Electricity transmission and distribution are popular topics at the moment, especially as they pertain to utilities infrastructure security. These essential pillars of modern society are undergoing rapid digital transformation, with increased connectivity and technological sophistication harboring large-scale cybersecurity challenges. Electrical…
Tag: Blog RSS Feed
Malaysia’s Data Sharing Bill 2024: Pioneering Secure and Efficient Government Collaboration
In December 2024, Malaysia passed its Data Sharing Bill 2024, a new piece of legislation aimed at streamlining data-sharing across federal government agencies. This bill promises to revolutionize how data is managed, shared, and secured within Malaysia’s government, fueling a…
CIS Control 01: Inventory and Control of Enterprise Assets
Since 2008, the CIS Controls have been through many iterations of refinement and improvement leading up to what we are presented with today in CIS Controls version 8.1. CIS Controls reflect the combined knowledge of experts from every part of…
Got a Microsoft Teams invite? Storm-2372 Gang Exploit Device Codes in Global Phishing Attacks
Security experts have warned that a cybercriminal group has been running a malicious and inventive phishing campaign since August 2024 to break into organizations across Europe, North America, Africa, and the Middle East. The Russian group, known as Storm-2372, has…
Ransomware: The $270 Billion Beast Shaping Cybersecurity—Insights from Cyentia’s Latest Report
Ransomware has evolved into one of the most devastating cyber threats of modern times, creating previously unimaginable financial and operational hardships for entities in every sector. As malicious actors employ increasingly sophisticated tools, honing their tactics and spreading their tentacles,…
Monitoring Applications vs. Operating Systems: Why It Matters
In today’s dynamic IT environments, securing and maintaining the integrity of your systems is critical. Fortra’s Tripwire Enterprise is a robust tool designed to help organizations ensure compliance and security by continuously monitoring the configuration and behavior of their IT…
#TripwireBookClub – Black Hat Bash: Creative Scripting for Hackers and Pentesters
Up Next from #TripwireBookClub is Black Hat Bash: Creative Scripting for Hackers and Pentesters by Dolev Farhi and Nick Aleks. This duo previously published Black Hat GraphQL, which we reviewed in March 2024. This book did not disappoint. I think…
Advanced Ransomware Evasion Techniques in 2025
Ransomware has become more than a threat—it’s a calculated assault on industries, wielding AI-driven precision to bypass traditional defenses. Attackers adapt faster than ever, turning cybersecurity into a high-stakes race where falling behind isn’t an option. As we step into…
US Coast Guard Urged to Strengthen Cybersecurity Amid $2B Daily Port Risk
The US Coast Guard has been urged to improve the cybersecurity infrastructure of the Maritime Transportation System (MTS), which includes ports, waterways, and vessels essential for transporting over $5.4 trillion worth of goods annually. The Government Accountability Office (GAO) has…
IIoT Security Threats Reshape Factory Protection Strategies
Modern factories are increasingly relying on Industrial Internet of Things (IIoT) solutions. This shift is beneficial in many regards, including higher efficiency and transparency, but it also introduces unique cybersecurity concerns. Better vulnerability management for IIoT systems is essential if…
Holding the Tide Against the Next Wave of Phishing Scams
By now, we should all be pretty well acquainted with phishing scams. They’ve been around for a very long time—nearly 30 years, in fact—and are the primary focus of most security awareness training programs and initiatives. Despite this, phishing remains…
CIS Control 02: Inventory and Control of Software Assets
Today, I will be going over Control 2 from version 8.1 of the top 18 CIS Controls – Inventory and Control of Software Assets. I will go over the seven safeguards and offer my thoughts on what I’ve found. Key…
VERT Threat Alert: February 2025 Patch Tuesday Analysis
Today’s VERT Alert addresses Microsoft’s February 2025 Security Updates. VERT is actively working on coverage for these vulnerabilities and expects to ship ASPL-1143 as soon as coverage is completed. In-The-Wild & Disclosed CVEs CVE-2025-21391 A vulnerability in Windows Storage could…
Building a Vulnerability Management Program from Scratch
Building a vulnerability management (VM) program from the ground up is no small feat. It requires technical expertise, organizational buy-in, and a clear roadmap. In recent months, I’ve been working with a client who had to discard their legacy approach…
Key Takeaways from the NCSC Annual Review 2024
In early December 2024, the UK’s National Cyber Security Center (NCSC) released its eighth Annual Review. While the report’s primary focus is to recap the NCSC’s activities over the past year, it also offers invaluable insights into how the UK…
“Quishing” – The Emerging Threat of Fake QR Codes
QR codes have revolutionized digital interactions, offering quick access to websites and services and adding a layer of security to many apps. These quick and seemingly innocent codes are everywhere — however, their widespread use has made them a prime…
Research Reveals Data Breaches On The Rise at UK Law Firms
British legal professionals have seen a “significant surge” in data breaches, according to new research from NetDocuments, a firm that provides a cloud-based content management platform for the legal sector. The firm has described how it analysed data from the…
How CISOs Can Build a Cybersecurity-First Culture
Creating an enterprise security-first culture is one of the most impactful things a CISO can do to protect their organization. Sure, high-tech solutions and fancy tools are important, but they are largely ineffective when staff are unable or unwilling to…
Man Sentenced to 7 Years in Prison for Role in $50M Internet Scam
A California man has been sentenced to seven years in prison for his involvement in a fraudulent scheme that saw over 50 individuals and organisations lose millions of dollars. 59-year-old Allen Giltman, of Irvine, California, pleaded guilty to charges that…
CIS Control 03: Data Protection
Key Takeaways for Control 3 At the heart of a strong data management plan is awareness surrounding the ‘ Five Ws’ of the enterprise’s data: What data does the enterprise store or handle? Who should have access to it? Where…
Zero Trust Principles for Critical Infrastructure Security
The cyber threat to critical infrastructure has never been greater. The growing sophistication of cybercriminals, deteriorating geopolitical relations, and the convergence of operational technology (OT) and information technology (IT) have created unprecedented risks for critical infrastructure organizations. Fortunately, resources are…
What Is a Security Operations Center (SOC)?
Data breaches continue to cost organizations millions of dollars each year, with costs rising steadily. According to IBM’s 2024 Cost of a Data Breach Report, the average cost of a data breach has surged to $4.88 million globally, reflecting the…
Tripwire Patch Priority Index for January 2025
Tripwire’s January 2025 Patch Priority Index (PPI) brings together important vulnerabilities for Microsoft. First on the list are patches for the Microsoft office platform, including Word, Access, Visio, Excel, OneNote, and Outlook. These patches resolve 13 issues such as remote…
How the Proposed HISAA Law Could Reshape Cybersecurity Compliance
It’s been a tough year for the healthcare sector. Throughout 2024, cybercriminals have unleashed a barrage of attacks on a vast number of healthcare organizations – with disconcerting levels of success. FBI research revealed that healthcare is now the US’s…
How Lack of Cybersecurity Training Makes Small Businesses Easy Targets
Small businesses may think they don’t need to implement cybersecurity training programs because larger enterprises with more revenue are more profitable for bad actors. However, small businesses lacking essential security measures are prime targets due to the ease of access…
CIS Control 04: Secure Configuration of Enterprise Assets and Software
Key Takeaways for Control 4 Most fresh installs of operating systems or applications come with preconfigured settings that are usually insecure or not properly configured with security in mind. Use the leverage provided by multiple frameworks such as CIS Benchmarks…
Tackling the New CIS Controls
In the early part of 2024, the Center for Internet Security (CIS) released the latest version of the well-respected Critical Security Controls (CSC). The new version, 8.1, adds contours to the prior versions, making it more comprehensive and timely in…
Identifying and Responding to Investment Scams
Investment scams are a growing problem. Modern cybercriminals are increasingly using this technique to swindle money out of unsuspecting victims. It’s easy to understand why: investment scams are remarkably effective. Research from Barclays even found that they accounted for a…
Industry Optimism Grows as TSA Proposes Balanced Cybersecurity Measures
The Transportation Security Administration (TSA) has proposed new rules requiring those under its jurisdiction to follow specific cyber risk management (CRM) requirements, report cybersecurity incidents in a certain timeframe, and address physical security concerns. This is positive news for the…
Best Practices for Securing Your SaaS Environment
Can you imagine a modern working world without Software-as-a-Service ( SaaS) applications? Productivity, communication, and project management solutions have transformed the modern workplace, enabling hybrid and remote working, helping to cut costs, and offering unprecedented opportunities for collaboration and innovation.…
New Law Could Mean Prison for Reporting Data Leaks
The Turkish government is proposing a controversial new cybersecurity law that could make it a criminal act to report on data breaches. The new legislation proposes penalties for various cybersecurity-related offences. But they key one which has people concerned is…
Understanding Microsoft’s CVSS v3.1 Ratings and Severity Scores
Recently, I looked at Microsoft’s assigned CVSS v3.1 scores for Patch Tuesday vulnerabilities alongside the Microsoft assigned severity ratings. I wanted to revisit these numbers and see just how closely CVSS aligns with Microsoft’s opinion of severity. Disclaimer: I’m aware…
CIS Control 05: Account Management
Knowing who has credentials, how those credentials are granted, and how they are being used is the foundation of any secure environment. It begins with user accounts and the credentials they use. Maintaining a thorough inventory of all accounts and…
From Alerts to Action: How AI Empowers SOC Analysts to Make Better Decisions
Security Operations Center ( SOC) analysts have it rough. Modern security tools generate an extraordinary number of alerts, attackers are more sophisticated than ever, and IT infrastructures are unprecedentedly complex. As a result, analysts are overwhelmed with workload and alerts,…
Helping the Energy Sector Navigate NERC Complexities
The energy sector is the cornerstone of modern infrastructure, powering essential services and supporting the daily operations of economies worldwide. However, it also faces unique cybersecurity challenges, particularly in complying with the North American Electric Reliability Corporation’s Critical Infrastructure Protection…
NASA’s Cybersecurity Initiative: What Spacecraft Manufacturers Need to Know
NASA is about to introduce new requirements for its contractors. These requirements will dramatically improve the cybersecurity of spacecraft and the US’ resilience to cyber threats. But what do these requirements mean for spacecraft manufacturers? What challenges will they face?…
Medusa Ransomware: What You Need To Know
What is the Medusa ransomware? Medusa is a ransomware-as-a-service (RaaS) platform that first came to prominence in 2023. The ransomware impacts organisations running Windows, predominantly exploiting vulnerable and unpatched systems and hijacking accounts through initial access brokers. Initial access brokers?…
CIS Control 06: Access Control Management
CIS Control 6 merges some aspects of CIS Control 4 (admin privileges) and CIS Control 14 (access on a need-to-know basis) into a single access control management group. Access control management is a critical component in maintaining information and system…
Think You Know Tripwire? Think Again
Fortra’s Tripwire has always been widely known as a File Integrity Monitoring (FIM) solution, and a very good one at that. The good news is that it still is – only when you look closely, it’s a lot more. And…
Managing Security and Compliance in a Remote Work Environment
Remote work isn’t just a temporary trend anymore; it has become a permanent fixture. What began as a quick response during the pandemic has evolved into the new normal for businesses worldwide. In America, 20% of people now work from…
VERT Threat Alert: January 2025 Patch Tuesday Analysis
Today’s VERT Alert addresses Microsoft’s January 2025 Security Updates. VERT is actively working on coverage for these vulnerabilities and expects to ship ASPL-1139 as soon as coverage is completed. In-The-Wild & Disclosed CVEs CVE-2025-21333 The first of three Hyper-V vulnerabilities…
The $55 Billion Wake-Up Call: Cybersecurity Challenges Facing UK Businesses
Organizations of all types must consider and prioritize cybersecurity in order to protect against a wide range of attacks and prevent potentially catastrophic consequences. With the evolution of the threat landscape and most businesses relying more and more on technological…
What Is Vulnerability Management?
Enterprise networks frequently experience changes in endpoint devices, software, and files, which can introduce risk to the organization. To mitigate this, companies can implement foundational security controls like file integrity monitoring (FIM), which tracks changes to essential files and helps…
Tripwire Patch Priority Index for December 2024
Tripwire’s December 2024 Patch Priority Index (PPI) brings together important vulnerabilities for Microsoft and Adobe. First on the list is a notice about Windows Common Log File System Driver (CLFS). CVE-2024-49138 impacts Windows CLFS, which Microsoft released a patch for…
Space Bears Ransomware: What You Need To Know
What is Space Bears? Space Bear is a relatively new ransomware group that first appeared on the radar in April 2024. The gang, which is aligned to the Phobos ransomware-as-a-service group, steals sensitive data from organisations, encrypts victims’ computer systems,…
Cyber Threats Rising: US Critical Infrastructure Under Increasing Attack in 2025
As we enter 2025, the frequency and sophistication of cyberattacks on critical national infrastructure (CNI) in the US are rising at an alarming rate. These attacks target the foundational systems that support everything from energy and water to transportation and…
Tripwire Enterprise Integration Framework (TEIF) Is Thriving. Here’s How You Can Benefit
In a team environment, it’s all about playing nice with others. The same could be said of your technology team (or stack), and its various components. The problem of disparate, complex systems – each coming from disparate, complex places –…
CIS Control 07: Continuous Vulnerability Management
When it comes to cybersecurity, vulnerability management is one of the older technologies that still play a critical role in securing our assets. It is often overlooked, disregarded, or considered only for checkbox compliance needs, but a proper vulnerability management…
The Overlooked Risks of Open-Source Software in Industrial Security
Open-source software (OSS) has become an indispensable component in many industrial environments. Just last year, 95% of companies said they increased or maintained their use of OSS. According to the Linux Foundation, 70-80% of all code in any modern solution…
The 7 Stages NERC CIP Audit Preparation
Maintaining compliance with the North American Electric Reliability Corporation (NERC) Critical Infrastructure Protection (CIP) standards is a complex process that can put significant strain on security and compliance teams. Easing this strain and ensuring compliance relies on effective preparation. As…
Why Configurations Are the Wrong Thing to Get Wrong
So many times, we look beyond the mark. With our feeds constantly inundated with headline-grabbing news about AI-generated threats, nation states upping their cybercrime game, and sophisticated new forms of malware, we can be tempted to think that the bulk…
Configurations Mega Blog: Why Configurations Are the Wrong Thing to Get Wrong
So many times, we look beyond the mark. With our feeds constantly inundated with headline-grabbing news about AI-generated threats, nation states upping their cybercrime game, and sophisticated new forms of malware, we can be tempted to think that the bulk…
Understanding AI in Network Security
Cyber threats are more sophisticated, pervasive, and frequent than ever before. As a result, traditional methods for network security are becoming obsolete. These solutions simply cannot handle the extraordinary scale and complexity of network traffic inherent in modern IT environments.…
Advice for Exponential Organizations: Intersecting Agile and Incident Response
While Exponential Organizations (ExOs) are transforming industries beyond the tech space, that doesn’t mean that they are not susceptible to an increasing number of cyber threats. As ExOs harness innovative and cutting-edge technologies to drive transformative growth, the ability to…
What’s Next for Cybersecurity in 2025 and Beyond? Fortra Experts Weigh In
We are fast approaching the end of (another) turbulent year for cybersecurity. Looking back, it’s hard to believe that so much can happen in such a short time. As we finish up our work for the year, head home to…
The Future of AI Regulation: Balancing Innovation and Safety in Silicon Valley
A Divisive Veto: California Rejects AI Safety Bill SB 1047 California Governor Gavin Newsom’s recent veto of SB 1047, a proposed AI safety bill, has sparked a hot debate on the balance between innovation and regulation in the artificial intelligence…
Understanding Data Leaks: Causes, Consequences, and Prevention Strategies
Imagine a seemingly minor misconfiguration in your cloud storage or an employee accidentally emailing a sensitive file to the wrong person. These incidents might seem trivial, but they can quickly snowball into a massive data breach, causing financial consequences. This…
The State of Security in 2024: The Fortra Experts Take a Look
At Fortra, we like to encourage a collaborative environment. One of the ways we bring our community together is through our Transformer meetups which aim to provide a positive, energizing, and fun hub for all Fortra employees to learn how…
4 Security Controls Keeping Up with the Evolution of IT Environments
The rapid adoption of cloud technology in the past few years has transformed IT environments, enabling unprecedented opportunities for flexibility, scalability, and collaboration. However, this transformation has introduced a potentially dangerous level of complexity into these environments – recent research…
Silent Heists: The Danger of Insider Threats
When thinking about cybersecurity, we envision malicious actors working in dark basements, honing their tools to invent cunning new ways to breach our defenses. While this is a clear and present danger, it’s also important to understand that another hazard…
CIS Control 08: Audit Log Management
Audit logs provide a rich source of data critical to preventing, detecting, understanding, and minimizing the impact of network or data compromise in a timely manner. Collection logs and regular reviews are useful for identifying baselines, establishing operational trends, and…
Managing NERC CIP Patching Process With Tripwire Enterprise and Tripwire State Analyzer
One of the hardest parts of managing an organization’s cybersecurity is patch management. Just as one patch cycle is completed, another set of patches are released. When compounded with the highly regulated energy industry, governed by the NERC CIP Standards,…
London’s CNI is Under Threat
London is one of the smartest and most interconnected cities in the world. Digital infrastructure plays a role in almost every facet of society, streamlining public transport, improving healthcare provision, boosting sustainability, and more. However, this reliance on technology has…
How the Cyber Essentials Certification Can Help Your Business
Cybersecurity is a vital concern for organisations, but many security strategies fall short: recent research shows that 44% of UK companies are lacking in basic cybersecurity skills. The consequences of poor security go far beyond the direct impacts of cyberattacks,…
The Top 10 State of Security Blog Posts From 2024
As we approach the end of another exciting year in the world of cybersecurity, it’s the perfect time to reflect on the stories, insights, and guidance that resonated most with our readers. 2024 brought new challenges and opportunities with the…
What’s the Difference Between DSPM, CSPM, and CIEM?
DSPM, CSPM, and CIEM are more than just a mouthful of acronyms. They are some of today’s most sophisticated tools for managing data security in the cloud. While they are all distinct entities and go about protecting data in different…
Digital Threats, Real Losses: Cyber Risks to Retail Operations
The success of retailers depends on being able to offer consumers what they want. That means, for example, stocking Halloween costumes in October, turkeys in November, and Christmas decorations in December. Cybercriminals are all too aware of this fact and…
27 DDoS-For-Hire Services Disrupted In Run-Up To Holiday Season
In a co-ordinated international effort, the law enforcement agencies of 15 countries have made the holiday season a little less stressful for companies and consumers – by seizing control of some of the internet’s most popular DDoS-for-hire services. Operation PowerOFF…
CIS Control 09: Email and Web Browser Protections
Web browsers and email clients are used to interact with external and internal assets. Both applications can be used as a point of entry within an organization. Users of these applications can be manipulated using social engineering attacks. A successful…
VERT Threat Alert: December 2024 Patch Tuesday Analysis
Today’s VERT Alert addresses Microsoft’s December 2024 Security Updates. VERT is actively working on coverage for these vulnerabilities and expects to ship ASPL-1136 as soon as coverage is completed. In-The-Wild & Disclosed CVEs CVE-2024-49138 The only vulnerability that has been…
3AM Ransomware: What You Need To Know
What is 3AM? 3AM (also known as ThreeAM) is a ransomware group that first emerged in late 2023. Like other ransomware threats, 3AM exfiltrates victims’ data (threatening to release it publicly unless a ransom is paid) and encrypts the copies…
Maximizing Security Data in Splunk with Tripwire’s New App
In today’s data-driven world, collecting information is just the beginning. The real value lies in transforming raw data into actionable insights that drive decisions. For enterprise security, this means making data not only accessible but also organized, relevant, and easy…
Understanding the EU Cyber Resilience Act: A New Era for Digital Product Security
Cyber resilience is a constant topic of concern in technology and cybersecurity, as it approaches security from the standpoint of assuming that attacks are inevitable rather than solely attempting to prevent them. Layered cybersecurity is crucial to ensure comprehensive defense…
8 Emerging Cybersecurity Scams And Their Implications For The Future
Technological advances usually lead to a brighter future. While that may be true, these developments could also be used to refine and increase cybersecurity scams. Attackers do not care about who they target as long as they get people’s and…
Steps for Successful Vulnerability Management: Lessons from the Pitch
When I was younger, I played a variety of team sports and enjoyed competing against opponents with my teammates. Winning was always a matter of applying sound tactics and strategy, attacking and defending well and using a blend of skill,…
Money-Laundering Network Linked To Drugs and Ransomware Disrupted
The UK’s National Crime Agency (NCA) has revealed details of Operation Destabilise, a years-long international law enforcement investigation into a giant Russian money laundering enterprise that handled billions of dollars for drug traffickers and ransomware gangs worldwide. The multi-billion dollar…
CIS Control 10: Malware Defenses
With the continuing rise of ransomware, malware defenses are more critical than ever before with regard to securing the enterprise. Anti-Malware technologies have become an afterthought in many organizations, a technology that they’ve always had, always used, and never really…
Tripwire Patch Priority Index for November 2024
Tripwire’s November 2024 Patch Priority Index (PPI) brings together important vulnerabilities for Microsoft and Google Chromium. First on the list are patches for Microsoft Edge, Excel, and Word that resolve remote code execution and security feature bypass vulnerabilities. Next are…
Tech Support Scams Exploit Google Ads to Target Users
It’s not a new technique, but that doesn’t mean that cybercriminals cannot make rich rewards from SEO poisoning. SEO poisoning is the dark art of manipulating search engines to ensure that malware-laced adverts and dangerous websites appear high on users’…
ShrinkLocker Ransomware: What You Need To Know
What is ShrinkLocker? ShrinkLocker is a family of ransomware that encrypts an organisation’s data and demands a ransom payment in order to restore access to their files. It was first identified by security researchers in May 2024, after attacks were…
Exploring the Security Risks of VR and AR
In an era where innovative technologies are emerging left, right, and center, two of the most influential in recent years are experiencing exponential growth. Virtual Reality (VR) and Augmented Reality (AR) are immersive technologies that have now firmly integrated into…
The Rising Cost of Cybersecurity: How Companies Can Effectively Communicate the Value of Protection
Data shows that financial motivation is a huge incentive for threat actors, which explains the rising prevalence of ransomware and other extortion breaches in the corporate world. In 2023 alone, business email compromise (BEC) complaints received by the FBI amounted…
CIS Control 13: Network Monitoring and Defense
Networks form a critical core for our modern-day society and businesses. People, processes, and technologies should be in place for monitoring, detecting, logging, and preventing malicious activities that occur when an enterprise experiences an attack within or against their networks.…
VERT Threat Alert: November 2024 Patch Tuesday Analysis
Today’s VERT Alert addresses Microsoft’s November 2024 Security Updates. VERT is actively working on coverage for these vulnerabilities and expects to ship ASPL-1132 as soon as coverage is completed. In-The-Wild & Disclosed CVEs CVE-2024-43451 A vulnerability that allows for NTLMv2…
IT Security Terms: Regulations, Standards, Controls, Frameworks, and Policies – Where to Start!?
When tasked with the IT security of an organization, it can be easy to get bogged down in particulars and definitions and lose heart before you’ve even begun. With a plethora of terms to learn, details to secure, and moving…
Winter Fuel Payment Scam Targets UK Citizens Via SMS
Scammers have leapt at the opportunity to exploit vulnerable UK residents by sending bogus messages telling them they need to take action to receive help with their winter heating bills. In July, the UK’s new Labour Government announced that it…
Creating a Real-Time USB Monitoring Rule for Enhanced Security and Compliance
In today’s cybersecurity landscape, controlling access to USB drives is critical, particularly for organizations looking to maintain compliance with regulations like NERC CIP and bolster their security posture. Unauthorized USB usage poses significant risks, from data exfiltration to malware injection.…
A Snapshot of Cyber Threats: Highlights from the ENISA Threat Landscape 2024 Report
Understanding the threats we face is crucial to protecting against them. Industry research and reports are invaluable to this understanding, providing insights to inform mitigation efforts. Few cybersecurity reports are as valuable or comprehensive as the annual ENISA Threat Landscape…
CIS Control 14: Security Awareness and Skill Training
Users who do not have the appropriate security awareness training are considered a weak link in the security of an enterprise. These untrained users are easier to exploit than finding a flaw or vulnerability in the equipment that an enterprise…
How to Integrate FIM with SOAR Platforms
File Integrity Monitoring ( FIM) is a key intelligence and audit tool in an advanced security portfolio. While it is a logical component to integrate into your Security Orchestration, Automation, and Response ( SOAR) tooling, it’s important to consider your…
Real Estate Fraud is Running Rampant in the US
Real Estate Fraud is Running Rampant in the US Real estate is an area ripe for fraud and scams: transactions usually involve large sums of money, convoluted paperwork, and messaging back and forth. Criminals can use a wide variety of…
Tripwire Patch Priority Index for October 2024
Tripwire’s October 2024 Patch Priority Index (PPI) brings together important vulnerabilities for Microsoft. First on the list are patches for Microsoft Edge, Office, Excel, and Visio that resolve remote code execution, elevation of privilege, and spoofing vulnerabilities. Next are patches…
Strategies for Implementing Effective Threat Detection in IIoT
The industrial Internet of Things (IIoT) is growing rapidly. While that’s good news for businesses in terms of productivity and cost savings, these devices carry unique cybersecurity risks that demand attention. Amid such rising concerns, IIoT threat detection is a…
What Is the ISA/IEC 62443 Framework?
Cybersecurity threats to manufacturing and process plants come from a wide range of attack vectors, including supply chain, logistics, enterprise computing, remote connections, operator stations, programmable logic controllers, distributed control systems (DCSs), smart sensors, and new smart devices. Internet of…
Fraudsters Exploit US General Election Fever, FBI Warns
As the United States of America enters the final days of the race for the White House, the FBI has warned that fraudsters are using the presidential election campaign to scam citizens out of their savings and personal data. According…
Understanding SOX Requirements for IT and Cybersecurity Auditors
The Sarbanes-Oxley Act (SOX) is a United States federal law that aims to enhance corporate transparency and accountability. Signed into law on July 30th, 2002, the Act came in response to a slew of major corporate accounting scandals, including those…
What’s New with the TSA’s Oil and Gas Security Directives?
In recent years, the security of the United States’ critical infrastructure has become a pressing concern, particularly in the oil and gas sector, due to its pivotal role in the nation’s economy and energy supply. Recognizing this, the Transportation Security…
CIS Control 15: Service Provider Management
Enterprises today rely on partners and vendors to help manage their data. Some companies depend on third-party infrastructure for day-to-day operations, so understanding the regulations and protection standards that a service provider is promising to uphold is very important. Key…
Why Security Configuration Management (SCM) Matters
Security configuration management (SCM) is all about making sure your security systems do what you think they’re doing. In tennis, there is something called an unforced error. This is when a player loses points for a mistake they made themselves,…
5 Things to Learn About COBIT
You can’t do large-scale business in 2024 without having a successful, well-run IT infrastructure. Arguably, it’s difficult to do any sort of business well (large or small) without tuning your IT capabilities to your business objectives. This allows them to…