SMBs turn to MSPs to improve cybersecurity
A new survey of over 500 IT decision makers at small and medium businesses, from threat detection and response specialist Vade, shows 69 percent say a serious breach had bypassed their current email security solution.
It's perhaps not surprising then that SMBs are increasingly likely to turn to managed service providers, with 96 percent of organizations either currently outsourcing at least some of their needs to MSPs or planning to do so in the future.
HP Support Assistant DLL hijacking vulnerability could grant attackers privilege escalation
HP has issued a warning about a security issue with its HP Support Assistant software. Pre-installed on numerous HP systems, and included with the installation of various products from the company, HP Support Assistant has been found to have a privilege escalation vulnerability.
Tracked as CVE-2022-38395 and assigned a score of 8.2, the vulnerability is of high severity. The good news is that a fix is available.
Cisco releases a batch of patches for security vulnerabilities in numerous products including Cisco Small Business routers
While for many people September 7 meant finding out about the latest iPhone and Apple Watch, for Cisco it was the day on which it pushed out security patches for various medium- and high-severity vulnerabilities.
The company posted a series of advisory notices in its security center and released four patches for a variety of flaws. The patches address the high-severity CVE-2022-20696, a vulnerability in the binding configuration of Cisco SD-WAN vManage Software, as well as CVE-2022-28199, a flaw in the NVIDIA Data Plane Development Kit. There are also patches for two medium-severity flaws -- CVE-2022-20863, a vulnerability in the messaging interface of Cisco Webex App, and CVE-2022-2092, a vulnerability in the IPSec VPN Server authentication functionality of several Cisco Small Business routers.
Understanding threat detection methods [Q&A]
Detecting threats today isn't just about deciding which methods to use, but also which data. Endpoint server and workstation logs are a start, but major blind spots still exist unless threat detection visibility extends to network and cloud as well.
In order to be effective, security teams need to look at what data to use, what the science says can be done with the data, and what to expect. We spoke to Andrew Hollister, CISO at LogRhythm to find out more.
Security awareness training goes mainstream but still needs more work
Some form of cybersecurity awareness training has been implemented in 97 percent of enterprises this year, according to a new survey of 1,900 security professionals from ThriveDX.
However, only 42 percent report involving their employees in security detection with the use of such measures as a Phishing Incident Button, while 65 percent agree that their training program needs expansion.
Almost half of education institutions see attacks on their cloud infrastructure
A new study reveals that 47 percent of educational institutions have suffered a cyberattack on their cloud infrastructure within the last 12 months.
The research from Netwrix shows that for 27 percent of these incidents in the cloud were associated with unplanned expenses being incurred to fix security gaps.
Cloud servers are the most common way in for cyberattacks
New data unveiled by the Atlas VPN team shows that cloud servers are now the number one way in for cyberattacks on businesses, with 41 percent of companies reporting them as the first point of entry.
The data, based on the Cyber Readiness Report 2022 by insurer Hiscox, also shows a 10 percent increase in cloud server attacks over the year before.
Samsung warns of a security breach that gave hackers access to US customer data
Samsung has revealed limited details of a security incident that took place earlier in the year, exposing the personal data of customers in the US.
The technology giant says that the data breach took place back in July when "an unauthorized third party acquired information from some of Samsung's US systems". No details about who may have been responsible have been released, and Samsung has issued a warning for customers to exercise caution.
Update Chrome immediately -- Google releases emergency patch for serious security issue
Whether you are running Windows, macOS or a Linux distro, if you're a Chrome user there is an extremely important update to install right now.
Google has released Chrome 105.0.5195.102 for all three platforms to address the vulnerability which is tracked as CVE-2022-3075. The security flaw, which relates to data validation in the Mojo runtime libraries, is known to have been exploited in the wild, so users are advised to actively seek out the update rather than waiting for Google to roll it out to everyone.
Why we need to face up to the e-waste problem [Q&A]
A record 59.1 million tonnes (53.6 million tons) of e-waste was generated by homes and businesses in 2019, but only 17.4 percent of it was correctly recycled, the rest ending up in landfill or other disposal routes.
With the amount of e-waste expected to grow further, it's still the case that many people simply don't know where or how to properly recycle their obsolete devices.
Supply chain issues lead to mobile app vulnerabilities
A new study from Symantec's Threat Hunter team looks at how upstream supply chain issues can make their way into mobile apps, making them vulnerable.
Issues identified include mobile app developers unknowingly using vulnerable external software libraries and SDKs, as well as companies outsourcing the development of their mobile apps then ending up with vulnerabilities that put them at risk.
Thousands of Android apps leak hard-coded secrets
Thousands of Android apps have hard-coded secrets which means that a malicious actor -- and not necessarily a very skilled one -- could gain access to API keys, Google Storage buckets and unprotected databases and more.
Research from Cybernews shows that over half of 30,000 investigated apps are leaking secrets that could have huge repercussions for both app developers and their customers.
Enterprises increase their SaaS usage but neglect security risks
A new study of SaaS usage among enterprises across the US, UK and Europe shows 74 percent report more than half of their applications are now SaaS-based, and 66 percent are spending more on SaaS applications today than a year ago.
The study by cybersecurity asset management company Axonius shows the increase in SaaS applications has resulted in more complexity and increased security risk in 66 percent of organizations, but 60 percent rank SaaS security fourth or lower on their list of current security priorities, and only 34 percent say they're worried about the costs associated with rising SaaS-based app usage.
How decentralized storage can help prevent data breaches [Q&A]
According to a recent IBM report the average cost of a data breach is now $4.35 million. If enterprises don't take steps to protect personal data effectively they risk losing not just money but also the trust of their customers.
We spoke to Saswata Basu, founder and CEO of 0Chain, to discuss how decentralized storage can help to address the problem.
Google launches new Open Source Software Vulnerability Rewards Program (OSS VRP)
Google is not alone in offering so-called bug bounty programs which give financial incentives to contributors to track down vulnerabilities and security issues in its software. Now the company has launched a new initiative called the Open Source Software Vulnerability Rewards Program (OSS VRP).
As the name suggests, this new program focuses on Google's open source projects. The company is offering rewards of between $100 and $31,337, depending on the severity of the vulnerability.
Recent Headlines
Most Commented Stories
© 1998-2024 BetaNews, Inc. All Rights Reserved. Privacy Policy - Cookie Policy.