Hunting Shadow Data: A Guide for Security and Compliance Teams
Blog Published: 01/10/2023
Originally written by Sentra. What is Shadow Data?Shadow data is any organizational data that has been copied, backed up or is otherwise stored such that it is not subject to your organization’s centralized (and secured) data management framework. For example, shadow data may not be housed acc...
Key Takeaways from Forrester’s Embrace A Paradigm Shift In SaaS Protection: SaaS Security Posture Management Report
Blog Published: 01/10/2023
Originally published by Adaptive Shield. Written by Zehava Musahanov, Adaptive Shield. Forrester, a research and advisory company, offers organization’s a variety of services including research and consulting. Their reports help professionals understand their customer’s behavior, concerns, and...
The Convergence of IT and OT
Blog Published: 01/10/2023
Originally published by Microsoft on December 14, 2022. The pervasiveness, vulnerability, and cloud connectivity of Internet-of-Things (IoT) and Operational Technology (OT) devices represent a rapidly expanding, often unchecked risk surface affecting a wider array of industries and organizatio...
6 Tips for Understanding 3rd-Party Risk in the Cloud
Blog Published: 01/11/2023
Originally published by Ermetic. If you’re like most modern organizations, you rely on third parties to help you run and grow your business. Yet the vendors, partners and suppliers that make up your supply chain are also a significant component of your cloud environment attack surface.While yo...
Zero Trust, as Explained by a Pirate (With Help from ChatGPT)
Blog Published: 01/12/2023
Originally published by CXO REvolutionaries. Written by Greg Simpson, Former Chief Technology Officer, Synchrony. OpenAI's ChatGPT is turning lots of heads on the internet. It grew to a million users in five days, and people are already putting it to all sorts of uses, from writing gear review...
Pipeline Sprawl in DevOps: It’s a Thing
Blog Published: 01/13/2023
Originally published by Dazz. Written by Tomer Schwartz, Co-founder & CTO, Dazz. CI/CD pipeline sprawl is happening faster than you can rein it inCompanies are developing software in the cloud in a big way. Under the umbrella of digital transformation, and driven by customer expectations a...
Revising Your Backup Strategy in 2023
Blog Published: 01/13/2023
By Alex Vakulov Data protection is an important task for any organization. Backups can protect not only from the loss of information but also from the suspension of the company's activities. What are the specifics of good backup strategies? What backup algorithms should you follow?For every co...
The Service Account Security Problem
Blog Published: 01/17/2023
Originally published by TrueFort. Written by Matt Hathaway, TrueFort. For a modern-day cyber attacker, initial access to an application is more than half the battle. With it, they are free to pursue their objectives, which likely include moving about freely to find data to sell or hold for ran...
SANS 2022 Cloud Security Survey, Chapter 3: How Do Enterprises Keep Their Cloud Infrastructure Secure?
Blog Published: 01/18/2023
Originally published by Gigamon.Editor’s note: This post explores Chapter 3 of the SANS 2022 Cloud Security Survey. Read Chapter 1 and Chapter 2. And check back or future posts covering Chapter 4.There’s been a cloud land rush over the past few years as more and more organizations move compute...
Who Stole My Cookies? XSS Vulnerability in Microsoft Azure Functions
Blog Published: 01/11/2023
Originally published by Pentera. Written by Uriel Gabay, Pentera. Purpose Learn how Pentera’s research team discovered a web XSS vulnerability in Azure Functions and determined its exploitability. The vulnerability was reported and fixed by Microsoft. Executive summary Cloud-based services ...
Identity and Access Management: Automation, Risks, and Best Practices
Blog Published: 01/11/2023
Originally published by TokenEx. Written by Anni Burchfiel, TokenEx. Identity and access management (IAM) uses a combination of tools and procedures to limit access to internal systems and sensitive data. Rigourous protection of account access is one of the best ways to prevent account takeove...
DuckLogs – New Malware Strain Spotted In The Wild
Blog Published: 01/19/2023
Originally published by Cyble.Malware-As-A-Service Provides Sophisticated Features To Threat Actors Cyble Research and Intelligence Labs (CRIL) has been continuously monitoring malware families that are new and active in the wild. Recently, CRIL observed a new malware strain named DuckLogs, wh...
Proxying Your Way to SaaS Security? There’s a Better Approach!
Blog Published: 01/19/2023
Originally published by DoControl. Written by John Newsome, DoControl. Over the course of my 20 plus years in cybersecurity, I’ve had the opportunity to work for some outstanding companies and thought leaders in the industry. One of the most controversial and debated topics throughout this tim...
Social Engineering Tactics are Changing. Awareness Training Must Too.
Blog Published: 01/19/2023
Originally published by CXO REvolutionaries. Written by Ben Corll, CISO - Americas, Zscaler. After hardening my corporate environment and improving our device management as CISO with previous organizations, I noticed that the would-be fraudsters quickly evolved their attack methods in response...
Who Has Control: The SaaS App Admin Paradox
Blog Published: 01/23/2023
Originally published by Adaptive Shield. Written by Eliana Vuijsje, Adaptive Shield. Imagine this: a company-wide lockout to the company CRM, like Salesforce, because the organization's external admin attempts to disable MFA for themselves. They don't think to consult with the security team an...
What is an Access Control Server in 3DS?
Blog Published: 01/24/2023
Originally published by TokenEx. Written by Anni Burchfiel, TokenEx. Quick Hits 3DS is a form of multifactor authentication used to reduce card-not-present fraud by verifying cardholder identities. The 3DS Access Control Server is a tool used by issuing banks to confirm the identity of the ca...
If You Could Only Ask One Question About Your Data, It Should be This
Blog Published: 01/25/2023
Originally published by Sentra. Written by Guy Spilberg, VP R&D, Sentra. When security and compliance teams talk about data classification, they speak in the language of regulations and standards. Personal Identifiable Information needs to be protected one way. Health data another way. Emp...
Herding Cats: How to Lead a Digital Transformation in a Federated Organization
Blog Published: 01/26/2023
Originally published by CXO REvolutionaries. Written by Yves Le Gelard, Former Group CIO and Chief Digital Officer, ENGIE. A tale of two types of organization Organizations embarking on digital transformations typically fall somewhere on a spectrum between rigidly hierarchical – in which leade...
Ensuring SaaS Security in ISO Compliance
Blog Published: 02/07/2023
Originally published by Adaptive Shield. The International Organization for Standardization (ISO) sets standards across various industries. As an internationally recognized standards organization, its two information technology security standards - ISO 27000:2018 and ISO 27001:2013 - can be us...
Security Tips to Keep in Mind for 2023
Blog Published: 01/12/2023
Written by Rebecca Harrisson, Content Specialist, Ardoq. Fast-growing scale-ups constantly work to scale their security to match their growth. Ardoq has experienced the proverbial growing pains associated with our own fast growth. As 2023 starts, we’d like to share some tips for better secur...
