Security

Building security into an application can often be an afterthought for developers, yet building those steps in at an early stage can save companies time and money.

We spoke with Matt Glenn, vice president of product management at Illumio, who shared his insights on why security professionals should be engaging with developers, and why segmentation is becoming a go-to tool for developers to easily implement security into their processes.

We all know that hackers and cybercriminals are keen to cash in on any opportunity to spread their wares. Researchers at Check Point have uncovered that hackers are using COVID-19 to offer specials and discounts on the dark net.

In similar fashion to Black Friday or Cyber Monday discounts, hackers are using the coronavirus pandemic as a special promotion to sell their malicious goods to hungry cyber attackers.

Almost 65 percent of security professionals surveyed at the recent RSA conference admit to accessing documents that have nothing to do with their jobs.

The study by risk analytics specialist Gurucul also reveals that nearly one in five (19 percent) of respondents admit to having abused their privileged access to view sensitive data. That number increases to 36 percent among those who've had a poor job performance review.

Businesses increasingly struggle with the sheer volume of cyber threats that they face. One way of tackling that is a risk-based system that allows analysts to focus on the most pressing issues.

SIRP a Security Orchestration, Automation and Response (SOAR) platform is launching a new security scoring module to provide vital context for security teams and allow them to prioritize risks.

Researchers at security vendor Check Point have revealed the identity and activities of a hacker whose seven-year career in cybercrime has earned him at least $100,000, and probably much more.

He's single, 25-years-old and living in Benin City, Southern Nigeria. His cybercrime activities have earned him, on average, at least 14 times the national minimum wage in Nigeria and three times the average professional salary in Nigeria every year since 2013.

Whenever there's any kind of major news story that sparks public interest it's usually good for cyber criminals as they seek to exploit people's fears for their own gains.

The latest coronavirus (COVID-19) pandemic is no exception. The UK's National Cyber Security Centre has identified a number of attacks on a COVID-19 theme, these include bogus emails with links claiming to have important updates, which once clicked on lead to devices being infected.

What gets CISOs out of bed in the morning is knowing that they are keeping their organizations safe, according to a new study from privileged access management company Thycotic.

The study of more than 550 IT security decision-makers globally finds being the 'business bodyguard' and the knowledge that they are keeping their organization safe is the top motivator (29 percent), closely followed by being the upholder of ethics (25 percent).

While we're all being encouraged to sing 'Happy Birthday' as we wash our hands to ward off the COVID-19 virus, you might like to know that you can sing it to the Dark Web, which turns 20 this month.

To mark the occasion digital risk management company Groupsense hasn't baked a cake but it has produced an infographic of the Dark Web's timeline.

Earlier this week, Microsoft inadvertently released details of a critical vulnerability in the SMBv3 protocol in Windows 10 and Windows Server. While there was no fix available at the time, the company did provide suggestions about how to mitigate against attacks.

With the information out in the wild, Microsoft was under pressure to get a patch released to customers -- and now it has managed to produce such a fix. KB4551762 is an emergency patch for the CVE-2020-0796 vulnerability, and users are advised to install it as soon as possible.

Open source components are the building bricks of many of today's software applications, but this puts them under increased scrutiny with regard to security.

Open source management specialist WhiteSource has released a new report which shows that disclosed open source software vulnerabilities in 2019 skyrocketed to over 6000, up almost 50 percent.

Just in case you weren't worried enough by the coronavirus, a new survey of almost 500 security professionals released today by Venafi reveals that 88 percent of them believe the world is in a permanent state of cyber war.

In addition 90 percent are concerned that the most significant damage will be inflicted on digital infrastructure with the most vulnerable industries being those that are undergoing rapid digital transformation and are essential to daily life.

Does the cybersecurity industry have an issue with gender bias? A new report from Tessian based on a survey of 200 female cybersecurity professionals in both the US and UK suggests that it does.

According to the results 82 percent of female cybersecurity professionals in the US believe that cybersecurity has a gender bias problem, compared with 49 percent of those in the UK.

Patch Tuesday is supposed to be the day Microsoft issues bug-fixing updates for Windows and other software, but this week things were a little different. In addition to the usual patches, the company also inadvertently revealed the existence of a critical vulnerability in the Microsoft Server Message Block 3.1.1 (SMBv3) protocol -- one for which there is currently no patch.

It seems that Microsoft had intended to issue a patch to the vulnerability (CVE-2020-0796) yesterday, and therefore referenced it in the introductory text for the Patch Tuesday release, but then changed its mind -- perhaps because the patch was not ready. Two cybersecurity firms also published brief details of the security flaw, and while Microsoft is still yet to issue a patch, the company has provided details of workarounds.

Even though there are many different tools now available, IT and security teams are increasingly losing touch with their asset base.

A new study from Enterprise Strategy Group, commissioned by asset management platform Axonius reveals that an ever-increasing number of end-user devices, rapid cloud adoption, and a growth in IoT devices are leading to increased complexity and risk and decreased visibility.

Both the NSA and a cybersecurity firm have reminded the tech world of the existence of a remote code execution vulnerability in Microsoft Exchange Server.

Although Microsoft issued a patch for CVE-2020-0688 last month, numerous state-sponsors hacking groups have been spotted exploiting the vulnerability. There was an uptick in exploitation after a technical report of the details of the vulnerability were published by a security researcher.