Daily digest for Security Boulevard, on June 2, 2022

Michael Vizard posted: "INKY, a provider of an email security platform, today revealed that since the start of 2022, it has detected 1,288 malicious emails sent via Telegraph. Telegraph is a free minimalist publishing tool that allows users to publish web pages instantly and ano" Security Boulevard INKY Identifies Telegraph as Platform for Phishing Campaigns Michael Vizard Jun 2 INKY, a provider of an email security platform, today revealed that since the start of 2022, it has detected 1,288 malicious emails sent via Telegraph. Telegraph is a free minimalist publishing tool that allows users to publish web pages instantly and anonymously without creating an account. These pages can be customized with embedded images and […] Read more of this post Comment Unsubscribe to no longer receive posts from Security Boulevard. Change your email settings at manage subscriptions. Trouble clicking? Copy and paste this URL into your browser: https://securityboulevard.com/2022/06/inky-identifies-telegraph-as-platform-for-phishing-campaigns/ Powered by Jetpack

SecZetta posted: "Gaylord National Resort & Convention Center | National Harbor | Maryland | June 7 – 10, 2022 Fall River, Mass. – Join SecZetta at  the Gartner Security & Risk Management Summit to learn the latest insights on risk management, cybersecurity, cloud " Security Boulevard SecZetta Brings Third-Party Identity Automation Solution to Gartner Security & Risk Management Summit SecZetta Jun 2 Gaylord National Resort & Convention Center | National Harbor | Maryland | June 7 – 10, 2022   Fall River, Mass. – Join SecZetta at  the Gartner Security & Risk ... The post SecZetta Brings Third-Party Identity Automation Solution to Gartner Security & Risk Management Summit appeared first on SecZetta. Read more of this post Comment Unsubscribe to no longer receive posts from Security Boulevard. Change your email settings at manage subscriptions. Trouble clicking? Copy and paste this URL into your browser: https://securityboulevard.com/2022/06/seczetta-brings-third-party-identity-automation-solution-to-gartner-security-risk-management-summit/ Powered by Jetpack

bacohido posted: "Companies have come to depend on Software as a Service – SaaS — like never before. Related: Managed security services catch on From Office 365 to Zoom to Salesforce.com, cloud-hosted software applications have come to make up the nerve center of dai" Security Boulevard RSAC insights: 'SaaS security posture management' — SSPM — has emerged as a networking must-have bacohido Jun 2 Companies have come to depend on Software as a Service – SaaS — like never before. Related: Managed security services catch on From Office 365 to Zoom to Salesforce.com, cloud-hosted software applications have come to make up the nerve center … (more…) Read more of this post Comment Unsubscribe to no longer receive posts from Security Boulevard. Change your email settings at manage subscriptions. Trouble clicking? Copy and paste this URL into your browser: https://securityboulevard.com/2022/06/rsac-insights-saas-security-posture-management-sspm-has-emerged-as-a-networking-must-have/ Powered by Jetpack

Jithin Nair posted: "Background On May 27, 2022, nao_sec found a malicious Word document submitted to Virustotal from a Belarus IP address. The document was abusing MS-MSDT URI scheme to execute PowerShell within the context of Word bypassing local Office macro policies. Mic" Security Boulevard Coverage Advisory for CVE-2022-30190: Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability Jithin Nair Jun 2 Background On May 27, 2022, nao_sec found a malicious Word document submitted to Virustotal from a Belarus IP address. The document was abusing MS-MSDT URI scheme to execute PowerShell within the context of Word bypassing local Office macro policies. Microsoft has since released protection guidance and assigned CVE-2022-30190 to this vulnerability. What is the issue? Malicious Word documents can use the remote template feature to fetch an HTML file from a remote server and the HTML code can use Microsoft's MS-MSDT URI protocol scheme to load additional code and execute PowerShell code. For most malicious Office documents, users have to be convinced to click two separate prompts: Enable editing (Protected Mode) Enable content (Run Macros) To exploit this vulnerability, the attacker just needs the user to open the office document. If a RTF file is used with this exploit, the same vulnerability can be exploited if the user just previews the RTF file using the preview pane in Windows Explorer. According to Microsoft, "A remote code execution vulnerability exists when MSDT is called using the URL protocol from a calling application such as Word. An attacker who successfully exploits this vulnerability can run arbitrary code with the privileges of the calling application. The attacker can then install programs, view, change, or delete data, or create new accounts in the context allowed by the user's rights". What systems are impacted? This vulnerability impacts all client and server platforms running the following versions of Windows operating systems. Windows Server 2012 R2 (Server Core installation) Windows Server 2012 R2 Windows Server 2012 (Server Core installation) Windows Server 2012 Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation) Windows Server 2008 R2 for x64-based Systems Service Pack 1 Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation) Windows Server 2008 for x64-based Systems Service Pack 2 Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation) Windows Server 2008 for 32-bit Systems Service Pack 2 Windows RT 8.1 Windows 8.1 for x64-based systems Windows 8.1 for 32-bit systems Windows 7 for x64-based Systems Service Pack 1 Windows 7 for 32-bit Systems Service Pack 1 Windows Server 2016 (Server Core installation) Windows Server 2016 Windows 10 Version 1607 for x64-based Systems Windows 10 Version 1607 for 32-bit Systems Windows 10 for x64-based Systems Windows 10 for 32-bit Systems Windows 10 Version 21H2 for x64-based Systems Windows 10 Version 21H2 for ARM64-based Systems Windows 10 Version 21H2 for 32-bit Systems Windows 11 for ARM64-based Systems Windows 11 for x64-based Systems Windows Server, version 20H2 (Server Core Installation) Windows 10 Version 20H2 for ARM64-based Systems Windows 10 Version 20H2 for 32-bit Systems Windows 10 Version 20H2 for x64-based Systems Windows Server 2022 Azure Edition Core Hotpatch Windows Server 2022 (Server Core installation) Windows Server 2022 Windows 10 Version 21H1 for 32-bit Systems Windows 10 Version 21H1 for ARM64-based Systems Windows 10 Version 21H1 for x64-based Systems Windows Server 2019 (Server Core installation) Windows Server 2019 Windows 10 Version 1809 for ARM64-based Systems Windows 10 Version 1809 for x64-based Systems Windows 10 Version 1809 for 32-bit Systems What can you do to protect yourself? You can block exploit attempts for CVE-2022-30190 by disabling the MSDT URL protocol which the threat actors abuse to launch troubleshooters and execute code on vulnerable systems. You are also advised to disable the Preview pane in Windows Explorer to prevent the exploit from executing when previewing malicious documents. To disable the MSDT URL Protocol Disabling MSDT URL protocol prevents troubleshooters being launched as links including links throughout the operating system. Troubleshooters can still be accessed using the Get Help application and in system settings as other or additional troubleshooters. Follow these steps to disable: Run Command Prompt as Administrator. To back up the registry key, execute the command "reg export HKEY_CLASSES_ROOT\ms-msdt filename" Execute the command "reg delete HKEY_CLASSES_ROOT\ms-msdt /f". How to undo the workaround Run Command Prompt as Administrator. To restore the registry key, execute the command "reg import filename" Zscaler coverage Advanced Threat Protection DOC.Exploit.CVE-2022-30190 XML/ABRisk.XNPT-2 XML/ABRisk.HRVC-3 Advanced Cloud Sandbox Zscaler Advanced Cloud Sandbox would be able to classify and detect Word documents exploiting CVE-2022-30190 as malicious. Our Cloud Sandbox Report for a Word document exploiting CVE-2022-30190 can be seen in Figure 1. Fig 1: Sandbox Report for Docx file with CVE-2022-30190 exploit Details related to the threat signatures released by Zscaler can be found in the Zscaler Threat Library. Read more of this post Comment Unsubscribe to no longer receive posts from Security Boulevard. Change your email settings at manage subscriptions. Trouble clicking? Copy and paste this URL into your browser: https://securityboulevard.com/2022/06/coverage-advisory-for-cve-2022-30190-microsoft-windows-support-diagnostic-tool-msdt-remote-code-execution-vulnerability/ Powered by Jetpack

Christian Wiens posted: "MixMode, a leading provider of self-learning solutions to detect cyberattacks in real time, announces that Dan "Thor" Thormodsgaard has joined the company as a Strategic Advisor. Thor will apply his 25 years of experience in IT Consulting, of which 19 wer" Security Boulevard MixMode Welcomes Seasoned Cybersecurity Leader Dan "Thor" Thormodsgaard as a Strategic Advisor Christian Wiens Jun 2 MixMode, a leading provider of self-learning solutions to detect cyberattacks in real time, announces that Dan "Thor" Thormodsgaard has joined the company as a Strategic Advisor. Thor will apply his 25 years of experience in IT Consulting, of which 19 were in IT Security Consulting, to support MixMode in strategic planning and partnerships. Read more of this post Comment Unsubscribe to no longer receive posts from Security Boulevard. Change your email settings at manage subscriptions. Trouble clicking? Copy and paste this URL into your browser: https://securityboulevard.com/2022/06/mixmode-welcomes-seasoned-cybersecurity-leader-dan-thor-thormodsgaard-as-a-strategic-advisor/ Powered by Jetpack

Deepen Desai posted: "Ransomware attacks increased by yet another 80% between February 2021 and March 2022, based on an analysis of ransomware payloads seen across the Zscaler cloud. Double-extortion attacks, which include data exfiltration in addition to encryption, are risin" Security Boulevard The 2022 ThreatLabz State of Ransomware Report Deepen Desai Jun 2 Ransomware attacks increased by yet another 80% between February 2021 and March 2022, based on an analysis of ransomware payloads seen across the Zscaler cloud. Double-extortion attacks, which include data exfiltration in addition to encryption, are rising even faster at 117% year-over-year. The 2022 ThreatLabz State of Ransomware report breaks down a year's worth of intelligence from a variety of sources, including over 200B daily transactions and 150M daily blocked threats across the Zscaler Zero Trust Exchange, and shows that ransomware is becoming even more attractive to criminals. Attackers are able to wage increasingly profitable campaigns based on three major trends: Supply chain attacks that exploit trusted vendor relationships to breach organizations and multiply the damage of attacks by enabling threat actors to hit multiple (sometimes hundreds or thousands) of victims at the same time. Ransomware-as-a-service that uses affiliate networks to distribute ransomware on a wide scale, allowing hackers who are experts in breaching networks to share profits with the most advanced ransomware groups. Multiple-extortion attacks that utilize data theft, distributed denial of service (DDoS) attacks, customer communications, and more as layered extortion tactics to increase ransom payouts. Supply chain attacks, ransomware-as-a-service ecosystems, and multi-extortion tactics have all increased the volume and success rates of attacks. In this report, ThreatLabz provides a comprehensive look at the ransomware threat landscape to provide trending data, predictions, and defense guidance. Our report includes a deep dive into the attack sequences, victim profiles, and business impact of the top 11 ransomware families, including: Conti LockBit PYSA/Mespinoza REvil/Sodinokibi Avaddon Clop Grief Hive BlackByte AvosLocker BlackCat/ALPHV Percentage change in double-extortion attacks by industry Key Findings Ransomware attacks increased by 80% year-over-year, accounting for all ransomware payloads observed in the Zscaler cloud. Double extortion ransomware increased by 117%. Some industries saw particularly high growth of double-extortion attacks, including healthcare (643%), food service (460%), mining (229%), education (225%), media (200%), and manufacturing (190%). Manufacturing was the most targeted industry for the second straight year, making up almost 20% of double-extortion ransomware attacks. Supply chain ransomware attacks are on the rise. Exploiting trusted suppliers lets attackers breach a large number of organizations all at once, including organizations that otherwise have strong protections against external attacks. Supply chain ransomware attacks of the past year include damaging campaigns against Kaseya and Quanta as well as a number of attacks exploiting the Log4j vulnerability. Ransomware as a service is driving more attacks. Ransomware groups continue to recruit affiliates through underground criminal forums. These affiliates compromise large organizations and deploy the group's ransomware, typically in exchange for about 80% of the ransom payments received from victims. Most (8 out of 11) of the top ransomware families of the past year have commonly proliferated via ransomware-as-a-service models. Law enforcement is cracking down. A number of last year's top ransomware families—particularly those targeting critical services—attracted attention from law enforcement agencies around the world. Three of the most infamous ransomware families of the past two years had assets seized by law enforcement in 2021. Ransomware families aren't going away—they're just rebranding. Feeling increased heat from law enforcement, many ransomware groups have disbanded and reformed under new banners, where they use the same (or very similar) tactics. The Russia-Ukraine conflict has the world on high alert. There have been several attacks associated with the Russia-Ukraine conflict, with some combining multiple tactics, such as HermeticWiper and PartyTicket ransomware. So far, most of this activity has targeted Ukraine. However, government agencies have warned organizations to be prepared for more widespread attacks as the conflict persists. Zero trust remains the best defense. To minimize the chance of a breach and the damage a successful attack can cause, your organization must use defense-in-depth strategies that include reducing your attack surface, enforcing least-privilege access control, and continuously monitoring and inspecting data across your environment. How to protect yourself against ransomware Whether a simple ransomware attack, a double- or triple-extortion attack, a self-contained threat family, or a RaaS attack executed by an affiliate network, the defense strategy is the same: employ the principles of zero trust to limit vulnerabilities, prevent and detect attacks, and limit the blast radius of successful breaches. Here are some best practices recommendations to safeguard your organization against ransomware: Get your applications off of the internet. Ransomware actors start their attacks by performing reconnaissance on your environment, looking for vulnerabilities to exploit, and calibrating their approach. The more applications you have published to the internet, the easier you are to attack. Use a zero trust architecture to secure internal applications, making them invisible to attackers. Enforce a consistent security policy to prevent initial compromise. With a distributed workforce, it is important to implement a security services edge (SSE) architecture that can enforce consistent security policy no matter where your users are working (in office or remotely). Use sandboxing to detect unknown payloads. Signature-based detection is not enough in the face of rapidly changing ransomware variants and payloads. Protect against unknown and evasive attacks with an inline, AI-powered sandbox that analyzes the behavior rather than the packaging of a file. Implement a zero trust network access (ZTNA) architecture. Implement granular user-to-application and application-to-application segmentation, brokering access using dynamic least-privileged access controls to eliminate lateral movement. This allows you to minimize the data that can be encrypted or stolen, reducing the blast radius of an attack. Deploy inline data loss prevention. Prevent exfiltration of sensitive information with trust-based data loss prevention tools and policies to thwart double-extortion techniques. Keep software and training up to date. Apply software security patches and conduct regular security awareness employee training to reduce vulnerabilities that can be exploited by cybercriminals. Have a response plan. Prepare for the worst with cyber insurance, a data backup plan, and a response plan as part of your overall business continuity and disaster recovery program. To maximize your chances of defending against ransomware, you must embrace layered defenses that can disrupt the attack at each stage—from reconnaissance to initial compromise, lateral movement, data theft, and ransomware execution. The Zscaler Zero Trust Exchange is a leading security service edge (SSE) platform, delivering unmatched ransomware protection across every stage of the attack chain to dramatically reduce your chance of being attacked and mitigate potential damages. Zscaler natively integrates industry-leading zero trust capabilities that: Minimize the attack surface: Zscaler's cloud native proxy-based architecture reduces the attack surface by making internal apps invisible to the internet, thus eliminating potential attack vectors. Prevent compromise: Zscaler delivers full inspection and authentication of all traffic, including encrypted traffic, to keep malicious actors out, leveraging tools such as browser isolation and inline sandboxing to protect users from unknown and evasive threats. Eliminate lateral movement: Zscaler safely connects users and entities directly to applications—not networks—to eliminate the possibility of lateral movement, and surrounds your crown jewel applications with realistic decoys for good measure. Stop data loss: Zscaler inspects all traffic outbound to cloud applications to prevent data theft, and uses cloud access security broker (CASB) capabilities to identify and remediate vulnerabilities in data at rest. To learn more about today's top ransomware threats and how to protect your organization against them, download a free copy of "The 2022 ThreatLabz State of Ransomware Report." About ThreatLabz ThreatLabz is the security research arm of Zscaler. This world-class team is responsible for hunting new threats and ensuring that the thousands of organizations using the global Zscaler platform are always protected. In addition to malware research and behavioral analysis, team members are involved in the research and development of new prototype modules for advanced threat protection on the Zscaler platform, and regularly conduct internal security audits to ensure that Zscaler products and infrastructure meet security compliance standards. ThreatLabz regularly publishes in-depth analyses of new and emerging threats on its portal, research.zscaler.com. Stay updated on ThreatLabz research by subscribing to our Trust Issues newsletter today. Read more of this post Comment Unsubscribe to no longer receive posts from Security Boulevard. Change your email settings at manage subscriptions. Trouble clicking? Copy and paste this URL into your browser: https://securityboulevard.com/2022/06/the-2022-threatlabz-state-of-ransomware-report/ Powered by Jetpack

Editor posted: " /*! elementor - v3.5.6 - 28-02-2022 */ .elementor-widget-text-editor.elementor-drop-cap-view-stacked .elementor-drop-cap{background-color:#818a91;color:#fff}.elementor-widget-text-editor.elementor-drop-" Security Boulevard Tiny Banker Trojan Editor Jun 2 While living in the 21st century, no one can live off offline modes of payment all the time. Financial institutions, especially banks, have gone the extra mile to ease the process for their clients in the meantime, attracting cybercriminals and their ever-changing malware as threats to their information security. Tinba is one such threat especially … Tiny Banker Trojan Read More » The post Tiny Banker Trojan appeared first on Cyphere | Securing Your Cyber Sphere. Read more of this post Comment Unsubscribe to no longer receive posts from Security Boulevard. Change your email settings at manage subscriptions. Trouble clicking? Copy and paste this URL into your browser: https://securityboulevard.com/2022/06/tiny-banker-trojan/ Powered by Jetpack

Luke Mcbride posted: "Organizations are absorbing a huge amount of open source component software.  These tools come with unique requirements that are becoming unwieldy to resolve. Companies are asking for problems both by allowing licenses they should not and by not fulfillin" Security Boulevard How to Manage Your Open Source Licenses in 2022 Luke Mcbride Jun 2 Organizations are absorbing a huge amount of open source component software.  These tools come with unique requirements that are becoming unwieldy to resolve. Companies are asking for problems both by allowing licenses they should not and by not fulfilling the requirements of those licenses.  You need automation to help manage this situation and avoid litigation. Read more of this post Comment Unsubscribe to no longer receive posts from Security Boulevard. Change your email settings at manage subscriptions. Trouble clicking? Copy and paste this URL into your browser: https://securityboulevard.com/2022/06/how-to-manage-your-open-source-licenses-in-2022/ Powered by Jetpack

Tripwire Guest Authors posted: " Cybersecurity awareness, protection, and prevention is all-encompassing. In addition to implementing the right tools and resources, and hiring skilled professionals with the right cybersecurity education and experience, organizations should be aware of t" Security Boulevard Top CVE Trends — And What You Can Do About Them Tripwire Guest Authors Jun 1 Cybersecurity awareness, protection, and prevention is all-encompassing. In addition to implementing the right tools and resources, and hiring skilled professionals with the right cybersecurity education and experience, organizations should be aware of the latest CVEs. What Is a CVE? The acronym "CVE" stands for Common Vulnerabilities and Exposures, and it refers to known computer security […]… Read More The post Top CVE Trends — And What You Can Do About Them appeared first on The State of Security. Read more of this post Comment Unsubscribe to no longer receive posts from Security Boulevard. Change your email settings at manage subscriptions. Trouble clicking? Copy and paste this URL into your browser: https://securityboulevard.com/2022/06/top-cve-trends-and-what-you-can-do-about-them/ Powered by Jetpack

Gabor posted: "Scripts, applications, and CI/CD pipelines all require secrets to operate. These secrets include API keys, tokens, passwords, certificates, private keys or similar sensitive pieces of information. Unfortunately, these secrets may lead to data breaches aff" Security Boulevard Removing Secrets From Your Source Code Gabor Jun 1 Scripts, applications, and CI/CD pipelines all require secrets to operate. These secrets include API keys, tokens, passwords, certificates, private keys or similar sensitive pieces of information. Unfortunately, these secrets may lead to data breaches affecting you and your organisation if the secrets end up in your source code. This article explains how to keep your […] The post Removing Secrets From Your Source Code appeared first on Rainbow and Unicorn. Read more of this post Comment Unsubscribe to no longer receive posts from Security Boulevard. Change your email settings at manage subscriptions. Trouble clicking? Copy and paste this URL into your browser: https://securityboulevard.com/2022/06/removing-secrets-from-your-source-code/ Powered by Jetpack

jj posted: "In this short 15-minute session, you'll learn about the broad product suite categories such as ZTNA, SASE, SWG, as well as the microsegmentation, and how each solution implements the zero trust security features. MORE > Click the title to read the ful" Security Boulevard Zero Trust Product Suites and Enforcement Modes jj Jun 1 In this short 15-minute session, you'll learn about the broad product suite categories such as ZTNA, SASE, SWG, as well as the microsegmentation, and how each solution implements the zero trust security features. MORE > Click the title to read the full article. Read more of this post Comment Unsubscribe to no longer receive posts from Security Boulevard. Change your email settings at manage subscriptions. Trouble clicking? Copy and paste this URL into your browser: https://securityboulevard.com/?p=1926205 Powered by Jetpack

Kaivalya Khursale posted: "Phishing has been a prominent cyber threat for decades, stealing the spotlight as the most prevalent attack vector for years, but the latest breed of attacks is more sophisticated and complicated to protect against than ever before. Attackers are always l" Security Boulevard Browser-in-the Browser sextortion scam makes victims pay by imitating Indian Gov Kaivalya Khursale Jun 1 Phishing has been a prominent cyber threat for decades, stealing the spotlight as the most prevalent attack vector for years, but the latest breed of attacks is more sophisticated and complicated to protect against than ever before. Attackers are always looking for new techniques to bypass security measures and remain undetected by victims. In the past year, Browser-in-the Browser (BITB) attacks have emerged as a very effective technique for evading detection and convincing users to hand over credentials. Zscaler first observed a phishing campaign using this technique back in February of 2020. Early this year, an unaffiliated security researcher who goes by the handle mrd0x on Twitter, took to the social platform to share key technical details revealing how this technique takes advantage of third-party single sign-on (SSO) targeting brands like Apple, Microsoft, and Google. Most commonly, BITB attacks mimic single sign-on (SSO) windows with mostly undetectable fakes of the familiar log-in pop-ups. Underlining this trend, the Zscaler ThreatLabz team recently observed a new Browser-in-the Browser (BITB) attack impersonating an Indian government website to deliver a sextortion demand with the threat of releasing sensitive information about victims if they refuse to pay. This layered phishing attack appears to be the first of its kind, delivering a pop-up window that states a victim's browser is blocked due to repeated visits of pornographic websites prohibited by the Government of India. Attackers then prompt the victim with an extortion demand requiring them to enter a credit card and pay a fine to avoid being arrested by the police. The homepage of this scam depicts a notice from the Indian government that due to repeatedly visiting pornographic sites user's browser is blocked and asks users to pay a fine by entering their card details. The mechanism by which the scam link is delivered to the victims is still unknown, but our research indicates that this may be linked to a landing page pop-up with a common alert that the user is about to leave the current page without saving the changes. This type of alert window, shown below in Fig 1 typically pops-up on legitimate websites when a user tries to close a form tab without saving or submitting entered data. Fig 1: Initial pop-up alert window before fullscreen Regardless of whether the victim clicks on the Leave or Cancel button the browser switches to full-screen mode. In this mode the scam becomes more difficult for most victims to recognize because normally when we switch the browser in full screen the address bar will disappear but in this case, there is a fake address bar which looks like a normal site in the browser and is very hard to identify as fake. Once the fake browser window expands into full-screen mode it also appears to have all the same icons and buttons of a legitimate browser as shown in the Fig 2 screenshot below. Fig 2: Fake India gov page with a full-screen window Of note, from this window, the address bar, minimize button, maximize button, refresh and back button are all fake and un-clickable, and the user is unable to select and drag to move or resize the window. The screenshot in Fig 3 below shows that if the user moves the mouse to the top of the browser window the closing icon will popup confirming the window is in full-screen mode. For the vigilant user or researcher, this is a clear indication BITB attack that reveals the open browser window is trying to hide the real URL and prevent the user from navigating away from the fake page. Fig 3: Window with a close popup button After exiting the full-screen window, it can be clearly seen in the below screenshot (Fig 4) that there are two address bars. The top address bar is the actual browser with the malicious website address and the below address bar is the fake address bar with buttons as images, and are loaded from the following URLs. supernight[.]world/assets/img/header_1.png (URL Image) supernight[.]world/assets/img/header_3.png(Close, Minimize, and maximize image) Fig 4: Window after exiting the full-screen mode. Attackers use browser fingerprinting, shown in Fig 5, and query browser attributes to create hashed visitor identifiers. This is a critical step in the attack because a browser's unique fingerprint data remains the same in incognito/private mode and when browser data like cookies and local storage is purged. This means that the attacker can still track the victim and carry out attacks even when users are taking extra safety precautions like using incognito browsers and purging site cookies. Fig 5: Browser fingerprinting. The browser fingerprinting data is sent to the server and if it returns with success flag as false, the user is either redirected to the hardcoded redirected domain i.e. hxxps://google[.]com/. If the browser fingerprinting data is sent to the attacker successfully then the server responds with a success flag and along with that responds with the credit card payment form code and SMS/ OTP form, shown in Fig 6. Fig 6: Response from the server with fake credit card and SMS details form. Any action by the victim on the scam page like scroll, mouse event or keypress will result in moving focus to the credit card details fields, shown in Fig 7. Fig 7: Function to set focus to credit card details field. After the user submits their credit card information, the scam site redirects to the payment processing window and prompts the victim to wait and tells them that their payment is being processed and not to close the page, however, this processing screen never updates or indicates when the transaction is completed, shown in Fig 8. Fig 8: Payment processing window after submitting credit card information The attacker verifies the credit card credentials entered by the user and the page will not accept invalid card details, as shown in Fig 9. Fig 9: Credit card validation After the extorted credit card details are validated, the credentials are sent to URL hxxps://supernight[.]world/gateway.php, shown in Fig 10. Fig 10: Sending stolen credit card credentials to c2 location Technical Appendix: This phishing page also has anti-debugging techniques, if the phishing kit is being deployed locally then the browser will not switch to the fullscreen mode. Fig 11: Function to switch browser to full-screen mode Function to disable the below keystrokes: F1-F10, Tab, Enter, Caps lock, Insert, Page Up-Down, End, Home, Arrow Left-Up-Right-Down, Print Scrn, scroll lock and right-left window key Fig 12: Disable keystrokes Fig 13: All mouse events will call the setfocus function. Indicators of compromise supernight[.]world alimalipay[.]xyz searchfirst[.]xyz secondsearch[.]xyz centralthis[.]xyz smemepay33[.]xyz npepayse17[.]xyz smemepay36[.]xyz npepayse21[.]xyz smemepay37[.]xyz smemepay29[.]xyz weserv38573w14[.]xyz weserv38573w9[.]xyz weserv38573w8[.]xyz vvservnkren8[.]xyz mmpepay16[.]xyz mmpepay12[.]xyz mmpepay19[.]xyz npepayse20[.]xyz desctopfree[.]xyz smemepay37[.]xyz npepayse19[.]xyz smemepay33[.]xyz smemepay36[.]xyz npepayse21[.]xyz npepayse17[.]xyz smemepay29[.]xyz weserv38573w14[.]xyz weserv38573w9[.]xyz weserv38573w8[.]xyz 65.20.70[.]213 92.255.85[.]133 Other adult redirection and scam domains resolving to the same IPs (possibly related to this campaign) supernight[.]xyz jerkdolls[.]digital jerkdolls[.]xyz jerkdolls[.]shop istripper[.]world istripper[.]online istripper[.]bond istripper[.]shop istripper[.]info istripper[.]icu weppahgeje5[.]xyz npepayse20[.]xyz smemepay35[.]xyz npepayser9[.]xyz smemepay34[.]xyz npepayse22[.]xyz smemepay28[.]xyz smemepay27[.]xyz smemepay20[.]xyz smemepay25[.]xyz vvservnkren10[.]xyz smemepay26[.]xyz smemepay24[.]xyz weserv38573w11[.]xyz tttsertkfm6[.]xyz tttsertkfm5[.]xyz tttsertkfm4[.]xyz vvservnkren18[.]xyz weserv38573w19[.]xyz fooldating[.]xyz weserv38573w10[.]xyz fooldat1ng[.]xyz desctopfree[.]xyz weserv38573w17[.]xyz vvservnkren1[.]xyz weserv38573w12[.]xyz weserv38573w13[.]xyz Read more of this post Comment Unsubscribe to no longer receive posts from Security Boulevard. Change your email settings at manage subscriptions. Trouble clicking? Copy and paste this URL into your browser: https://securityboulevard.com/2022/06/browser-in-the-browser-sextortion-scam-makes-victims-pay-by-imitating-indian-gov/ Powered by Jetpack

michele-johnston posted: " There are many common perceptions about cybersecurity – but many are misperceptions. For small and mid-sized businesses (SMBs), misinformation about cybersecurity can be confusing – and sometim" Security Boulevard Fact or Fiction? The Truth About Cybersecurity for Small and Mid-Sized Businesses michele-johnston Jun 1 There are many common perceptions about cybersecurity – but many are misperceptions. For small and mid-sized businesses (SMBs), misinformation about cybersecurity can be confusing – and sometimes risky. It's time to set the record straight on which statements are fact and which are fiction. Fiction: Cyber criminals don't care about SMBs Modern cyber criminals actually DO care about SMBs – and often use smaller third-party vendors to gain access to larger targets. With fewer budget dollars and expert resources dedicated to cybersecurity than their larger counterparts, small and mid-sized organizations often make easier targets, particularly in today's increasingly complex and connected cloud environment. In fact, nearly one-third (28%) of data breaches in 2020 involved small businesses, according to the Verizon 2020 Data Breach Investigations Report (DBIR) – 70% of which were perpetrated by external actors. Fiction: Outsourcing cybersecurity is not a realistic option for SMBs Outsourcing cybersecurity is a great option for SMBs. Leveraging a managed service rather than buying a security point solution gives your SMB fixed-cost access to enterprise-grade technology and expertise you might otherwise not be able to afford. These seasoned security teams become an extension of your internal IT team, and can help with creating and enhancing your overall cybersecurity program and boosting your security posture. Fact: Compliant doesn't mean secure  While it's true that cybersecurity and compliance are often intertwined, they are not the same. An organization may meet minimum government or industry security requirements, but that doesn't mean the organization is secure. Your IT/security team should be aware of the compliance mandates in your industry, but also be ready to play an active role in protecting your organization. Rather than trying to take on these responsibilities alone, a cybersecurity-as-a-service provider with demonstrated industry expertise can help you meet your compliance obligations – and will have the technology and expertise to keep you secure as well. Fact: Cybersecurity fatigue is a problem  Forty-one percent of respondents at both SMBs and large enterprises report experiencing fatigue, according to the Cisco Cybersecurity Report Series 2020 for Small and Medium-Sized Business. IT/security teams and business leaders need to be efficient at managing security, especially at organizations where resources are stretched thin. Outsourcing some of the tasks to a managed cybersecurity provider can relieve your IT team of the stress and burnout associated with running your cybersecurity program – and can even help optimize it. Fiction: Strong passwords are enough Strong passwords are important, but passwords alone won't keep your enterprise protected. Other components of a good cybersecurity posture include two-factor authentication and continuous cybersecurity monitoring. Collecting security events from across your IT infrastructure, network, and applications, and reporting threats on a constant basis, are integral to enterprise network safety. The cybersecurity landscape is constantly changing, and the COVID-19 pandemic has introduced a new set of challenges and cybersecurity issues for organizations across industries. The good news is that we've seen remarkable improvement in the SMB cybersecurity space in recent years, thanks to growing awareness and maturing managed detection and response (MDR) capabilities. Today SMBs have access to security products and services that were previously only available to large enterprises. Fiction: Anti-virus is the only endpoint protection you need Anti-virus solutions are typically signature-based, which means that the malware they detect is already known. Increasingly, attackers are leveraging zero-day vulnerabilities or targeted attacks that traditional signature-based solutions don't "recognize" and will not pick up. As user devices such as desktops, laptops, and mobile devices now extend beyond your perimeter, visibility into these endpoints is critical. Endpoint detection and response (EDR) solutions deliver this visibility, and also supplement anti-virus protection by leveraging behavior-based signatures, machine learning, and analytics to detect advanced compromises. EDR also can alert, block, remediate, and quarantine suspicious behavior as needed. Fiction: Monitoring my edge firewall is the only monitoring needed Your edge firewall will only inspect traffic that is transiting that firewall. Instead, your entire estate needs to be monitored. Network segmentation and monitoring the entire network will provide crucial visibility into compromises that originate inside the network or that are propagating laterally across the network (east to west traffic patterns). In addition, monitoring all application, database, file shares, and authentication sources provide key telemetry for threat detection. Fiction: SMBs can't afford a cybersecurity program To the contrary – you can't afford NOT to have a cybersecurity program. According to the National Cyber Security Alliance, 60% of small businesses that suffer a cyber attack go out of business within six months of the incident. As enterprise organizations expand their cybersecurity programs, budget, and detection capabilities, they become more difficult targets, which increases the focus of attackers on the often less-protected smaller organizations – for a better ROI. FACT: Phishing and social engineering are the number one attack vector for SMBs Humans are the weak link in the cybersecurity chain for companies of all sizes, and the numbers prove it. According to the Verizon 2022 DBIR, 82% of breaches involved the human element, and social attacks such as phishing got attackers in the door. Top motives include financial gain, and your users with access to your organization's banking and business systems are likely targets. Protection against these tactics include strong email security controls coupled with end-user security awareness training and phishing testing as components of your cybersecurity program. Don't believe everything you hear. Knowing the facts about cybersecurity gives you the ability to stand up to attackers and plan your cybersecurity strategy appropriately. For many SMBs, security point solutions, tight budgets, and limited expertise can impact the effectiveness of your security efforts. Consider partnering with a managed services provider who can give you on-demand access to enterprise-grade cybersecurity technologies and the resources to run them – without the complexity or cost of implementing, staffing, and managing everything yourself. Are you looking to strengthen your security posture by using a managed services provider? Check out SilverSky's leading security services for cybersecurity that's simple, affordable, and accessible.   Read more of this post Comment Unsubscribe to no longer receive posts from Security Boulevard. Change your email settings at manage subscriptions. Trouble clicking? Copy and paste this URL into your browser: https://securityboulevard.com/2022/06/fact-or-fiction-the-truth-about-cybersecurity-for-small-and-mid-sized-businesses/ Powered by Jetpack

Davi Ottenheimer posted: "An interesting turnabout from the timeline and details of the Uvalde child massacre is how a generic armed defense argument is being proven bogus yet again. First, a plethora of armed police were on the scene and didn't respond to an active shooter. We ca" Security Boulevard Uvalde Child Massacre Destroys Theory of Armed Defense Davi Ottenheimer Jun 1 An interesting turnabout from the timeline and details of the Uvalde child massacre is how a generic armed defense argument is being proven bogus yet again. First, a plethora of armed police were on the scene and didn't respond to an active shooter. We can easily assume from this that future incidents would continue the … Continue reading Uvalde Child Massacre Destroys Theory of Armed Defense → Read more of this post Comment Unsubscribe to no longer receive posts from Security Boulevard. Change your email settings at manage subscriptions. Trouble clicking? Copy and paste this URL into your browser: https://securityboulevard.com/2022/06/uvalde-child-massacre-destroys-theory-of-armed-defense/ Powered by Jetpack

Marc Handelman posted: "Our thanks to Zero Day Initiative for publishing their outstanding Pwn2Own Vancouver 2022 videos on the organization's' YouTube channel. Permalink" Security Boulevard Zero Day Initiative's Pwn2Own Vancouver 2022 – Bien Pham Vs. Ubuntu Desktop Marc Handelman Jun 1 Our thanks to Zero Day Initiative for publishing their outstanding Pwn2Own Vancouver 2022 videos on the organization's' YouTube channel. Permalink Read more of this post Comment Unsubscribe to no longer receive posts from Security Boulevard. Change your email settings at manage subscriptions. Trouble clicking? Copy and paste this URL into your browser: https://securityboulevard.com/2022/06/zero-day-initiatives-pwn2own-vancouver-2022-bien-pham-vs-ubuntu-desktop/ Powered by Jetpack

Bruce Schneier posted: "Researchers have reported a still-unpatched Windows zero-day that is currently being exploited in the wild. Here's the advisory, which includes a work-around until a patch is available. " Security Boulevard Clever — and Exploitable — Windows Zero-Day Bruce Schneier Jun 1 Researchers have reported a still-unpatched Windows zero-day that is currently being exploited in the wild. Here's the advisory, which includes a work-around until a patch is available. Read more of this post Comment Unsubscribe to no longer receive posts from Security Boulevard. Change your email settings at manage subscriptions. Trouble clicking? Copy and paste this URL into your browser: https://securityboulevard.com/?p=1926135 Powered by Jetpack

Will Schroeder posted: "DeepPass — Finding Passwords With Deep LearningOne of the routine tasks operators regularly encounter on most engagements is data mining. While exactly what operators are after varies from environment to environment, there is one common target that everyo" Security Boulevard DeepPass — Finding Passwords With Deep Learning Will Schroeder Jun 1 DeepPass — Finding Passwords With Deep Learning One of the routine tasks operators regularly encounter on most engagements is data mining. While exactly what operators are after varies from environment to environment, there is one common target that everyone's always interested in: passwords. After diving into machine learning from an adversarial perspective I started to pay attention to any offensive security problems that could be augmented with ML. In one of my previous posts, I mentioned the differentiation between Adversarial Machine Learning and Offensive Machine Learning- Will Pearce defines Adversarial ML as the "Subdiscipline that specifically attacks ML algorithms" and Offensive ML as the "Application of ML to offensive security problems" and I agree with these definitions. My previous posts covered an introduction to adversarial ML, where we crafted adversarial samples to evade target existing models. Offensive ML includes things like sandbox detection, augmenting password guessing attacks, or improving spear phishing. In this post, we're going to try to tackle password recognition. We're obviously not the first people to think of this. Two years ago Tom Kallo from Hunnic Cyber released a post titled, "Password Hunting with Machine Learning in Active Directory" and an associated tool called SharpML. Their approach was an interesting one, summarized by their graphic: SharpML's execution process. While the post states, "We will also be seperately [sic] releasing the un-compiled Machine Learning model and rules for you to play with, which will be similarly hosted on Github." as of the writing of this post that hasn't yet occurred. Without knowing what the model's architecture, performance metrics, or exactly how it was trained (though my guess based on the repo is that it utilized 10k leaked passwords), I wanted to recreate a password recognition model and provide as much detail as possible. I also wanted to avoid the live password verification component, so this means I didn't have to worry about transporting and executing the model on an arbitrary host in a target environment. Full note upfront: this model is not perfect, and I'll be explaining its shortcomings as we go. There's actually a StackExchange post on some of these difficulties, including a topic we're going to talk about here, "…the tricky part is figuring out how to get decent training data at sufficient volume." If you thought you were avoiding memes in this post, think again. The Jupyter notebook and Dockerized model are not publicly available in the DeepPass GitHub repository. The Problem A lot of things in machine learning are easier said than done. When I started learning this discipline, the mystery of ML felt similar to when I started learning offensive security: I thought anything was possible. Now I still believe that anything is possible, but some things are definitely more possible than others. So what's the exact problem we want to tackle here? Our operators download a larger number of documents on most engagements, whether through an agent or through various sites like Sharepoint. Reading through a large amount of text searching for specific key words or things like look like passwords is time consuming and something that machine learning could possibly help with (note, I didn't say "solve" ; ) I'm going to skip over the topic of auto-ingestion here, and will focus on how to build an abstracted API that we can submit an arbitrary document to and receive password candidates back. Architecture-wise this is a common deployment scenario for ML models, and I'll cover the Dockerized implementation in a later section. Our API needs to: Accept documents of various data types (.docx, .pdf, .pptx, etc.) Extract plaintext words (often known as tokens in machine learning lingo) from each document type Run the extracted text through some type of machine learning model Return password "candidates" from the model results along with a bit of surrounding context Before we start building and training, once again there's an elephant in the room mentioned in the StackExchange post: how do we get good training data? The Problem of Data When we manually triage documents as humans we bring a wealth of experience and internalized pattern recognition to bear. Anyone who's performed offensive operations can look at any number of documents and easily identify if a password is present. Consider the following sentences: In order to login, use the following password: Password123! We've reset your credentials to 'ChangeMePlz?', please change this at some point in the future. The creds for the database are user:Qwerty123456. Obviously there is almost always a good amount of juicy context surrounding a password in a document that holds up a big red "PASSWORD!" flag to us when doing document triage. However, if we wanted to train a predictive model for that specific problem set we need labeled data, and a good amount of it, if we're not just doing a basic regex-style search. That means we need a large number of documents similar to what we would encounter in the field where we know a subset has passwords within them and we know a subset has no passwords at all. We don't preserve client data past reporting, and I don't know of any public document corpus that satisfies these requirements. <data frustration intensifies> There are few things more frustrating in ML than believing you could solve a problem if you just had the right (non-existent) dataset. So my approach was an idea for the next best, but not ideal, approach: I focused on differentiating passwords themselves from "regular" words. To reiterate, I know that this isn't perfect but it was the best approach I could think of given the constraints. The relative rarity of passwords in a document's text also creates a class-imbalance problem that we'll talk about tackling in later sections. In English: training a model to detect events that are relatively rare has its own unique set of challenges! For an input dataset, I needed a large number of passwords and non-passwords. For passwords, I downloaded the "real human" password dump from CrackStation. I randomly selected 2,000,000 passwords that were between 7–32 characters to function as the known-password half of the dataset. I then ran a large number of Google dorks to find technical/IT related documents of a number of different formats, ultimately gathering ~1,300 public "benign" documents. While there are possibly passwords contained within these documents, the normal text greatly outnumbers any possible outliers. I ran these documents through Apache Tika, an established toolkit that, "…detects and extracts metadata and text from over a thousand different file types (such as PPT, XLS, and PDF)" — I'll also use Tika later in the model serving section. I selected 2,000,000 random words/tokens from this set for the known-word half of the dataset. The Model In my previous posts I detailed using a number of different model architectures for our tabular obfuscated PowerShell AST data set. I also mentioned that gradient boosted trees tend to outperform Neural Networks on tabular data. For text, specific types of Neural Networks generally outperform other approaches like Naive Bayes or N-Gram approaches, though this sometimes does depend on the amount of data you have. For this case, since we're doing character tokenization of individual words instead of word tokenization of an entire document, I experimented with a variety of Neural Networks. This took a decent amount of time due to the 4,000,000 word dataset, so I wasn't able to experiment quite as much as I would have liked. I'm confident that there is either a different architecture or a differently tuned approach that performs better than what I have here. I tried a number of architectures, from stacked LSTMs to a variety of 1-Dimensional ConvNets (including multichannel variations). The best resulting architecture was a 200 node Bidirectional Long Short Term Memory (LSTM) network with a manual embedding layer and a bit of dropout: Our Bidirectional LSTM model architecture. If this is you after reading the last few paragraphs, I'll try to add some context: Me a year ago. There's no way that I can fully explain token embedding for Neural Networks or the bidirectional LSTM architecture in this post, and I doubt many want me to. So I'll provide a short, high-level explanation and some references in case you're interested. Text is sequential data. In a sentence, the sequence of words matter, and for a word (i.e., password) situation like we have here, the sequence of characters matter. We can't treat sequences how we treated our tabular/matrix-type data, we need a different type of model. This is where LSTMs come in. LSTMs are a special type of deep learning architecture called a recurrent neural network (RNN) which were designed to handle various types of sequence data. Neurons in a RNN have a loop that allows them to "remember" information about data in a sequence. LSTMs are an advanced RNN architecture that has proven to be very effective for text data, and was the de facto text architecture before transformers took over a few years ago. I specifically used a bidirectional LSTM which trains one LSTM running forward and one running backward on the input sequences. This helps us ensure we capture as much about the pattern of a password as possible. A detailed explanation of Long Short Term Memory networks (LSTMs) More information about bidirectional LSTMs More information on word embeddings More information on dropout Nerd sidenote: "Why didn't you use transformers??!" Well, I thought about it and played around a bit, but pretty much all transformer examples I found deal with word sequences and not character sequences. I'm also not completely convinced that neural attention is the best tool for word-length character sequences. However, let me reiterate my usual "i not an expert and don't math too good" statement, and that I'm completely open to someone telling showing me I'm wrong! For training, I also used a technique called Early Stopping to help prevent overfitting. Deep learning involves multiple "epochs", where the entire data set is trained in batches that chunks all of the data to the model once per epoch. Early stopping is used to monitor specific performance metrics of the model during training and stops the training if performance doesn't improve after a certain number of epochs. This helps preserve runaway overfitting. So how did the model perform? You, as a reader, hopefully not (but probably) tired of my memes. Pretty well actually, with almost 99% accuracy! However, this is still a big issue because of the ratio of rare events (like a word in a document being a password) thanks to our old friend the base rate fallacy. Let's think about a simplified example to understand why. Let's say we download 100 documents that average 5000 words each, and 10 of those documents have a single password within them. That means among the 500,000 candidate words we're going to process only 10 are passwords. Where does a 99% accuracy rate get us? 499,990 non-passwords * 99% accuracy = 494990 true negative non-passwords + 5000 false positive passwords 10 passwords * 99% accuracy = 0 false negative non-passwords, 10 true positive passwords We likely will flag all of the passwords, but we'll also have 5000 false positives! This is a big issue that's similar to the false positive problem that plagues detection analysts. When a true positive is a relatively rare event in a large dataset, like a password in a document or real intrusion on a host in a large network, even very accurate models will produce a large number of false positives. Like my blog meme count. Often when training a model on rare events, the dataset itself is imbalanced. That is, the dataset would reflect the distribution of data in the real world, like the password frequency I described previously. There are various methods for handling imbalanced datasets, like upsampling/downsampling the class samples, data augmentation, etc. However in our case due to how we generated the dataset it's perfectly balanced. In order to deal with the false positive problem I had two ideas I experimented with. The first was changing the probability decision threshold for the model output. Our model, with its single Sigmoid output neuron, doesn't output a hard label of "password" or "not password" but rather a probability that the input word is a password. Most of the time we use a threshold of 0.5 to decide the labels, with >=0.5 here signifying the input is a password. However we can manually adjust this, only returning results that have a higher, say 0.9, probability of being a password. One advantage here is that we can adjust the threshold multiple times after the model is trained. The other option is to weight each class differently when training the model. This modifies the loss function to more heavily penalize incorrect classifications for a specific class, which can change the ratio of false positives or false negatives depending on how things are weighted. A disadvantage here is that once we train the model on the weighted classes, this can't be changed like adjusting the threshold. However this ultimately outperformed the threshold option in this particular case, though we could possibly combine the approaches if wanted. The final model I trained used class weights of .9/.1 which penalized false positives more heavily. This is detailed in the ./notebooks/password_model_bilstm.ipynb notebook in the DeepPass repo. For a final evaluation, I used the best performing early-stopping model on the test set to produce the performance metrics below. If you're not familiar with the confusion matrix or validation/test sets, check out my introduction post on machine learning. accuracy : 0.98997 precision : 0.99629 recall : 0.98358 F1 score. : 0.98990 Confusion matrix for the test set. This is definitely more manageable, with 723 false positives out of 400,000 balanced input words. False positives and false negatives are intrinsically linked, and reducing one will increase the other. Using class weighting to reduce false positives here means that false negatives, or potential passwords we miss, will increase! However I felt that this tradeoff was necessary for the approach to hope to be usable. I also gained even more empathy for defenders who have to triage a deluge of alerts every day : ) Model Deployment OK, neat, we have a nifty Keras LSTM model that seems like it performs decently well for our task. How do we actually use this thing? Oh god it haunts my dreams. In keeping with our API design goal, I chose to use Docker to package everything together. Luckily for us, there's an officially supported Apache Tika Docker Image we can use to replicate the text extraction step, and TensorFlow (the underlying fabric for the Keras Deep Learning framework we used) has an awesome project called TensorFlow Serving. TensorFlow Serving is a lightweight approach for serving up model functionality after training and has a nice Docker Image as well. The final step is to create a small application to handle the input requests and call all of the pieces. Additionally, I wanted to provide the ability to supply custom regex terms to search through each document text as well, as well as providing a few words of surrounding context for each result. All of this code is properly dockerized and up in the DeepPass repo. Here's how the (janky, I know) tiny front end proof-of-concept web app looks: And here's an example result: The whole system can obviously be used as a straight API at http://localhost:5000/api/passwords C:\Users\harmj0y\Documents\GitHub\DeepPass>curl -F "file=@test_doc.docx" http://localhost:5000/api/passwords [{"file_name": "test_doc.docx", "model_password_candidates": [{"left_context": ["for", "the", "production", "server", "is:"], "password": "P@ssword123!", "right_context": ["Please", "dont", "tell", "anyone", "on"]}, {"left_context": ["that", "the", "other", "password", "is"], "password": "LiverPool1", "right_context": [".", "This", "is", "our", "backup."]}], "regex_password_candidates": [{"left_context": ["for", "the", "production", "server", "is:"], "password": "P@ssword123!", "right_context": ["Please", "dont", "tell", "anyone", "on"]}], "custom_regex_matches": null}] As a reminder, the file formats are what Apache Tika supports. Also, I previously mentioned the decision probability threshold- this can be adjusted in the app.py file on line 221 if wanted to further reduce false positives. Conclusion This is my first application of "offensive" machine learning and was an interesting project for me. I hope this was interesting to others and that the model is of use, even if it's not perfect. I also hope that this might spark ideas in others regarding password detection during data mining. This effort definitely impressed upon me yet again that getting good quality, labeled data is usually the hardest part of any machine learning project. If you'd like to retrain the model with a different dataset more tailored to your operations, the Jupyter notebook in the DeepPass repository should show you how. Just build a new dataset.csv with columns of "word","is_password", retrain the model, save the model off, and substitute the model into the ./models/ section of the Docker project. DeepPass — Finding Passwords With Deep Learning was originally published in Posts By SpecterOps Team Members on Medium, where people are continuing the conversation by highlighting and responding to this story. Read more of this post Comment Unsubscribe to no longer receive posts from Security Boulevard. Change your email settings at manage subscriptions. Trouble clicking? Copy and paste this URL into your browser: https://securityboulevard.com/2022/06/deeppass-finding-passwords-with-deep-learning/ Powered by Jetpack

Matt Wilson posted: " The future of security solutions is cloud-native By Matt Wilson Sr. Director Product Management More than a decade ago, the cloud became the next "hot thing" in computing. Today, we are seeing the culmination of this tre" Security Boulevard The future of security solutions is cloud-native Matt Wilson Jun 1 A cloud-native platform means security leaders can get ahead of advancing complexity to embrace the flexibility of the cloud with confidence and—best of all—do so on their terms. The post The future of security solutions is cloud-native appeared first on Netography. Read more of this post Comment Unsubscribe to no longer receive posts from Security Boulevard. Change your email settings at manage subscriptions. Trouble clicking? Copy and paste this URL into your browser: https://securityboulevard.com/2022/06/the-future-of-security-solutions-is-cloud-native/ Powered by Jetpack

Haekka Blog posted: "Context and frequency drives connection.Connection drives engagement.Engagement drives effectiveness.At Haekka, we continually deliver hyper-contextual training to users. We connect security to employees. This connection is what drives security engagement" Security Boulevard Security Engagement Over Security Awareness Haekka Blog Jun 1 Context and frequency drives connection.Connection drives engagement.Engagement drives effectiveness.At Haekka, we continually deliver hyper-contextual training to users. We connect security to employees. This connection is what drives security engagement and effectiveness. In our last post, we discussed how frequently you should train users on security awareness. Data shows that training should be done monthly, at a minimum, if the goal is to have training be effective (and not just check the box).At Haekka, we believe you need to flip the question and stop considering "how often do you train your employees on security awareness" and instead focus on "how frequently do engage with employees on security awareness". Engagement is a better bar if the goal is retention, behavior change, and incorporating a security mindset into day to day work.How often should you engage with employees on security awareness?If you believe security awareness training is important because your employees need help to combat the constant stream of attacks waged against them (phishing vishing, malware, account takeover, ransomware, etc.), then you need to go beyond checking the box. As the data in our last post shows, more frequent training improves effectiveness. At a minimum, monthly training is a good startling point even though it has its weaknesses as noted in our last post, namely that specific topics are covered infrequently.At Haekka, we leverage our Slack integration to drive more frequent training. When we talk about training in the flow of work, we mean that we can deliver training in snippets, in the apps users are already in, on a regular basis without blocking work.We still offer lesson-based security awareness courses. These courses are typically done at onboarding and sometimes recur annually. But, many Haekka users do this training once and then engage with our frequent training snippets.By default, we deliver relevant, up-to-date training each week. These are short, 30-90 seconds, but the repetitive nature results in more retention of the topics and, more importantly, a more prevalent security mindset. When you consider getting 50+ different security awareness topics in a year, there is some redundancy in the topics and categories covered. This is by design. Our weekly training tells the same story in different ways, ensuring more of the content is retained.In addition, we also provide all Haekka customers with the ability to quickly create ad-hoc or recurring messages, announcements, quizzes, or surveys. These are not full courses and are not meant to replace full courses. We call these Engagements. They can be created in under 5 minutes and delivered to individuals, groups, channels, or all users in Slack.The last thing we do at Haekka to drive training effectiveness is delivering training based on employee actions. The actions we use are things that employees do in SaaS apps like Slack, Google Workspace, or Zoom. The event-driven nature of this type of training is not on a specific cadence but is real-time and hyper-contextual to the work a person is doing. Context, like training frequency, matters.---Here's a simple way to frame training vs engagement.Context and frequency drives connection.Connection drives engagement.Engagement drives effectiveness.At Haekka, we continually deliver hyper-contextual training to users. We connect security to employees. This connection is what drives security engagement and effectiveness. Read more of this post Comment Unsubscribe to no longer receive posts from Security Boulevard. Change your email settings at manage subscriptions. Trouble clicking? Copy and paste this URL into your browser: https://securityboulevard.com/2022/06/security-engagement-over-security-awareness/ Powered by Jetpack

Maahnoor Siddiqui posted: " Automated risk assessment tools help you assess information security risks and related metrics in real-time based on the available data internally and externally. Connecting the dots makes the bigger picture visible to management to see what's going o" Security Boulevard The Top 5 Automated Risk Assessment Tools Maahnoor Siddiqui Jun 1 Automated risk assessment tools help you assess information security risks and related metrics in real-time based on the available data internally and externally. Connecting the dots makes the bigger picture visible to management to see what's going on. This is exactly what these tools do.  Read more of this post Comment Unsubscribe to no longer receive posts from Security Boulevard. Change your email settings at manage subscriptions. Trouble clicking? Copy and paste this URL into your browser: https://securityboulevard.com/2022/06/the-top-5-automated-risk-assessment-tools/ Powered by Jetpack

Marc Handelman posted: " via the Comic Noggins of Nitrozac and Snaggy at The Joy" Security Boulevard Joy Of Tech® 'Geeks Will Be Geeks' Marc Handelman Jun 1 via the Comic Noggins of Nitrozac and Snaggy at The Joy of Tech®! Permalink Read more of this post Comment Unsubscribe to no longer receive posts from Security Boulevard. Change your email settings at manage subscriptions. Trouble clicking? Copy and paste this URL into your browser: https://securityboulevard.com/2022/06/joy-of-tech-geeks-will-be-geeks/ Powered by Jetpack

David Lindner, Director, Application Security posted: " Skip to content " Security Boulevard Cybersecurity Insights with Contrast CISO David Lindner | 5/27 David Lindner, Director, Application Security Jun 1 Insight #1 "A recent survey shows developers are struggling to write secure code and often times publish code with known security vulnerabilities due to juggling priorities and demands. The only way to solve this is to provide your developers with all the information they need, in process, and in real-time, and allow them to fix vulnerabilities as they write code. Out of band tests, pdf reports, and false positives all lead to ignoring and deprioritizing."   Insight #2 "Struggling with retention on your security teams? Three things that may help. First, provide weekly research time as part of their normal job. Second, send them to conferences. Third, pay them well and continually review the market."   Insight #3 "When was the last time you did a Github search for common secrets, keys, or configuration files used in your environments? Try it today as I guarantee you find something."       Read more of this post Comment Unsubscribe to no longer receive posts from Security Boulevard. Change your email settings at manage subscriptions. Trouble clicking? Copy and paste this URL into your browser: https://securityboulevard.com/2022/06/cybersecurity-insights-with-contrast-ciso-david-lindner-5-27/ Powered by Jetpack

David Lindner, Director, Application Security posted: " Skip to content " Security Boulevard Cybersecurity Insights with Contrast CISO David Lindner | 5/20 David Lindner, Director, Application Security Jun 1 Insight #1 "The Exploit Prediction Scoring System (EPSS) is yet another data point I urge you to add to your risk calculations of known CVEs. More data, better risk measurements, and easier prioritization."   Insight #2 "Did you know that the active third-party library code in your applications is only about 10%? Our engineers may pull in a lot of third-party library code (in upwards of 80% of all the code in an application), but knowing if, when, and how you use that library code is extremely important to understand the risks posed by them. Use instrumentation-based tools to provide you with this information, to better inform your risk decisions."   Insight #3 "When was the last time you looked at the open-source library licenses in your applications? Are you using any copy-left licenses (GPL, AGPL, etc) that could create legal nightmares for your organization? It's imperative you implement controls, both process and technical, to limit the licenses to those approved by your legal teams."     Read more of this post Comment Unsubscribe to no longer receive posts from Security Boulevard. Change your email settings at manage subscriptions. Trouble clicking? Copy and paste this URL into your browser: https://securityboulevard.com/2022/06/cybersecurity-insights-with-contrast-ciso-david-lindner-5-20/ Powered by Jetpack

brooke.crothers posted: "Massive Spotify Podcast Outage, Verifone Problems Highlight 'Ugly Reality' of Expired Certificates brooke.crothers Wed, 06/01/2022 - 09:24 22 views Spotify: No certificate, no access Publishers and listeners for Megaphone-hosted podcasts face" Security Boulevard Massive Spotify Podcast Outage, Verifone Problems Highlight 'Ugly Reality' of Expired Certificates brooke.crothers Jun 1 Massive Spotify Podcast Outage, Verifone Problems Highlight 'Ugly Reality' of Expired Certificates brooke.crothers Wed, 06/01/2022 - 09:24 22 views Spotify: No certificate, no access Publishers and listeners for Megaphone-hosted podcasts faced service disruptions after the outage. Listeners, for example, lost access to their favorite podcasts. Though the certificate outage was resolved by Tuesday morning, it was a massive disruption for Spotify, which hosts a popular podcast service. An SSL certificate authenticates a website's identity and enables an encrypted connection, a necessary security measure. An SSL secured website always has "HTTPS" in the URL, replacing the older, less secure HTTP.  "When these critical security assets expire unexpectedly, they leave consumers without access to data, services and applications," according to Kevin Bocek, VP Security Strategy & Threat Intelligence at Venafi. Spotify confirmed the platform outage "due to an issue related to our SSL certificate." Spotify acquired Megaphone, a podcast advertising and publishing platform, in 2020.  Megaphone, which handles ad insertion, also hosts popular podcasts. "During the outage, clients were unable to access the Megaphone CMS and podcast listeners were unable to download podcast episodes from Megaphone-hosted publishers. Megaphone service has since been restored," a Spotify spokesperson told the media on Tuesday. Verifone also grapples with certificate problems Verifone, which provides provides technology for electronic payment transactions and point-of-sale (POS) systems, was plagued by disruptions in Germany.  Twitter threads point to an issue with certificates. A payment terminal, the Verifone H5000, which is an old platform, "brought down big parts of card payment all over Germany as one of the embedded certificates expired unnoticed on Tuesday," said Jan Wildeboer, who describes himself as Red Hat's EMEA Evangelist, in a tweet. The outage was felt at payment systems across Germany, according to reports, citing Wildeboer. "Turns out this terminal is still being installed as new by many local payment service companies. It is cheap [since it is end-of-life]…But seemingly no one noticed the expiration date of a certificate that is needed to get authorisation from the German payment system," Wildboer said. Venafi: certificate outage is an 'ugly reality' The double whammy of Spotify and Verifone, two major brands, points to the importance of tackling machine identity management. The lack of a robust machine identity management can impact everything from gas pumps to banking services to airline reservations and to streaming services. "The ugly reality is that certificates outages can happen to anyone; we've seen high profile examples like LinkedIn and O2 suffering the exact same problem with certificates in the past," said Bocek said. (See: LinkedIn Certificate Crash: Is Your Organization Outage Free?) "Certificates enable secure communication between machines, applications and services but they're often poorly managed. And the challenge of managing machine identities is becoming harder as more companies move to the cloud where every container and application needs a unique identity," Bocek said. Recent data shows that machine identities, like the certificate that expired on Megaphone, are growing at over 40% per year, Bocek said.  And most companies will have over half a million identities to manage by 2024. "We should expect to see a lot more of these kinds of outages until companies invest in the automation necessary to effectively automate the entire lifecycle of every machine identity," Bocek said. Related Posts Why Stopping Certificate Outages Starts with an Outage Safety Net SSL/TLS Certificates: Easily Overlooked When You Have an Outage? Anatomy of a Certificate Outage [Epic Games]     Brooke Crothers Outages Users of Spotify's Megaphone service could not download podcasts on Monday due to an all-too-familiar error: an expired certificate. Verifone also appears to have experienced problems with certificates causing card payment problems.  What if you could eliminate certificate outages forever? Learn about our No Outage Guarantee! "> Off UTM Medium Resources UTM Source Blog UTM Campaign Recommended-Resources Read more of this post Comment Unsubscribe to no longer receive posts from Security Boulevard. Change your email settings at manage subscriptions. Trouble clicking? Copy and paste this URL into your browser: https://securityboulevard.com/2022/06/massive-spotify-podcast-outage-verifone-problems-highlight-ugly-reality-of-expired-certificates/ Powered by Jetpack

Digital Defense by HelpSystems posted: " Payment Card Industry Data Security Standards PCI DSS Toolkit Tools to Help With Und" Security Boulevard PCI 4.0 Toolkit Digital Defense by HelpSystems Jun 1 The post PCI 4.0 Toolkit appeared first on Digital Defense. Read more of this post Comment Unsubscribe to no longer receive posts from Security Boulevard. Change your email settings at manage subscriptions. Trouble clicking? Copy and paste this URL into your browser: https://securityboulevard.com/2022/06/pci-4-0-toolkit/ Powered by Jetpack

Guest Expert posted: " Shimon Brathwaite EC-Council University | Certified Ethical Hacker | Information Technology Cybersecurity professional, a published author, freelance writer and cybersecurity copywriter. Author | SecurityMadeSimpleIntroductionThe Softwa" Security Boulevard Key Highlights From the New NIST SSDF Guest Expert Jun 1 In this article, we'll be going over the 1.1 revision of The Secure Software Development Framework that was published earlier this year. Read more of this post Comment Unsubscribe to no longer receive posts from Security Boulevard. Change your email settings at manage subscriptions. Trouble clicking? Copy and paste this URL into your browser: https://securityboulevard.com/2022/06/key-highlights-from-the-new-nist-ssdf/ Powered by Jetpack

Simon M posted: "What is driving the demand for new authorization models, software vendors and emerging authorization design patterns? This discusses previous failures of RBAC and XACML as well as modern architecture patterns such as identity centricity and the business m" Security Boulevard Authorization: Drivers for Demand Simon M Jun 1 What is driving the demand for new authorization models, software vendors and emerging authorization design patterns? This discusses previous failures of RBAC and XACML as well as modern architecture patterns such as identity centricity and the business mesh. To access this post, you must purchase Member Content. The post Authorization: Drivers for Demand appeared first on The Cyber Hut. Read more of this post Comment Unsubscribe to no longer receive posts from Security Boulevard. Change your email settings at manage subscriptions. Trouble clicking? Copy and paste this URL into your browser: https://securityboulevard.com/?p=1926150 Powered by Jetpack

Digital Defense by HelpSystems posted: " Proactive Cybersecurity: The One Place Where "You're Being Offensive" is a Compliment Cyber attackers are often portrayed as evil masterminds, but the truth " Security Boulevard WEBINAR: Proactive Cybersecurity: The One Place Where "You're Being Offensive" is a Compliment Digital Defense by HelpSystems Jun 1 The post WEBINAR: Proactive Cybersecurity: The One Place Where "You're Being Offensive" is a Compliment appeared first on Digital Defense. Read more of this post Comment Unsubscribe to no longer receive posts from Security Boulevard. Change your email settings at manage subscriptions. Trouble clicking? Copy and paste this URL into your browser: https://securityboulevard.com/2022/06/webinar-proactive-cybersecurity-the-one-place-where-youre-being-offensive-is-a-compliment/ Powered by Jetpack

Marc Handelman posted: "Our thanks to Zero Day Initiative for publishing their outstanding Pwn2Own Vancouver 2022 videos on the organization's' YouTube channel. Permalink" Security Boulevard Zero Day Initiative's Pwn2Own Vancouver 2022 – David Berard's And Vincent Dehors' 'Synacktiv Vs. Tesla' Marc Handelman Jun 1 Our thanks to Zero Day Initiative for publishing their outstanding Pwn2Own Vancouver 2022 videos on the organization's' YouTube channel. Permalink Read more of this post Comment Unsubscribe to no longer receive posts from Security Boulevard. Change your email settings at manage subscriptions. Trouble clicking? Copy and paste this URL into your browser: https://securityboulevard.com/2022/06/zero-day-initiatives-pwn2own-vancouver-2022-david-berards-and-vincent-dehors-synacktiv-vs-tesla/ Powered by Jetpack

Nikhil Panwar posted: "Many companies use social media platforms as an outlet to manage their relations with customers, troubleshoot user problems, and answer their queries.Twitter is one of the key platforms where users can tag the brand's handle with the troubles they&ap" Security Boulevard Customer Support Impersonation Scams on Twitter Nikhil Panwar Jun 1 How scammers are using fake/lookalike brand customer support accounts on Twitter to hijack users' crypto wallets, bank accounts and user handles Read more of this post Comment Unsubscribe to no longer receive posts from Security Boulevard. Change your email settings at manage subscriptions. Trouble clicking? Copy and paste this URL into your browser: https://securityboulevard.com/2022/06/customer-support-impersonation-scams-on-twitter/ Powered by Jetpack

jj posted: "Join me for a roundtable, a zero trust session, and a few cool panels. Most of these activities are open to everyone so regardless of your conference pass type, I hope to see you there! MORE > Click the title to read the full article. " Security Boulevard Where to Find Me at RSAC 2022 jj Jun 1 Join me for a roundtable, a zero trust session, and a few cool panels. Most of these activities are open to everyone so regardless of your conference pass type, I hope to see you there! MORE > Click the title to read the full article. Read more of this post Comment Unsubscribe to no longer receive posts from Security Boulevard. Change your email settings at manage subscriptions. Trouble clicking? Copy and paste this URL into your browser: https://securityboulevard.com/?p=1926071 Powered by Jetpack

Jenn Markey posted: "First it was music, then photos and watches, and now it's payments. The smart phone continues to disrupt and reinvent how we go about our daily lives including how we pay for things. Great for consumers, but the side of the mobile device highway is litter" Security Boulevard Thinking Digital Cards? Don't be the next Kodachrome camera or Sony Walkman Jenn Markey Jun 1 First it was music, then photos and watches, and now it's payments. The smart phone continues to disrupt and reinvent... The post Thinking Digital Cards? Don't be the next Kodachrome camera or Sony Walkman appeared first on Entrust Blog. Read more of this post Comment Unsubscribe to no longer receive posts from Security Boulevard. Change your email settings at manage subscriptions. Trouble clicking? Copy and paste this URL into your browser: https://securityboulevard.com/2022/06/thinking-digital-cards-dont-be-the-next-kodachrome-camera-or-sony-walkman/ Powered by Jetpack

Bruce Lynch posted: "The outmoding of traditional network security Traditional network security was based on the concept of a guarded network perimeter, which is difficult to access from the outside but implicitly trusts everyone on the inside. The problem with this approach " Security Boulevard Five Steps to Prepare Data for a Zero-Trust Security Model Bruce Lynch Jun 1 The outmoding of traditional network security Traditional network security was based on the concept of a guarded network perimeter, which is difficult to access from the outside but implicitly trusts everyone on the inside. The problem with this approach is that once an attacker has access to the network, they are free to move laterally […] The post Five Steps to Prepare Data for a Zero-Trust Security Model appeared first on Blog. Read more of this post Comment Unsubscribe to no longer receive posts from Security Boulevard. Change your email settings at manage subscriptions. Trouble clicking? Copy and paste this URL into your browser: https://securityboulevard.com/2022/06/five-steps-to-prepare-data-for-a-zero-trust-security-model/ Powered by Jetpack

JJ Cranford posted: " Sensors are the workhorse of Endpoint Detection and Response (EDR) solutions. An endpoint sensor is a lightweight software component on devices that collects data and provides a firsthand account of what is taking place on the endpoint. Sensors " Security Boulevard How to Choose the Right Endpoint Sensor JJ Cranford Jun 1 Sensors are the workhorse of Endpoint Detection and Response (EDR) solutions. An endpoint sensor is a lightweight software component on devices that collects data and provides a firsthand account of what is taking place on the endpoint. Sensors are primarily responsible for visibility, aggregating data from endpoints, taking response actions, and transmitting information back to analysts and investigators. In general, endpoint sensors provide on-device visibility that is crucial to threat detection and response. Read more of this post Comment Unsubscribe to no longer receive posts from Security Boulevard. Change your email settings at manage subscriptions. Trouble clicking? Copy and paste this URL into your browser: https://securityboulevard.com/?p=1926152 Powered by Jetpack

Maor Bin posted: " The phenomenon known as the Great Resignation is showing no signs of slowing. Nearly 48 million people in the U.S. quit their jobs last year with another 4.3 million this past January alone. This creates obvious labor shortage challenges, but what's l" Security Boulevard SaaS Security in the Great Resignation Maor Bin Jun 1 The phenomenon known as the Great Resignation is showing no signs of slowing. Nearly 48 million people in the U.S. quit their jobs last year with another 4.3 million this past January alone. This creates obvious labor shortage challenges, but what's less obvious are the critical risks it brings to workforce cybersecurity, specifically when it […] Read more of this post Comment Unsubscribe to no longer receive posts from Security Boulevard. Change your email settings at manage subscriptions. Trouble clicking? Copy and paste this URL into your browser: https://securityboulevard.com/2022/06/saas-security-in-the-great-resignation/ Powered by Jetpack

Ashish Jain posted: "In the backdrop of complex bot- and human-driven attacks, security teams need smarter detection capabilities for uncovering attacks that go undetected. With transparency at its core, Arkose Detect provides multi-layered detection with real-time insights t" Security Boulevard 3 Reasons Arkose Detect Outperforms reCAPTCHA in Detecting Bots Ashish Jain Jun 1 In the backdrop of complex bot- and human-driven attacks, security teams need smarter detection capabilities for uncovering attacks that go undetected. With transparency at its core, Arkose Detect provides multi-layered detection with real-time insights to improve catch rates and ensure consumers' account security. Advanced bots, human click farms, fraud-as-a-service, 24×7 support services, and sharing expertise […] Read more of this post Comment Unsubscribe to no longer receive posts from Security Boulevard. Change your email settings at manage subscriptions. Trouble clicking? Copy and paste this URL into your browser: https://securityboulevard.com/2022/06/3-reasons-arkose-detect-outperforms-recaptcha-in-detecting-bots/ Powered by Jetpack

Team Nuspire posted: "On May 30, 2022, security researchers identified a new zero-day flaw in Microsoft Office that could be used to run arbitrary code execution (ACE) on Windows systems. Dubbed "Follina" because the zero day code references 0438 – the area code of Follina in " Security Boulevard Microsoft Office Zero-Day Vulnerability: What You Need to Know Team Nuspire Jun 1 On May 30, 2022, security researchers identified a new zero-day flaw in Microsoft Office that could be used to run arbitrary code execution (ACE) on Windows systems. Dubbed "Follina" because the zero day code references 0438 – the area code of Follina in Italy – the flaw impacts all Windows versions still receiving security updates.… The post Microsoft Office Zero-Day Vulnerability: What You Need to Know appeared first on Nuspire. Read more of this post Comment Unsubscribe to no longer receive posts from Security Boulevard. Change your email settings at manage subscriptions. Trouble clicking? Copy and paste this URL into your browser: https://securityboulevard.com/2022/06/microsoft-office-zero-day-vulnerability-what-you-need-to-know/ Powered by Jetpack

Anthony M. Freed posted: " Spear phishing is a social engineering tactic adversaries use in targeted attacks where they send emails purported to be from someone known or trusted by the target–such as a coworker or established organization–to trick them into revealing confi" Security Boulevard Spear Phishing: A Technical Case Study for XDR Anthony M. Freed Jun 1 Spear phishing is a social engineering tactic adversaries use in targeted attacks where they send emails purported to be from someone known or trusted by the target–such as a coworker or established organization–to trick them into revealing confidential information like account credentials or as an enticement to click on a malicious link or download a tainted document. Read more of this post Comment Unsubscribe to no longer receive posts from Security Boulevard. Change your email settings at manage subscriptions. Trouble clicking? Copy and paste this URL into your browser: https://securityboulevard.com/?p=1926154 Powered by Jetpack

Karolin Hemmingsson posted: " Developer Community June 1, 2022 New REST API Support and More Frequent Releases From EJBCA Community 7.9.0.1 Read More Developer Community " Security Boulevard Try Out Post-Quantum Cryptography for Code Signing With SignServer Community 5.9.1 Karolin Hemmingsson Jun 1 The post Try Out Post-Quantum Cryptography for Code Signing With SignServer Community 5.9.1 appeared first on Keyfactor. Read more of this post Comment Unsubscribe to no longer receive posts from Security Boulevard. Change your email settings at manage subscriptions. Trouble clicking? Copy and paste this URL into your browser: https://securityboulevard.com/2022/06/try-out-post-quantum-cryptography-for-code-signing-with-signserver-community-5-9-1/ Powered by Jetpack

Karolin Hemmingsson posted: " Developer Community June 1, 2022 Try Out Post-Quantum Cryptography for Code Signing With SignServer Community 5.9.1 Read More Developer Communit" Security Boulevard New REST API Support and More Frequent Releases From EJBCA Community 7.9.0.1 Karolin Hemmingsson Jun 1 The post New REST API Support and More Frequent Releases From EJBCA Community 7.9.0.1 appeared first on Keyfactor. Read more of this post Comment Unsubscribe to no longer receive posts from Security Boulevard. Change your email settings at manage subscriptions. Trouble clicking? Copy and paste this URL into your browser: https://securityboulevard.com/2022/06/new-rest-api-support-and-more-frequent-releases-from-ejbca-community-7-9-0-1/ Powered by Jetpack

Mitch Mitchell posted: " A disaster recovery plan is a vital thing to have in times of growing economic uncertainty and a rapidly evolving cyberthreat landscape. No sensible person would ever drive a car without first making sure they have a valid insurance policy. For the s" Security Boulevard Why Your Business Needs a Disaster Recovery Plan Mitch Mitchell Jun 1 A disaster recovery plan is a vital thing to have in times of growing economic uncertainty and a rapidly evolving cyberthreat landscape. No sensible person would ever drive a car without first making sure they have a valid insurance policy. For the same reasons, no business should be without a disaster recovery plan. While it […] Read more of this post Comment Unsubscribe to no longer receive posts from Security Boulevard. Change your email settings at manage subscriptions. Trouble clicking? Copy and paste this URL into your browser: https://securityboulevard.com/2022/06/why-your-business-needs-a-disaster-recovery-plan/ Powered by Jetpack

SecZetta posted: "Fall River, Mass. – Providing external parties with internal access to data and systems has become a regular business practice, unfortunately, most organizations lack good, automated identity programs for managing B2B access and, as a result, face increas" Security Boulevard SecZetta and Forrester Research Host Webinar on Solving the Third-Party Access Gap in Identity SecZetta Jun 1 Fall River, Mass. – Providing external parties with internal access to data and systems has become a regular business practice, unfortunately, most organizations lack good, automated identity programs for managing ... The post SecZetta and Forrester Research Host Webinar on Solving the Third-Party Access Gap in Identity appeared first on SecZetta. Read more of this post Comment Unsubscribe to no longer receive posts from Security Boulevard. Change your email settings at manage subscriptions. Trouble clicking? Copy and paste this URL into your browser: https://securityboulevard.com/2022/06/seczetta-and-forrester-research-host-webinar-on-solving-the-third-party-access-gap-in-identity/ Powered by Jetpack

Tyler Atkinson & Ashley Wynn posted: "Imagine you with your toes in the sand and also being productive at work! Nowadays everyone wants to work remotely just for that reason. The freedom of being able to work anywhere in the world is an amazing reason to want to work remotely. Since the pande" Security Boulevard Situational awareness and security while working remotely Tyler Atkinson & Ashley Wynn Jun 1 Imagine you with your toes in the sand and also being productive at work! Nowadays everyone wants to work remotely just for that reason. The freedom of being able to work anywhere in the world is an amazing reason to want to work remotely. Since the pandemic, there have been a lot of companies that have given their employees more options when it comes to where they can work and be productive. Being able to spend more time with your family and being able to work from anywhere in the world with an internet connection are only a few reasons why more and more everyday people are choosing to work remotely. Read more of this post Comment Unsubscribe to no longer receive posts from Security Boulevard. Change your email settings at manage subscriptions. Trouble clicking? Copy and paste this URL into your browser: https://securityboulevard.com/2022/06/situational-awareness-and-security-while-working-remotely/ Powered by Jetpack

Michael Vizard posted: "A survey of 1,000 organizations in North America, Europe, Asia-Pacific and Japan found potential attacks against software supply chains are now a bigger concern than attacks that exploit zero-day vulnerabilities or ransomware. The survey, conducted by " Security Boulevard Survey Sees Greater Appreciation of Software Supply Chain Risks Michael Vizard Jun 1 A survey of 1,000 organizations in North America, Europe, Asia-Pacific and Japan found potential attacks against software supply chains are now a bigger concern than attacks that exploit zero-day vulnerabilities or ransomware. The survey, conducted by Enterprise Strategy Group (ESG) on behalf of Illumio, a provider of a platform for microsegmenting networks, found nearly half […] Read more of this post Comment Unsubscribe to no longer receive posts from Security Boulevard. Change your email settings at manage subscriptions. Trouble clicking? Copy and paste this URL into your browser: https://securityboulevard.com/2022/06/survey-sees-greater-appreciation-of-software-supply-chain-risks/ Powered by Jetpack

Chelsea Glosser posted: "Invicti Security today appointed esteemed cybersecurity industry veteran and investor Gerhard Watzinger as Chairman of the Board. Watzinger joins board members Michael George, CEO of Invicti, Scott Collins and Sophia Popova of Summit Partners, and Dominic" Security Boulevard Invicti Security Appoints Gerhard Watzinger as Chairman of the Board Chelsea Glosser Jun 1 Invicti Security today appointed esteemed cybersecurity industry veteran and investor Gerhard Watzinger as Chairman of the Board. Watzinger joins board members Michael George, CEO of Invicti, Scott Collins and Sophia Popova of Summit Partners, and Dominic Ang and Joanne Yuan of Turn/River Capital. READ MORE Read more of this post Comment Unsubscribe to no longer receive posts from Security Boulevard. Change your email settings at manage subscriptions. Trouble clicking? Copy and paste this URL into your browser: https://securityboulevard.com/?p=1926168 Powered by Jetpack