Return of the RCE: Addressing the regreSSHion Vulnerability – CVE-2024-6378
Blog Published: 08/20/2024
Originally published by Pentera. A Regrettable Resurgence On July 1, 2024, the Qualys Threat Research Unit (TRU) published their discovery of an unauthenticated remote code execution (RCE) vulnerability in OpenSSH, a tool for secure remote connectivity using the Secure Shell (SSH) protocol. Th...
Top Threat #1 - Misconfig Misadventures: Taming the Change Control Chaos
Blog Published: 08/20/2024
Written by CSA’s Top Threats Working Group.In this blog series, we cover the key security challenges from CSA's Top Threats to Cloud Computing 2024. Drawing from insights of over 500 experts, we'll discuss the 11 top cybersecurity threats, their business impact, and how to tackle them. Whether...
Driving AI Value in Security and Governance
Blog Published: 08/21/2024
Originally published by CXO REvolutionaries.Written by Rob Sloan, VP, Cybersecurity Advocacy, Zscaler.At Zscaler’s latest Women in Technology and Security CXO event at the RSA Conference in San Francisco, EVP of Customer Experience and Transformation, Kavitha Mariappan, hosted tech leaders to ...
Building vs. Buying an ASPM Solution (And What We Can Learn from Raising Tamagotchis)
Blog Published: 08/21/2024
Originally published by Dazz.Let’s travel back in time to the mid ‘90’s, shall we?Tamagotchis—those adorable, electronic virtual pets—were introduced to the market in 1996 and absolutely exploded. In less than a year, Bandai had sold more than 10 million little e-critters, and to date, over 91...
Colorado Artificial Intelligence Act Passes with Affirmative Defense Provision
Blog Published: 08/22/2024
Originally published by Truyo.In a groundbreaking move, Colorado is poised to become the pioneer state in regulating the use of high-risk artificial intelligence (AI) systems. The Colorado Artificial Intelligence Act (SB 205), recently passed by the state legislature, represents a significant ...
The New York Times GitHub Breach: What You Need to Know
Blog Published: 08/23/2024
Origially published by Suridata.Recently, the security landscape has been shaken by several high-profile breaches, and the latest incident involving GitHub tokens has once again highlighted the critical importance of Machine-to-Machine security practices. This blog dives deep into the details ...
Understanding the Differences Between Fully Homomorphic Encryption and Confidential Computing
Blog Published: 08/22/2024
Written by Ryan Gifford, Jez Goldstone, and Joseph Wilson.In the realm of data security and privacy, Fully Homomorphic Encryption (FHE) and Confidential Computing are two cutting-edge technologies that have garnered significant attention. While both aim to protect sensitive information, they d...
What is Offensive Security and Why is it So Challenging?
Blog Published: 08/23/2024
In cybersecurity, offensive security involves proactively simulating a cyber attacker’s behavior to identify system vulnerabilities. By understanding these potential vulnerabilities, organizations can then implement and enhance security controls to reduce the risk of exploitation by actual mal...
Identity and Access Management in Cloud Security
Blog Published: 08/28/2024
Written by Ashwin Chaudhary, CEO, Accedere.Identity and access management (IAM) ensures that only authorized identities have the right access to the right resources. With cloud platforms consolidating numerous administrative functions of data centers and services into unified Internet-accessib...
Safeguarding AWS AI Services: Protecting Sensitive Permissions
Blog Published: 08/29/2024
Originally published by Sonrai Security.Written by Tally Shea.As AI continues to grow in importance, ensuring the security of AI services is crucial. Our team at Sonrai attended the AWS Los Angeles Summit on May 22nd, where we noted how big of a role AI is going to play in 2024. In fact, accor...
Zero Trust and SASE: A Synergistic Approach to Security
Blog Published: 08/29/2024
Written by Himanshu Sharma, Principal Software Engineer, Netskope Inc.Traditional network security models are increasingly inadequate in today’s rapidly evolving IT landscape. The shift towards remote work, cloud services, and edge computing requires a more modern approach to security. Secure ...
Securing SaaS Data: Strategies for 2024
Blog Published: 08/30/2024
Originally published by Own Company.Written by Mike Melone, Sr. Content Marketing Manager, Own Company.As organizations increasingly operate in the cloud, securing cloud data has become more top of mind. Securing software as a service (SaaS) data is particularly pressing when you consider that...
Research Report: Internet-Connected Industrial Control Systems (Part One)
Blog Published: 08/26/2024
Originally published by Censys.IntroductionIn November 2023, the CyberAv3ngers, an Iranian Revolutionary Guard Corps-affiliated hacking group, compromised the Municipal Water Authority of Aliquippa, Pennsylvania. They targeted a water pressure monitoring system at a remote pumping station, exp...
Preparing for the End: PCI 4.0 Retirement in December 2024
Blog Published: 08/27/2024
Originally published by CyberGuard Compliance.Get ready for the upcoming retirement of PCI 4.0 on 31 December 2024. After this point, PCI DSS v4.0.1 will be the only active version of the standard supported by PCI SSCPreparing Your Business for the ChangeAs the retirement of PCI 4.0 approaches...
Securing the Future of HPC: Implementing Zero Trust and Strengthening Network Security
Blog Published: 08/23/2024
Written by CSA's High Performance Computing Working Group. High-Performance Computing (HPC) systems are pivotal in driving scientific research and innovation, offering computational power that exceeds conventional computing architectures. However, the complexity and scale of these systems int...
Cloud Security Alliance Incorporates Strategy Domain into Scope of Certificate of Competence in Zero Trust (CCZT) Exam
Press Release Published: 08/27/2024
Addition ensures security professionals are best prepared to implement and manage their Zero Trust environmentsSEATTLE – Aug. 27, 2024 – To better equip professionals with the essential knowledge they need to understand and implement Zero Trust principles, the Cloud Security Alliance (CSA), t...
What are Machine Credentials, And Why Are They Important to Secure in Your Organization?
Blog Published: 08/27/2024
Originally published by Astrix.WHAT are Machine Credentials?Machine Credentials are a collective noun for Non-human Identities that operate as digital access keys used by systems. They are used to authenticate and communicate securely with other applications or services in the organization’s e...
Building a Fortress of ‘Never Trust, Always Verify’: The Power of Zero Trust Architecture
Blog Published: 08/28/2024
Originally published by CXO REvolutionaries.Written by Ben Corll, CISO in Residence, Zscaler.There’s no succinct instruction manual for zero trust architecture, but here’s the next best thing Recent headlines about critical vulnerabilities plaguing VPNs and other legacy infrastructure are a s...
14 Essential Steps to a Secure Salesforce Environment
Blog Published: 08/29/2024
Originally published by Suridata.IntroductionSalesforce.com has been so successful that we tend to forget what a breakthrough it was when it debuted 25 years ago. At the time, people were skeptical that you could get enterprise-grade functionality on a browser. They were mistaken. The software...
What is the NIS 2 Directive? A European Approach to Cybersecurity
Blog Published: 08/30/2024
Originally published by Schellman.As technology continues to evolve and embed itself more into society, regulations to govern its use and protect consumers are struggling to keep up in parts of the world. But not so in the European Union (EU), where they’ve recently made progress on a wave of ...
