New research provides organizations with a roadmap for cloud security
Organizations often rush into cloud deployments without fully appreciating all of the risks that they can present.
A new report from cybersecurity advisory and assessment services firm Coalfire identifies key considerations, common pitfalls, and practical advice for professionals who have responsibility for enterprise cloud strategy, planning, adoption, and operations.
13 percent of Q1 phishing attacks related to COVID-19
In the first quarter of 2020 phishing attacks increased by 22.5 percent compared to the end of 2019, and 13 percent of all phishing was related to COVID-19.
A new report from Positive Technologies also shows that in Q1 there were 23 very active APT groups whose attacks targeted mostly government agencies, industrial, finance, and medical institutions.
F-Secure uncovers counterfeit Cisco network devices
Finnish cybersecurity company F-Secure has published a report detailing its investigation into a pair of counterfeit Cisco network switches.
The investigation concludes that the counterfeits had been designed to bypass processes that authenticate system components. Two different counterfeit versions of Cisco Catalyst 2960-X series switches were discovered by an IT company after a software update stopped them from working.
SIGRed: Microsoft releases patch for critical, wormable vulnerability in Windows DNS Server
As part of this month's Patch Tuesday, Microsoft has issued a fix for a 17-year-old Windows DNS Server vulnerability. Known as SIGRed and tracked as CVE-2020-1350, the flaw is a serious one that has been assigned a CVSS base score of 10.0.
The vulnerability affects all version of Windows Server and is a wormable remote code execution flaw that requires no user interaction. In addition to issuing a critical patch, Microsoft has also provided details of a workaround for anyone who is unable to deploy the fix immediately
New security platform traces end-to-end cloud app activity
Using complex cloud applications built with microservices and APIs can often expose business logic that threat actors use to infiltrate applications and private data.
A new application security company Traceable is launching today with a platform that traces end-to-end application activity from the user and session all the way through the application code. Traceable's TraceAI machine learning and distributed tracing technology analyzes data to learn normal application behavior and detect any activity that deviates from the norm.
Email impersonation attacks target dispersed workforces
With increased numbers of people working remotely, a new report reveals that cybercriminals are using email impersonation to prey on the sense of urgency of an increasingly distracted and dispersed workforce.
Email security company GreatHorn has collected data from over 640 security, IT and C-suite professionals to gain a better understanding of new threat vectors and attack strategies. It found almost half of respondents (48.7 percent) report seeing impersonations of people such as colleagues, customers or vendors.
More than half of cybersecurity professionals suffer overwork or burnout
New research from the UK's Chartered Institute of Information Security (CIISec) shows that overwork and burnout remain major problems for the IT security sector.
The study of almost 450 cybersecurity professionals shows that 54 percent of respondents have either left a job due to overwork or burnout, or have worked with someone who has.
New platform combines application and infrastructure risk management
Vulnerability management specialist RiskSense is launching a new version of its platform that harmonizes threat analysis, prioritization and risk scoring across both network-based assets and applications.
RiskSense aggregates and normalizes outputs from multiple data sources including SAST, DAST, open source software, containers, pen testing and bug bounty programs. This approach enables organizations to easily pinpoint and fix vulnerabilities in their attack surface regardless of where they arise.
Microsoft's new Kernel Data Protection will make kernel memory read-only and block attacks on Windows 10
Microsoft has revealed details of a new platform security technology which the company says will prevent data corruption attacks.
Kernel Data Protection (KDP) works by marking sections of kernel memory as read-only, so there is no way it can be tampered with. The technology comes in response to the fact that increasing numbers of attackers are using data corruption techniques to bypass security, gain additional privileges, and more.
Imperva launches new cloud data security solution to help digital transformation
As companies accelerate their digital transformation programs, many move data into the cloud without all the security controls necessary to protect both their organization and customers’ data. This leaves them vulnerable to cyberattacks and without evidence of compliance with data protection regulations
Cybersecurity specialist Imperva is launching a new SaaS Cloud Data Security product that gives businesses visibility and compliance oversight for data hosted in a database-as-a-service (DbaaS).
Security staff suffering alert fatigue as report volumes increase
According to a new study, 70 percent of security teams have seen more than double the volume of security alerts in the past five years. These high volumes of reports cause problems for IT security teams with 83 percent saying their security staff experience 'alert fatigue'.
The survey conducted by Dimensional Research on behalf of continuous intelligence specialist Sumo Logic also shows that while automation is helpful it isn't a complete solution.
Remote working exposes organizations to more security risks
A new survey released today by security software firm NetMotion reveals that 47 percent of organizations believe remote work has exposed their organization to high or extreme security risk.
Of these 62 percent are most concerned that workers will visit malicious URLs that could compromise networks and devices, while 45 percent are worried about workers accessing inappropriate content.
Fake content drives online fraud
Based on a study of 34,000 sites and apps, as well as a survey of over 1,000 consumers conducted in June 2020, new research details how content abuse is a critical part of the fraud supply chain, the interconnected ecosystem of fraud.
The research, carried out by digital trust and safety firm Sift, also uncovered a fraud ring based in Russia where fraudsters executed a card-testing scheme through fake listings on an e-commerce marketplace.
Security not keeping pace with moving to BYOD
With a shift to remote working many more businesses are embracing BYOD, but a new report from Bitglass suggests that security arrangements are failing to keep pace.
In the study, 69 percent of respondents say that employees at their companies are allowed to use personal devices to perform their work, while 26 percent also enable BYOD for contractors, 21 percent for partners, and some even for customers, and suppliers.
Over 15 billion sets of credentials in circulation on criminal marketplaces
New research from risk prevention specialist Digital Shadows finds there are more than 15 billion sets of usernames and passwords in circulation in cybercriminal marketplaces -- the equivalent of more than two for every person on the planet.
The number of stolen and exposed credentials has risen 300 percent from 2018 as the result of more than 100,000 separate breaches. Of these, more than 5 billion were assessed as 'unique' -- that is not advertised more than once on criminal forums.
BetaNews, your source for breaking tech news, reviews, and in-depth reporting since 1998.
© 1998-2025 BetaNews, Inc. All Rights Reserved. About Us - Privacy Policy - Cookie Policy - Sitemap.