Duo's Security Blog

OCTOBER 6, 2023

Threat actors have dramatically escalated their attacks – targeting security controls like multi-factor authentication (MFA), conducting wily social engineering attacks and extorting businesses large and small with ransomware. Since then, teams have had years to adjust to this new reality, yet the attackers have as well.

Authentication 117

Authentication Risk Social Engineering InfoSec 117

Security Boulevard

AUGUST 21, 2021

The post DEF CON 29 Main Stage – Jenko Hwong’s ‘New Phishing Attacks Exploiting OAuth Authentication Flows’ appeared first on Security Boulevard. Our thanks to DEFCON for publishing their outstanding DEFCON Conference Main Stage Videos on the groups' YouTube channel.

Authentication 98

Authentication Phishing Education InfoSec 98

Security Boulevard

JANUARY 10, 2022

The post BSides Berlin 2021 – Harsh Bothra’s ‘Exploiting Vulnerabilities In Cookie Based Authentication’ appeared first on Security Boulevard. Our thanks to BSides Berlin for publishing their tremendous videos from the BSides Berlin 2021 Conference on the organization’s’ YouTube channel.

Authentication 58

Authentication Education InfoSec Information Security 58

Hot for Security

FEBRUARY 16, 2021

Non-encrypted data, insecure protocols and poor user authentication mechanisms are among the security issues that leave seismological networks open to breaches, the authors note.

IoT 128

IoT InfoSec Data collection Encryption 128

Malwarebytes

FEBRUARY 22, 2023

The company will pay a total fine of $400,000 for Ohio and Pennsylvania—and has promised to tighten its information security. Acting Attorney General Michelle Henry added, "The more personal information these criminals gain access to, the more vulnerable the person whose information was stolen becomes."

Penetration Testing 92

Penetration Testing InfoSec Accountability Authentication 92

eSecurity Planet

DECEMBER 3, 2021

Here are the top Twitter accounts to follow for the latest commentary, research, and much-needed humor in the ever-evolving information security space. His contributions include founding Security BSides, serving as Strategist for Tenable, speaking at conferences, and co-hosting the podcast Security Voices.

Accountability 139

Accountability Cybersecurity Penetration Testing InfoSec 139

Security Affairs

NOVEMBER 25, 2023

ransomfeed #security #infosec #energychina pic.twitter.com/deRRximVPd — Ransomfeed (@ransomfeed) November 25, 2023 The China Energy Engineering Corporation (CEEC) is a state-owned company in China that operates in the energy and infrastructure sectors. Energy China [link] TL;DR That's huuuge!

Ransomware 112

Ransomware Hacking Engineering Manufacturing 112

Security Affairs

AUGUST 10, 2022

The user had enabled password syncing via Google Chrome and had stored their Cisco credentials in their browser, enabling that information to synchronize to their Google account.” cybersecurity #infosec #ransomware pic.twitter.com/kwrfjbwbkT — CyberKnow (@Cyberknow20) August 10, 2022.

Ransomware 122

Ransomware Hacking VPN Phishing 122

Security Affairs

NOVEMBER 20, 2023

– Authentication and Security : APIs may require authentication for access control. Here are a few: Security Vulnerabilities : Unmanaged APIs may have security vulnerabilities that can be exploited by malicious actors. Authentication and Authorization : APIs frequently employ token-based authentication (e.g.,

Authentication 99

Authentication Government Technology Risk 99

CyberSecurity Insiders

APRIL 21, 2021

As an information security professional, you are aware that identity management is a very important part of the security landscape. To the modern information security practitioner, it must do both at the same time. Quite often, the information security professional has experienced this frustration too.

Passwords 116

Passwords Information Security Engineering Authentication 116

Security Affairs

JULY 13, 2020

Records of 45 Million+ travelers to Thailand and Malaysia Leaked on #Darkweb (Blog Link) [link] #infosec #leaks #CyberSecurity pic.twitter.com/zHOujQ8CMm — Cyble (@AuCyble) July 12, 2020. The huge trove of data was discovered by the researchers during their regular Deepweb and Darkweb monitoring activity.

Mobile 127

Mobile InfoSec Data breaches Advertising 127

SecureWorld News

MARCH 31, 2022

He is the Chief Information Security Officer at Veterans United Home Loans in Columbia, Missouri. He has more than 25 years of experience in both public entities and private industry, having built several Information Security programs from the ground up. In this installment, we introduce you to Randy Raw.

Cybersecurity 72

Cybersecurity InfoSec Authentication DDOS 72

Security Affairs

APRIL 21, 2020

A security researcher disclosed details of four zero-day flaws impacting an IBM security product after the IT giant refused to address them. The IBM Data Risk Manager manages credentials to access other security tools used in the enterprise and information about security vulnerabilities that affect the organizations.

Risk 93

Risk Authentication InfoSec Advertising 93

Security Affairs

MARCH 13, 2023

The three-year-old high-severity flaw is a deserialization of untrusted data in Plex Media Server on Windows, a remote, authenticated attacker can trigger it to execute arbitrary Python code. CISAgov added #CVE -2020-5741 & CVE-2021-39144 to the Known Exploited Vulnerabilities Catalog.

Media 76

Media InfoSec Password Management Engineering 76

SC Magazine

MAY 3, 2021

Dan Meacham is chief information security officer and CSO with Legendary Entertainment, the production company behind Godzilla vs. Kong and other popular films such as The Dark Knight and Jurassic World. If they can pass this authentication process, then they don’t even need a password to log in. Legendary Entertainment).

CSO 69

CSO InfoSec Media Authentication 69

Security Boulevard

JULY 28, 2021

This triggers the event or flow of payment authentication and processing with various entities involved in the process. Author Bio Narendra Sahoo (PCI QSA, PCI QPA, CISSP, CISA, and CRISC) is the Founder and Director of VISTA InfoSec , a global Information Security Consulting firm, based in the US, Singapore & India.

Banking 64

Banking InfoSec Accountability Information Security 64

Security Affairs

FEBRUARY 5, 2022

link] #Cybersecurity #InfoSec pic.twitter.com/Tu7MoTEETC — US-CERT (@USCERT_gov) February 4, 2022. At the end of January, the security researchers RyeLv has publicly released an exploit for a Windows local privilege elevation flaw ( CVE-2022-21882 ) that allows anyone to gain admin privileges in Windows 10.

InfoSec 84

InfoSec Authentication Hacking Cybersecurity 84

The Security Ledger

MAY 8, 2019

In this week’s episode, #145 Veracode CTO Chris Wysopal joins us to talk about the early days of the information security industry with L0pht and securing software supply chains. Also: we continue our series on life after the password by speaking to Ian Paterson, the CEO of behavioral authentication vendor Plurilock.

Passwords 40

Passwords Password Management Authentication InfoSec 40

Security Boulevard

FEBRUARY 26, 2023

Twitter is phasing out its free text message two-factor authentication (2FA) and putting the feature behind a paywall, prompting security experts to advise Twitter users to switch to other authentication methods.

Authentication 52

Authentication Data breaches Data privacy Technology 52

Duo's Security Blog

APRIL 29, 2022

As I immersed myself in foreign concepts around the information security industry, marketing, and business practices at scale, I grew to appreciate not just the technology we were building at Duo, but the people who built it, the diverse audiences that we addressed, and the unique problems-to-solve around security at large.

Marketing 88

Marketing InfoSec Architecture Authentication 88

Herjavec Group

AUGUST 2, 2021

He has over 30 years of experience in information security and has established himself as a leading voice in business and cybersecurity. Along with these contributions, Robert is active in a number of impactful infosec initiatives. Winner: Top 10 Cybersecurity Experts – Robert Herjavec. Connect with Robert.

InfoSec 52

InfoSec Cybersecurity Computers and Electronics Marketing 52

Security Boulevard

JULY 23, 2023

In this episode, we discuss the recent Microsoft security breach where China-backed hackers gained access to numerous email inboxes, including those of several federal government agencies, using a stolen Microsoft signing key to forge authentication tokens. A TikTok influencer used a voice cloning app to expose a cheating boyfriend.

Scams 97

Scams Cybersecurity Authentication Government 97

Security Affairs

OCTOBER 4, 2020

The vulnerabilities have been reported to HP by the infosec researchers Nick Bloor, an attacker could chain the three issues to achieve SYSTEM privileges on targeted devices and potentially take over them. The issue does not impact customers who use Active Directory authenticated accounts. ” reads the HP’s advisory.

Hacking 125

Hacking Accountability Passwords InfoSec 125

Security Affairs

AUGUST 22, 2022

provides software and hardware used to issue financial cards, e-passport production, user authentication for those looking to access secure networks or conduct financial transactions, trust certificated for websites, mobile credentials, and connected devices. Entrust security incident dated June 18th. Entrust Corp.

DDOS 79

DDOS Hacking InfoSec Ransomware 79

Security Affairs

JULY 2, 2021

Cybersecurity #Infosec — US-CERT (@USCERT_gov) June 30, 2021. Researchers from security firm Lares have released a tool for the remediation of the PrintNightmare zero-day along with instructions to disable the Print Spooler service. Administrator action is required to prevent exploitation. Learn more at [ [link] ].

InfoSec 123

InfoSec Authentication Hacking Cybersecurity 123

Security Affairs

JANUARY 19, 2020

In August 2017, security researchers Ankit Anubhav found a list of more than 1,700 valid Telnet credentials for IoT devices online. Link : [link] #iot #hacking #malware #infosec @newskysecurity pic.twitter.com/0Lg7q8G0Kq — Ankit Anubhav (@ankit_anubhav) August 24, 2017. admin:admin, root:root, or no authentication required).

IoT 82

IoT DDOS InfoSec Internet 82

SecureWorld News

SEPTEMBER 7, 2023

Director of Information Security, State of Colorado Governor's Office of Information Technology; and Toby Zimmerer, Sr. As for the panel presentation at SecureWorld Denver , it features Edgar Acosta, Experienced Cybersecurity Professional (former CISO at DCP Midstream ); Craig Hurter, Sr. Demand and Delivery Director, Optiv.

Encryption 90

Encryption Technology Risk Architecture 90

Security Affairs

JULY 8, 2020

This vulnerability allows for unauthenticated attackers, or authenticated users, with network access to the TMUI, through the BIG-IP management port and/or Self IPs, to execute arbitrary system commands, create or delete files, disable services, and/or execute arbitrary Java code.” reads the advisory published by F5.

Advertising 113

Advertising InfoSec Government Healthcare 113

SC Magazine

APRIL 26, 2021

As critical infrastructure facilities increasingly converge their IT and OT systems, visibility into traditionally isolated operational systems is turning into a key security challenge. So far, “it’s been going really well,” she said. However, such modernization is not without risk.

CISO 82

CISO IoT VPN InfoSec 82

Security Boulevard

JUNE 15, 2022

It is the de-facto standard for remote administration of servers, with SSH keys acting as identities to enable automated authentication, encryption, and authorization. It is secure, flexible, and easy to use, while it encompasses many other protocols, such as SFTP, SCP and RSYNC. Re)Defining trust with Zero Trust.

Risk 52

Risk Architecture Digital transformation InfoSec 52

Security Affairs

MARCH 7, 2021

This vulnerability is remotely exploitable and does not require authentication of any kind, nor does it require any special knowledge or access to a target environment.” Cyber #Cybersecurity #InfoSec — US-CERT (@USCERT_gov) March 6, 2021. ” reads the analysis published by Volexity. ” wrote Microsoft.

Hacking 104

Hacking Accountability Government Small Business 104

ForAllSecure

FEBRUARY 10, 2021

To answer these questions, Paul Roberts, Editor-in-Chief of the Security Ledger, has founded securepairs.org , a group of infosec experts who are volunteering their free time to fight for the digital right to repair in local legislation. Back then Paul was writing infosec stories for IDG and I was doing the same at ZDNet.

InfoSec 52

InfoSec Manufacturing Technology Software 52

ForAllSecure

FEBRUARY 10, 2021

To answer these questions, Paul Roberts, Editor-in-Chief of the Security Ledger, has founded securepairs.org , a group of infosec experts who are volunteering their free time to fight for the digital right to repair in local legislation. Back then Paul was writing infosec stories for IDG and I was doing the same at ZDNet.

InfoSec 52

InfoSec Manufacturing Technology Software 52

Cisco Security

OCTOBER 6, 2021

Here are some more insights from people in the infosec community on what works for them: Advice on How Security Pros Can Promote Their Mental Health. A trusting culture starts with authenticity from the most influential person in the group – the “leader.” Zoë Rose | Regional and Supplier Information Security Lead at Canon EMEA.

Cybersecurity 103

Cybersecurity CISO InfoSec Media 103

Security Through Education

JANUARY 4, 2023

There is a plethora of personal information available to successful malicious attackers, including (but not limited to) credit card information and social security numbers. According to the Office of Information Security, the following 5 reasons are why healthcare workers are at risk: People are naturally trusting.

Social Engineering 64

Social Engineering Healthcare Engineering Phishing 64

Cisco Security

JUNE 25, 2021

First of all, while I am honoured and deeply thankful for the recognition, I believe strongly that Security is a team effort and I must acknowledge the superb InfoSec team in Steward but also the Steward workforce. I thank you all for keeping our patients safe and secure! My story is the same as millions of emigrants to the US.

CISO 74

CISO Healthcare InfoSec Computers and Electronics 74

Troy Hunt

DECEMBER 4, 2017

Particularly when we're talking about public figures in positions of influence, we need to see leadership around infosec, not acknowledgement that elected representatives are consciously exercising poor password hygiene. It's normalising a behaviour that we should be actively working towards turning around.

Passwords 204

Passwords Accountability Technology InfoSec 204