Daily digest for Security Boulevard, on February 1, 2024

Kamal Srinivasan posted: "When it comes to cybersecurity, it may be tempting to cut corners. After all, who thinks they will be the next target of a cyberattack? Many live in the delusion that they are safe from harm. However, this is a dangerous misconception, as the report "The " Security Boulevard Read on blog or Reader Is Your Remote Workforce Truly Safe? Three Reasons Zero-Trust is the Answer Kamal Srinivasan February 1 Zero-trust is the smart way to secure your remote workforce, and done right, it results in a more secure future with the technology available in the security space. Read more of this post

CISO Global posted: "February 1, 2024 By: Randy Griffith, Senior Security Consultant, Strategy and Risk In the ever-evolving cybersecurity landscape, organizations are constantly striving to enhance their defenses against organized malicious actors. As cyber atta" Security Boulevard Read on blog or Reader Strengthening Cybersecurity in Local Government: How to Protect Networks Amid an Epidemic CISO Global February 1 By: Randy Griffith, Senior Security Consultant, Strategy and Risk In the ever-evolving cybersecurity landscape, organizations are constantly striving to enhance their defenses against organized malicious actors. As cyber attacks become more advanced, regulatory bodies have created and enforced compliance requirements to ensure that organizations protect sensitive data and systems. One groundbreaking solution that can help […] The post Strengthening Cybersecurity in Local Government: How to Protect Networks Amid an Epidemic appeared first on CISO Global. Read more of this post Comment

Rohan Timalsina posted: "CISA and FBI have jointly issued a warning about the threat posed by AndroxGh0st malware, emphasizing its use in establishing a botnet for "victim identification and exploitation within target networks." Originating in a Lacework report from D" Security Boulevard Read on blog or Reader CISA and FBI Warn of AndroxGh0st Malware Threat Rohan Timalsina February 1 CISA and FBI have jointly issued a warning about the threat posed by AndroxGh0st malware, emphasizing its use in establishing a botnet for "victim identification and exploitation within target networks." Originating in a Lacework report from December 2022, AndroxGh0st, a Python-based malware, has spawned similar tools such as AlienFox, GreenBot (aka Maintance), Legion, and Predator. […] The post CISA and FBI Warn of AndroxGh0st Malware Threat appeared first on TuxCare. Read more of this post Comment

Emma Kelly posted: " The True Cost of Employee Fraud:A $90,000 Blow Forces Newspaper to Cease PrintingIn a shocking disclosure last week, the respected Eugene Weekly, a 40-year-old newspaper with a circulation exceeding 30,000, recently fell victim to a devastating ca" Security Boulevard Read on blog or Reader The True Cost of Employee Fraud Emma Kelly February 1 The True Cost of Employee Fraud:A $90,000 Blow Forces Newspaper to Cease PrintingIn a shocking disclosure last week, the respected Eugene Weekly, a 40-year-old newspaper with a circulation exceeding 30,000, recently fell victim to a devastating case of embezzlement. The New York Times reported that the newspaper's management uncovered a series […] The post The True Cost of Employee Fraud appeared first on SafePaaS. Read more of this post Comment

Rohan Timalsina posted: " Live patching plays a vital role in helping enterprises stay secure   Live patching is becoming crucial for maintaining compliance with various data privacy standards and regulations   TuxCare's Extended Lifecycle Support program includes l" Security Boulevard Read on blog or Reader Trends and Innovations in Enterprise Live Patching Services for Cybersecurity Rohan Timalsina February 1 Live patching plays a vital role in helping enterprises stay secure   Live patching is becoming crucial for maintaining compliance with various data privacy standards and regulations   TuxCare's Extended Lifecycle Support program includes live patching services for end-of-life Linux systems   Cyber threats have become more sophisticated and the traditional methods of patching are […] The post Trends and Innovations in Enterprise Live Patching Services for Cybersecurity appeared first on TuxCare. Read more of this post Comment

Wajahat Raja posted: "In recent developments, GitHub, a Microsoft-owned subsidiary, has taken proactive measures to address a security vulnerability potentially exposing credentials within production containers. In this article, we'll analyze the GitHub vulnerability incident," Security Boulevard Read on blog or Reader GitHub Vulnerability: Key Rotation Amid High-Severity Threat Wajahat Raja February 1 In recent developments, GitHub, a Microsoft-owned subsidiary, has taken proactive measures to address a security vulnerability potentially exposing credentials within production containers. In this article, we'll analyze the GitHub vulnerability incident, shedding light on the key rotations and the security landscape surrounding the issue. GitHub Vulnerability Discovery and Immediate Action GitHub became aware of the […] The post GitHub Vulnerability: Key Rotation Amid High-Severity Threat appeared first on TuxCare. Read more of this post Comment

madhav posted: "ESG Research Unearths Critical Insights for Future-Proofing Encryption and Key Management madhav Thu, 02/01/2024 - 05:14 Encryption and key management are critical defenses against data breaches and cyber threats in the evolving digital lands" Security Boulevard Read on blog or Reader ESG Research Unearths Critical Insights for Future-Proofing Encryption and Key Management madhav February 1 ESG Research Unearths Critical Insights for Future-Proofing Encryption and Key Management madhav Thu, 02/01/2024 - 05:14 Encryption and key management are critical defenses against data breaches and cyber threats in the evolving digital landscape. A comprehensive study by ESG Research, commissioned by Thales, sheds light on emerging trends, operational challenges, and strategic advancements in this vital field. For IT professionals navigating the complexities of data security, these insights offer a guide to the evolving demands and solutions in encryption and key management. Strategic Insights at a Glance The ESG Research study offers a trove of insights for all IT professionals and business execs. The following points provide a high-level snapshot of the current encryption landscape: Widespread Data Loss: 71% of organizations have faced multiple data breaches in the past year, primarily due to inadequate encryption. Operational Challenges: Top concerns include identifying where and when to apply encryption, managing certificate chains of trust, and ensuring regulatory compliance. Trends in Encryption: An increase in encryption for data at rest, in motion, and in use is anticipated, with a notable shift towards cloud-resident data protection. Strategic Focus: The formation of dedicated encryption teams and direct reporting to C-level executives emphasize encryption's strategic significance. The Rising Tide of Cloud-Based Sensitive Data The volume of sensitive data residing in the cloud is surging, with an average of 51% of organizational data currently cloud-based, projected to increase to 68% within 24 months. This trend underscores the growing reliance on encryption as a primary safeguard. As data migrates skyward, encryption techniques for data at rest, in motion, and in use are becoming more pervasive, evolving into a standard practice for protecting cloud-resident sensitive information against emerging cyber threats. Encryption as a Strategic Imperative Encryption is increasingly recognized as a strategic cornerstone within organizations. Reflecting this shift, 71% have initiated formal cryptographic programs, while 81% boast dedicated encryption teams. Notably, 63% of these teams report directly to C-level executives, underscoring encryption's elevation to a critical, strategic function. This trend highlights the growing acknowledgment of encryption's vital role in safeguarding an organization's most sensitive assets. Operationalizing Encryption: Challenges Ahead Navigating the encryption landscape presents a complex array of operational challenges for IT professionals: Decision Dilemmas: Determining where and when to apply encryption tops the list of complexities, requiring a nuanced understanding of data types, regulatory requirements, and threat vectors. Trust Management: Managing certificate chains of trust is a critical task, ensuring the integrity and reliability of encryption across systems. Compliance Complexity: Navigating the maze of regulatory compliance demands a meticulous approach, especially with the varying standards across regions and industries. The common occurrence of sensitive data loss compounds these challenges. Many organizations report multiple breaches within a year, often due to unencrypted data being vulnerable to malicious actors or insufficient encryption strength. This reveals a critical gap between overconfidence in protocols and the harsh reality of data security. Preparing for a Quantum Future Post-quantum cryptography (PQC) emerges as a pivotal frontier in encryption technology as the digital world braces for the quantum era. Currently, 51% of organizations have embarked on their PQC journey, deploying solutions or actively testing them, with an additional 25% planning evaluations within the next two years. This proactive shift reflects a keen awareness of quantum computing's potential to disrupt current encryption paradigms. PQC offers a beacon of hope, promising robust defenses against future threats. However, the journey is fraught with complexities, demanding a deep understanding of quantum-resistant algorithms and strategic planning. As IT professionals navigate this transition, they balance the immediate needs of data security with the long-term imperative of quantum readiness, ensuring that today's encryption efforts can withstand tomorrow's challenges. The commitment to PQC underscores encryption's evolution from a tactical tool to a strategic necessity, preparing organizations for a secure future in an uncertain quantum landscape. Uncertainty and Data Volume Fuel Investment The uncertainty of the quantum future, coupled with the increase in cloud-resident sensitive data, justifies the notable surge in investment. With a reported 51% of an organization's sensitive data currently stored in the cloud, it's no wonder that a striking 87% of organizations plan to increase their encryption budget, outpacing other areas of cybersecurity. This uptick is accompanied by a strategic shift towards unified, centralized Key Management Systems (KMS), with expectations that adoption will double in the near future while distributed/federated KMS usage will decline. Additionally, the pursuit of comprehensive, integrated encryption solutions is gaining traction, reflecting a preference for holistic, streamlined security architectures. These trends signify a maturation in understanding the complexities of data security and herald a future where encryption is seamlessly embedded in the fabric of organizational defense mechanisms. Conclusion The ESG Research study commissioned by Thales unveils critical insights into the evolving realm of encryption and key management. As organizations grapple with increasing data volumes, regulatory complexities, and emerging quantum threats, encryption emerges as a strategic imperative. The shift towards comprehensive, integrated solutions and increased investment reflects a deeper understanding and commitment to data security. For businesses, these findings underscore the challenges and highlight the path forward, offering a blueprint for navigating the intricate landscape of encryption in the digital age. Learn more about the findings of the ESG Research study and how Thales can help here, and register to join our webinar as Jack Poller, Senior Analyst, Enterprise Strategy Group joins Leonor Jones, Director of Product Management, Thales to discuss the key findings. Encryption Emily Richuso | Senior Product Marketing Manager, Thales More About This Author > Schema Read more of this post Comment

girishwallarm posted: "Do you know what 23andMe, Jason's Deli, North Face, and Hot Topic have in common? They've all been breached by successful credential stuffing attacks in the last year!  An attack type that has gained prominence in recent years is credential stuffing. In t" Security Boulevard Read on blog or Reader Stopping Credential Stuffing Attacks: We Need to Do Better girishwallarm January 31 Do you know what 23andMe, Jason's Deli, North Face, and Hot Topic have in common? They've all been breached by successful credential stuffing attacks in the last year!  An attack type that has gained prominence in recent years is credential stuffing. In this blog, we will explore what credential stuffing is, discuss current approaches to [...] The post Stopping Credential Stuffing Attacks: We Need to Do Better appeared first on Wallarm. Read more of this post Comment

Steve Winterfeld posted: "While it is not an exciting topic, I find I am passionate about compliance.  Most cybersecurity professionals agree that 'compliance' does not necessarily equal 'secure'—many companies that have been breached were fully compliant—but compliance can create" Security Boulevard Read on blog or Reader A Wake-Up Call for Emerging Cybersecurity Compliance Changes Steve Winterfeld January 31 As the year kicks off, now is a good time to think through what updates to your compliance program might be needed. Read more of this post

Flare posted: " Third-parties are an important part of your extended enterprise. They're your vendors, your partners, and your suppliers. They provide some of your business's most critical services: billing, data storage, or sales. Unfortunately, vendors and supplie" Security Boulevard Read on blog or Reader Third-Party Cybersecurity Risk Management: A Short Guide for 2024 Flare January 31 Third-parties are an important part of your extended enterprise. They're your vendors, your partners, and your suppliers. They provide some of your business's most critical services: billing, data storage, or sales. Unfortunately, vendors and suppliers also come along with significant third party cybersecurity risk. Early in January, Gartner named third-party risk cyber management (TPCRM) a […] The post Third-Party Cybersecurity Risk Management: A Short Guide for 2024 appeared first on Flare | Cyber Threat Intel | Digital Risk Protection. Read more of this post Comment

Tamara Bailey, Content Marketing Specialist @ AppOmni posted: " /*! elementor - v3.19.0 - 29-01-2024 */ .elementor-widget-text-editor.elementor-drop-cap-view-stacked .elementor-drop-cap{background-color:#69727d;color:#fff}.elementor-widget-text-editor.elementor-drop-cap-view-f" Security Boulevard Read on blog or Reader AppOmni Harnesses Google Data Center in Australia to Address Regional Demand for Specialised SaaS Security Solutions Tamara Bailey, Content Marketing Specialist @ AppOmni January 31 AppOmni launches a new data centre in Australia as a part of their global expansion efforts. The post AppOmni Harnesses Google Data Center in Australia to Address Regional Demand for Specialised SaaS Security Solutions appeared first on AppOmni. Read more of this post Comment

Marc Handelman posted: " Author/Presenters: Kunal Mukherjee, Joshua Wiedemeier, Tianhao Wang, James Wei, Feng Chen, Muhyun Kim, Murat Kantarcioglu, and Kangkook Jee Many thanks to USENIX for publishing their outstanding USENIX Security '23 Pre" Security Boulevard Read on blog or Reader USENIX Security '23 – Evading Provenance-Based ML Detectors With Adversarial System Action Marc Handelman January 31 Author/Presenters: Kunal Mukherjee, Joshua Wiedemeier, Tianhao Wang, James Wei, Feng Chen, Muhyun Kim, Murat Kantarcioglu, and Kangkook Jee Many thanks to USENIX for publishing their outstanding USENIX Security '23 Presenter's content, and the organizations strong commitment to Open Access. Originating from the conference's events situated at the Anaheim Marriott; and via the organizations YouTube channel. Read more of this post Comment

Grip Security Blog posted: "In today's rapidly evolving digital landscape, security and risk management leaders are grappling with a formidable challenge: managing the technical identity debt that increasingly burdens their organizations. As Gartner discusses in its recent report, R" Security Boulevard Read on blog or Reader Shadow SaaS from Business-Led IT Leads to IAM Technical Debt Grip Security Blog January 31 As companies embrace business-led IT, understanding and mitigating the risks associated with shadow SaaS is crucial. Read more of this post Comment

Ivan Novikov posted: "Deciphering the Cyber Invasion Terrain We exist in an era deeply entrenched in digital dependence, where cyber invasions present significant risks for companies, government establishments, and solitary users. As we hurdle deeper into the digital era, the" Security Boulevard Read on blog or Reader How to Prepare for a Cyberattack Ivan Novikov January 31 Deciphering the Cyber Invasion Terrain We exist in an era deeply entrenched in digital dependence, where cyber invasions present significant risks for companies, government establishments, and solitary users. As we hurdle deeper into the digital era, the art of cyber misdemeanors continues to evolve. This initial chapter aims to unravel the extensive terrain of cyber [...] The post How to Prepare for a Cyberattack appeared first on Wallarm. Read more of this post Comment

bacohido posted: "San Francisco, Calif., Jan. 31, 2024 – Reken, an AI & cybersecurity company, today announced the close of its $10M oversubscribed seed round, led by Greycroft and FPV Ventures. Other investors in the round include Firebolt Ventures, Fika Ventures, Ome" Security Boulevard Read on blog or Reader News alert: Reken raises $10M from Greycroft to protect against generative AI-enabled fraud bacohido January 31 San Francisco, Calif., Jan. 31, 2024 – Reken, an AI & cybersecurity company, today announced the close of its $10M oversubscribed seed round, led by Greycroft and FPV Ventures. Other investors in the round include Firebolt Ventures, Fika Ventures, Omega … (more…) Read more of this post Comment

Arkose Labs posted: "Mobile devices are facing a growing number of threats, particularly from bot attacks. The surge in mobile usage has led to an increase in cyberattacks that exploit vulnerabilities specific to mobile operating systems. These attacks use tactics like malici" Security Boulevard Read on blog or Reader New Threat Intelligence Reveals Top 5 Threats to Mobile Devices Arkose Labs January 31 Mobile devices are facing a growing number of threats, particularly from bot attacks. The surge in mobile usage has led to an increase in cyberattacks that exploit vulnerabilities specific to mobile operating systems. These attacks use tactics like malicious apps, app-based vulnerabilities, and SMS messages. Mobile attacks aim to compromise data, track user activities, or […] Read more of this post Comment

Security Boulevard © 2024. Manage your email settings or unsubscribe. Get the Jetpack app Subscribe, bookmark, and get real-time notifications - all from one app! Automattic, Inc. - 60 29th St. #343, San Francisco, CA 94110