Technology has supercharged marketing. The vast data at marketers’ disposal provides unparalleled insight into what customers want, why they want it, and how they use products and services. Behavioral analytics benefits businesses and consumers; it allows companies to drive sales…
Category: Blog RSS Feed
The Top 10 Highest Paying Jobs in Cybersecurity – Part 2
It’s no secret that we’re (still) in an international cyber talent crisis, and that skilled workers are in high demand. We conducted research into the top ten highest paying jobs in cybersecurity to find out just what kind of opportunities…
Decryption tool for Akira ransomware available for free
There’s good news for any business which has fallen victim to the Akira ransomware. Security researchers at anti-virus company Avast have developed a free decryption tool for files that have been encrypted since the Akira ransomware first emerged in March…
12 Essential Tips for Keeping Your Email Safe
Hey, did you get that sketchy email? You know, the one from that malicious hacker always trying to fool us into clicking on some malware? Boy, these criminals are relentless. Wait, what? You clicked on it? Uh-oh… A hypothetical scenario,…
PCI DSS 4.0 Requirements –Test Security Regularly and Support Information Security with Organizational Policies and Programs
The Payment Card Industry Data Security Standard (PCI DSS) has always been a massive security undertaking for any organization that has worked to fully implement its recommendations. One interesting aspect that seems to be overlooked is the focus on the…
Phishing Trends and Tactics: Q1 of 2023
In the world of cybersecurity, there are a few constants, one of the big ones being the fact that news, innovation, and threats move fast and are constantly evolving. It is important for security professionals to stay in the loop…
Tripwire Patch Priority Index for June 2023
Tripwire’s June 2023 Patch Priority Index (PPI) brings together important vulnerabilities for Microsoft and Progress MOVEit. First on the patch priority list this month are patches for the Progress MOVEit Transfer application. An exploit targeting the MOVEit vulnerability CVE-2023-34362 has…
5 Things Everyone Needs to Know About GRC
Over the following years, the costs associated with cybercrime, projected at $10.5 trillion annually by 2025, will exceed the estimated worldwide cybersecurity spending—$267.3 billion annually by 2026. Leadership needs to change its perspective on managing cyber risks instead of just…
5 Cyber Survival Tips for Businesses
The past few years have been among the most challenging for most businesses. Lockdowns, staff reductions, and reduced revenues resulted in the demise of many businesses. For those who remained, the new onuses brought about by supply chain concerns and…
The Top 10 Highest Paying Jobs in Cybersecurity – Part 1
If you’re looking for job security, look no further: The cybersecurity sector can keep you gainfully employed for a very, very long time. There are an ever-growing number of ways in which someone with cybersecurity prowess can contribute, and as…
PCI DSS 4.0 Requirements – Restrict Physical Access and Log and Monitor All Access
Most data crimes are the result of online compromises. This makes sense, as the criminals don’t need to know any of the old, dirty, hands-on techniques such as lock-picking, dumpster diving, or any other evasive maneuvers to carry out a…
What is the FFIEC Cybersecurity Assessment Tool?
The FFIEC Cybersecurity Assessment Tool (CAT) is a diagnostic test designed to help institutions identify risks and gauge cybersecurity preparedness. The tool is primarily for financial and non-depository institutions, enabling organizations to make risk-driven security decisions informed by regular cybersecurity…
API Security: Navigating the Threat Landscape
An Application Programming Interface (API) is an essential and ubiquitous software that allows the exchange of information between day-to-day applications and processes, such as Software as a Service (SaaS) applications, Internet of Things (IoT) devices, universal profile login pages, and…
Is CMMC 2.0 Rollout on the Horizon?
The Department of Defense (DoD) introduced the Cybersecurity Maturity Model Certification (CMMC) in 2019. This framework outlined a series of security standards contractors must meet to win DoD contracts, so it’s a big concern for many companies. However, four years…
Infosecurity Europe 2023 – that’s a wrap!
This piece was originally published on Fortra’s blog. Infosecurity Europe has closed its doors for another year. The aftermath of these events can be a strange time; still reeling from the chaos of the show floor and nursing feet unaccustomed…
What is the Gramm-Leach-Bliley Act (GLBA)?
The Gramm-Leach Bliley Act (GLBA or GLB Act), or financial modernization act, is a bi-partisan federal regulation passed in 1999 to modernize the financial industry. It repealed vast swathes of the Glass-Steagall Act of 1933 and the Bank Holding Act…
What (Still) Needs to be Done to Secure the U.S. Power Grid in 2023?
It’s no secret that the U.S. power grid is one of the main foundations of the nation’s economy, infrastructure, and daily way of life. Now that almost everything is digitized, it is hinging on it even more. We wouldn’t be…
A Guide to 5 Common Twitter Scams in 2023
Elon Musk’s ascension isn’t the first thing to cause waves of scams on Twitter, and it certainly won’t be the last. On July 20th of 2022, data belonging to over 5 million Twitter users was put up for sale on…
A Sarbanes-Oxley Act (SOX) IT Compliance Primer
At the turn of the most recent century, the financial world was in a moment of unregulated growth, which lead to some serious corporate misdeeds in the United States. This presented the opportunity for two senators to enact a new…
What Is SCM (Security Configuration Management)?
Attackers always seek the easiest path to get into our systems and compromise data. System misconfigurations and insecure default settings are often the criminals’ favorite vectors since these errors allow them easy access to critical systems and data. The rise…
BlackLotus bootkit patch may bring “false sense of security”, warns NSA
The NSA has published a guide about how to mitigate against attacks involving the BlackLotus bootkit malware, amid fears that system administrators may not be adequately protected against the threat. The BlackLotus UEFI bootkit made a name for itself in…
Insider Risk Hits Closer to Home
If you’re busy securing the perimeter, mandating strong authentication practices, and restricting software downloads, you may be missing the mark. (Just to be clear: if you are doing those things, keep it up. You’re off to a good start, and…
PCI DSS 4.0 Requirements – Restrict Access, Identify Users and Authenticate Access
In the early days of computer networking, the idea of restricted permissions was shunned. Network administrators could access every system in the environment. In some extreme cases, a CEO would demand full administrative access to a network, thinking that this…
2023 Zero Trust Security Report Highlights
Zero trust is a hot topic in cybersecurity, and for a good reason. There is no one-size-fits-all solution to securing your data and networks; rather, zero trust offers a more holistic perspective comprised of many different safety measures and practices…
The Real Value-Add of Red Teaming
They say character isn’t gained in a crisis; it’s displayed in one. By the time the disaster hits, the time for preparation has passed. But what if you could go through that earth-shattering event beforehand so when the time came,…
SBOM Security: Fundamentals and Best Practices
What Is an SBOM (Software Bill of Materials)? A software bill of materials (SBOM) is a comprehensive, structured inventory of all components, libraries, and dependencies used within a software product or application. It typically includes information about the names, versions,…
How to Protect Against the Four Largest Cybersecurity Threats to Your Supply Chain
Digital technology is becoming an increasingly essential part of nearly every industry, and supply chains are no exception. In recent years, supply chains have become more dependent on digital solutions, from manufacturing, packing, and shipping processes, to storing records in…
5 Malware Trends on the Horizon
Cybercrime has become a dominant concern for many businesses, as well as individuals. Cybercriminals will target any business, and any individual if they can realize a profit from their minimal efforts. One of the ways that criminals achieve their goals…
The Wonderful Cybersecurity Community: Watching Past Employees Succeed
The cybersecurity community is one of the best communities around. Whether it is our peers, our colleagues, or our managers, there are a number of great qualities that we all share. That’s one of the reasons that we’re so lucky…
PCI DSS 4.0 Requirements – Protect from Malicious Software and Maintain Secure Systems and Software
We often hear how a company was compromised by a sophisticated attack. This characterization contains all the romantic thrill of a spy movie, but it is usually not how most companies are victimized. Most breaches usually happen as a result…
VERT Threat Alert: June 2023 Patch Tuesday Analysis
Today’s VERT Alert addresses Microsoft’s June 2023 Security Updates, which include a new release notes format. VERT is actively working on coverage for these vulnerabilities and expects to ship ASPL-1060 on Wednesday, June 14th. In-The-Wild & Disclosed CVEs There were…
US charges two men with Mt. Gox heist, the world’s largest cryptocurrency hack
More than ten years after the hack of the now-defunct Mt. Gox cryptocurrency exchange, the US Department of Justice says it has identified and charged two men it alleges stole customers’ funds and the exchange’s private keys. Two Russians, 43-year-old…
ChatGPT and Data Privacy
In April 2023, German artist Boris Eldagsen won the open creative award for his photographic entry entitled, Pseudomnesia: The Electrician. But, the confusing part of the event for the judges and the audience was that he refused to receive the…
The Role of the SEC in Enforcing InfoSec Legislation
What is the SEC? Founded 85 years ago at the height of the Great Depression, the Securities and Exchange Commission (SEC) has a clear mission: to protect investors, maintain fair, orderly, and efficient markets, and facilitate capital formation. Put simply,…
Minding Your Data Leaks: Simple Steps to Help Prevent Leaks
If you mention data leakage to most people, they may think that it sounds like a problem for a plumber, but the phrase “data leak” has specific and troubling concerns for a business. Data leakage is a particular security threat,…
Malware menaces Minecraft mods
If you, or your kids, are fans of Minecraft – you might be wise not to download any new mods of plugins for a while. Computer security researchers say that they have uncovered that cybercriminals have succeeded in embedding malware…
Offbeat Social Engineering Tricks in a Scammer’s Handbook
Contrary to stereotype, today’s cyberattacks aren’t limited to complex tactics such as the use of zero-day exploits or polymorphic malware that flies under the radar of traditional defenses. Instead of going the extra mile to set such schemes in motion,…
PCI DSS 4.0 Requirements – Protect Stored Account Data and Protect Cardholder Data During Transmission
If someone asked you “are you protecting your data,” your initial response would probably be to clarify what they are referring to specifically, since the question is so broadly stated. You could just reply with a terse “Yes,” but that…
Tripwire Patch Priority Index for May 2023
Tripwire’s May 2023 Patch Priority Index (PPI) brings together important vulnerabilities for Microsoft. First on the patch priority list this month are patches for Microsoft Edge. These patches resolve elevation and security feature bypass vulnerabilities. Up next are 3 patches…
Has Ransomware Turmoil Started Slowing Down for Good?
On the surface, ransomware – malicious software designed to block access to a computer system until a sum of money is paid – appears to be off to yet another ruthless start in 2023 as one of the leading types…
What APIs Do and Don’t Do
It’s hard to be in the realm of technology and not hear about APIs these days. Whether it’s the launch of the ChatGPT API or news of a significant data breach at Twitter, APIs are having their time in the…
The Future of Driverless Cars: Technology, Security and AI
Back in 2015, we published an article about the apparent perils of driverless cars. At that time, the newness and novelty of sitting back and allowing a car to drive you to your destination created a source of criminal fascination…
How to Avoid Cybercrime While Traveling Internationally
Traveling abroad, whether for business or leisure, brings plenty of tangible benefits to individuals and organizations. Coupled with the convenience of innovative technology at our fingertips, business professionals can achieve a lot if they spend much of their time on…
Elevate Your Cloud Defense: 6 Top Strategies for Safeguarding Cloud-Native Apps
A cloud-native application is specifically created to operate seamlessly within a cloud environment, taking advantage of cloud infrastructure and services to achieve top-notch performance, adaptability, and reliability. They use microservices instead of monolithic structures, allowing independent development and deployment. Microservices…
Decade-old critical vulnerability in Jetpack patched on millions of WordPress websites
Jetpack. an extremely popular WordPress plugin that provides a variety of functions including security features for around five million websites, has received a critical security update following the discovery of a bug that has lurked unnoticed since 2012. Jetpack’s maintainers,…
PCI DSS 4.0 Requirements – Network Security Controls and Secure Configuration
We have officially entered the 12-month countdown to the enactment of the new Payment Card Industry Data Security Standard (PCI DSS). The new version, 4.0, set to go into effect on April 1, 2024, contains some interesting and notable changes.…
Cybersecurity Standards in the Banking Industry
Cybersecurity has risen to become a major concern for nearly every industry. With the constant stream of news about the escalating numbers of breaches, it is understandable that governments have taken a more active role by passing cybersecurity and privacy…
The Issue of Insider Threats: What you Need to Know
Not all Risks Become Threats Insider threats are an updated version of the wolf in sheep’s clothing – the people we rely on to safeguard systems and data can sometimes be the ones who pose the greatest risk. From malicious…
PCI DSS 4.0: How to Delight the Auditors
While we all know the actual point of PCI is vastly more far-reaching, we can’t deny that the juggernaut of PCI DSS 4.0 compliance is getting past the auditors. However, there is a right way to do it that doesn’t…
How Large is Your Target? Advice for the Smallest Businesses
Most cybersecurity professionals will often try to cybersplain the importance of protection to their friends. In most social circles, many of the businesses that people work in are small businesses. Perhaps you are the owner of a small delicatessen, a…
The Royal & BlackCat Ransomware: What you Need to Know
The US healthcare sector continues to be aggressively targeted by ransomware operators. Royal and BlackCat are two of the more recent – and highly sophisticated – ransomware threats. These two new flavors of ransomware pose serious potential impacts on the…
A Brief Introduction to the World of IP Addresses
How many internet-connected devices do you own? If you took a quick inventory around your house, you may be surprised at exactly how many there are. Have you ever wondered how they all communicate, not only with each other, but…
Rogue IT security worker failed to cover his tracks
Bad enough for your company to be held to ransom after a cyber attack. Worse still to then have one of your own employees exploit the attack in an attempt to steal the ransom for themselves. That’s the situation gene…
Cybersecurity Asset Inventory in Your Home
Back in 2015, we published an article about the third party risks that are introduced into a home network. Now, eight years later, it is a good time to revisit the landscape of the home network. If we think about…
Security Awareness Training (SAT) is finally having its day. Here’s why.
Cybersecurity awareness is on the rise as more organizations adopt security awareness training programs. Why the hype? In several recent reports, we break down our findings around why SAT is on the rise—and why companies need it now more than…
Understanding how Polymorphic and Metamorphic malware evades detection to infect systems
Polymorphic and metamorphic malware constantly changes itself in order to avoid detection and persistently remain on the system. This adaptive behavior is the main distinctive attribute of these types of malware, which is also why they are harder to detect;…
A Bright Future for Forensic Analysis
I’m going to jump on board the Artificial Intelligence/Machine Learning (AI/ML) bandwagon in this blog and talk about why I’m excited about some of the prospects for this being applied to the compliance and file integrity monitoring data that Tripwire…
#TripwireBookClub – How to Hack Like a Legend
This one took a bit longer to read than most of the books we review, but that’s entirely on me… everyone else finished it a while ago. This time around, we’re looking at How to Hack Like a Legend: Breaking…
Do you Work in a SOC Noise Factory?
Gabrielle is a security engineer. She deploys tools to scan for threats and vulnerabilities, read logs, and manage the security risks for her company, but is all that data really helping? Sometimes, it seems like she works in a noise…
How ChatGPT is Changing Our World
The Artificial intelligence (AI) based language model, ChatGPT, has gained a lot of attention recently, and rightfully so. It is arguably the most widely popular technical innovation since the introduction of the now ubiquitous smart speakers in our homes that…
VERT Reads All About It – Cybersecurity News May 22, 2023
The Tripwire Vulnerability Exposure and Research Team (VERT) keeps its finger on the cybersecurity pulse. Check out some of the stories that stood out for us recently: Multiple Vulnerabilities in Netgear Routers Netgear RAX30 routers are subject to multiple vulnerabilities.…
Take action now to avoid BianLian ransomware attacks, US Government warns organisations
The US Cybersecurity and Infrastructure Security Agency (CISA), FBI, and others have issued a joint alert, advising organisations of the steps they should take to mitigate the threat posed by BianLian ransomware attacks. BianLian, which has been targeting different industry…
Risk Tolerance: Understanding the Risks to your Organization
‘A ship in port is safe, but that’s not what ships are built for,’ said Dr. Grace Hopper, Rear Admiral of the US Navy and a computer pioneer. As soon as the ship leaves the harbor, or even the dock,…
Security Journeys: From Change Management to Compliance
Zero Trust seems to no longer command the volume of articles that once set it up as a trend that promised a bright new future for security. This is in part because security is a journey. Rushed implementations and low…
Common Social Media Scams and How to Avoid Them
While there are an estimated 30,000 daily cyber attacks on business websites, there are roughly ten times as many attacks against social media accounts every single day, equating to roughly 1.4 billion accounts every month. Social media attacks and scams…
Q1 2023 Privacy: In for Another Wild Year
2023 started much the same as the year before, with state legislatures producing an impressive list of privacy-related bills in the U.S. Twenty-three states introduced comprehensive privacy legislation, with many more targeted privacy bills being considered as well. Iowa’s governor…
How to comply with PCI DSS 4.0 while juggling day-to-day tasks
In our webinar, Insights for Navigating PCI DSS 4.0 Milestones, we discuss some of the challenges organizations face as they try to comprehend the new requirements of PCI DSS 4.0. One of the questions we commonly hear is, “How do…
Tripwire Products: Quick Reference Guide
Here at The State of Security, we cover everything from breaking stories about new cyberthreats to step-by-step guides on passing your next compliance audit. But today we’d like to offer a straight-forward roundup of Fortra’s Tripwire product suite. Get to…
Beyond the firewall: How social engineers use psychology to compromise organizational cybersecurity
A Social engineering attack is the process of exploiting weaknesses in human psychology to manipulate and persuade others to perform in a way that is harmful. Prior to the digital age, criminals would carry out these attacks in person, in…
Akira ransomware – what you need to know
What is Akira? Akira is a new family of ransomware, first used in cybercrime attacks in March 2023. Akira? Haven’t we heard of that before? Maybe you’re thinking of the cyberpunk Manga comic books and movie that came out in…
Red Teaming: 4 Ways to Get the Best Value While Improving Your Security
What is Red Teaming? Red Teaming will always have similar concepts and strategies, but no Red Team endeavour is the same, and the meaning may change from one organization to another. Simply stated, Red Teaming is acting as an adversary…
3 Tips for Enterprise Patch Management
We have recently concluded the first quarter of 2023, and there have already been over 250 patches for the many components and flavours of Microsoft’s operating systems, as well as a handful of patches for Adobe, Apple, and Android. If…
Professional Services in the World of Cybersecurity
Cybersecurity is a critical concern for businesses of all sizes and industries. With the increasing sophistication of cyber threats, it’s more important than ever to have a robust security strategy in place. However, many organizations lack the expertise or resources…