategic partnership that will drive cyber readiness across industries by focusing on the human element of cybersecurity. Cyberbit delivers a holistic approach to developing cyber readiness that emphasizes the human…
Metomic raises $20 millions to help security teams control sensitive data
Metomic has raised a $20 million Series A funding round. The round is led by Evolution Equity Partners with participation from Resonance and Connect Ventures. The investment will be used for U.S. expansion efforts and research and development initiatives. It…
Privacera integrates with Databricks Unity Catalog
Privacera and Databricks users can now facilitate data discovery and consistent data access across the Databricks Lakehouse Platform, including seamless migration of existing Privacera policies. With this latest integration, Privacera increases the ability for its users to provide a holistic…
Users looking for ChatGPT apps get malware instead
The massive popularity of OpenAI’s chatbot ChatGPT has not gone unnoticed by cyber criminals: they are exploiting the public’s eagerness to experiment with it to trick users into downloading Windows and Android malware and visit phishing pages. Fake ChatGPT apps…
Cybersecurity layoffs in 2023: What to expect?
The economic downturn predicted for 2023 will lead to layoffs but cybersecurity workers will be least affected, says the latest (ISC)² report. Also, as soon as things get better, they will likely be the first ones to get (re)hired. Execs…
Researchers find hidden vulnerabilities in hundreds of Docker containers
Rezilion uncovered the presence of hundreds of Docker container images containing vulnerabilities that are not detected by most standard vulnerability scanners and SCA tools. The research revealed numerous high-severity/critical vulnerabilities hidden in hundreds of popular container images, downloaded billions of…
Nudge Security launches SaaS attack surface management capabilities
Organizations face an average of six breaches in their SaaS supply chain every year, according to new data published by Nudge Security. With threat actors like Lapsus$ exploiting this modern attack surface, securing it has become a top cybersecurity priority…
CyberGRX Portfolio Risk Findings enables customers to identify riskiest vendors
CyberGRX launched a new capability, Portfolio Risk Findings, allowing customers to gain visibility into their organization’s specific control coverages gapped by the riskiest third parties through the lens of any framework or threat profile. With Portfolio Risk Findings, CyberGRX will…
Netwrix Privilege Secure eliminates standing privileged accounts across on-premises databases
Netwrix has released Netwrix Privilege Secure (formerly Netwrix SbPAM), which expands its zero standing privileges (ZSP) approach to databases to ensure privileged accounts exist for only as long as needed. “Netwrix Privilege Secure now eliminates standing privileged accounts across on-premises…
Malwarebytes Application Block restricts access to outdated and unsafe apps
Malwarebytes has added Malwarebytes Application Block to its Nebula and OneView endpoint protection platforms. The new threat prevention module helps resource-strained security teams guard against unsafe third-party Windows applications, meet key compliance requirements and encourage productivity without adding management complexity.…
Lacework releases composite alerts feature to help customers identify and remediate threats
Lacework has released composite alerts on the Lacework Polygraph Data Platform, to help customers detect compromised credentials, cloud ransomware, and cryptomining that would otherwise go unnoticed. By combining human intelligence with the automatic correlation of disparate alerts, Lacework generates a…
Bitdefender Premium Security Plus detects threats across multiple operating systems
Bitdefender has unveiled Bitdefender Premium Security Plus, a new security suite that provides threat prevention and detection, a fully featured password manager to keep credentials safe, secure virtual private network (VPN) for online privacy, and 24/7 digital identity protection monitoring.…
Xcitium ZeroDwell Containment isolates all unknown or suspect code entering an organization
Xcitium has unveiled its endpoint security solution, ZeroDwell Containment, for customers with or without legacy EDR products. Xcitium multi-patented technology closes the gaps in enterprise cybersecurity defenses left by traditional detection methods. According to Tim Bandos, EVP of SOC services…
The potential pitfalls of open source management
84% of codebases contain at least one known open-source vulnerability, a nearly 4% increase from last year, according to Synopsys. The findings of the report deliver an in-depth look at the current state of open source security, compliance, licensing, and…
CISOs struggle with stress and limited resources
94% of CISOs report being stressed at work, with 65% admitting work-related stress issues are compromising their ability to protect their organization, according to Cynet. Among the CISOs surveyed, 100% said they needed additional resources to adequately cope with current…
Insider threats must be top-of-mind for organizations facing layoffs
Amid uncertain economic conditions, the technology sector has been a hot topic of discussion in recent months due to the mass amounts of layoffs across the industry. In this Help Net Security video, Nick Tausek, Lead Security Automation Architect at…
Scott Lundgren and John Spiliotis join NetSPI Board of Directors
NetSPI has appointed Scott Lundgren and John Spiliotis to its Board of Directors. The two veteran security industry executives will support the company’s next stage of growth following a year of record momentum. “We’re honored to have Scott and John…
Sublime Security raises $9.8 million to boost email security
Sublime has launched open email security platform and raised $9.8 million in funding. The platform has been in private beta testing for more than a year and is already in use at dozens of organizations, including Fortune 500s, Global 2000s,…
DarkLight partners with Resecurity to improve enterprise cybersecurity posture
DarkLight and Resecurity partnership will give DarkLight access to Resecurity’s threat intelligence solution called Context, which identifies indications of cyber intrusions and data breaches for clients. This will give DarkLight the ability to provide comprehensive risk assessments tailored to each…
VMware patches critical injection flaw in Carbon Black App Control (CVE-2023-20858)
VMware has fixed a critical vulnerability (CVE-2023-20858) in Carbon Black App Control, its enterprise solution for preventing untrusted software from executing on critical systems and endpoints. Even though the flaw has been privately reported to VMware, and there is no…
Are your IoT devices at risk? Cybersecurity concerns for 2023
In this Help Net Security video, J.R. Cunningham, CSO at Nuspire, discusses IoT cybersecurity concerns for 2023. With homes becoming increasingly connected and reliant on smart technology, the potential for cybercriminals to exploit vulnerabilities and wreak havoc is higher than…
The top security threats to GraphQL APIs and how to address them
Enterprises looking to modernize their APIs are increasingly switching from the REST architecture to the open-source data query and manipulation language GraphQL. While the transition makes sense – GraphQL is more flexible, scalable, and easier for developers to use –…
How a hub and spoke model can future-proof your cloud deployment
Cloud adoption among organizations has increased dramatically over the past few years, both in the range of services used and the extent to which they are employed, according to Info-Tech Research Group. However, network builders tend to overlook the vulnerabilities…
Most vulnerabilities associated with ransomware are old
Researchers identified 56 new vulnerabilities associated with ransomware threats among a total of 344 threats identified in 2022 – marking a 19% increase year-over-year. Threat actors are actively searching the internet and deep and dark web for 180 vulnerabilities known…
CloudCasa and Ondat bring bundled offering for Kubernetes storage and data protection
Catalogic Software has unveiled a new bundled offering of its native back-up-as-a-service platform CloudCasa and Ondat. This combined CloudCasa and Ondat offering provides customers with a unified solution to run their stateful applications on Kubernetes, without worrying about availability, performance,…
Perimeter 81 and TD SYNNEX provide secure network access for the modern workforce
Mitigating persistent cyber threats has made network security mission critical for businesses of all sizes. The 2022 U.S. Cybersecurity Census Report found that the average business experiences 42 cyberattacks each year, amplifying the need for a comprehensive solution. Perimeter 81…
PoC exploit, IoCs for Fortinet FortiNAC RCE released (CVE-2022-39952)
Horizon3’s Attack Team has released a PoC exploit for CVE-2022-39952, a critical vulnerability affecting FortiNAC, Fortinet’s network access control solution. “Similar to the weaponization of previous archive vulnerability issues that allow arbitrary file write, we use this vulnerability to write…
What can we learn from the latest Coinbase cyberattack?
Cryptocurrency exchange Coinbase has fended off a cyberattack that might have been mounted by the same attackers that targeted Twillio, Cloudflare and many other companies last year. Leveraging smishing and vishing, the attackers tried to trick Coinbase employees into sharing…
Google Protected Computing: Ensuring privacy and safety of data regardless of location
In this Help Net Security interview, Royal Hansen, VP of Engineering for Privacy, Safety, and Security at Google, talks about Protected Computing, the impact of data protection regulations, and privacy in general. Data protection regulations are rapidly developing globally. What…
ChatGPT is bringing advancements and challenges for cybersecurity
Understanding why ChatGPT is garnering so much attention takes a bit of background. Up until recently, AI models have been quite “dumb”: they could only respond to specific tasks when trained on a large dataset providing context on what to…