70% of customer-facing APIs are secured using HTTPS, leaving nearly one-third of these APIs completely unprotected, according to F5. This is a stark contrast to the 90% of web pages that are now accessed via HTTPS, following the push for…
Category: Help Net Security
Microsoft patches two zero-days exploited in the wild (CVE-2024-43573, CVE-2024-43572)
For October 2024 Patch Tuesday, Microsoft has released fixes for 117 security vulnerabilities, including two under active exploitation: CVE-2024-43573, a spoofing bug affecting the Windows MSHTML Platform, and CVE-2024-43572, a remote code execution flaw in the Microsoft Management Console (MMC).…
Ivanti fixes three CSA zero-days exploited in the wild (CVE-2024-9379, CVE-2024-9380, CVE-2024-9381)
Ivanti has patched three additional Cloud Service Appliance (CSA) zero-day flaws, which have been exploited by attackers in conjuction with a zero-day bug the company accidentally fixed in September. The fixed zero-days “We are aware of a limited number of…
OpenBSD 7.6 released: security improvements, new hardware support, and more!
OpenBSD is a free, multi-platform 4.4BSD-based UNIX-like operating system. The 57th release, OpenBSD 7.6, comes with new features, various improvements, bug fixes, and tweaks. Security improvements Added -fret-clean option to the compiler, defaulting to off. This new option causes the…
Dashlane Credential Risk Detection prevents credential-based breaches
Dashlane launched Credential Risk Detection, a solution that continuously monitors and detects at-risk credential activity in real-time across the workforce, whether employees use a password manager or not. The web extension-based solution is the latest Dashlane innovation that shifts credential…
Data Theorem Code Secure helps security and DevOps teams secure their software
Data Theorem launched Code Secure, the latest evolution in application security designed to protect the software supply chain from code to deployment. Code Secure uniquely integrates Static Application Security Testing (SAST), Software Composition Analysis (SCA), and Supply Chain Security capabilities—including…
Juniper Secure AI-Native Edge accelerates detection of potential network threats
Juniper Networks announced its new Juniper Secure AI-Native Edge solution, with a new Security Assurance product, combining Juniper Mist’s AI-Native and cloud-native network operations with the efficacy security solution. By integrating network and security operations together under a single cloud…
OTAVA S.E.C.U.R.E. Score simplifies cybersecurity strategy for businesses
OTAVA introduced the OTAVA S.E.C.U.R.E. Score to help businesses further improve their security posture. The S.E.C.U.R.E. Score is a dynamic metric that assesses vulnerabilities, and makes recommendations on how to close security gaps and minimize risk. The S.E.C.U.R.E. acronym stands…
Qualcomm zero-day under targeted exploitation (CVE-2024-43047)
An actively exploited zero-day vulnerability (CVE-2024-43047) affecting dozens of Qualcomm’s chipsets has been patched by the American semiconductor giant. About CVE-2024-43047 On Monday, Qualcomm has confirmed patches for 20 vulnerabilities affecting both proprietary and open source software running on its…
American Water shuts down systems after cyberattack
American Water, the largest water and wastewater utility company in the US, has shut down some of its systems following a cyberattack. While the company confirmed that none of its water or wastewater facilities or operations have been negatively affected…
BreachLock Attack Surface Analytics strengthens enterprise CTEM capabilities
BreachLock strengthens continuous threat exposure management (CTEM) capabilities for enterprise customers with its new Attack Surface Analytics feature. Time is of the essence when Fortune 500 security teams find themselves waking up to a Code Red vulnerability being actively exploited.…
SimSpace’s OT content enhancements improve critical infrastructure security
SimSpace announced its enhanced OT (Operational Technology) content, now offering more realistic and high-fidelity training and emulation. As OT cybersecurity becomes increasingly critical for industries relying on operational systems, SimSpace has invested in this content to ensure that organizations are…
The role of self-sovereign identity in enterprises
As personal data becomes increasingly commodified and centralized, the need for individuals to reclaim control over their identities has never been more urgent. Meanwhile, traditional identity systems used by enterprises often expose sensitive information to unnecessary risk, leaving both users…
How hybrid workforces are reshaping authentication strategies
In this Help Net Security interview, Brian Pontarelli, CEO at FusionAuth, discusses the evolving authentication challenges posed by the rise of hybrid and remote workforces. He advocates for zero trust strategies, including MFA and behavioral biometrics, to enhance security while…
Websites are losing the fight against bot attacks
The discovery that 95% of advanced bot attacks go undetected points to a weakness in current detection and mitigation strategies. This suggests that while some organizations may have basic defenses, they are ill-equipped to handle more sophisticated attacks, such as…
Webinar: ManageEngine Log360 product demo
Discover how ManageEngine Log360, a comprehensive SIEM solution empowers you to prevent internal security breaches, safeguard your network from external threats, protect sensitive data, and ensure compliance with stringent regulatory mandates. Schedule a personalized demo Be a part of this…
Action1 offers extended endpoint management capabilities for macOS devices
Action1 announced its latest product release. As part of its platform enhancements, Action1 has introduced a new agent for macOS, enabling organizations with diverse IT environments to ensure unified, cross-platform patching automation and integrated software vulnerability management. As the world’s…
Linux systems targeted with stealthy “Perfctl” cryptomining malware
Thousands of Linux systems are likely infected with the highly elusive and persistent “perfctl” (or “perfcc“) cryptomining malware and many others still could be at risk of getting compromised, Aqua Security researchers revealed last week. “In all the attacks observed,…
Transforming cloud security with real-time visibility
In this Help Net Security interview, Amiram Shachar, CEO at Upwind, discusses the complexities of cloud security in hybrid and multi-cloud environments. He outlines the need for deep visibility into configurations and real-time insights to achieve a balance between agility…
The case for enterprise exposure management
For several years, external attack surface management (EASM) has been an important focus for many security organizations and the vendors that serve them. EASM, attempting to discover the full extent of an organization’s external attack surface and remediate issues, had…
SOC teams are frustrated with their security tools
Security operations center (SOC) practitioners believe they are losing the battle detecting and prioritizing real threats – due to too many siloed tools and a lack of accurate attack signal, according to Vectra AI. They cite a growing distrust in…
Rspamd: Open-source spam filtering system
Rspamd is an open-source spam filtering and email processing framework designed to evaluate messages based on a wide range of rules, including regular expressions, statistical analysis, and integrations with custom services like URL blacklists. The system analyzes each message and…
Meet the shared responsibility model with new CIS resources
You can’t fulfill your end of the shared responsibility model if you don’t emphasize secure configurations. Depending on the cloud services you’re using, you’re responsible for configuring different things. Once you figure out those responsibilities, you then need to perform…
Week in review: Critical Zimbra RCE vulnerability exploited, Patch Tuesday forecast
Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: October 2024 Patch Tuesday forecast: Recall can be recalled October arrived, and Microsoft started the month by announcing the release of Windows 11 24H2. The…
100+ domains seized to stymie Russian Star Blizzard hackers
Microsoft and the US Justice Department have seized over 100 domains used by Star Blizzard, a Russian nation-state threat actor. “Between January 2023 and August 2024, Microsoft observed Star Blizzard target over 30 civil society organizations – journalists, think tanks,…
October 2024 Patch Tuesday forecast: Recall can be recalled
October arrived, and Microsoft started the month by announcing the release of Windows 11 24H2. The preview versions of this release have been in the news due to many innovations and one controversial feature. Windows 11 24H2 and Microsoft Recall…
Best practices for implementing threat exposure management, reducing cyber risk exposure
In this Help Net Security interview, Sanaz Yashar, CEO at Zafran, discusses the role of threat exposure management (TEM) in modern cybersecurity strategies. As traditional vulnerability management evolves, TEM addresses the overwhelming risks arising from expanded attack surfaces and fragmented…
MaLDAPtive: Open-source framework for LDAP SearchFilter parsing, obfuscation, and more!
MaLDAPtive is an open-source framework for LDAP SearchFilter parsing, obfuscation, deobfuscation, and detection. At its core, the project features a custom-built C# LDAP parser designed for tokenization and syntax tree parsing. It also incorporates specialized properties to ensure precise obfuscation,…
Cybercriminals capitalize on poorly configured cloud environments
Off-the-shelf offensive security tools and poorly configured cloud environments create openings in the attack surface, according to Elastic. Adversaries are utilizing off-the-shelf tools Offensive security tools (OSTs), including Cobalt Strike and Metasploit, made up ~54% of observed malware alerts. The…
New infosec products of the week: October 4, 2024
Here’s a look at the most interesting products from the past week, featuring releases from Balbix, Halcyon, Metomic, Red Sift, SAFE Security, Veeam Software, and Legit Security. SAFE X equips CISOs with integrated data from all their existing cybersecurity products…
Critical Ivanti Endpoint Manager flaw exploited (CVE-2024-29824)
CVE-2024-29824, an unauthenticated SQL Injection vulnerability in Ivanti Endpoint Manager (EPM) appliances, is being exploited by attackers, the Cybersecurity and Infrastructure Security Agency has confirmed by adding the bug to its Known Exploited Vulnerabilities catalog. Ivanti did the same by…
Darktrace brings real-time cloud detection and response to Microsoft Azure customers
Darktrace announced the expansion of Darktrace / CLOUD to support Microsoft Azure environments. The AI-driven Cloud Detection and Response (CDR) system leverages Microsoft’s virtual network flow logs for agentless deployment, slashing deployment times by 95%. The need for AI-driven cloud…
Malwarebytes Browser Guard updates block unwanted and unsafe content
Malwarebytes released new features for Browser Guard, its free browser extension for Chrome, Edge, Firefox, and Safari that blocks content identified as potentially unwanted and unsafe. Users will now receive a pop-up alert if a website was involved in a…
CUPS vulnerabilities could be abused for DDoS attacks
While the Common UNIX Printing System (CUPS) vulnerabilities recently disclosed by researcher Simone “evilsocket” Margaritelli are not easily exploited for remote command execution on vulnerable systems, they could offer more opportunity to attackers who engage in DDoS attacks, Akamai threat…
Legit Posture Score empowers security teams to measure and manage their AppSec posture
Legit Security launched its new “Legit Posture Score,” delivering a dynamic, comprehensive, and fully transparent ASPM rating system. Now security teams can proactively measure and manage their AppSec posture instantly with a holistic score that eliminates security scanning siloes and…
Private US companies targeted by Stonefly APT
Undeterred by the indictment issued against one of its alleged members, North Korean APT group Stonefly (aka APT45) continues to target companies in the US, Symantec threat analysts warned. About Stonefly Also known as Andariel and OnyxFleet, Stonefly has been…
AuthenticID Velocity Checks detects fraudulent activities
AuthenticID released Velocity Checks, a new tool that integrates with its comprehensive identity verification and fraud prevention platform. The solution leverages biometric and document analysis to detect multiple identities for fraudulent activities in real-time. Fraudsters can use different names with…
Three hard truths hindering cloud-native detection and response
According to Gartner, the market for cloud computing services is expected to reach $675 billion in 2024. Companies are shifting from testing the waters of cloud computing to making substantive investments in cloud-native IT, and attackers are shifting with them.…
Spotting AI-generated scams: Red flags to watch for
In this Help Net Security interview, Andrius Popovas, Chief Risk Officer at Mano Bank, discusses the most prevalent AI-driven fraud schemes, such as phishing attacks and deepfakes. He explains how AI manipulates videos and audio to deceive victims and highlights…
How to use the Apple Passwords app
The latest Apple OS updates (iOS 18, iPadOS 18, macOS Sequoia) have introduced a standalone Passwords app, to make users’ passwords, passkeys, Wi-Fi passwords, and verification codes easily accessible. You can access the Passwords app on your iPhone, iPad, Mac,…
15% of office workers use unsanctioned GenAI tools
Rigid security protocols — such as complex authentication processes and highly restrictive access controls — can frustrate employees, slow productivity and lead to unsafe workarounds, according to Ivanti. Understanding workplace behavior key to strengthening security In fact, one in two…
Ransomware activity shows no signs of slowing down
Ransomware attacks have seen a significant resurgence, disrupting multiple sectors and affecting global supply chains. Despite efforts to disrupt major ransomware groups, incidents continue to rise, signaling an ongoing and growing threat into 2024. In this Help Net Security round-up,…
Whitepaper: Reach higher in your career with cloud security
The cybersecurity skills gap presents ongoing challenges worldwide, so organizations are scrambling to fill cloud security positions. Having a subject matter expert on staff qualified to advise on cloud security requirements is more important now than ever. Because of this…
Metomic Data Classification automates complex data management workflows
Metomic released its Data Classification solution, making it possible to discover, classify and secure sensitive data at scale across Google Workspaces. Metomic’s latest innovation is an AI-powered tool that automates complex data management workflows, enabling IT and security teams to…
Venafi helps organizations solve more machine identity security problems
Venafi introduced new product capabilities in its Control Plane for Machine Identities. This latest version of the Venafi Control Plane will enable security and platform teams to address the most critical machine identity security challenges and help future-proof their organizations,…
Concentric AI helps monitor and remediate risky Copilot activity
Concentric AI announced an AI-based DSPM functionality that identifies data access and activity risk from Copilot requests. With this launch, enterprises can now for leverage AI-driven DSPM to track, monitor and seamlessly enforce access governance around Copilot activity and abnormal…
PlexTrac unveils new capabilities to prioritize proactive security remediation
PlexTrac announced significant enhancements to its platform. These updates are designed to help enterprises and security service providers harness proactive security by offering business context, automating risk scoring to focus on what matters most, streamlining remediation workflows with event-driven interoperability,…
Harmonic Security raises $17.5 million to improve data security for organizations
Harmonic Security has secured $17.5 million in Series A funding to bring its “zero-touch data protection” capabilities to enterprises. Total funding has now reached more than $26 million since the company launched in October last year with enterprise customers already…
Critical Zimbra RCE vulnerability under mass exploitation (CVE-2024-45519)
Attackers are actively exploiting CVE-2024-45519, a critical Zimbra vulnerability that allows them to execute arbitrary commands on vulnerable installations. Proofpoint’s threat researchers say that the attacks started on September 28 – several weeks after Zimbra developers released patches for CVE-2024-45519…
4 new LockBit-related arrests, identities of suspected Evil Corp members, affiliates revealed
The third phase of Operation Cronos, which involved officers from the UK National Crime Agency (NCA), the FBI, Europol and other law enforcement agencies, has resulted in the arrest of four persons for allegedly participating in the LockBit ransomware-as-a-service operation…
Catalogic DPX 4.11 strengthens data security
Catalogic Software announced the newest version of Catalogic DPX, the company’s enterprise data protection software. DPX 4.11 provides enhanced capabilities in data recovery and data security. With this new release, Catalogic DPX continues to increase its customers ability to avoid…
SAFE X equips CISOs with integrated data from all their existing cybersecurity products
Safe Security launched SAFE X, a generative AI-powered mobile app for CISOs. SAFE X delivers CISOs real-time business impact insights into their cybersecurity posture, enabling better decision-making and risk prioritization. CISOs often invest millions of dollars in building their cyber…
Balbix D3 accelerates vulnerability mitigation
Balbix unveild Balbix D3, the latest version of its exposure management platform. Packed with AI innovations, Balbix D3 is designed to help cybersecurity teams mitigate critical exposures faster than ever before, protecting organizations against emerging threats before attackers can exploit…
Enveil enables organizations to securely train machine learning models
Enveil announced the expansion of the core technologies supported by its ZeroReveal Machine Learning product, an enhancement that will further broaden and diversify the range of customer-driven use cases the solution can address. By allowing customers to leverage Trusted Execution…
Enhancing firewall management with automation tools
In this Help Net Security interview, Raymond Brancato, CEO at Tufin, discusses the considerations organizations must weigh when selecting a next-generation firewall to effectively balance security needs with network performance. What factors should organizations prioritize when selecting a next-generation firewall…
Suricata: Open-source network analysis and threat detection
Suricata is an open-source network intrusion detection system (IDS), intrusion prevention system (IPS), and network security monitoring engine. Suricata features Suricata offers comprehensive capabilities for network security monitoring (NSM), including logging HTTP requests, capturing and storing TLS certificates, and extracting…
Cybersecurity jobs available right now: October 2, 2024
Applied Cybersecurity Engineer (Center for Securing the Homeland) MITRE | USA | Hybrid – View job details As an Applied Cybersecurity Engineer (Center for Securing the Homeland), you will apply interdisciplinary competencies in secure systems architecture and design, security operations,…
What bots mean for businesses and consumers
Simple bots have existed since the early to mid-2000s when organizations had no means to protect themselves or their website’s users from them. Yet today, despite having tools to protect against these simple bots, two in three organizations have made…
Cybersecurity hiring slows, pros’ stress levels rise
66% of cybersecurity professionals say their role is more stressful now than it was five years ago, according to ISACA. Major contributors to rising stress levels among cybersecurity professionals According to the data, the top reasons for increased stress among…
Veeam Recon Scanner identifies adversary tactics, techniques, and procedures
Veeam Software announced the addition of new Veeam Recon Scanner technology to Veeam Data Platform. This technology, developed by Coveware by Veeam, draws on years of experience in cyber-extortion incident response and the largest database of cyber incidents in the…
Red Sift Radar diagnoses issues through AI-powered insights
Red Sift launched Red Sift Radar, the upskilled LLM assistant that identifies and diagnoses misconfigurations and exposures across email, domains, and internet-facing assets, supporting security teams to prevent incidents before they happen. Malicious actors are widely exploiting AI. Crowdstrike recently…
Exabeam introduces AI-driven LogRhythm Intelligence
Exabeam announced its first quarterly product release since merging with LogRhythm. The latest innovations provide global customers with increased flexibility to choose the security solutions that best meet their specific needs based on infrastructure, regulatory requirements, and operational preference. The…
Halcyon offers ransomware protection for Linux environments
As an integral part of the Halcyon Anti-Ransomware Platform, Halcyon Linux offers protection against ransomware attacks targeting Linux systems. While ransomware operators were once almost exclusively focused on targeting Windows environments, the introduction of Linux variants represents a significant expansion…
RSA and Swissbit join forces to secure government agencies
RSA and Swissbit announced that RSA will start introducing its next-generation hardware authenticators RSA iShield Key 2 series powered by Swissbit alongside RSA ID Plus for Government. Built to meet the highest security standards, the RSA iShield Key 2 and…
ConnectSecure unveils M365 Assessment Module to help MSPs identify security weaknesses
ConnectSecure launched its new Microsoft 365 (M365) Assessment module. The solution empowers MSPs with greater visibility into Microsoft 365 configurations, offering real-time monitoring of changes and improving security controls. As the most widely used productivity suite by millions of companies…
Dragos acquires Network Perception to boost security in OT environments
Dragos announced the acquisition of Network Perception, makers of NP-View, a network visualization platform for OT networks. The acquisition will bolster the Dragos Platform with industry-leading OT network visibility along with compliance and segmentation analysis and reporting capabilities tailored to…
Use Windows event logs for ransomware investigations, JPCERT/CC advises
The JPCERT Coordination Center – the first Computer Security Incident Response Team established in Japan – has compiled a list of entries in Windows event logs that could help enterprise defenders respond to human-operated ransomware attacks and potentially limit the…
OWG Parallax Private Cloud Desktop simplifies business operations
OWG unveiled Parallax Private Cloud Desktop to provide businesses with IT solutions that ensure efficiency, security, and scalability. This next-generation cloud platform is engineered to meet the most stringent security protocols, empowering businesses to meet evolving IT challenges head-on. Brandon…
Apono raises $15.5 million to accelerate product development
Apono announced the successful completion of its Series A funding round, raising $15.5 million. The funding round was led by New Era Capital Partners, with participation from Mindset Ventures, Redseed Ventures, Silvertech Ventures, initial seed investors, and more. The newly…
3 easy microsegmentation projects
Like many large-scale network security projects, microsegmentation can seem complex, time-consuming, and expensive. It involves managing intricate details about inter-device service connectivity. One web server should connect to specific databases but not to others, or load balancers should connect to…
Password management habits you should unlearn
Despite advancements in security technology, many individuals and organizations continue to rely on outdated and vulnerable authentication methods, leaving themselves exposed to cyber threats. This ongoing reliance on insecure methods has led to a steady rise in fraud, with weak…
Reducing credential complexity with identity federation
In this Help Net Security interview, Omer Cohen, Chief Security Officer at Descope, discusses the impact of identity federation on organizational security and user experience. He explains how this approach streamlines credential management and enhances security by leveraging trusted identity…
Infosec products of the month: September 2024
Here’s a look at the most interesting products from the past month, featuring releases from: Absolute, anecdotes, ArmorCode, Binarly, Bitdefender, Druva, F5 Networks, Gcore, Guardsquare, Huntress, Ketch, LOKKER, Malwarebytes, NETGEAR, Nudge Security, Prompt Security, Rapid7, Revenera, Skyhigh Security, Strivacity, Tenable,…
Ransomware attackers hop from on-premises systems to cloud to compromise Microsoft 365 accounts
Storm-0501, an affiliate of several high-profile ransomware-as-a-service outfits, has been spotted compromising targets’ cloud environments and on-premises systems. “Storm-0501 is the latest threat actor observed to exploit weak credentials and over-privileged accounts to move from organizations’ on-premises environment to cloud…
Microsoft revised the controversial Copilot+ Recall feature
Microsoft has made changes to Recall – the screenshot-taking, AI-powered search feature for Copilot+ PCs running Windows 11 – to reassure users worried about security and privacy. The security of the feature has been assessed by Microsoft’s Offensive Research &…
SCCMSecrets: Open-source SCCM policies exploitation tool
SCCMSecrets is an open-source tool that exploits SCCM policies, offering more than just NAA credential extraction. SCCM policies are a key target for attackers in Active Directory environments, as they can expose sensitive technical information, including account credentials. Attackers may…
Could APIs be the undoing of AI?
Application programming interfaces (APIs) are essential to how generative AI (GenAI) functions with agents (e.g., calling upon them for data). But the combination of API and LLM issues coupled with rapid rollouts is likely to see numerous organizations having to…
Open source maintainers: Key to software health and security
Open source has become the foundation of modern application development, with up to 98% of applications incorporating open-source components and open-source code accounting for 70% or more of the typical application. In this Help Net Security video, Donald Fischer, CEO…
The most common authentication method is also the least secure
Despite the rise in cyber threats, many people do not have a holistic view of security, according to Yubico. The results of the survey uncovered concerning patterns and behaviors when it comes to personal and workplace cybersecurity, including the extensive…
Businesses turn to private AI for enhanced security and data management
In this Help Net Security interview, Joe Baguley, CTO EMEA at Broadcom, shares insights on private AI and its significance in data security. He explains how it helps organizations maintain control over sensitive information while addressing the complexities of compliance…
Week in review: Windows Server 2025 gets hotpatching option, PoC for SolarWinds WHD flaw released
Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: Windows Server 2025 gets hotpatching option, without reboots Organizations that plan to upgrade to Windows Server 2025 once it becomes generally available will be able…
CUPS vulnerabilities affecting Linux, Unix systems can lead to RCE
After much hyping and following prematurely leaked information by a third party, security researcher Simone Margaritelli has released details about four zero-day vulnerabilities in the Common UNIX Printing System (CUPS) that can be abused by remote, unauthenticated attackers to achieve…
SpyCloud Connect delivers automated remediation of compromised identities
SpyCloud released new hosted automation solution, SpyCloud Connect, which delivers custom-built automation workflows to Information Security (InfoSec) and Security Operations (SecOps) teams. The solution enables rapid automation of SpyCloud’s suite of identity threat protection products with a vast array of…
AuditBoard’s risk platform enhancements empower teams to boost efficiency
AuditBoard announced extensions to its modern connected risk platform to help teams improve efficiency, foster collaboration, and increase the rigor and intentionality of their GRC management programs. Available immediately, these functionalities include: AuditBoard analytics enhancements include nine new out-of-the-box workflows…
Tosint: Open-source Telegram OSINT tool
Tosint is an open-source Telegram OSINT tool that extracts useful information from Telegram bots and channels. It’s suited for security researchers, investigators, and others who want to gather insights from Telegram sources. Several law enforcement agencies utilize Tosint to gather…
3 tips for securing IoT devices in a connected world
IoT devices have become integral to how many organizations operate. From Smart TVs in conference rooms to connected sensors and wireless security cameras, these connected devices are now a fixture in the modern workplace. They also, however, present a real…
Developing an effective cyberwarfare response plan
In this Help Net Security interview, Nadir Izrael, CTO at Armis, discusses how AI has transformed cyberwarfare by amplifying attacks’ scale and sophistication. Izrael emphasizes the need for AI-powered defenses and proactive cybersecurity strategies to combat these evolving threats. How…
How to lock and hide iPhone apps in iOS 18
iOS 18 allows you to lock and hide apps to protect the information within them by requiring Face ID, Touch ID, or your passcode for access, while also concealing the content from searches, notifications, and various areas throughout the system.…
New infosec products of the week: September 27, 2024
Here’s a look at the most interesting products from the past week, featuring releases from Absolute, ArmorCode, Bitdefender, Guardsquare, Malwarebytes, NETGEAR, and Nudge Security. Bitdefender debuts GravityZone PHASR, enhancing security through user behavior analysis GravityZone PHASR enables security teams to…
Zilla Security simplifies identity governance and administration for organizations
Zilla Security launched AI-powered modern IGA platform, which includes Zilla AI Profiles and significantly enhanced provisioning capabilities. These innovations tackle the long-standing challenge of managing hundreds of roles or group membership rules to give users job-appropriate access. The cloud has…
Active Directory compromise: Cybersecurity agencies provde guidance
Active Directory (AD), Microsoft’s on-premises directory service for Windows domain networks, is so widely used for enterprise identity and access management that compromising it has become almost a standard step in cyber intrusions. “Active Directory is susceptible to compromise due…
DoControl introduces security product suite for Google Workspace
DoControl released a security product suite for Google Workspace, designed to protect data, identities, configurations, and third-party connected apps. DoControl’s SSPM provides Google Workspace customers with security capabilities that are not offered by Google’s built-in security ecosystem. Adopted by top…
The number of Android memory safety vulnerabilities has tumbled, and here’s why
Google’s decision to write new code into Android’s codebase in Rust, a memory-safe programming language, has resulted in a significant drop in memory safety vulnerabilities, despite old code (written in C/C++) not having been rewritten. The number of memory safety…
Salt Security provides improved API protection with Google Cloud
Salt Security announced its integration with Google Cloud‘s Apigee API Management platform. With this technical collaboration, customers can discover all of their APIs, including shadow and deprecated APIs, apply posture rules, uncover areas of non-compliance, and stop API-based attacks at…
New MIT protocol protects sensitive data during cloud-based computation
Deep-learning models have found applications across various industries, from healthcare diagnostics to financial forecasting. However, their high computational demands often require powerful cloud-based servers. This dependency on cloud computing raises notable security concerns, particularly in sensitive sectors like healthcare. Hospitals,…
AI use: 3 essential questions every CISO must ask
In July, Wall Street experienced its worst day since 2022, with the tech-focused Nasdaq falling by 3.6%. The downturn was largely triggered by what commentators suggest is the result of underwhelming earnings from some major tech companies. What’s notable is…
Rethinking privacy: A tech expert’s perspective
Data privacy has become one of the most pressing challenges of our time, but it didn’t happen overnight. The proliferation of data collection, coupled with the rise of advanced technologies like artificial intelligence and machine learning, has made it easier…
Compliance management strategies for protecting data in complex regulatory environments
In this Help Net Security interview, Andrius Buinovskis, Head of Product at NordLayer, discusses how organizations can assess their compliance management and ensure they meet regulatory requirements. Buinovskis also addresses the challenges of managing multiple frameworks and offers strategies for…
Companies mentioned on the dark web at higher risk for cyber attacks
The presence of any data relating to an organization on the dark web demonstrably increases its risk of a cyber attack, according to Searchlight Cyber. Dark web insights and breach correlation Marsh McLennan Cyber Risk Intelligence Center analyzed the dark…
Malwarebytes Personal Data Remover protects user privacy
Malwarebytes introduced its latest consumer product, Personal Data Remover, designed to protect user privacy by assisting users with the deletion of personal information from data broker databases and people search sites. This new solution offers regular monitoring to ensure individuals’…