Businesses continue to struggle with app security
Threats to web, mobile and API-based apps are developing rapidly and the average time taken to fix them isn't improving, with critical vulnerabilities remaining open on average for 202 days.
NTT Application Security has released its latest AppSec Stats Flash report looking at the current state of application security and the wider threat landscape. It finds the utilities sector the worst, with with 66 percent of applications in the industry having at least one serious exploitable vulnerability throughout the year.
IT leaders think remote workers are more at risk but struggle to protect them
A new survey of enterprise IT security leaders shows almost 80 percent believe remote workers are at more risk from phishing attacks now because they're isolated from their organizations' security teams.
The study from Egress also reveals that more than 59 percent of respondents feel solutions such as video training (27 percent), email reminders (20 percent), and VPNs (12 percent), are sufficient by themselves to keep organizations safe from the biggest security breach fears: damage to brand and reputation, and legal jeopardy.
What to do after a ransomware attack [Q&A]
Ransomware is a major problem and ideally while you'd like to avoid being attacked, the chances are that at some point you're going to be a target.
So, what happens following an attack and what should organizations be doing immediately afterwards to lessen the impact? We spoke to Ed Williams, EMEA director of SpiderLabs at Trustwave, to find out and to get some tips on how to proactively secure against ransomware attacks in future.
Kaspersky warns about the potential dangers of downloading Windows 11
As with any big-name software that is yet to be officially released, there is not only great enthusiasm about Windows 11, but also a rush to get hold of it by any means possible. While there are formal channels through which to obtain Windows 11 legitimately in order to test it out, scammers are taking advantage of the excitement surrounding the new operating system.
Security firm Kaspersky has issued a warning for anyone thinking about downloading Windows 11. The company urges caution lest users find their system infected with malware and adware, particularly in the light of a 1.75GB file that is currentlyu in circulation called 86307_windows 11 build 21996.1 x64 + activator.exe.
Security: 2FA adoption is incredibly low with Twitter users
In a recently published transparency report, Twitter has revealed figures that show a disappointing adoption of 2FA (two-factor authentication) by users.
While the number of users choosing to secure their account with 2FA is on the increase, it "remains relatively low", says Twitter. And we are talking low numbers here -- a mere 2.3 percent of the Twitter userbase is concerned enough about security to enable two-factor authentication.
Enterprise endpoint protection needs to move to zero trust
As enterprise boundaries have become more flexible, older authentication models of security have begun to look increasingly outmoded.
A new survey of 150 IT security decision makers carried out by ThycoticCentrify finds that 71 percent of contributors agree that a distributed workforce makes a zero trust security strategy even more critical.
Cyber attacks on council workers increase over 200 percent
Local councils have faced the same pressure as commercial businesses to have people working at home during the pandemic. But a new report shows attacks on UK councils' remote workers rose by 213 percent from March 2020 compared to the previous year.
Freedom of Information (FOI) requests made by technology solutions provider Insight, show that on average councils switched 74 percent of their employees -- more than double the UK average -- to remote working during the pandemic.
Universal decryptor now available for REvil ransomware
It is now almost three weeks since the gigantic ransomware attack that exploited a vulnerability in Kaseya VSA remote management software. The attack affected millions of devices and the group behind it, REvil, had been demanding a $70 million ransom.
There had been great concern about the fall out from the attack due to the apparent disappearance of REvil which made it impossible for anyone willing to pay the ransom to do so. Now a universal decryption key has been obtained from a "trusted third party", giving victims the chance to regain access to their data without the need to part with any money.
Why have we failed and what do we need to do?
In watching the most recent high profile, and very costly breaches, I’ve begun to ask the question "Why have we failed and what do we need to do?" We’ve failed. As I enter the twilight of my career in our industry, we haven’t gotten better -- breaches are more expensive, they’re more difficult to remediate, the economic destruction is real, and people get hurt or die as a result of cybersecurity breaches. Why? Where did we go wrong, and what do we need to do to fix it?
The first question I asked myself is, "What do we do well?" We’re an industry of incredibly talented people. Over the years, we’ve learned to collaborate and share information (which, we didn’t start off doing), and we have no shortage of tools. Our tool chest is loaded to the gills with capability. We also have boards and executives who are more cyber savvy than ever before. When I started in our industry over two decades ago, I couldn’t explain to a board what cybersecurity was with a PowerPoint presentation. Now, they’re all concerned about the issue and paying attention.
36 percent of organizations have suffered a serious cloud breach in the last year
A new survey of 300 cloud professionals finds that 36 percent of organizations have suffered a serious cloud security data leak or a breach in the past 12 months.
The study conducted by security and compliance automation firm Fugue and developer tools company Sonatype finds eight out of ten are worried that they're vulnerable to a major data breach related to cloud misconfiguration.
97 percent don't recognize the security limitations of containers
A new study finds that only three percent of respondents recognize that a container, in and of itself, is not a security boundary, suggesting that the default security capabilities of containers are overestimated.
The survey, from cloud security company Aqua Security of 150 cloud native security practitioners and executives from IT, Security and DevOps teams, across sectors and geographies, also shows that only 24 percent of respondents have plans in place to deploy the necessary building blocks for runtime security.
Over half of exploits sold on underground forums are for Microsoft products
A new study from Atlas VPN shows that 51 percent of exploits sold on underground cybercriminal forums are for Microsoft products.
Microsoft Office exploits make up 23 percent while Windows accounts for 12 percent of exploits sold on hacker forums. Remote Desktop Protocol (RDP) exploits make up 10 percent, with Internet Explorer and Share Point taking three percent each.
Researchers discover high-severity, 16-year-old flaw in drivers for millions of HP, Samsung and Xerox printers
Security researchers from SentinelOne have uncovered an ancient vulnerability in the drivers used by printers from three big manufacturers.
The high-severity security vulnerability -- which is being tracked as CVE-2021-3438 -- affects drivers for HP, Samsung and Xerox printers and has evaded detected for 16 years. In all, around 400 printer models are at risk, leaving millions of printers exposed to the danger of the serious privilege escalation vulnerability.
Sequoia: Linux kernel security flaw gives unprivileged users root access
A vulnerability has been discovered in the Linux kernel that makes it possible to gain root access on a number of popular distributions, including Ubuntu, Debian and Fedora. The flaw has been named Sequoia, and it exists in the filesystem layer.
The security issue is thought to affect all versions of the Linux kernel released since 2014, meaning that a large number of distros are vulnerable. Specifically, the flaw is a size_t-to-int type conversion vulnerability that can be exploited to elevate privileges.
Critical vulnerabilities found in cloud-based ICS management systems
There are lots of good reasons for moving industrial control systems to the cloud including better telemetry and analysis of device performance, management of logic and remote device configuration, improved diagnostics and troubleshooting, a centralized view of processes.
But as more operational technology and lCS make the move, they become increasingly vulnerable to threats. ICS security specialist Claroty has unveiled its new Team82 research arm along with a report on critical vulnerabilities found in cloud-based management platforms for ICS.
© 1998-2025 BetaNews, Inc. All Rights Reserved. About Us - Privacy Policy - Cookie Policy - Sitemap.