Daily digest for Security Boulevard, on August 4, 2023

Sue Poremba posted: "Everyone wants to make their work processes easier. A step that many developers take to provide simpler access to their workflows is to embed credentials directly into the code. It's not hard to understand why developers do this–as more applications be" Security Boulevard Generative AI Adding to the Risks for Embedded Credentials Sue Poremba Aug 4 Everyone wants to make their work processes easier. A step that many developers take to provide simpler access to their workflows is to embed credentials directly into the code. It's not hard to understand why developers do this–as more applications become cloud-native and need to authenticate to more third-party APIs, applications need more credentials. The […] Read more of this post Unsubscribe to no longer receive posts from Security Boulevard. Change your email settings at manage subscriptions. Trouble clicking? Copy and paste this URL into your browser: https://securityboulevard.com/2023/08/generative-ai-adding-to-the-risks-for-embedded-credentials/

Get the Jetpack app to use Reader anywhere, anytime Follow your favorite sites, save posts to read later, and get real-time notifications for likes and comments. Automattic, Inc. - 60 29th St. #343, San Francisco, CA 94110

Bruce Lynch posted: "For cybersecurity and simplifying threat management, the advantages of network segmentation are tenfold Network segmentation also provides critical help to organizations on the journey to a zero trust security model.  Advantages of Network Segmentation Wh" Security Boulevard Ten Advantages of Network Segmentation Bruce Lynch Aug 4 For cybersecurity and simplifying threat management, the advantages of network segmentation are tenfold Network segmentation also provides critical help to organizations on the journey to a zero trust security model.  Advantages of Network Segmentation When Implementing Zero Trust  Network segmentation is the practice of dividing a computer network into smaller subnetworks or segments. Once divided,... The post Ten Advantages of Network Segmentation appeared first on TrueFort. Read more of this post Comment Unsubscribe to no longer receive posts from Security Boulevard. Change your email settings at manage subscriptions. Trouble clicking? Copy and paste this URL into your browser: https://securityboulevard.com/2023/08/ten-advantages-of-network-segmentation/

Get the Jetpack app to use Reader anywhere, anytime Follow your favorite sites, save posts to read later, and get real-time notifications for likes and comments. Automattic, Inc. - 60 29th St. #343, San Francisco, CA 94110

Emma Kelly posted: " Top 5 Segregation of Duties Auditing Tips: Understanding the Criticality of Segregation of Duties in Risk ManagementSegregation of duties (SoD) is one of the most impactful internal controls your organization can use to minimize risks and maintain" Security Boulevard Top 5 Segregation of Duties auditing tips Emma Kelly Aug 4 Top 5 Segregation of Duties Auditing Tips: Understanding the Criticality of Segregation of Duties in Risk ManagementSegregation of duties (SoD) is one of the most impactful internal controls your organization can use to minimize risks and maintain the integrity of your operations and financial systems. SoD also protects against intentional […] The post Top 5 Segregation of Duties auditing tips appeared first on SafePaaS. Read more of this post Comment Unsubscribe to no longer receive posts from Security Boulevard. Change your email settings at manage subscriptions. Trouble clicking? Copy and paste this URL into your browser: https://securityboulevard.com/2023/08/top-5-segregation-of-duties-auditing-tips/

Get the Jetpack app to use Reader anywhere, anytime Follow your favorite sites, save posts to read later, and get real-time notifications for likes and comments. Automattic, Inc. - 60 29th St. #343, San Francisco, CA 94110

Emma Kelly posted: " Navigating UK SOX Compliance: Proactive Strategies for Enhanced Governance and Risk ManagementIn March 2021, the Department for Business, Energy & Industrial Strategy (BEIS) published its "Restoring Trust in Audit and Corporate Governance" con" Security Boulevard Navigating UK SOX Compliance Emma Kelly Aug 4 Navigating UK SOX Compliance: Proactive Strategies for Enhanced Governance and Risk ManagementIn March 2021, the Department for Business, Energy & Industrial Strategy (BEIS) published its "Restoring Trust in Audit and Corporate Governance" consultation on proposals for extensive reform to enhance corporate transparency. The consultation outlines a comprehensive program of changes […] The post Navigating UK SOX Compliance appeared first on SafePaaS. Read more of this post Comment Unsubscribe to no longer receive posts from Security Boulevard. Change your email settings at manage subscriptions. Trouble clicking? Copy and paste this URL into your browser: https://securityboulevard.com/2023/08/navigating-uk-sox-compliance/

Get the Jetpack app to use Reader anywhere, anytime Follow your favorite sites, save posts to read later, and get real-time notifications for likes and comments. Automattic, Inc. - 60 29th St. #343, San Francisco, CA 94110

Unork - Webflow Ecommerce website template posted: "The flow of work is a term used to describe the sequence of steps that are taken to complete a task or project. It's a process that defines how work is done, and it's an essential part of any organization. The flow of work can be a simple or complex proce" Security Boulevard What is the flow of work? | Haekka Blog Unork - Webflow Ecommerce website template Aug 4 The flow of work is a term used to describe the sequence of steps that are taken to complete a task or project. It's a process that defines how work is done, and it's an essential part of any organization. The flow of work can be a simple or complex process, depending on the task or project at hand. Read more of this post Comment Unsubscribe to no longer receive posts from Security Boulevard. Change your email settings at manage subscriptions. Trouble clicking? Copy and paste this URL into your browser: https://securityboulevard.com/?p=1983815

Get the Jetpack app to use Reader anywhere, anytime Follow your favorite sites, save posts to read later, and get real-time notifications for likes and comments. Automattic, Inc. - 60 29th St. #343, San Francisco, CA 94110

Keon Ramzani posted: " /*! elementor - v3.8.1 - 13-11-2022 */ .elementor-widget-text-editor.elementor-drop-cap-view-stacked .elementor-drop-cap{background-color:#818a91;color:#fff}.elementor-widget-text-ed" Security Boulevard The Achilles Heel of Large Language Models: FraudGPT, WormGPT and Constella's Proactive Response to AI-Powered Cyber Threats Keon Ramzani Aug 3 The Achilles Heel of Large Language Models: FraudGPT, WormGPT and Constella's Proactive Response to AI-Powered Cyber Threats The capabilities of large language models (LLMs) have come into sharp focus recently, with applications ranging from generating complex and creative texts to mimicking human-like conversation. However, this power isn't without its shortcomings. The Achilles heel of these … Continue reading The Achilles Heel of Large Language Models: FraudGPT, WormGPT and Constella's Proactive Response to AI-Powered Cyber Threats The post The Achilles Heel of Large Language Models: FraudGPT, WormGPT and Constella's Proactive Response to AI-Powered Cyber Threats appeared first on Constella Intelligence. Read more of this post Comment Unsubscribe to no longer receive posts from Security Boulevard. Change your email settings at manage subscriptions. Trouble clicking? Copy and paste this URL into your browser: https://securityboulevard.com/2023/08/the-achilles-heel-of-large-language-models-fraudgpt-wormgpt-and-constellas-proactive-response-to-ai-powered-cyber-threats/

Get the Jetpack app to use Reader anywhere, anytime Follow your favorite sites, save posts to read later, and get real-time notifications for likes and comments. Automattic, Inc. - 60 29th St. #343, San Francisco, CA 94110

Keon Ramzani posted: " Identity Theft Botnet Infostealer Exposures Vs. Breach Exposures: A Comparative AnalysisIn the realm of identity theft, a deep understanding of the types of threats and their uni" Security Boulevard Identity Theft Botnet Infostealer Exposures Vs. Breach Exposures: A Comparative Analysis Keon Ramzani Aug 3 Identity Theft Botnet Infostealer Exposures Vs. Breach Exposures: A Comparative Analysis In the realm of identity theft, a deep understanding of the types of threats and their unique implications is critical. Among these threats, two types of exposures frequently rise to prominence because of their capacity to cause substantial harm – Botnet Infostealer exposures and … Continue reading Identity Theft Botnet Infostealer Exposures Vs. Breach Exposures: A Comparative Analysis The post Identity Theft Botnet Infostealer Exposures Vs. Breach Exposures: A Comparative Analysis appeared first on Constella Intelligence. Read more of this post Comment Unsubscribe to no longer receive posts from Security Boulevard. Change your email settings at manage subscriptions. Trouble clicking? Copy and paste this URL into your browser: https://securityboulevard.com/2023/08/identity-theft-botnet-infostealer-exposures-vs-breach-exposures-a-comparative-analysis/

Get the Jetpack app to use Reader anywhere, anytime Follow your favorite sites, save posts to read later, and get real-time notifications for likes and comments. Automattic, Inc. - 60 29th St. #343, San Francisco, CA 94110

Karlo Zanki posted: "ReversingLabs has identified several malicious Python packages on the Python Package Index (PyPI) open source repository. In all, ReversingLabs researchers uncovered 24 malicious packages imitating three, popular open source Python tools: vConnector, a wr" Security Boulevard VMConnect: Malicious PyPI packages imitate popular open source modules Karlo Zanki Aug 3 ReversingLabs has identified several malicious Python packages on the Python Package Index (PyPI) open source repository. In all, ReversingLabs researchers uncovered 24 malicious packages imitating three, popular open source Python tools: vConnector, a wrapper module for pyVmomi VMware vSphere bindings; as well as eth-tester, a collection of tools for testing ethereum based applications; and databases, a tool that gives asyncro support for a range of databases. Read more of this post Comment Unsubscribe to no longer receive posts from Security Boulevard. Change your email settings at manage subscriptions. Trouble clicking? Copy and paste this URL into your browser: https://securityboulevard.com/2023/08/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules/

Get the Jetpack app to use Reader anywhere, anytime Follow your favorite sites, save posts to read later, and get real-time notifications for likes and comments. Automattic, Inc. - 60 29th St. #343, San Francisco, CA 94110

Nic Finn posted: "August 3, 2023 Introduction Across the cybersecurity community, defenders are constantly finding threat actors using novel and innovative techniques to further their exploitation efforts against target networks. Lately, some Threat Actors (TAs) have " Security Boulevard Tunnel Vision: CloudflareD AbuseD in the WilD Nic Finn Aug 3 Introduction Across the cybersecurity community, defenders are constantly finding threat actors using novel and innovative techniques to further their exploitation […] Read more of this post Comment Unsubscribe to no longer receive posts from Security Boulevard. Change your email settings at manage subscriptions. Trouble clicking? Copy and paste this URL into your browser: https://securityboulevard.com/2023/08/tunnel-vision-cloudflared-abused-in-the-wild/

Get the Jetpack app to use Reader anywhere, anytime Follow your favorite sites, save posts to read later, and get real-time notifications for likes and comments. Automattic, Inc. - 60 29th St. #343, San Francisco, CA 94110

Marc Handelman posted: "Thanks are in order to BSides Leeds for publishing their presenter's outstanding BSides Leeds 2023 security content on the organizations' YouTube channel. Permalink" Security Boulevard BSides Leeds 2023 – Dan Cannon – Red Red Whine Marc Handelman Aug 3 Thanks are in order to BSides Leeds for publishing their presenter's outstanding BSides Leeds 2023 security content on the organizations' YouTube channel. Permalink Read more of this post Comment Unsubscribe to no longer receive posts from Security Boulevard. Change your email settings at manage subscriptions. Trouble clicking? Copy and paste this URL into your browser: https://securityboulevard.com/2023/08/bsides-leeds-2023-dan-cannon-red-red-whine/

Get the Jetpack app to use Reader anywhere, anytime Follow your favorite sites, save posts to read later, and get real-time notifications for likes and comments. Automattic, Inc. - 60 29th St. #343, San Francisco, CA 94110

Ainsley Lawrence posted: "As an entrepreneur, you likely know just how valuable data is in the current business landscape. Having access to vast amounts of user data can help you make better-informed operational decisions that directly impact your success. However, this data is &#" Security Boulevard Safeguarding User Data: How Innovative Technologies Are Bolstering Client Security Ainsley Lawrence Aug 3 As an entrepreneur, you likely know just how valuable data is in the current business landscape. Having access to vast amounts of user data can help you make better-informed operational decisions that directly impact your success. However, this data is … Safeguarding User Data: How Innovative Technologies Are Bolstering Client Security Read More » The post Safeguarding User Data: How Innovative Technologies Are Bolstering Client Security appeared first on TechSpective. Read more of this post Comment Unsubscribe to no longer receive posts from Security Boulevard. Change your email settings at manage subscriptions. Trouble clicking? Copy and paste this URL into your browser: https://securityboulevard.com/2023/08/safeguarding-user-data-how-innovative-technologies-are-bolstering-client-security/

Get the Jetpack app to use Reader anywhere, anytime Follow your favorite sites, save posts to read later, and get real-time notifications for likes and comments. Automattic, Inc. - 60 29th St. #343, San Francisco, CA 94110

Ingrid Kambe posted: "The post Fidelis Security is now Part of Partner One. appeared first on Fidelis Cybersecurity. " Security Boulevard Fidelis Security is now Part of Partner One. Ingrid Kambe Aug 3 The post Fidelis Security is now Part of Partner One. appeared first on Fidelis Cybersecurity. Read more of this post Comment Unsubscribe to no longer receive posts from Security Boulevard. Change your email settings at manage subscriptions. Trouble clicking? Copy and paste this URL into your browser: https://securityboulevard.com/2023/08/fidelis-security-is-now-part-of-partner-one/

Get the Jetpack app to use Reader anywhere, anytime Follow your favorite sites, save posts to read later, and get real-time notifications for likes and comments. Automattic, Inc. - 60 29th St. #343, San Francisco, CA 94110

Stephen Hinck posted: "SummaryThe BloodHound code-convergence project brings some significant and long-desired feature enhancements to BloodHound Enterprise (BHE):Cypher search, including pre-built queries for AD and AzureBuilt-in support for offline data collection (i.e., cont" Security Boulevard BloodHound Enterprise Learns Some New Tricks Stephen Hinck Aug 3 Summary The BloodHound code-convergence project brings some significant and long-desired feature enhancements to BloodHound Enterprise (BHE): Cypher search, including pre-built queries for AD and Azure Built-in support for offline data collection (i.e., control systems or acquisition use cases) Expanded capabilities for pathfinding BloodHound Enterprise customers will get access to these features on Monday, August 7, 2023, and will receive release notes upon delivery. Existing customers can reach out to their TAM with questions. Interested in learning more about BloodHound Enterprise? Check out https://bloodhoundenterprise.io/. Introduction Our previous blog discussed our strategy for a converged code base and the opportunities it would bring. Today we'll focus on all of the new features coming to BHE due to that convergence effort and some that we already have in progress for delivery. Let's get started! Cypher search When we launched BloodHound Enterprise, we knew every customer familiar with the BloodHound product family would want support for Cypher. There was just one (not so little) problem… As a hosted service, how do we ensure the security and availability of an open query interface that could allow someone (maliciously or otherwise) to improperly manipulate data or gain access to the database system itself. In preparation for this release, we created a utility within the BloodHound code base called "DAWGS" (short for Database Agnostic Wrapper for Graph Schemas). DAWGS is our middleware layer that handles every query made against BloodHound's Neo4J database, including custom-written Cypher statements. With DAWGS, we can ensure the safety and security of our hosted tenants by preventing individual queries from taking too long or from consuming too much memory (resulting in critical hangs in Neo4J when exhausting available resources). DAWGS takes every query written in the BloodHound UI, rips it apart, and rebuilds it safely before issuing the call to the database so that our customers can query their data to their hearts' content! Identifying the location of all Tier Zero objects utilizing Cypher in BHE For those interested in the inner workings of DAWGS please stay tuned for an in-depth blog post from our engineering team in the near future Offline data collection Our customers love the ease of collection offered by the enterprise version of SharpHound and AzureHound; they are always online, collecting data as you need. But in certain circumstances, deploying persistent data collection services isn't always feasible. Whether validating the risk of introducing a domain trust to that newly acquired child organization or analyzing the Attack Paths from an offline industrial controls environment, our customers have long desired the ability to perform offline collections but still take advantage of all of the analysis capabilities offered by their BloodHound Enterprise license. With this release, these use cases have straightforward, UI-driven workflows to enable our customers to download the most recent version of SharpHound and upload the results via the UI for ingestion and processing. This simplification will enable customers to easily evaluate the risks across their environments with greater flexibility. Ingesting data collected from an offline environment Improved pathfinding search Just like using Google Maps to get to dinner while avoiding tolls, sometimes you want to exclude certain edges from an Attack Path in BloodHound. We've brought the ability to filter edge types for both AD and Azure-based Attack Paths to BloodHound Enterprise. We've also made it much easier to reverse your current path if you accidentally set your start and endpoints backward! Filtering Attack Paths for pathfinding Conclusion and what's next Next week's early access release of BloodHound CE is just the beginning. This convergence project will enable the BloodHound Engineering team to rapidly pursue additional features and deliver them to all of our customers. Our engineering team is already hard at work bringing additional features into the code base and additional Attack Path coverage in both AD and Azure. Up next in our release blog series is the one everyone has been waiting for. On August 8, 2023, BloodHound CE will be made available in its entirety, complete with a blog post by BloodHound co-founder Andy Robbins covering all the changes. Andy and fellow BloodHound co-founder Rohan Vazarkar will also be hosting a webinar on August 18, 2023 to discuss all of the new changes coming to BloodHound CE. You can register for the webinar here. BloodHound Enterprise Learns Some New Tricks was originally published in Posts By SpecterOps Team Members on Medium, where people are continuing the conversation by highlighting and responding to this story. Read more of this post Comment Unsubscribe to no longer receive posts from Security Boulevard. Change your email settings at manage subscriptions. Trouble clicking? Copy and paste this URL into your browser: https://securityboulevard.com/2023/08/bloodhound-enterprise-learns-some-new-tricks/

Get the Jetpack app to use Reader anywhere, anytime Follow your favorite sites, save posts to read later, and get real-time notifications for likes and comments. Automattic, Inc. - 60 29th St. #343, San Francisco, CA 94110

Richi Jennings posted: "Fist of FAIL: Amit Yoran has had enough—and he's not gonna take it anymore.:@AYoran says his team reported a critical @Azure bug four months ago. Has @Microsoft fixed it yet? "Of course not," he says.Satya looks like he's about to punch someone. In today'" Security Boulevard Microsoft is a "Strategic Problem in the Security Space," Says CEO – Security Boulevard Richi Jennings Aug 3 Fist of FAIL: Amit Yoran has had enough—and he's not gonna take it anymore. :@AYoran says his team reported a critical @Azure bug four months ago. Has @Microsoft fixed it yet? "Of course not," he says. Satya looks like he's about to punch someone. In today's #SBBlogwatch, at @TechstrongGroup's @SecurityBlvd: https://t.co/OcTW5HxcwS — @Richi Jennings (@RiCHi) August 3, 2023 Read more of this post Comment Unsubscribe to no longer receive posts from Security Boulevard. Change your email settings at manage subscriptions. Trouble clicking? Copy and paste this URL into your browser: https://securityboulevard.com/?p=1983806

Get the Jetpack app to use Reader anywhere, anytime Follow your favorite sites, save posts to read later, and get real-time notifications for likes and comments. Automattic, Inc. - 60 29th St. #343, San Francisco, CA 94110

Richi Jennings posted: "Yoran has had enough—and he's not gonna take it anymore. Tenable CEO Amit Yoran says his team reported a critical Azure bug four months ago. Has Microsoft fixed it yet? "Of course not," he says. Satya Nadella (pictured) can't be happy. Looks like he's" Security Boulevard Microsoft is a "Strategic Problem in the Security Space," Says CEO Richi Jennings Aug 3 Fist of FAIL: Tenable CEO Amit Yoran has had enough—and he's not gonna take it anymore. Satya Nadella (pictured) can't be happy. Read more of this post Unsubscribe to no longer receive posts from Security Boulevard. Change your email settings at manage subscriptions. Trouble clicking? Copy and paste this URL into your browser: https://securityboulevard.com/2023/08/microsoft-tenable-amit-yoran-richixbw/

Get the Jetpack app to use Reader anywhere, anytime Follow your favorite sites, save posts to read later, and get real-time notifications for likes and comments. Automattic, Inc. - 60 29th St. #343, San Francisco, CA 94110