Daily digest for Security Boulevard, on September 2, 2022

Sue Poremba posted: "Digital identities play an important role in an organization's security program. But the idea of "identity" in APIs can be complex, Jeff Williams, CTO and co-founder at Contrast Security, said in an email interview. "People think of APIs as a way for t" Security Boulevard Identity's Role in API Security Sue Poremba Sep 2 Digital identities play an important role in an organization's security program. But the idea of "identity" in APIs can be complex, Jeff Williams, CTO and co-founder at Contrast Security, said in an email interview. "People think of APIs as a way for two software applications to communicate," Williams explained. For example, if a mobile phone […] Read more of this post Comment Unsubscribe to no longer receive posts from Security Boulevard. Change your email settings at manage subscriptions. Trouble clicking? Copy and paste this URL into your browser: https://securityboulevard.com/2022/09/identitys-role-in-api-security/ Powered by Jetpack

SEO EXPERT posted: "Healthcare fraud, waste, and abuse cost taxpayers billions of dollars. According to a report published in BusinessWire, the global healthcare fraud analytic market may reach US$ 5.69 billion by 2027. Detection of fraud leads to hefty fines, criminal proce" Security Boulevard How to Prevent Fraud in Healthcare by Knowing Your Patient? SEO EXPERT Sep 2 Healthcare fraud, waste, and abuse cost taxpayers billions of dollars. According to a report published in BusinessWire, the global healthcare fraud analytic market may reach US$ 5.69 billion by 2027. Detection of fraud leads to hefty fines, criminal proceedings, and incarceration for the concerned individuals in organizations. 2021 saw a peaking of medical fraud and […] Read more of this post Comment Unsubscribe to no longer receive posts from Security Boulevard. Change your email settings at manage subscriptions. Trouble clicking? Copy and paste this URL into your browser: https://securityboulevard.com/2022/09/how-to-prevent-fraud-in-healthcare-by-knowing-your-patient/ Powered by Jetpack

Carolynn van Arsdale posted: " Welcome to the latest edition of The Week in Cybersecurity, which brings you the newest headlines from both the world and our team about the most pressing topics in cybersecurity. This week: a China-linked cyber espionage campaign targets critical entit" Security Boulevard The Week in Cybersecurity: Cyber espionage operation fueled for months by targeted phishing attacks Carolynn van Arsdale Sep 1 Welcome to the latest edition of The Week in Cybersecurity, which brings you the newest headlines from both the world and our team about the most pressing topics in cybersecurity. This week: a China-linked cyber espionage campaign targets critical entities in Australia and the South China Sea, password manager LastPass gets hacked (again), and more.      Read more of this post Comment Unsubscribe to no longer receive posts from Security Boulevard. Change your email settings at manage subscriptions. Trouble clicking? Copy and paste this URL into your browser: https://securityboulevard.com/2022/09/the-week-in-cybersecurity-cyber-espionage-operation-fueled-for-months-by-targeted-phishing-attacks/ Powered by Jetpack

Lightspin posted: "The principle of least privilege can improve the security of your system. Learn what the principle of least privilege is, how it works, and best practices.  What is the Principle of Least Privilege? The Principle of Least Privilege states that use" Security Boulevard What Is the Principle of Least Privilege & Why Does It Matter? Lightspin Sep 1 The principle of least privilege can improve the security of your system. Learn what the principle of least privilege is, how it works, and best practices.  Read more of this post Comment Unsubscribe to no longer receive posts from Security Boulevard. Change your email settings at manage subscriptions. Trouble clicking? Copy and paste this URL into your browser: https://securityboulevard.com/2022/09/what-is-the-principle-of-least-privilege-why-does-it-matter/ Powered by Jetpack

Team Nuspire posted: "The pace of technological growth understandably excites people and businesses alike. In the realm of investments and banking, an app-driven world coupled with the emergence of cryptocurrency opens up many new avenues for investments and opportunities for " Security Boulevard Cybersecurity Threats and Mobile Banking/Crypto Team Nuspire Sep 1 The pace of technological growth understandably excites people and businesses alike. In the realm of investments and banking, an app-driven world coupled with the emergence of cryptocurrency opens up many new avenues for investments and opportunities for financial institutions to provide mobile banking and investment services via mobile apps. The excitement generated by these changes also extends to cybercriminals. Wherever ... Read More The post Cybersecurity Threats and Mobile Banking/Crypto appeared first on Nuspire. Read more of this post Comment Unsubscribe to no longer receive posts from Security Boulevard. Change your email settings at manage subscriptions. Trouble clicking? Copy and paste this URL into your browser: https://securityboulevard.com/2022/09/cybersecurity-threats-and-mobile-banking-crypto/ Powered by Jetpack

Atinderpal Singh posted: "Stealing information is fundamental to cybercriminals today to scope and gain access to systems, profile organizations, and execute bigger payday schemes like ransomware. Information stealer malware families including Prynt Stealer are often configured th" Security Boulevard No Honor Among Thieves – Prynt Stealer's Backdoor Exposed Atinderpal Singh Sep 1 Stealing information is fundamental to cybercriminals today to scope and gain access to systems, profile organizations, and execute bigger payday schemes like ransomware. Information stealer malware families including Prynt Stealer are often configured through a builder to facilitate the process for less sophisticated threat actors. However, Zscaler ThreatLabz researchers have uncovered the Prynt Stealer builder, also attributed with WorldWind, and DarkEye, has a secret backdoor in the code that ends up in every derivative copy and variant of these malware families. The backdoor sends copies of victims' exfiltrated data gathered by other threat actors to a private Telegram chat monitored by the builder's developers. While this untrustworthy behavior is nothing new in the world of cybercrime, the victims' data end up in the hands of multiple threat actors, increasing the risks of one or more large scale attacks to follow. Key Points Prynt Stealer is an information stealer that has the ability to capture credentials that are stored on a compromised system including web browsers, VPN/FTP clients, as well as messaging and gaming applications The Prynt Stealer developer based the malware code on open source projects including AsyncRAT and StormKitty Prynt Stealer uses Telegram to exfiltrate data that is stolen from victims The Prynt Stealer malware author added a backdoor Telegram channel to collect the information stolen by other criminals The informational stealer malware families known as DarkEye and WorldWind are near identical to Prynt Stealer Prynt Stealer is a relatively new information stealer malware family that is written in .NET. The malware has previously been analyzed in-depth including the data harvesting capabilities and the targeted applications. Zscaler ThreatLabz has since uncovered additional details about the malware including the codebase being derived from at least two other open source malware families: AsyncRAT and StormKitty. This blog will focus on these shared codebases, the modifications introduced by the Prynt Stealer author (including a backdoor), and the very close relationship with WorldWind and DarkEye. Prynt Stealer Origins Prynt Stealer is not just inspired from open source malware families, but shares code that appears to have been directly copy and pasted from these repositories. Many parts of the Prynt Stealer code that have been borrowed from other malware families are not used, but are still present in the binary as dead unreachable code. The Prynt Stealer code is primarily derived from AsyncRAT (a versatile RAT) and StormKitty (an information stealer). The AsyncRAT code is used as the main module with a modified entry point that calls the StormKitty stealer method. Prynt Stealer executables are configured using a builder that has no options to modify the embedded AsyncRAT components, which are pre-configured primarily just to run the StormKitty stealer module. Most of AsyncRAT's functionality in Prynt Stealer is disabled and the command-and-control (C&C) URLs are configured to 127.0.0.1. While the AsyncRAT's network component of Prynt Stealer is disabled, the malware contains the following embedded certificate shown below: "issuer": "CN=WorldWind Stealer", "subject": "CN=WorldWind Stealer", "to_date": "9999-12-31T23:59:59", "version": "v3", "from_date": "2021-07-13T04:51:06", "serial_number": 852016614067188563094399707801818649 Note that the common name for this certificate is WorldWind Stealer, which is also sold by the Prynt Stealer malware author. AsyncRAT/StormKitty Code Comparison The Prynt Stealer author added two new fields (highlighted in Figure 1) to the AsyncRAT configuration codebase for data exfiltration via Telegram. Figure 1: Side-by-side comparison of a Prynt Stealer configuration (left) with an original AsyncRAT configuration (right) The main code responsible for sending information to Telegram is copied from StormKitty with a few minor changes in text as shown in Figure 2. Figure 2: Side-by-side comparison of Prynt Stealer's UploadFile with StormKitty's SendSystemInfo function The main difference is the field names and order have changed, and a field related to detecting porn websites is missing from Prynt. A Detailed look at Prynt Stealer Modifications Anti-Detection Techniques Prynt Stealer does not use the anti-analysis code from either AsyncRAT or StormKitty with one exception: the malware creates a thread that invokes the function named processChecker (shown in Figure 3) in AsyncRAT's static constructor. The thread execution is started at the end of the main function after stolen logs are sent. Figure 3: Prynt Stealer process checker thread's code Prynt Stealer uses this thread to continuously monitor the victim's process list. If any of the following processes are detected, the malware will block the Telegram C&C communication channels: taskmgr processhacker netstat netmon tcpview wireshark filemon regmon cain Telegram Command Thread Prynt Stealer creates a thread that will poll for a file to download using the Telegram getUpdates API as shown in Figure 4. Of note, this download command only saves the file on the target system and does not take any further actions that might be expected like executing a second-stage payload or updating the malware. Figure 4: Prynt Stealer Telegram download command Crowdsourcing Stolen Logs Prynt Stealer steals data from a wide array of applications, and the information is sent to a Telegram channel that is configured using the builder shown in Figure 5. Figure 5: Prynt Stealer builder The Prynt Stealer logs are sent to the operator's Telegram. However, there is a catch: a copy of the log files is also sent to a Telegram chat presumably embedded by the Prynt Stealer author as shown below in Figure 6. Figure 6: Prynt Stealer backdoor sending log files to two different Telegram chats ThreatLabz has observed similar tactics employed by malware authors in the past as well, where the malware has been given away for free. This enables a malware author to benefit from unsuspecting cybercriminal clients who perform the heavy lifting of infecting victims. The fact that all Prynt Stealer samples encountered by ThreatLabz had the same embedded telegram channel implies that this backdoor channel was deliberately planted by the author. Interestingly, the Prynt Stealer author is not only charging some clients for the malware, but also receiving all of the data that is stolen. Note that there are cracked/leaked copies of Prynt Stealer with the same backdoor, which in turn will benefit the malware author even without direct compensation. Prynt Stealer / WorldWind / DarkEye: Multiple Faces of the Same Malware ThreatLabz has identified at least two more Prynt Stealer variants dubbed WorldWind and DarkEye that appear to be written by the same author. All three strains are nearly identical with a few minor differences. Prynt Stealer is the most popular brand name for selling the malware, while WorldWind payloads are the most commonly observed in-the-wild. DarkEye is not sold or mentioned publicly, however, it is bundled as a backdoor with a "free" Prynt Stealer builder. Figure 7 shows a pie chart of the percentage of samples by name observed by ThreatLabz over the last year. Figure 7: Distribution of Prynt Stealer, WorldWind and DarkEye payloads in-the-wild over the last year Both Prynt and WorldWind have been sold by the same author on the following websites: Market Website Malware name Status http://shop.prynt%5B.%5Dmarket WorldWind Inactive http://market.prynt%5B.%5Dmarket Prynt Stealer Inactive http://venoxxxx%5B.%5Dxxx Prynt Stealer Active Screenshots of these websites (offline at the time of publication) are shown in Figure 8. Figure 8: market.prynt[.]market selling Prynt Stealer and shop.prynt[.]market selling WorldWind side-by-side Various websites and criminal forums have offered cracked versions of Prynt Stealer and the code has been uploaded on GitHub for free under different names. Prynt (with the same Telegram backdoor) has also been offered for free on Telegram channels used by cybercriminals as shown in Figure 9. Figure 9: Prynt Stealer offered for free on a cybercriminal Telegram channel The distributed builder is backdoored with DarkEye Stealer and Loda RAT. This may be a deliberate leak by the Prynt Stealer threat actor since they will benefit from the data stolen from victims. Feature/Code Comparison Table 1 shows a feature parity between Prynt, WorldWind and DarkEye. Overall, there are few very minor differences such as the text in the log report, code and settings placement. However, functionality-wise all three are almost identical. Prynt WorldWind DarkEye AsyncRAT Present (Not Used) Present (Not Used) Used Clipper Present (Not Used) Present (Not Used) Used Keylogger Present (Not Used) Present (Not Used) Used ProcessChecker Anti-Analysis Used Not Present Not Present StomKitty Stealing Used Used Used HideConsoleWindow Used Not Present Not Present Elevate privileges by running as admin Used Not Present Not Present Copy itself to a specified path Used Not Present Not Present Persist using task creation (e.g., "Chrome Update") Used Not Present Not Present Self delete using a .bat file Used Not Present Not Present Check for an Internet connection Used Not Present Not Present Protect the process using RtlSetProcessIsCritical Used Not Present Not Present Prevent sleep by setting SetThreadExecutionState to 0x80000003 (ES_CONTINUOUS | ES_DISPLAY_REQUIRED | ES_SYSTEM_REQUIRED) Used Not Present Not Present Table 1. Some notable similarities and differences in functionality between Prynt Stealer, WorldWind and DarkEye Table 2 compares the field names between StormKitty, Prynt Stealer, WorldWind and DarkEye. StormKitty Prynt WorldWind DarkEye *StormKitty - Report:* \ud83d\udc63 *Prynt Stealer New Results:* \ud83c\udf2a *WorldWind Pro - Results:* \ud83d\ude39 *DARK-EYE - Report:* *Banking services* \ud83c\udfe6 *Banks* \ud83c\udfe6 *Bank Logs* \ud83c\udfe6 *Banking services* *Cryptocurrency services* \ud83d\udcb0 *Crypto* \ud83d\udcb0 *Crypto Logs* \ud83d\udcb0 *Cryptocurrency services* *Porn websites* N/A \ud83c\udf53 *Freaky Logs* \ud83c\udf53 *Porn websites* *Browsers:* \ud83d\udcb5 *Stealer Data:* \ud83c\udf10 *Logs:* \ud83c\udf10 *Browsers:* *Software:* \ud83d\udc63 *Installed Software:* \ud83d\uddc3 *Software:* \ud83d\uddc3 *Software:* *Device:* \ud83d\udc63 *Local Device:* \ud83e\udded *Device:* \ud83e\udded *Device:* *File Grabber:* \ud83d\udc63 *Files:* \ud83d\udcc4 *File Grabber:* \ud83d\udcc4 *File Grabber:* N/A \ud83d\udc63 Solen Useing Prynt Stealer\n\n \ud83d\udc63 Developed By @FlatLineStealerUpdated\n\n \ud83d\udc63 Or Join The Channel @pryntdotmarket Telegram Channel: @x0splinter N/A Table 2. Comparison of field names between StormKitty, Prynt Stealer, WorldWind and DarkEye Leaked Prynt Stealer Builder Threatlabz has acquired a copy of the Prynt Stealer builder that is backdoored with DarkEye being circulated in-the-wild. Figure 10 illustrates the "free" Prynt Stealer builder's backdoor execution process. Figure 10: Prynt Stealer builder backdoor execution and infection flow The Prynt Stealer builder package includes the following files: Stub.exe - Prynt stub used by the builder Prynt Stealer.exe - Builder executable Prynt Stealer sub.exe - Unmanaged PE Prynt.exe - Backdoor that downloads and executes DarkEye Stealer Stub.exe - The Prynt Stealer Stub This is the actual Prynt Stealer stub that is used by the builder to build payloads based on the configuration. The stub simply enumerates the resources in the file Prynt Stealer sub.exe and performs actions based on the settings in the RCData resource section, as shown in Figure 11. Figure 11. Celesity Binder resource enumeration method The Prynt Stealer sub.exe is generated using Celesty Binder as indicated by the presence of the string C:\Users\DarkCoderSc\Desktop\Celesty Binder\Stub\STATIC\Stub.pdb. This binary stores embedded payloads under the "RBIND" resource in plaintext. This sample was configured to drop and execute the payloads in the %TEMP% folder as shown in Figure 12. Figure 12. Celesity Binder stub settings in resources Other valid options for the "DROPIN" value include the following: %APPDATA% %PROGFILES% %DEFDRIVE% %STARTUPDIR% %LAPPDATA% %USERDIR% The Prynt Stealer builder stub contains two payloads: "PRYNT STEALER.EXE" - The builder binary explained below "SVCHOST.EXE" - LodaRAT backdoor Prynt Stealer.exe - The Builder The Prynt Stealer builder is a modified version of the AsyncRAT builder with modified forms to change the UI and an additional line was added in the main method to run the loader mentioned above from {Builder Path}/Stub/Prynt.exe. Prynt.exe - The Loader This is a very basic loader written in .NET, which simply downloads the payload from a hardcoded URL and runs the payload as shown in Figure 13. Figure 13. Loader obfuscated vs deobfuscated The downloaded payload is DarkEye Stealer, a variant of Prynt Stealer. Based on a hardcoded Telegram token shared by DarkEye, Prynt and WorldWind stealer, they are all likely from the same author(s). DarkEye Stealer This malware is essentially Prynt Stealer with some minor differences in code placement. Most settings related to the clipper, keylogger, etc are moved under the AsyncRAT constructor as shown in Figure 14. Figure 14. Example AsyncRAT settings configured by DarkEye Stealer The main factor differentiating DarkEye from Prynt and Worldwind is that the AsyncRAT part of the code is weaponized by configuring the related settings. Note that there were some earlier versions of DarkEye stealer in-the-wild without the AsyncRAT components. Loda RAT Loda RAT is an Autoit based RAT first documented in 2017 that has been active since and has evolved over the years. This is a fairly capable malware that can steal a variety of information, remotely control an infected system and deploy additional payloads. Conclusion The free availability of source code for numerous malware families has made development easier than ever for less sophisticated threat actors. As a result, there have been many new malware families created over the years that are based on popular open source malware projects like NjRat, AsyncRAT and QuasarRAT. The Prynt Stealer author went a step further and added a backdoor to steal from their customers by hardcoding a Telegram token and chat ID into the malware. This tactic is not new by any means; there have been several similar instances, including CobianRAT. As the saying goes, there is no honor among thieves. Cloud Sandbox Detection Figure 15: Zscaler Cloud Sandbox Report In addition to sandbox detections, Zscaler's multilayered cloud security platform detects indicators related to the campaign at various levels with the following threat names: Win32.Backdoor.PryntStealer Win32.Backdoor.WorldWind Win32.Backdoor.DarkEyeStealer Win32.Backdoor.LodaRat Indicators of Compromise (IOCs) Prynt Stealer IOCs are available in our GitHub repository. SHA256 Malware d8469e32afc3499a04f9bcb0ca34fde63140c3b872c41e898f4e31f2a7c1f61f Prynt Stealer f15e92c34dd8adfcd471d726e88292d6698217f05f1d2bcce8193eb2536f817c Prynt Stealer 3b948a0eb0e9bbca72fc363b63ffd3a5983e23c47f14f8296e8559fd98c25094 WorldWind Stealer bb96db7406566ec0e9305acde9205763d4e9d7a65f257f3d5c47c15f393628ec DarkEye Stealer e48179c4629b5ab9e53ccb785ab3ee5eeb2e246e1897154a15fec8fd9237f44b DarkEye Stealer (old version without AsyncRAT) 9678ca06068b705da310aa2f76713d2d59905b12b67097364160857cd1f90c58 Celesty Binder payload 654f080d5790054f0cd1a0f9b31cd7a82a4722ff3ce5093acdc31ff154f1ae24 Builder cb132691793e93ad8065f857b4b1baba92e937cfc3d3a8042ce9109e12d32b4c LodaRAT d37d0ae4c5ced373fe1960af5ea494a6131717d1c400da877d9daa13f55439bb Prynt Stealer Stub c79aed9551260daf74a2af2ec5b239332f3b89764ede670106389c3078e74d1a Loader Telegram Token Chat ID Comment 1119746739:AAGMhvpUjXI4CzIfizRC--VXilxnkJlhaf8 1096425866 WorldWind (hardcoded) 1784055443:AAG-bXLYtnFpjJ_L3ogxA3bq6Mx09cqh8ug 1937717367 Prynt Stealer (hardcoded) 5292408150:AAHAPbTr2Jc9L4hgsfkDkvfw_hISg6lPMMI 5038570348 Prynt Stealer 5292408150:AAHAPbTr2Jc9L4hgsfkDkvfw_hISg6lPMMI 1856525476 Prynt Stealer 1916193181:AAHhdcx3k6mHbnJ6JLfyWtJBMChny-la8Xs 849561191 Prynt Stealer URL Description https://cdn.discordapp%5B.%5Dcom/attachments/523238636561629190/890007970207907871/vltn.exe DarkEye Stealer Hosting bigdaddy-service[.]biz:6606 DarkEye Stealer C&C bigdaddy-service[.]biz:7707 DarkEye Stealer C&C bigdaddy-service[.]biz:8808 DarkEye Stealer C&C daddy.linkpc[.]net:1199 LodaRAT C&C Read more of this post Comment Unsubscribe to no longer receive posts from Security Boulevard. Change your email settings at manage subscriptions. Trouble clicking? Copy and paste this URL into your browser: https://securityboulevard.com/2022/09/no-honor-among-thieves-prynt-stealers-backdoor-exposed/ Powered by Jetpack

scott.fie@sourcedefense.com posted: " By Source Defense Imagine facing a compliance fine of $238 million due to a data breach and being told that the breach itself was not the main reason for the fine. That's precisely what happened to British Airways after a 2018 data breach exposed the " Security Boulevard British Airways: A Case Study in GDPR Compliance Failure scott.fie@sourcedefense.com Sep 1 An investigation into the breach by Britain's Information Commissioner Office (ICO) concluded that British Airways had violated Europe's General Data Protection Regulation (GDPR). The post British Airways: A Case Study in GDPR Compliance Failure appeared first on Source Defense. Read more of this post Comment Unsubscribe to no longer receive posts from Security Boulevard. Change your email settings at manage subscriptions. Trouble clicking? Copy and paste this URL into your browser: https://securityboulevard.com/2022/09/british-airways-a-case-study-in-gdpr-compliance-failure/ Powered by Jetpack

jasonaxelrod posted: " Too often, modern businesses are forced to choose between the speed of innovation and privacy and security for valuable data. The modern CIO must balance immense market and board pressure related to cybers" Security Boulevard How CIOs Can Balance Boldness and Caution By Implementing DevOps Test Data Management jasonaxelrod Sep 1 How CIOs Can Balance Boldness and Caution By Implementing DevOps Test Data Management jasonaxelrod Thu, 09/01/2022 - 12:16 With automated test data, companies can achieve fast, quality software releases, more seamless cloud adoption, and improved data security and privacy for meeting emerging compliance requirements. Josh Harbert Sep 01, 2022 Too often, modern businesses are forced to choose between the speed of innovation and privacy and security for valuable data. The modern CIO must balance immense market and board pressure related to cybersecurity risks and compliance requirements, all while innovating fast enough for the business to achieve its goals. The truth is, data privacy and security can be a business enabler, not a hindrance— it just requires the understanding that data privacy and security is as much of a cultural, organizational, and managerial issue as it is a technical one. By making the right changes to culture and process, along with the appropriate investments for data automation software like the Delphix platform, CIOs can successfully make data privacy and security an enabler of fast application innovation and growth.  The Delphix DevOps Data Platform is the only API-first DevOps Test Data Management (TDM) platform for multi-cloud that delivers continuous compliance while rapidly deploying data to accelerate development. With automated test data, companies can achieve fast, quality software releases, more seamless cloud adoption, and improved data security and privacy for meeting emerging compliance requirements.  Developers, Developers, Developers! Remember that oft repeated and mocked broadside by former Microsoft CEO Steve Balmer of Microsoft at the company's 2000 Windows Conference? "Developers, developers, developers" is more relevant today than ever before — just like at the turn of the century, developers remain one of the most critical talent areas within a modern company.  What has changed in companies since 2000 is the fact that a dedicated team can no longer accomplish security on its own through trust and manual processes.  This couldn't be more evident based on continued data breaches of major companies like T-Mobile, which recently reached a  $350M settlement for a test data breach in 2021 that exposed the personal information of 77 million customers. It's clear a more comprehensive approach to data security must be employed.  Today, security is every employee's responsibility. And finding ways to automate the delivery of fast and compliant test data can assist data security management across an organization significantly.  In the end it's all about empowering your developers to be as productive as possible, and one of the biggest roadblocks to developer productivity is quick access to production-quality test data. Developers are constantly being hamstrung and application releases delayed  due to security concerns of providing test data. Developers need to be enabled to work seamlessly, and they need high-quality test data, and a shift in culture and process to make that happen.  CIOs must create the right working and coding environment in which their development teams can innovate. CIOs can best enable this shift in cultural thinking by applying a developer mindset — rather than a compliance mindset — to security issues.  But what does a developer mindset entail? It means giving developers near real-time access to production-quality test data during their normal development cycle so they are not impeded by data security concerns while coding. Let developers be developers and code, not wait for permission or put up roadblocks to getting their core job done.  It's also about setting a zero-trust security framework so data can be protected down to all lower environments, abandoning the traditional castle-and-moat security model. A zero trust framework can be achieved through the automation of production-quality test data using the Delphix DevOps Platform, which helps enforce regulatory compliance through the technique of data masking, all while protecting referential integrity of complex enterprise applications. One way to achieve all this is by employing a DevSecOps working model. This model, an extension of the DevOps concept, is a development model where security is integrated into each stage of an agile product life cycle rather than being done at the end. According to Hasan Yaser, Technical Director of Continuous Deployment of Capability for the Carnegie Mellon Software Engineering Institute, "DevSecOps is focused on how to get the security practices into the DevOps pipeline, which includes DevOps pieces. Plus getting other thoughts and ideas related to risk and security, related to any possibilities of merging risk and security together, and how to change the company culture regarding risk, all within the right software delivery and the deployment pipeline." Additionally,  CIOs can modify how their teams are structured and interact with each other by having security and compliance professionals working in tandem with developers to address security issues before they develop. Tools, Talent, and Culture Matter Tools, product management, culture, and talent management can have the greatest impact on improving developer and business performance, according to McKinsey. The companies that have most effectively leveraged their developers focus on empowering them, ensuring technology investments align to customer value, and minimizing productivity barriers. McKinsey reports that best-in-class tools are the primary driver of their Developer Velocity Index (DVI), which quantifies the improvement of business performance through software developer empowerment. The McKinsey report found that organizations that enable and empower software teams to experiment, learn, and even fail in a safe environment consistently see better results. Companies that perform best in this area invest in the tools and platforms that can absorb and minimize the cost of failures, like Delphix's automated DevOps data platform for application transformation. With the Delphix DevOps platform, your organization can automatically deliver data into development environments, while  allowing for data refresh, rewind, integration, and version control. You can test with real, production-quality data to eliminate defects, and do this with confidence knowing sensitive data values have been automatically masked. Finally, the McKinsey survey found that companies with high DVI scores frequently recognize employees for their achievements. These forward-looking companies will publicly acknowledge both individual and team efforts, and they'll reward their outstanding contributors appropriately. Making Data Security an Enabler of Speed and Growth The CIOs who succeed in both securing their data and leveraging it for business value are ones that can not only deploy the right technology to meet their business goals, but can make the cultural, procedural, organizational, and talent-management changes needed to win. Companies that provide and apply the right tools, culture, product, and talent will succeed at not only developing software faster, but will deliver improved business performance. In a recent McKinsey article on the CIO agenda for 2022, an unnamed CEO commented, "I'm more concerned about not being bold enough than about being too cautious." Using secure  and private data, while leveraging a platform like Delphix to automate test data security, CIOs can balance boldness and caution to ensure the ability to innovate and drive business growth. And do you really need to sacrifice speed for safety? Not according to the most famous race car driver in history. "It is amazing how many drivers, even at the Formula One level, think that the brakes are for slowing the car down," said Mario Andretti.  Download this solution brief for more information on how Delphix can help with data compliance for the Gramm-Leach-Bliley Act (GLBA) Read more of this post Comment Unsubscribe to no longer receive posts from Security Boulevard. Change your email settings at manage subscriptions. Trouble clicking? Copy and paste this URL into your browser: https://securityboulevard.com/2022/09/how-cios-can-balance-boldness-and-caution-by-implementing-devops-test-data-management/ Powered by Jetpack

Marc Handelman posted: "Our sincere thanks to BSides Vancouver for publishing their outstanding conference videos on the organization's YouTube channel. Permalink" Security Boulevard BSides Vancouver 2022 – Rafal Los' 'Chaos In User Land – When The Feature Is The Vulnerability' Marc Handelman Sep 1 Our sincere thanks to BSides Vancouver for publishing their outstanding conference videos on the organization's YouTube channel. Permalink Read more of this post Comment Unsubscribe to no longer receive posts from Security Boulevard. Change your email settings at manage subscriptions. Trouble clicking? Copy and paste this URL into your browser: https://securityboulevard.com/2022/09/bsides-vancouver-2022-rafal-los-chaos-in-user-land-when-the-feature-is-the-vulnerability/ Powered by Jetpack

Michael Vizard posted: "Dario Forte, vice president and general manager for security orchestration at Sumo Logic, explains why the management of security is shifting to the cloud. The video is below followed by a transcript of the conversation. Mike Vizard: Hey, guys. Thanks " Security Boulevard Security Management Shifting to the Cloud – Techstrong TV Michael Vizard Sep 1 Dario Forte, vice president and general manager for security orchestration at Sumo Logic, explains why the management of security is shifting to the cloud. The video is below followed by a transcript of the conversation. Mike Vizard: Hey, guys. Thanks for the throw. We're here with Dario Forte, who is the vice-president and general manager […] Read more of this post Comment Unsubscribe to no longer receive posts from Security Boulevard. Change your email settings at manage subscriptions. Trouble clicking? Copy and paste this URL into your browser: https://securityboulevard.com/2022/09/security-management-shifting-to-the-cloud-techstrong-tv/ Powered by Jetpack

Alan Shimel posted: "Shrav Mehta, CEO and Founder of Secureframe, talks about Secureframe's platform for security compliance automation. They automate the compliance process for certifications like SOC 2, ISO 27001, HIPAA, and PCI DSS. The video is below followed by a transcr" Security Boulevard Secureframe Automates Security Compliance – Techstrong TV Alan Shimel Sep 1 Shrav Mehta, CEO and Founder of Secureframe, talks about Secureframe's platform for security compliance automation. They automate the compliance process for certifications like SOC 2, ISO 27001, HIPAA, and PCI DSS. The video is below followed by a transcript of the conversation. Alan Shimel: Hey, everyone. Welcome to another Techstrong TV episode. I've got a […] Read more of this post Comment Unsubscribe to no longer receive posts from Security Boulevard. Change your email settings at manage subscriptions. Trouble clicking? Copy and paste this URL into your browser: https://securityboulevard.com/2022/09/secureframe-automates-security-compliance-techstrong-tv/ Powered by Jetpack

Joe Pelletier posted: "Infrastructure as code (IaC) is the ability to provision and manage infrastructure using a configuration language. It offers the repeatability, transparency, and testing of modern software development to the management of infrastructure such as networks, " Security Boulevard Why Infrastructure-as-Code Scanning Matters for Kubernetes Configuration Joe Pelletier Sep 1 Infrastructure as code (IaC) is the ability to provision and manage infrastructure using a configuration language. It offers the repeatability, transparency, and testing of modern software development to the management of infrastructure such as networks, load balancers, virtual machines, Kubernetes clusters, and monitoring. Its primary goal is to reduce error and configuration drift, while allowing engineers to spend time on higher value tasks. IaC is a major benefit for Kubernetes users.  Read more of this post Comment Unsubscribe to no longer receive posts from Security Boulevard. Change your email settings at manage subscriptions. Trouble clicking? Copy and paste this URL into your browser: https://securityboulevard.com/2022/09/why-infrastructure-as-code-scanning-matters-for-kubernetes-configuration/ Powered by Jetpack

A.J. Dunham posted: "Many industries are affected by skills gaps, but according to Cybersecurity Ventures, the shortage within the IT/cybersecurity sector is nearly unmatched: Over an eight-year period, the number of unfilled cybersecurity jobs increased from one million posi" Security Boulevard Cyber Skills Shortage? The Time for Security Automation Is Now A.J. Dunham Sep 1 Many industries are affected by skills gaps, but according to Cybersecurity Ventures, the shortage within the IT/cybersecurity sector is nearly unmatched: Over an eight-year period, the number of unfilled cybersecurity jobs increased from one million positions in 2013 to 3.5 million in 2021. The researchers predict this skills gap will hold steady through 2025, but […] The post Cyber Skills Shortage? The Time for Security Automation Is Now appeared first on Forescout. Read more of this post Comment Unsubscribe to no longer receive posts from Security Boulevard. Change your email settings at manage subscriptions. Trouble clicking? Copy and paste this URL into your browser: https://securityboulevard.com/2022/09/cyber-skills-shortage-the-time-for-security-automation-is-now/ Powered by Jetpack

Michael Vizard posted: "A GitLab survey of more 5,500 DevOps professionals (including roughly 700 application security professionals) found 57% of those security respondents reported that responsibility for security has either already or soon will shift left toward developers. " Security Boulevard Application Security Responsibility Shifting Further Left Michael Vizard Sep 1 A GitLab survey of more 5,500 DevOps professionals (including roughly 700 application security professionals) found 57% of those security respondents reported that responsibility for security has either already or soon will shift left toward developers. However, 43% of respondents said they still have full ownership of security, with another third reporting they are at least […] Read more of this post Comment Unsubscribe to no longer receive posts from Security Boulevard. Change your email settings at manage subscriptions. Trouble clicking? Copy and paste this URL into your browser: https://securityboulevard.com/2022/09/application-security-responsibility-shifting-further-left/ Powered by Jetpack

Digital Defense by HelpSystems posted: "  Outflank's trusted experts run sophisticated attack scenarios supported by a unique SaaS offering that help global businesses pinpoint and address dangerous" Security Boulevard HelpSystems Acquires Outflank Digital Defense by HelpSystems Sep 1 Company's Global Partner Program Provides Comprehensive Lineup of Benefits for Channel Partners The post HelpSystems Acquires Outflank appeared first on Digital Defense. Read more of this post Comment Unsubscribe to no longer receive posts from Security Boulevard. Change your email settings at manage subscriptions. Trouble clicking? Copy and paste this URL into your browser: https://securityboulevard.com/2022/09/helpsystems-acquires-outflank/ Powered by Jetpack

Marc Handelman posted: " via the comic artistry and dry wit of Randall Munroe, r" Security Boulevard XKCD 'America Songs' Marc Handelman Sep 1 via the comic artistry and dry wit of Randall Munroe, resident at XKCD! Permalink Read more of this post Comment Unsubscribe to no longer receive posts from Security Boulevard. Change your email settings at manage subscriptions. Trouble clicking? Copy and paste this URL into your browser: https://securityboulevard.com/2022/09/xkcd-america-songs/ Powered by Jetpack