QR Codes, Audio Notes, and Voicemail - Clever Tricks Up a Phisher’s Sleeve
Blog Published: 03/07/2024
Written by David Balaban.Cybercriminals are increasingly cashing in on human gullibility rather than the security flaws of software architecture. It comes as no surprise that phishing, the dominating vector of social engineering attacks targeting individuals and businesses alike, is on a steady r...
Cybersecurity Advisory: Apache Struts Vulnerability CVE-2023-50164
Blog Published: 03/06/2024
Originally published by Uptycs. The Apache Struts vulnerability CVE-2023-50164, with a critical CVSS score of 9.8, poses a significant threat to a wide range of industries. This newly reported vulnerability enables remote code execution, and its exploitation is already evident in the wild.Apache ...
How Do I Choose a SOC Auditor?
Blog Published: 03/06/2024
Originally published by MJD.Written by JC London, Senior Manager, CISA, CISSP, MJD. Q: How do I choose a SOC auditor?A: MJD Answer:Choosing the right auditor and audit team may seem like an uncomplicated process at first. You’ve done your research, asked ChatGPT for its opinion, and you feel like...
Implementing DevSecOps: Some Practical Considerations for CISOs
Blog Published: 03/06/2024
Originally published by CXO REvolutionaries. Written by Sam Curry, VP & CISO in Residence, Zscaler. “The perfect is the enemy of the good.” – VoltaireIn early development models like Waterfall – where all processes were performed sequentially – a high wall separated build teams and run teams,...
Adhere to the EU Cloud CoC through the CSA
Blog Published: 03/05/2024
Written by SCOPE Europe.It’s live - you can now adhere to the EU Cloud CoC through the CSA!With a shared mission of supporting the dissemination of trusted cloud services, the anticipated collaboration between the EU Cloud CoC and Cloud Service Alliance (CSA) is now live. In practice, this collab...
Evolving Email Threats: 5 Attacks to Watch For in 2024
Blog Published: 03/05/2024
Originally published by Abnormal Security.Written by Emily Burns. A new year means a new set of challenges across the email threat landscape. While traditional attack vectors are continuing to trend upward, there are also a number of novel attack types emerging. Threat actors have learned to bypa...
11 Months to DORA: EU's New Framework For BFSI
Blog Published: 03/04/2024
Written by [email protected], AuditCue.In September 2020, the European Commission unveiled a landmark proposal - the Digital Operational Resilience Act (DORA) - as part of its sweeping Digital Finance Package aimed at fortifying cybersecurity across EU financial institutions. Once finalized, DORA...
Jenkins Vulnerability Estimated to Affect 43% of Cloud Environments
Blog Published: 03/04/2024
Originally published by Orca Security.Written by Bar Kaduri and Deborah Galea. On January 24th, Jenkins, a widely used open source CI/CD automation tool, released a security advisory regarding a new critical vulnerability that could allow arbitrary file read, possibly leading to Remote Code Execu...
Checklist for Designing Cloud-Native Applications – Part 1: Introduction
Blog Published: 03/04/2024
Written by Eyal Estrin.When organizations used to build legacy applications in the past, they used to align infrastructure and application layers to business requirements, reviewing hardware requirements and limitations, team knowledge, security, legal considerations, and more. In this series of...
Looking Forward, Looking Back: A Quarter Century as a CISO
Blog Published: 03/01/2024
Originally published by F5.Gail Coury explores how cybersecurity has evolved and what the future holds, after a distinguished career as a CISO.IntroductionThe first Chief Information Security Officer, or CISO, was named 29 years ago: After Russian hackers infiltrated financial services giant Citi...
Why Compliance is a Roadmap to Security
Blog Published: 03/01/2024
Originally published by RegScale.In the realm of cybersecurity, compliance is often perceived as a necessary but sometimes challenging aspect of safeguarding data and systems. As we celebrate Cybersecurity Awareness Month, let’s delve into the evolving role of compliance in the cybersecurity land...
How To Secure Your AWS Environment: Six Best Practices
Blog Published: 03/01/2024
Originally published by Tenable Cloud Security.Even for those experienced with AWS, securing your AWS environment can be a difficult process. In this article, we outline six best practices that can help those involved with protecting your AWS environment keep it secure.Recommendation #1 - Manage ...
A New Era of Data Protection: CSA’s Strategic Partnership with the EU Cloud CoC for GDPR Compliance
Blog Published: 02/29/2024
Read the full FAQ here.In an era where data protection has become a vital concern for cloud service providers (CSPs) and their clients, the Cloud Security Alliance (CSA) has partnered with the EU Cloud Code of Conduct (EU Cloud CoC) to disseminate privacy standards across the cloud sector. This i...
Cloudflare Hacked Following Okta Compromise
Blog Published: 02/29/2024
Originally published by Valence Security.Cloudflare disclosed that the Okta breach that occurred several months ago led to a suspected ‘nation state attacker’ gaining unauthorized access to their Atlassian servers. According to Cloudflare, the attackers that gained their initial access due to the...
To Meet Bold Ambitions and Combat Mounting Threats, Australia Endorses Zero Trust
Blog Published: 02/28/2024
Originally published by CXO REvolutionaries.Written by Heng Mok, CISO in Residence, Zscaler. If Australia is to become the most cyber-secure nation in the world by 2030, as Cyber Security Minister Clare O'Neill has said it can be, it has a ways to go. The Australian government’s recognition of th...
Understanding the Ransomware Wave of 2023
Blog Published: 02/28/2024
Originally published by Skyhigh Security on December 8, 2023. Written by Nick Graham, Solution Architect, Public Sector, Skyhigh Security. As we near the end of 2023, Skyhigh Security has observed a concerning surge in ransomware attacks that have significantly reshaped the cybersecurity landscap...
An Explanation of the Guidelines for Secure AI System Development
Blog Published: 02/28/2024
Originally published by Schellman & Co.Recently, the UK National Security Centre (NCSC) and the US Cybersecurity and Infrastructure Security Agency (CISA)—along with other groups from around the world—released the Guidelines for Secure AI System Development. A new resource for developers as o...
Securing Your Microsoft Environment After the Midnight Blizzard Attack
Blog Published: 02/27/2024
Originally published by Reco. Written by Oz Wasserman. IntroductionThe attack on Microsoft's SaaS-based Entra environment by Midnight Blizzard (aka Nobelium, Cozy Bear or APT29) was notably one of the most sophisticated attacks seen on similar platforms. This incident, spanning from November 2023...
Departing Thoughts of the STAR Program Director
Blog Published: 02/27/2024
As I prepare to transition from my role as the STAR Program Director to embark on a new journey as the Director of Operations Excellence at CSA, I find myself reflecting on the incredible journey we've embarked on together. Leading the STAR program has been one of the most fulfilling chapters of ...
What is Azure Policy: All You Need to Know
Blog Published: 02/27/2024
Originally published by Sonrai Security.Written by Tally Shea. What is Azure Policy? Azure Policy is a service within Microsoft Azure that allows organizations to create, assign, and manage policies. These policies define rules and effects over resources, identities, and groups, in an effort to e...
