5 Steps to Stop the Latest OpenSSL Vulnerabilities: CVE-2022-3602, CVE-2022-3786
Blog Published: 11/16/2022
Originally published by Sysdig. Written by Michael Clark, Sysdig. The OpenSSL Project team announced two HIGH severity vulnerabilities (CVE-2022-3602, CVE-2022-3786) on Oct. 25, which affect all OpenSSL v3 versions up to 3.0.6. These vulnerabilities are remediated in version 3.0.7, which was rele...
The Anatomy of Wiper Malware, Part 4: Less Common “Helper” Techniques
Blog Published: 11/16/2022
Originally published by CrowdStrike. Written by Ioan Iacob and Iulian Madalin Ionita, CrowdStrike. In Part 3, a leading Endpoint Protection Content Research Team covered the finer points of Input/Output Control (IOCTL) usage by various wipers. The fourth and final part of the wiper series covers...
Mastodon - User Discovery and Verification via Email, the Easy Way
Blog Published: 11/15/2022
This is going to be a short blog entry because it’s simple: Mastodon is fantastic, but discovering and verifying users is a pain (as with most social networks). The best solution most people have landed on is scraping their Twitter account followers/following for profiles with Mastodon IDs like @...
Zscaler Debuts Zero Trust Certified Architect (ZTCA) Program to Address IT and SecOps Skills Gap
Blog Published: 11/15/2022
Originally published by Zscaler. Written by Jay Chaudhry, CEO and Founder, Zscaler. An increase in large-scale cyber attacks has driven widespread interest for organizations to migrate to a Zero Trust architecture. A Zero Trust architecture is a new, clean architectural paradigm - one that is bui...
Data Center Resilience and Risk Assessment
Blog Published: 11/15/2022
Originally published by ShardSecure. Written by Marc Blackmer, VP of Marketing, ShardSecure. What is data resilience? A multifaceted endeavor, data resilience can include data integrity and availability, cluster storage, regular testing, disaster recovery, redundancy, backups, and more. As TA...
Uber Cybersecurity Incident: Which Logs Do IR Teams Need to Focus On?
Blog Published: 11/15/2022
Originally published by Mitiga. Written by Or Aspir, Mitiga. On September the 16th, Uber announced they experienced a major breach in their organization in which malicious actor was able to log in and take over multiple services and internal tools used at Uber.In this incident, the attacker annou...
From Dynamite to Quantum Entanglement
Blog Published: 11/15/2022
Originally published by Entrust. Written by Greg Wetmore, Entrust. When you think of “entanglement” what comes to mind? Knotty problems? Sticky situations? If you’re like me…and the committee that awards the Nobel Prize in Physics... you think of all that and quantum mechanics – and the science b...
What is ERP Security?
Blog Published: 11/14/2022
Originally published by Onapsis on October 6, 2022. This month marks CISA’s 19th Cybersecurity Awareness Month, a joint effort between the government and public to raise awareness of the importance of cybersecurity. This year's theme, "See Yourself in Cyber," demonstrates that while cybersecurity...
Altruism in Information Security? (Part 1 of 3)
Blog Published: 11/14/2022
Originally published by Tentacle. Written by Matt Combs, Tentacle. Altruism and Information Security; two terms not commonly used together - the first term not often used to describe the foundational philosophy of the latter. Altruism is ideological; a desired state of the ultimate do-gooder who...
Security Scope and the Threat Continuum. What CISOs Need to Know.
Blog Published: 11/14/2022
Originally published by Netography. Written by Martin Roesch, Netography. The pandemic kicked off a rapid evolution of networks that have now become composites of multi-cloud, hybrid-cloud, and on-prem infrastructure with mobile and remote workers accessing data and applications scattered across ...
Top Threat #8 to Cloud Computing: Accidental Cloud Data Disclosure
Blog Published: 11/13/2022
Written by the CSA Top Threats Working Group. The CSA Top Threats to Cloud Computing Pandemic Eleven report aims to raise awareness of threats, vulnerabilities, and risks in the cloud. The latest report highlights the Pandemic Eleven top threats, in which the pandemic and the complexity of worklo...
SaaS Security Use Case Series: SaaS-to-SaaS Access
Blog Published: 11/10/2022
Originally published by Adaptive Shield. Written by Eliana Vuijsje, Adaptive Shield. It's no secret that SaaS-to-SaaS apps can boost productivity, enable remote and hybrid work and are overall, essential in building and scaling a company's work processes.It's an innocuous process much like clicki...
Defining Cyber Immunity
Blog Published: 11/10/2022
Written by Arti Raman, CEO and Founder of Titaniam. Biologically, a virus is something that inserts itself into the body of a living thing and replicates itself to infect its host. Technology can also be exposed to viruses – codes that replicate themselves with the ultimate goal to destroy da...
Is 3D Secure 2.0 Required in the US?
Blog Published: 11/09/2022
Originally published by TokenEx. Written by Anni Burchfiel, TokenEx. Quick Hits: 3D Secure is a security protocol that requires an extra layer of authentication for online payments.3D Secure connects the three parties involved in a transaction (the card issuer, the acquirer, and the payment syste...
How Cybersecurity Asset Management Helps Amid Economic Uncertainty
Blog Published: 11/09/2022
Originally published by Axonius. Written by Kathleen Ohlson, Axonius. Trying to understand, manage and protect the disparate parts that make up an IT infrastructure can be one of the biggest challenges — and headaches — for IT and cybersecurity professionals. With today’s increased economic uncer...
The Anatomy of Wiper Malware, Part 3: Input/Output Controls
Blog Published: 11/09/2022
Originally published by CrowdStrike. Written by Ioan Iacob and Iulian Madalin Ionita, CrowdStrike. In Part 1 of this four-part blog series examining wiper malware, an Endpoint Protection Content Research Team introduced the topic of wipers, reviewed their recent history and presented common adver...
Incident Detection and Response in the Cloud
Blog Published: 11/08/2022
Written by Lior Zatlavi, Senior Cloud Security Architect, Ermetic. Cloud technology is not the future of business. Not anymore; now it’s the present. Businesses born today are often cloud-native, and older businesses are migrating their workloads to the cloud, looking for agility and efficien...
Cloud Data Security Means Shrinking the “Data Attack Surface”
Blog Published: 11/08/2022
Originally published by Sentra. Traditionally, the attack surface was just the sum of the different attack vectors that your IT was exposed to. The idea being as you removed vectors through patching and internal audits. With the adoption of cloud technologies, the way we managed the attack surfac...
ISO 27018 vs. ISO 27701
Blog Published: 11/08/2022
Originally published by Schellman. Written by Danny Manimbo, Schellman. Famed baseball player and possessor of a great name, Yogi Berra, once said, “When you come to a fork in the road, take it.” Granted, he was likely being funny, but he obviously never had to pay for an ISO certification. When ...
What is FedRAMP? Complete Guide to FedRAMP Authorization and Certification
Blog Published: 11/07/2022
Originally published by A-LIGN. Written by Tony Bai, Federal Practice Lead, A-LIGN. With the rise in cybersecurity attacks comes wariness from customers — no one wants to work with an organization that has an increased risk of falling victim to an attack. And when it comes to the Federal governme...
