Duo's Security Blog

JANUARY 29, 2024

We will outline the trends and attack patterns that are the most prevalent and discuss how to configure Duo policies to best protect your users. In analyzing de-identified customer data over the latter half of 2023, we found a pattern of threat activity targeting multiple universities using shared attack infrastructure.

Education 119

Education Authentication Passwords Phishing 119

The Last Watchdog

JUNE 13, 2022

Among them: an expanding digital footprint, growing attack surfaces, and increasing government regulation. The SolarWinds attack made API supply chain security a front-page story in 2020. Improving identity management. projects, makes the urgency of more robust and portable identity management systems even more imminent.

Cybersecurity 239

Cybersecurity Artificial Intelligence Software Marketing 239

CyberSecurity Insiders

DECEMBER 21, 2022

These are generally considered non-critical, but the risk of chained attacks stemming from issues like subdomain takeovers make it more essential than ever to monitor and secure the full attack surface. How attackers think. What your attack surface truly looks like.

Internet 131

Internet Internet Risk DNS 131

Anton on Security

MAY 24, 2023

talk to us :-) These are the episodes: EP52 Securing AI with DeepMind CISO EP68 How We Attack AI? 1b3 What aspects of securing AI are different because the use cases emerge so quickly? 2a2 AI is being used for illegal purposes? 2a3 AI is being used against privacy rules and conventions? More questions?

Artificial Intelligence 130

Artificial Intelligence CISO Risk Marketing 130

Anton on Security

FEBRUARY 8, 2022

In the real world, very clearly there is a role for cloud providers in both facilitating threat detection against whatever the customer puts in the cloud (say via a network IDS ), or in some cases, just doing that detection themselves for customers (like say what we do here or here ).

Threat Detection 189

Threat Detection Cloud Migration Technology Engineering 189

The Last Watchdog

DECEMBER 14, 2023

ai Antani Many speculated that the ransomware attack on a Toyota supply chain player in Kojima, Japan was in retaliation for Japan’s aid to Ukraine. Generative AI is expected to supercharge the velocity and precision of attacks. As concerns about supply chain attacks continue to escalate, compliance measures will tighten.

Cybersecurity 201

Cybersecurity Marketing Encryption CISO 201

SC Magazine

APRIL 22, 2021

Though the term Attack Surface Monitoring (ASM) doesn’t specifically refer to external threats, that’s what this market currently focuses on. In short, products in this category aim to catalogue and help manage an organization’s exposed assets. To see specific methodology used for the reviews in this category, click here.

Penetration Testing 87

Penetration Testing Marketing Internet Internet 87

Security Affairs

MARCH 24, 2024

surfaces in the threat landscape Pokemon Company resets some users’ passwords Ukraine cyber police arrested crooks selling 100 million compromised accounts New AcidPour wiper targets Linux x86 devices.

Malware 107

Malware Cybercrime Hacking Cyber threats 107

CyberSecurity Insiders

AUGUST 17, 2022

It should be no surprise that ransomware is currently one of the most common attack vectors wreaking havoc on businesses worldwide. Attackers and ransomware operators are constantly looking for more vulnerabilities to weaponize and increase their arsenal of tools, tactics, and techniques. How to use data to combat ransomware.

Ransomware 124

Ransomware Healthcare Manufacturing Cybersecurity 124

Thales Cloud Protection & Licensing

DECEMBER 6, 2023

As the Thales 2023 Cloud Security Study reveals, enterprises now use, on average, 2.3 Escalating Security Concerns The expanded use of SaaS applications across multiple cloud platforms has led to an increased attack surface, making SaaS apps a prime target for cyberattacks. cloud platforms and 97 SaaS applications.

Encryption 83

Encryption Data privacy Marketing Cyber threats 83

Google Security

SEPTEMBER 15, 2023

If that trust is violated, the consequences can be huge—regardless of whether the package is malicious, or well-intended but using overly broad permissions, such as with Log4j in 2021. Most software packages depend on external libraries, trusting that those packages aren’t doing anything unexpected.

Software 116

Software 116

Thales Cloud Protection & Licensing

JANUARY 5, 2022

However, that has not really been the case, and we are going to continue the trend towards decentralization and hybrid working. Organizations are not slowing down the migration of applications, workloads, and data to the cloud, which leads to a broader attack surface. What technologies are expected to rise?

Digital transformation 127

Digital transformation Engineering Technology Phishing 127

eSecurity Planet

JUNE 2, 2022

Shadow Server Foundation researchers reported that they simply issued a MySQL connection request on default port 3306 to see if a server responded with a MySQL Server Greeting, rather than intrusive requests that pentesters use to break into databases. MySQL is a an open source relational database management system that runs as a server.

Internet 118

Internet Internet Architecture Data breaches 118

The Last Watchdog

APRIL 6, 2021

Related: Business-logic attacks target commercial websites. Yet all organizations today, no matter their size or sector, face the same daunting security challenge: how to preserve the integrity of their IT systems when the attack surface is expanding and intrusion attempts are intensifying. The case for basic PAM.

Accountability 148

Accountability Passwords Digital transformation Authentication 148

CyberSecurity Insiders

APRIL 13, 2021

As organizations extend their business-critical applications into cloud environments, the attack surface they’re defending evolves. This presents an attack surface to the public internet that looks very different from what organizations had been used to years ago. SQL Injection, cross-site scripting, et al.)

B2B 115

B2B Internet Internet DDOS 115

SecureList

APRIL 15, 2024

Since then, attackers have been able to generate customized versions of the threat according to their needs. This opens up numerous possibilities for malicious actors to make their attacks more effective, since it is possible to configure network spread options and defense-killing functionality. Revisiting the LockBit 3.0

Ransomware 90

Ransomware Encryption Passwords Accountability 90

NetSpi Executives

SEPTEMBER 5, 2023

As the adoption and use cases continue to grow, it is critical that organizations understand the unique threats that AI/ML brings along with it, along with identifying weak spots and building more resilient models. This blog post is a part of our offensive security solutions update series.

Penetration Testing 52

Penetration Testing Risk Network Security Technology 52

Malwarebytes

OCTOBER 28, 2021

For an attacker, fileless malware has two major advantages: There is no file for traditional anti-virus software to detect. Fileless malware attacks have been around for 20 years at least. But in the last few years fileless attacks have become more prevalent. Some use the so-called CactusTorch framework in a malicious document.

Malware 116

Malware Artificial Intelligence Software Ransomware 116

CyberSecurity Insiders

OCTOBER 28, 2022

The guidance aims to shake up the way devices are tracked, managed, and protected against unauthorized access and attacks like Ransomware. 93% of companies are vulnerable to external attackers breaching their network perimeters and gaining access to sensitive data. What does it mean for IT teams?

Government 117

Government Software Technology Risk 117

Security Boulevard

JANUARY 24, 2022

The attack surface continues to expand, in a lot of cases exponentially, as data moves to SaaS, applications move to containers, and the infrastructure moves to the cloud. The tools used by the SOC analysts are improving, but not fast enough. There tend to be two use cases main use cases for the SOC.

Education 108

Education Marketing Technology 108

CyberSecurity Insiders

JULY 2, 2023

The demands have never been higher—more assets to protect, a larger attack surface, more incidents than ever before. But this means that every modern business has a far bigger attack surface that needs the best possible protection. And how does the business’s cybersecurity budget compare with the scale of attacks?

CISO 96

CISO Marketing Cybersecurity Data privacy 96

eSecurity Planet

SEPTEMBER 22, 2022

Trellix security researchers have revealed a major vulnerability in the Python tarfile library that could be exploited in software supply chain attacks. The researchers believe it could be used against organizations at scale, which could lead to attacks as serious as the one that hit SolarWinds two years ago.

Software 86

Software Risk Cybersecurity 86

Thales Cloud Protection & Licensing

APRIL 24, 2024

Businesses in every sector are trying to digitally transform their operations using the cloud but are finding themselves in an increasingly tangled web of challenges. Traditional defense boundaries have eroded due to the cloud and distributed workforces, which has seen the attack surface expand rapidly.

Telecommunications 62

Telecommunications Digital transformation Software Technology 62

Malwarebytes

SEPTEMBER 3, 2023

In only a few rare cases does one organization have full control over every step in the entire process. In these cases, demonstrating vendor compliance will keep your internal organization from facing fines and penalties. There are also vendors that we use to get the work done, like software, infrastructure, and services.

Risk 89

Risk Penetration Testing Software Technology 89

Anton on Security

MAY 27, 2021

There were also cases where both business and IT migrated to the cloud, but security was left behind and had to approach cloud challenges with on-premise tools and practices. Cloud providers haven’t necessarily simplified this journey for customers, even though, compared to 2012 , decent logs actually exist today in many cases.

Cloud Migration 170

Cloud Migration Architecture Technology Government 170

NopSec

SEPTEMBER 20, 2023

We are pleased to announce that after a thorough evaluation process, NopSec has been rated as a Strong Performer in the recently published Forrester Vulnerability Risk Management Wave report. We take this news with great pride as we continue striving to solve our client’s vulnerability management needs with our unique approach.

Cyber threats 52

Cyber threats Risk Marketing 52

The Last Watchdog

MARCH 1, 2019

There is a gaping shortage of analysts talented enough to make sense of the rising tide of data logs inundating their SIEM (security information and event management) systems. In many cases the tedious, first-level correlating of SIEM logs to sift out threats has moved beyond human capability. But this hasn’t done the trick.

Threat Detection 141

Threat Detection Digital transformation Marketing Firewall 141

CyberSecurity Insiders

OCTOBER 3, 2022

Monitoring and tracking potential threats from the dark web, open source, and social media platforms to detect threats that could attack your organization is critical to ensure public and corporate safety and security. For this reason, the last decade has seen a dramatic rise in managed services adoption.

Risk 123

Risk Media Cyber threats Cybersecurity 123

Malwarebytes

JULY 12, 2023

Microsoft is aware of targeted attacks that attempt to exploit these vulnerabilities by using specially-crafted Microsoft Office documents. An attacker could create a specially crafted Microsoft Office document that enables them to perform remote code execution in the context of the victim.

Telecommunications 88

Telecommunications Phishing Software Government 88

eSecurity Planet

OCTOBER 12, 2023

Cyber attackers frequently use legacy technology as part of their attack strategies, targeting organizations that have yet to implement mitigations or upgrade obsolete components. In an Active Directory environment, one such component is legacy protocols, which attackers can use to gain access to Active Directory.

Risk 132

Risk Authentication Encryption Cybersecurity 132

The Last Watchdog

AUGUST 8, 2023

8, 2023 – Picus Security , the pioneer of Breach and Attack Simulation (BAS) technology, has released The Blue Report 2023. According to the report, security teams make four trade-offs in deciding: •Which attacks to prioritize. However, some attack types are prevented far more effectively than others. San Francisco, Calif.,

Malware 100

Malware Healthcare Firewall Risk 100

SecureWorld News

JANUARY 7, 2024

This includes using a range of tools and methods to implement risk management strategies and to enable self-governance, without preventing a business from reaching its goals and growth targets. Governance Governance refers to the policies, rules, and frameworks that a company needs to follow to meet its business targets.

IoT 74

IoT Technology Artificial Intelligence Government 74

CyberSecurity Insiders

MARCH 30, 2023

News is breaking about a software supply chain attack on the 3CX voice and video conferencing software. Experts believe the supply chain attack, which was maliciously sideloaded, targets downstream customers by installing popular phone and video conferencing software that has been digitally authenticated and modified.

Software 93

Software Risk Malware CISO 93

CyberSecurity Insiders

SEPTEMBER 21, 2021

With 5G networks, billions of devices and IoT (the internet of things) are interconnectible — leading to use cases like smart cities, AR/VR on mobile networks, remote medicine and much more. And what role should managed services play in your 5G security strategy? The potential is practically unlimited.

Architecture 117

Architecture IoT Mobile Risk 117

Centraleyes

MARCH 25, 2024

Let’s discuss an acronym reshaping the business world: Vendor Risk Management , or VRM. With supply chains extending across multiple regions and involving numerous third-party vendors, organizations face unprecedented challenges in managing vendor risks effectively. Who are you, and what are your goals?

Risk 111

Risk Data collection Architecture Government 111

eSecurity Planet

MARCH 27, 2023

Enterprise IT, network and security product vulnerabilities were among those actively exploited in zero-day attacks last year, according to a recent Mandiant report. State-sponsored Attacks Dominate Mandiant identified a motive for 16 cases of zero-day exploitation.

Firewall 82

Firewall Internet Internet Telecommunications 82

eSecurity Planet

SEPTEMBER 11, 2023

Container security is the combination of cybersecurity tools, strategies, and best practices that are used to protect container ecosystems and the applications and other components they house. Examples of container networking and virtualization tools include VMWare NSX and HAProxy.

Cybersecurity 89

Cybersecurity Encryption Risk Network Security 89