Why Are Zombie APIs and Shadow APIs So Scary?

A lax API governance strategy can lead to abandoned or overlooked APIs that open up organizations to security threats.

Cyberattack Strikes Global Copper Conglomerate

Now mostly recovered, Aurubis said the breach was part of a broader campaign against the metals and mining industry.

Persistent Launches Cyber-Recovery Solution With Google Cloud

Accelerates the safe recovery from ransomware attacks.

Zscaler's Cloud-Based Cybersecurity Outages Showcase Redundancy Problem

While fewer cloud providers are suffering outages, customers should prepare for the uncommon event, especially when relying on cloud services for security.

A Cyber Threat Minute: Cybercrime’s Scope in 60-Second Snapshots

When looking at the scale and scope of worldwide cybercrime, password attacks are the most commonly observed type of threat in a given 60-second period.

Does Security Have to Get Worse Before It Gets Better?

How to solve the software vulnerability problem across the entire SDLC.

Synack Expands Security Platform With Adversarial API Pentesting

Security researchers will handle testing on "headless" API endpoints that lack a user interface and are increasingly exposed to attackers.

Cyber Leadership and Strategy Solutions (CLASS-LLC) and Cyversity Launch a Cybersecurity Apprenticeship Cohort

Nozomi Networks-Sponsored SANS Survey Finds Security Defenses are Getting Stronger as Cyber Threats to OT Environments Remain High

Urgent: Google Issues Emergency Patch for Chrome Zero-Day

With scant details attached, Google Chrome seeks to shore up yet another exploited zero-day vulnerability.

Wanted: Cybersecurity Training That Breaks Down Silos

The next generation of cybersecurity pros will need to participate frequently in relevant training to expand their skills and stay engaged.

Cloud Providers Throw Their Weight Behind Confidential Computing

New technologies designed into processors allow enterprises to leverage cloud advantages while meeting privacy regulations.

Raspberry Robin's Cyber Worm Infects Thousands of Endpoints

The malware is being used to deliver Clop ransomware, in a vicious spate of October attacks that show an evolution in its methods.

NY Post Falls Victim to Insider Threat

A malicious employee was behind hateful, violent messages on the Post's website and Twitter account, the paper has confirmed.

Prepare Now for Critical Flaw in OpenSSL, Security Experts Warn

Even if the security bug is not another Heartbleed, prepare like it might be, they note — it has potentially sprawling ramifications.

Google Trumpets US Federal Open Source Security Initiative

A bipartisan bill aims to create a usable framework for the use of open source components when building applications, which Google is urging the private sector to support.

Cyberattackers Target Instagram Users With Threats of Copyright Infringement

A novel campaign is using an emerging URL redirection tactic to try to trick business users and others into clicking on an embedded link and giving up credentials.

How to Attract Top Research Talent for Your Bug Bounty Program

Successful bug bounty programs strike a balance between vendor benefits and researcher incentives.

Google Chrome Pays $57K (and Counting) in Bug Bounties for Latest Update

Chrome's Stable Channel 107 rollout includes security fixes from a slew of independent researchers, racking up nearly $60,000 in bounties.

GitLab Adds Governance, Software Supply Chain Enhancements

Developers would be able to scan for vulnerabilities in source code, containers, dependencies, and applications in production.

Ransomware Gangs Ramp Up Industrial Attacks in US

The manufacturing segment was especially hard hit by cyberattacks in the third quarter of 2022.

Why Retail Stores Are More Vulnerable Than Ever to Cybercrime

When we think about cybercrime and retail it is natural to focus on websites being targeted with attacks. Indeed, there has been a shocking rise in the number of cyberattacks perpetrated against online retailers in the past year. Dakota Murphey explains why store owners and security managers need to also protect their physical locations from the cyber threat, too, however.

Rezilion Vulnerability Scanner Benchmark Report Finds Top Scanners Only 73% Accurate

Majority of vulnerability scanner tools overwhelming teams with false positives and missing exploitable vulnerabilities.

Baltimore/Washington International Thurgood Marshall Airport Selects Telos to Process Background Checks for Aviation Workers

Telos' aviation channeling service offers increased efficiency and flexibility in credentialing operations at the busiest airport in the Washington-Baltimore region.

Dark Reading Launches New Section Dedicated to ICS/OT Security

ICS/OT Security joins the lineup of 14 cybersecurity topic sections on the media site.

Equifax's Lessons Are Still Relevant, 5 Years Later

Cybersecurity pros discuss a trio of lessons from the Equifax hack and how to prevent similar attacks in the enterprise.

Windows Mark of the Web Zero-Days Remain Patchless, Under Exploit

A pair of Microsoft bugs allow cyberattackers to bypass native Windows Internet download security, says former CERT CC researcher who discovered the flaws.

LinkedIn Phishing Spoof Bypasses Google Workspace Security

A credential-stealing attack that spoofed LinkedIn and targeted a national travel organization skates past DMARC and other email protections.

HR Departments Play a Key Role in Cybersecurity

A more secure organization starts with stronger alignment between HR and the IT operation.

Spyderbat Raises Series A to Deliver Runtime Security Throughout Cloud Native Software Development Environments

Led by NTTVC, the funding enables further development of Cloud Native Intrusion Prevention from the team that invented Network Intrusion Prevention Systems.

As Vulnerabilities Soar, Slim.AI Launches 'Container Intelligence' to Give In-Depth Analysis on Hundreds of Popular Container Images

Free service provides insights developers need to systematically identify and reduce container vulnerabilities.

IoT Fingerprinting Helps Authenticate and Secure All Those Devices

For organizations struggling to protect a rapidly expanding volume of IoT devices, IoT fingerprinting could help with security and management.

Atlassian Vulnerabilities Highlight Criticality of Cloud Services

Two flaws in the popular developer cloud platform show how weaknesses in authorization functions and SaaS flaws can put cloud apps at risk.

Stress Is Driving Cybersecurity Professionals to Rethink Roles

Burnout has led one-third of cybersecurity staffers to consider changing jobs over the next two years, potentially further deepening the talent shortage, research shows.

Ransomware Barrage Aimed at US Healthcare Sector, Feds Warn

A CISA advisory warns that the Daixin Team ransomware group has put the US healthcare system in its crosshairs for data extortion, and provides tools to fight back.

Godspeed Capital-Backed SilverEdge Partners with Counter Threat Solutions

Affiliation adds new all-source and counterintelligence, cyber, software development, and identity intelligence capabilities to SilverEdge's growing suite of technology solutions focused on the US intelligence community.

Scribe Security Launches Evidence-Based Security Trust Hub

Security, DevSecOps, and DevOps teams can now build transparent trust in the software they deliver or use.

Nok Nok, a Global Leader in Customer Passwordless Authentication, Releases Full Support for Passkeys

Nok Nok, an inventor of FIDO authentication standards, announces full support for passkeys in its S3 Authentication Suite that allows organizations to replace passwords.

Embracing the Next Generation of Business Developers

Security teams that embrace low-code/no-code can change the security mindset of business users.

Google's GUAC Aims to Democratize Software Supply Chain Security Metadata

Software makers and customers will be able to query graph database for information about the security and provenance of components in applications and codebases.

Exploit Attempts Underway for Apache Commons Text4Shell Vulnerability

The good news: The Apache Commons Text library bug is far less likely to lead to exploitation than last year's Log4j library flaw.

Katzcy Teams up with NIST on Cybersecurity Games

.

Iron Man Started His Journey From Scratch & Your Security Awareness Program Can Too

Build your company's security awareness program a suit of high-tech cybersecurity armor along with a collaborative atmosphere.

List of Common Passwords Accounts for Nearly All Cyberattacks

Half of a million passwords from the RockYou2021 list account for 99.997% of all credential attacks against a variety of honeypots, suggesting attackers are just taking the easy road.

Microsoft Data-Exposure Incident Highlights Risk of Cloud Storage Misconfiguration

Many enterprises continue to leave cloud storage buckets exposed despite widely available documentation on how to properly secure them.

Brazilian Police Nab Suspected Member of Lapsus$ Group

Lapsus$ Group became a top target after it breached the Brazilian Ministry of Health, among other targets.

4 Ways To Achieve Comprehensive Security

Zero trust protects identities, endpoints, applications, networks, infrastructure, and data, and can be implemented in different ways.

'FurBall' Spyware Being Used Against Iranian Citizens

New Android malware variant is part of long-running Domestic Kitten campaign being conducted by APT C-50 Group, analysts report.

Name That Toon: Witching Hour

Feeling creative? Submit your caption and our panel of experts will reward the winner with a $25 Amazon gift card.

Are You a CISO Building Your Risk Register for 2023? Read This First

Achieving basic IT hygiene is 99% of the game.

8 Trends Driving Cybersecurity in the Public Sector

CISOs and security leaders in state and local governments are dealing with increasing threats like ransomware — with varying degrees of cyber maturity.

Microsoft Customer Data Exposed by Misconfigured Server

The data exposure was the result of an "unintentional misconfiguration on an endpoint" and not a security vulnerability, Microsoft said.

Emotional Toll From Cyberattacks Can Linger Among Staff for Years

Research shows 1 in 7 employees involved in a cyberattack exhibits clinical trauma symptoms months after the incident.

Security Awareness Urged to Grow Beyond Compliance

Increasingly vendors are looking for ways to take security awareness beyond checkbox compliance courses to more context-dependent interactions — a "shift left" to the average worker.

Apache Commons Vulnerability: Patch but Don't Panic

Experts say CVE-2022-42899 is a serious vulnerability, but widespread exploitation is unlikely because of the specific conditions that need to exist for it to happen.

SBOMs: An Overhyped Concept That Won't Secure Your Software Supply Chain

We need more than the incomplete snapshot SBOMs provide to have real impact.

China-Linked Cyber-Espionage Team Homes In on Hong Kong Government Orgs

The Winnti APT was spotted dropping several variants of Spyder Loader and other malware as part of the so-called Operation Cuckoobees.

RCS Secure Catches Its Next Big Wave

Cybersecurity company RCS Secure announces round of Series A funding and name change as it rebrands to Third Wave Innovations.

GitGuardian Extends Code Security Platform, Adding Infrastructure-as-Code Scanning for Security Misconfigurations

The extension allows cloud security teams to protect their organization's infrastructure at the source and collaborate with developers.

Patching-as-a-Service Offers Benefits, Challenges

Organizations without the time or talent to patch may find patching-as-a-service to be a way to improve security.

Gen Z, Millennial Workers Are Bigger Cybersecurity Risks Than Older Employees

Younger workers surveyed are less likely to follow established business cybersecurity protocols than their Gen X and baby boomer counterparts, a new survey finds.

German Cybersecurity Boss Sacked Over Kremlin Connection

Head of German national cybersecurity agency was fired over ties to a member of Russian intelligence once honored by Vladimir Putin.

Treat Essential Security Certificates as Valuable Assets

Manage the company's often-overlooked security certificates as the valuable assets they are, essential for security hygiene and to prevent issues.

AutoRABIT Accelerates Release Management Processes with Automation and Key Integrations

Improving the flow of clean, safe code with heightened visibility and automation.

CISA Offers Free RedEye Analytics Tool for Red Teams

The tool helps red teams manage their activities, analyze the data from their campaigns, create reports, and better present results to organizations.

Shared Responsibility or Shared Fate? Decentralized IT Means We Are All Cyber Defenders

With the IT universe expanding, collaboration, thoughtfulness, and discipline can ensure a more secure future.

Mastercard To Bring Crypto Trading Capabilities To Banks

New Crypto Source program extends Mastercard’s safe, secure, and trusted services.

Researchers Keep a Wary Eye on Critical New Vulnerability in Apache Commons Text

There's nothing yet to suggest CVE-2022-42889 is the next Log4j. But proof-of-concept code is available, and interest appears to be ticking up.

Tactics Tie Ransom Cartel Group to Defunct REvil Ransomware

Ransom Cartel ransomware-as-a-service operator blog claims to offer a new and improved version of REvil ransomware.

New Research Report Predicts Blockchain and Quantum Threat Will Quickly Spread Beyond Cybercurrencies; Surge in New Product and Services Opportunities to Come

Research report identifies the challenges as well as the opportunities for new products and services that arise from the threat that quantum computers pose to the "blockchain" mechanism.

What Fast-Talkers Can Teach Us About Vetting Vendors

Here's how to differentiate vendors that can back up their words with solutions and those that cannot.

4 Stakeholders Critical to Addressing the Cybersecurity Workforce Gap

A cross-disciplinary effort of change is needed to attract new professionals in the coming decade.

Imprivata Expands Its Integrated Digital Identity Platform to Defragment Identities Across Disparate Applications

Offers solution to accelerate identity intelligence through simplified, yet extensive, visibility of user activity.

Microsoft Secures Azure Enclaves With Hardware Guards

Microsoft highlighted emerging confidential computing offerings for Azure during its Ignite conference.

Apple's Constant Battles Against Zero-Day Exploits

Such exploits sell for up to $10 million, making them the single most valuable commodity in the cybercrime underworld.

Concerns Over Fortinet Flaw Mount; PoC Released, Exploit Activity Grows

The authentication bypass flaw in FortiOS, FortiProxy, and FortiSwitch Manager is easy to find and exploit, security experts say.

Fast Fashion Retailer Data Breach Draws $1.9M Fine

New York AG fines Shein and Romwe parent company for failure to protect customer data and downplaying the 2018 compromise of 46 million shopper records.

Feature-Rich 'Alchimist' Cyberattack Framework Targets Windows, Mac, Linux Environments

The comprehensive, multiplatform framework comes loaded with weapons, and it is likely another effort by a China-based threat group to develop an alternative to Cobalt Strike and Sliver.

QAKBOT Attacks Spike Amid Concerning Cybercriminal Collaborations

The QAKBOT group has successfully ramped up its operations, infecting systems, installing attack frameworks, and selling access to other groups, including Black Basta.

The Playbook for Human-Operated Ransomware

Ransomware attacks are on the rise, but organizations also have access to advanced tools and technologies they can use to fight back.

What You Need for a Strong Security Posture

From the basics to advanced techniques, here's what you should know.

Attackers Use Automation to Speed from Exploit to Compromise According to Lacework Labs Cloud Threat Report

New open source Cloud Hunter tool, developed through Lacework Labs research, helps customers get better visibility to reduce response times for incident investigations.

What the Uber Breach Verdict Means for CISOs in the US

Can already beleaguered CISOs now add possible legal charges to their smorgasbord of job considerations? Disclose a breach to comply and face dismissal, or cover it up and face personal punishment.

Thoma Bravo to Acquire ForgeRock in $2.3B Deal

This marks the third identity and access management (IAM) company acquired by Thoma Bravo in just the past few months.

WhatsApp Users Beware: Dangerous Mobile Trojan Being Distributed via Malicious Mod

Among other things, users who download the app could end up having their WhatsApp account details stolen.

KnowBe4 to Be Acquired for $4.6B by Private Equity Firm Vista

Vista Equity Partners plans take the publicly traded security-awareness training vendor private.

Airborne Drones Are Dropping Cyber-Spy Exploits in the Wild

Drone-based cyberattacks to spy on corporate targets are no longer hypothetical, one incident from this summer shows.

Key Takeaways From Omdia's IGA Market Radar

Identity governance administration (IGA) started life as a tool for organizations to meet a sudden surge of legal and regulatory requirements, but it has grown into a key enabler of security.

Android Leaks Wi-Fi Traffic Even When VPN Protection Features Are On

The platform lets network connectivity data escape outside of the secure tunnel when connected to a public network, posing a "privacy concern" for users with "certain threat models," researchers said.

5 Signs That It's Time to Invest in Data Loss Prevention

Automation means more attacks. It also means smarter, easier-to-implement prevention techniques. Here are five signs it is time to put your own data loss prevention strategy into place.

2 Out of 3 Companies See Zero Trust Network Access as Key to Mitigate Work-From-Anywhere Risks, According to New EMA Report

Report also shows that cloud-based solutions minimize complexity to enable easy adoption by small to midsize businesses.

Palo Alto Networks Ushers in the Next-Generation Security Operations Center With General Availability of Cortex XSIAM — the Autonomous Security Operations Platform

Early adopters reaping the benefits of improved SOC operations and efficiencies.

Microsoft Addresses Zero-Days, but Exchange Server Exploit Chain Remains Unpatched

The computing giant didn't fix ProxyNotLogon in October's Patch Tuesday, but it disclosed a rare 10-out-of-10 bug and patched two other zero-days, including one being exploited.

Dependency Management Aims to Make Security Easier

Existing software security firms and new startups tackle the tasks of exposing dependencies and helping developers manage their use of open-source components.

Intel Processor UEFI Source Code Leaked

Exposed code included private key for Intel Boot Guard, meaning it can no longer be trusted, according to a researcher.

It's Time to Make Security an Innovation Enabler

How data-driven security can best safeguard your unique cloud operations.

Skybox Security Unveils Industry's First SaaS Solution For Security Policy and Vulnerability Management Across Hybrid Environments

Skybox Security Cloud Edition ushers in a new era of proactive cybersecurity .

DigiCert Root CA Approved for Matter Device Attestation by Connectivity Standards Alliance

DigiCert ready to help smart home device manufacturers achieve Matter compliance rapidly and at scale.

Delinea Releases 'Cloud Server Privilege Management for Dummies' eBook

.

Stairwell Announces $45M Series B Funding Round

Investment led by Section 32 will be used to scale the product and team.

Cybersecurity Survey of State CISOs Identifies Many Positive Trends

.

Emotet Rises Again With More Sophistication, Evasion

An analysis of the malware and its infection strategies finds nearly 21,000 minor and 139 major variations on the malware — complexity that helps it dodge analysis.

US Airports in Cyberattack Crosshairs for Pro-Russian Group Killnet

Killnet calls on other groups to launch similar attacks against US civilian infrastructure, including marine terminals and logistics facilities, weather monitoring centers, and healthcare systems.

Zimbra RCE Bug Under Active Attack

A flaw in unpatched Zimbra email servers could allow attackers to obtain remote code execution by pushing malicious files past filters.

6 Things Every CISO Should Do the First 90 Days on the Job

A CISO's responsibilities have evolved immensely in recent years, so their first three months on the job should look a different today than they might have several years ago.

Email Defenses Under Siege: Phishing Attacks Dramatically Improve

About 1 in 5 phishing email messages reach workers' inboxes, as attackers get better at dodging Microsoft's platform defenses and defenders run into processing limitations.

Credential Harvesting Is Retail Industry's Top Threat

Why bother with new tactics and exploits when the old tricks are still effective?

Meta Flags Malicious Android, iOS Apps Affecting 1M Facebook Users

Some 400 mobile apps have posed as legitimate software on Google Play and the Apple App Store over the past year, and were designed to steal Facebook user credentials.

State Bar of Georgia Notifies Members and Employees of Cybersecurity Incident

Current and former employees and members are being offered complimentary credit monitoring and identity protection services as some personal information may have been accessed.

We Can Save Security Teams From Crushing Workloads. Will We?

Today, the processing of mountain-high stacks of alarms is considered "security." That system is failing customers and the cybersecurity workforce.

CyberRatings.org Invites Industry Participation in Forthcoming Enterprise Firewall and Data Center Firewall Tests

Test methodologies published today, and their scope includes security effectiveness, performance, stability and reliability, and total cost of ownership.

Sharing Knowledge at 44CON

The infosec conference named after the UK's calling code returned this year with a focus on building a healthy community.

macOS Archive Utility Bug Lets Malicious Apps Bypass Security Checks

Exploit allows unsigned and unnotarized macOS applications to bypass Gatekeeper and other security, without notifying the user.

Russian Hackers Shut Down US State Government Websites

Russian-speaking cyberattackers boast they are behind disruption of Colorado, Kentucky, and Mississippi government websites.

US Consumers Are Finally Becoming More Security & Privacy Conscious

The trend, spotted by Consumer Reports, could mean good news for organizations struggling to contain remote work challenges.

School Is in Session: 5 Lessons for Future Cybersecurity Pros

Opportunities in the field continue to grow — and show no signs of slowing down.

Contrast Security Launches Expanded Security Testing Tools for JavaScript and Popular Angular, React, and jQuery Frameworks

New language and framework support empowers developers to analyze front-end code for vulnerabilities throughout the development lifecycle.

Relentless Russian Cyberattacks on Ukraine Raise Important Policy Questions

Microsoft cybersecurity executive John Hewie explained cyberwar developments and what they mean for Western democratic policy going forward.

Ikea Smart Light System Flaw Lets Attackers Turn Bulbs on Full Blast

With just one malformed Zigbee frame, attackers could take over certain Ikea smart lightbulbs, leaving users unable to turn the lights down.

CISA: Multiple APT Groups Infiltrate Defense Organization

Advanced attackers gained access to Microsoft Exchange services, conducted searches of email, and used an open source toolkit to collect data from the network for nearly a year.

NullMixer Dropper Delivers a Multimalware Code Bomb

In one shot, Trojan dropper NullMixer installs a suite of downloaders, banking Trojans, stealers, and spyware on victims' systems.

Giving Away the Keys to Your Backups? Here’s How to Keep Out Hackers

As threat actors' sophistication has grown dramatically in the last few years, organizations haven't kept up with implementing the necessary countermeasure controls.

RatMilad Spyware Scurries onto Enterprise Android Phones

A novel mobile malware found lurking behind a phone-spoofing app is being distributed via Telegram and a dedicated website, in a broad operation to monitor corporate victims.

The Insecurities of Cybersecurity Success

Becoming a big wheel doesn't have to cost your happiness, but grind culture makes that likely.

Expert Insights: How to Protect Sensitive Machine-Learning Training Data Without Borking It

Another element of ML security is the data used to train the machine learning system itself.

Exposure Management? Understanding the Attacker Takes Center Stage

Announcing its exposure management platform, Tenable joins other companies in offering ways — such as attack surface management — to look at business networks through the eyes of attackers.

Microsoft Updates Mitigation for Exchange Server Zero-Days

Researchers had discovered that Microsoft's original mitigation steps for the so-called "ProxyNotShell" flaws was easily bypassed.

Aussie Telco Telstra Breached, Reportedly Exposing 30,000 Employees' Data

The Telstra cyber incident comes just weeks after its main rival Optus suffered a major compromise of its customer database.

Former NSA Employee Faces Death Penalty for Selling Secrets

Suspect allegedly thought he was swapping secrets with a foreign government for crypto — but it turned out to be an FBI agent.

Workforce Data Privacy in the Modern Work Era

It takes culture as well as individual and corporate responsibilities to ensure workforce data privacy and compliance.

Steam Gaming Phish Showcases Browser-in-Browser Threat

Attackers are using the recently emerged browser-in-the-browser phishing technique to steal accounts from Valve's popular gaming platform, but it's a warning shot to businesses.

More Than 30% of All Malicious Attacks Target Shadow APIs

New research spotlights how attackers are capitalizing on API-driven innovation.

Eclypsium Raises Series B to Protect Digital Supply Chain As Attacks Grow

The new round highlights market demand to protect global businesses from soaring breaches through supply chains of critical hardware, devices, firmware, and software.

Aryaka Delivers Zero-Trust WAN Based on Unified SASE Architecture

The new offering integrates firewall-as-a-service and secure web gateway into cloud-managed networking and security services.

Ransomware 3.0: The Next Frontier

Attackers are already circling back to reselling stolen data instead of — and in addition to — extortion.

Tidal Cyber Closes $4M Funding Round to Continue Making Threat-Informed Defense Achievable

.

Bumblebee Malware Loader's Payloads Significantly Vary by Victim System

On some systems the malware drops infostealers and banking Trojans; on others it installs sophisticated post-compromise tools, new analysis shows.

First 72 Hours of Incident Response Critical to Taming Cyberattack Chaos

Responding to cyberattacks is extraordinarily stressful, but better planning, frequent practice, and the availability of mental health services can help IR professionals, a survey finds.

Vice Society Publishes LA Public School Student Data, Psych Evals

After a flat refusal to pay the ransom, Los Angeles Unified School District's stolen data has been dumped on the Dark Web by a ransomware gang.

Name That Edge Toon: Mumbo Dumbo

Come up with a clever caption, and our panel of experts will reward the winner with a $25 Amazon gift card.

The Top 4 Mistakes in Security Programs to Avoid

Overlooking even just a single security threat can severely erode a company’s community and consumer confidence, tarnish reputation and brand, negatively impact corporate valuations, provide competitors with an advantage, and create unwanted scrutiny.

How AWS, Cisco, Netflix & SAP Are Approaching Cybersecurity Awareness Month

This year's theme is "See Yourself in Cyber," and these security folks are using the month to reflect on the personal factor in cybersecurity.