Cybercriminals step up their targeting of macOS
Historically Windows has been the favorite target of cybercriminals, but new research from Accenture suggests macOS is becoming a lucrative priority on the dark web and information on exploits is being traded for millions of dollars.
The Accenture Cyber Threat Intelligence (ACTI) team has noted a significant upward trend in dark-web threat actors targeting macOS from 2019 to 2022 and the volume from 2023 has overtaken 2022 in just the first six months.
The future of identity and cybersecurity [Q&A]
Back in May, when World Password Day was once again in the news, we asked whether the days of the password were numbered.
Rishi Bhargava, co-founder of Descope, agrees that passwords belong to the past. We spoke to him to discover more and find out how new technologies like passkeys are driving the change.
Inside the world of cyber incident investigations
Investigation of information security incidents is the last stage of enterprise protection and one of its most important parts, helping to minimize the damage caused by hackers and build defenses to prevent future incidents. The investigation assists in evaluating the security of the company's IT infrastructure and in formulating recommendations for its enhancement.
Incident investigation is a crucial component of any enterprise's information security framework. Merely monitoring the work of the security tools is not enough, as security incidents are happening all the time. Without a proper response to these incidents, the enterprise, in effect, lacks adequate information security protection.
Avast launches free security training quiz for small businesses
Smaller businesses are not immune from cyberattacks. In fact, because they lack the resources for the latest defenses and to train their staff to spot threats, they can be particularly vulnerable.
Education and training are key to protect any business and to help smaller companies stay up to date Avast -- now part of digital security and privacy brand Gen -- is launching a new Cybersecurity Training Quiz.
How phishing scams have changed and how to protect against them [Q&A]
Cyberattacks and data breaches come it many forms, but often at the root of them is a phishing scam.
Exploiting the fact that humans are the weakest link in the security chain, cybercriminals use phishing to trick employees into giving up credentials or other sensitive information that can be used to gain a foothold to carry out a later attack.
Why'd you have to go and make PAM so complicated?
Avril Lavigne didn't quite sing that line but she might well have done if she'd worked in IT. More than two-thirds of IT managers (68 percent) say their current privileged access management (PAM) product is too complex or has too many features they don't use.
A new report from Keeper Security also finds that 87 percent of respondents would prefer a pared down form of PAM that is easier to deploy and use.
Over a third of ICS vulnerabilities have no patch available
New research from SynSaber, along with the ICS Advisory Project, into industrial control operational technology system vulnerabilities finds that 34 percent of the CVEs reported in the first half of 2023 currently have no patch or remediation available from the vendor.
This compares to the 35 percent that had no fixes in the second half of 2022 but is a significant increase from the 13 percent in the first half of last year.
Adapting to a changing cybersecurity landscape [Q&A]
The past few years have seen some major changes in the IT world. Accelerated by the pandemic we've seen a significant shift to the cloud and hybrid working models.
But this brings with it additional risks. We spoke to Matt Spitz, head of engineering at Vanta, to discuss the security challenges posed and how enterprises can adapt to cope with them.
SSH is the service most targeted by cloud attackers
A new cloud threat findings report from Cado Security looks at the evolving cloud threat landscape, shedding light on the heightened risk of cyberattacks due to the rapid adoption of cloud-focused services.
The report shows SSH is the most commonly targeted service accounting for 68.2 percent of the samples seen, followed by Redis at 27.6 percent, and Log4Shell traffic at a mere 4.3 percent, indicating a shift in threat actor strategy no longer prioritizing the vulnerability as a means of initial access.
Organizations are responding faster to cyber threats
On average, organizations' response time to cyber attacks improved by around a third -- from 29 to 19 days -- from 2021 to 2022.
The report from Immersive Labs suggests this improvement can be attributed to the urgency and need for fast response times amid the fallout of the Log4j crisis and other high-profile vulnerabilities over the past year.
Over half of Azure and Google Cloud deployments fail CIS benchmarks
Cloud misconfiguration is a critical issue as it amplifies the risk of data breaches and unauthorized access. But new research from Qualys shows that many cloud deployments on major platforms are failing Center for Internet Security (CIS) benchmarks.
The report finds that on average, 50 percent of CIS Benchmarks are failing across the major providers. The average fail rate for each provider is 34 percent for AWS, 57 percent for Azure, and 60 percent for Google Cloud Platform (GCP).
80 percent of digital certificates vulnerable to man-in-the-middle attacks
A new survey finds that nearly 80 percent of TLS certificates on the internet are vulnerable to man-in-the-middle (MiM) attacks, while as many as 25 percent of all certificates are expired at any given time.
The study, sponsored by automated machine identity management firm AppViewX and carried out by EEnterprise Management Associates (EMA), focuses on servers with SSL/TLS certificates on port 443.
Cyber Essentials? What's that then?
New research from Lookout finds that 40 percent of security pros have no clue about the UK Cyber Essentials framework -- the government backed program that aims to help UK organizations improve their cyber resiliency against the most common cyberattacks.
The research, carried out at Infosecurity Europe, surveyed 246 security professionals and finds only 28 percent of organizations had fully implemented Cyber Essentials. Of those that had not implemented the scheme, 58 percent say a lack of awareness or understanding is the reason why they hadn't.
How can companies leverage machine learning to mitigate cyber threats?
Cybersecurity has become one most crucial aspects of many organizations due to the speed at which cyber threats evolve. The "speed of cybersecurity" makes it vital to have timely and agile defense measures to detect, analyze, and mitigate cyber risks -- as it is the only way to stay ahead of attackers and protect assets in an increasingly dynamic and interconnected world.
New technologies like cloud computing and automation have led to transformative changes in cybersecurity, though these changes weren’t immediate. The use of the cloud within other IT teams advanced much faster than it did in cybersecurity departments, as security teams were hesitant to cede control to technologies in the hands of others.
Industry reacts to new SEC breach disclosure rules
On Wednesday the US Securities and Exchange Commission (SEC) approved new rules that require publicly traded companies to publicize details of a cyber attack within four days of identifying that it has a 'material' impact on their finances.
This marks a major shift in how data breaches are disclosed and industry figures have been quick to give their views on the effect the new rules will have.
Recent Headlines
Most Commented Stories
Betanews Is Growing Alongside You
Only a fool still uses Windows 7
© 1998-2025 BetaNews, Inc. All Rights Reserved. Privacy Policy - Cookie Policy.