We’re looking at how DMARC adoption is shaping the email security landscape of colleges and universities in North America.
The post DMARC Adoption in U.S. and Canada Higher Education Sector appeared first on Security Boulevard.
As organizations increasingly adopt cloud-native technologies, securing Kubernetes infrastructure has become more important than ever. Cloud-native security encompasses practices and tools designed specifically to protect applications, data, and infrastructure in today’s ephemeral, distributed cloud environments. By aligning cloud native security practices with regulatory requirements, you can better ensure compliance, which is critical for organizations operating in industries such as finance and healthcare.
The post Cloud Native Security: How to Protect Your Kubernetes Infrastructure appeared first on Security Boulevard.
Authors/Presenters: Kris Rides, Silvia Lemos, Ricki Burke, Kirsten Renner
Our sincere appreciation to [BSidesLV][1], and the Presenters/Authors for publishing their erudite [Security BSidesLV24][2] content. Originating from the conference’s events located at the [Tuscany Suites & Casino][3]; and via the organizations [YouTube][4] channel.
The post BSidesLV24 – HireGround – What Goes Bump in the Night? Recruiter Panel About Job Search and Other Scary Things appeared first on Security Boulevard.
Hunters International, the RaaS group that some believe evolved from Hive, appears to be rebranding and shifting operations, moving away from an unprofitable and risky ransomware business and focusing solely on exfiltrating data and extorting victims, say Group-IB researchers.
The post Hunters International Dumps Ransomware, Goes Full-on Extortion appeared first on Security Boulevard.
If you’re part of the defense industrial base and you’re seeking CMMC certification, there’s a very good chance you’re aiming for Level 2. Level 1 is mostly meant for businesses with a focus on federal contract information but not CUI, while Level 3 is meant for businesses handling the most sensitive kinds of CUI; since […]
The post CMMC Level 2 Documentation: What Auditors Want to See appeared first on Security Boulevard.
Microsoft’s approach offers a compelling opportunity to secure AI, leverage AI-driven security tools and establish a self-reinforcing ecosystem where AI agents effectively collaborate within defined organizational boundaries
The post AI Security Got Complicated Fast. Here’s How Microsoft is Simplifying It appeared first on Security Boulevard.
Classic “wordplay:” Larry’s PR angels desperately dance on the head of a pin.
The post Oracle Hack: From ‘Deny-Deny-Deny’ to ‘Oops-Oops-Oops’ appeared first on Security Boulevard.
Security teams can now define application protection policies declaratively in Impart — with Cursor's agent executing them safely and autonomously, eliminating the need for tedious clickops.
Why This MattersApplication protection has traditionally been a necessary burden. Security engineers find themselves trapped in a cycle of managing brittle regex rules, wrestling with unwieldy WAF interfaces, and constantly troubleshooting policy misconfigurations that disrupt production.
This manual toil isn't just frustrating — it's a significant business risk that drains resources and creates vulnerabilities.
Our integration with Cursor transforms this landscape by offering declarative security policies that are autonomously executed at runtime, freeing your team to focus on strategic security initiatives rather than repetitive maintenance.
Why Now Is the TimeSecurity teams are increasingly strained, trying to secure complex, rapidly evolving application stacks while facing:
Impart + Cursor Agent delivers the solution these teams desperately need.
What Sets This Integration ApartIn a market saturated with automated and agentic detection tools, Impart stands alone as a comprehensive solution for automated and agentic application protection.
Impart + Cursor provides:
This isn't just detection and visibility — it's real time protection that operates independently in production environments.
What We've ReleasedWith this integration, you can now:
Security engineers now have the power to move quickly, maintain robust security, and escape the chaos of manual WAF operations once and for all.
Get Started TodayReady to experience what truly agentic application protection looks like?
Say goodbye to clickops. Say hello to autonomous protection.
The post Design, implement, and deploy application protection policies with Cursor Agent | Impart Security appeared first on Security Boulevard.
CISA, the FBI, and NSA issued an advisory about the national security threat posed by "fast flux," a technique used by threat actors to evade detection of their C2 infrastructures that has been around for two decades but has seen a resurgence in use by ransomware gangs and nation-state bad actors.
The post Longtime ‘Fast Flux’ Evasion Technique Now a National Security Threat appeared first on Security Boulevard.
Check out the security controls that SANS Institute says are essential for protecting your AI systems. Plus, the U.K. NCSC urges organizations to adopt newer API security techniques. In addition, CISA and other cyber agencies warn that attackers are using “fast flux” techniques to conceal their actions. And much more!
Dive into five things that are top of mind for the week ending April 4.
1 - SANS: Six critical controls for securing AI systemsHow do you protect the growing number of artificial intelligence (AI) systems your organization is gleefully deploying to improve business operations?
That’s a critical question cybersecurity teams grapple with every day. In an effort to help bring clarity to this issue, SANS Institute this week published draft guidelines for AI system security.
The “SANS Draft Critical AI Security Guidelines v1.1” document outlines these six key security control categories for mitigating AI systems' cyber risks.
“By prioritizing security and compliance, organizations can ensure their AI-driven innovations remain effective and safe in this complex, ever-evolving landscape,” the document reads.
In addition to the six critical security controls, SANS also offers advice for deploying AI models, recommending that organizations do it gradually and incrementally, starting with non-critical systems; that they establish a central AI governance board; and that they draft an AI incident response plan.
For more information about securing AI systems against cyberattacks, check out these Tenable resources:
Organizations must update their methods for securing their application programming interfaces (APIs), including by using stronger authentication.
So said the U.K. National Cyber Security Centre (NCSC) this week in a new guidance document titled “Securing HTTP-based APIs,” published in the wake of several high-profile API breaches.
“Strengthening API security should not simply be seen as a protective measure; it can also enable organisations to enhance agility, simplicity and productivity,” reads a companion NCSC blog titled “New guidance on securing HTTP-based APIs.”
Unfortunately, many organizations rely on outdated API-security practices, including:
NCSC offers detailed recommendations to boost the security of your HTTP-based APIs in areas including:
For example, NCSC recommends adopting strong authentication frameworks like OAuth 2.0 or token-based authentication. It also suggests doing a threat modeling analysis of your API design.
Another recommendation is to develop APIs’ applications in a secure development and delivery environment; and to use secure standards, such as JSON for data exchange and TLS cryptography for in-transit data.
For more information about API security:
Cyber attackers are leveraging a technique called “fast flux” to evade detection and conceal their actions, so critical infrastructure organizations, internet service providers and governments must prioritize addressing this critical threat.
The warning comes via a joint cybersecurity advisory issued this week by the governments of Australia, Canada, New Zealand and the U.S.
“Fast flux represents a persistent threat to network security, leveraging rapidly changing infrastructure to obfuscate malicious activity,” reads the advisory, titled “Fast Flux: A National Security Threat.”
“By implementing robust detection and mitigation strategies, organizations can significantly reduce their risk of compromise by fast flux-enabled threats,” the document adds.
A type of dynamic resolution technique, “fast flux” allows cyber criminals, nation-state actors and other cyber attackers to:
Governments, critical infrastructure organizations, ISPs, cybersecurity service providers and protective DNS service providers should take “a multi-layered approach to detection and mitigation to reduce risk of compromise by fast flux-enabled threats,” reads an alert from the U.S. Cybersecurity and Infrastructure Security Agency (CISA).
“Fast flux” mitigation recommendations include:
Agencies that co-authored this advisory include CISA, the U.S. Federal Bureau of Investigation (FBI), the Australian Cyber Security Centre, the Canadian Centre for Cyber Security and New Zealand’s Nation Cyber Security Centre.
For more information about the “fast flux” technique:
During a recent webinar about our Tenable Web Application Scanning product, we polled attendees about their API security practices, including API discovery and protection. Check out what they said.
(41 webinar attendees polled by Tenable, April 2025)
(38 webinar attendees polled by Tenable, April 2025)
To learn more about API security and about what’s new in Tenable Web Application Scanning, watch the webinar on demand.
5 - U.S. House looks at cybersecurity of local, state governmentsA U.S. House of Representatives subcommittee held a hearing this week about the ability of U.S. state, local, tribal and territorial (SLTT) governments to address rapidly-changing cyber threats.
Also discussed: The future of the “State and Local Cybersecurity Grant Program” (SLCGP), which was established in 2021 to help boost SLTT governments’ cybersecurity preparedness and which is set to expire in September.
“Cybersecurity is a whole-of-society challenge, meaning the Federal government must continue to support and strengthen cybersecurity at the state and local levels to protect our nation’s networks and critical infrastructure,” said Rep. Andrew Garbarino (R-NY), Chairman of the House Subcommittee on Cybersecurity and Infrastructure Protection.
Tenable Chief Security Officer Robert Huber was one of four experts who testified during the hearing, titled “Cybersecurity is Local, Too: Assessing the State and Local Cybersecurity Grant Program.”
Huber, who is also Tenable’s Head of Research and President of Tenable Public Sector, emphasized the importance of the SLCGP in strengthening cybersecurity and critical infrastructure, while recommending grant process improvements to increase participation.
Check out a few minutes of Huber’s participation in the hearing:
For more information about cybersecurity challenges of state and local governments:
The post Cybersecurity Snapshot: SANS Recommends Six Controls To Secure AI Systems, While NCSC Warns About Outdated API Security Methods appeared first on Security Boulevard.
Vulnerability assessment is a process that identifies security weaknesses of any IT system, network, application, or cloud environment. It is a proactive approach to detect and fix security gaps before...
The post The Ultimate Guide to Vulnerability Assessment appeared first on Strobes Security.
The post The Ultimate Guide to Vulnerability Assessment appeared first on Security Boulevard.
Q1 Goals to Gaps in Security: The Rise of HR-Themed Phishing
The post Q1 Goals to Gaps in Security: The Rise of HR-Themed Phishing appeared first on Security Boulevard.
Artificial Intelligence (AI) has quickly become an integral part of modern workflows, with AI-powered applications like copilots, chatbots, and large-scale language models streamlining automation, decision-making, and data processing. However, these same tools introduce significant security risks—often in ways organizations fail to anticipate.
The post The Fast Flux DNS Threat: A Call to Action Against a Geopolitical and Hacktivist Nightmare appeared first on Security Boulevard.
The post 5 Reasons to Secure Firmware in Financial Services Organizations appeared first on Eclypsium | Supply Chain Security for the Modern Enterprise.
The post 5 Reasons to Secure Firmware in Financial Services Organizations appeared first on Security Boulevard.
Are You Truly Equipped to Tame Secrets Sprawl? Managing secrets sprawl is no trifling matter. A significant challenge lying in the labyrinth of cloud security, secrets sprawl could pose a hefty risk to your organization’s data security. So, are you fully geared to combat this beast? Decoding Secrets Sprawl: An Invisible Threat Secrets sprawl refers […]
The post Are You Capable of Handling Secrets Sprawl? appeared first on Entro.
The post Are You Capable of Handling Secrets Sprawl? appeared first on Security Boulevard.
Why Should You Be Excited About Innovations in Identity and Access Management (IAM)? If you’re a Cybersecurity professional or CISO, you understand the value of Non-Human Identities (NHI) and Secrets Management. The burning question, then, is “Why should you be excited about innovations in IAM?” IAM, or Identity and Access Management, is a critical piece […]
The post Get Excited About Innovations in IAM appeared first on Entro.
The post Get Excited About Innovations in IAM appeared first on Security Boulevard.
Strengthened Cloud Compliance: Why Machine Identities Hold the Key? The importance of robust cybersecurity practices and tools cannot be overstressed. One area that demands particular attention is the management of Non-Human Identities (NHIs) and secret security, which is critical for ensuring the highest level of compliance assurance. Unraveling the Concept of Non-Human Identities and Secrets […]
The post Feel Assured with Enhanced Cloud Compliance appeared first on Entro.
The post Feel Assured with Enhanced Cloud Compliance appeared first on Security Boulevard.
See how a top retailer protected revenue and customer trust during a major spring sale — with faster checkouts and zero downtime.
The post How to Protect Your Spring Sale from Bots appeared first on Security Boulevard.
DataDome stopped a 28M-request Flash DDoS in real time—no downtime or disruption for the $3B e-commerce platform under attack.
The post How DataDome Instantly Blocked a 28M-Request Flash DDoS Attack For a $3B E-Commerce Leader appeared first on Security Boulevard.
Author/Presenter: Anthony Hendricks
Our sincere appreciation to BSidesLV, and the Presenters/Authors for publishing their erudite Security BSidesLV24 content. Originating from the conference’s events located at the Tuscany Suites & Casino; and via the organizations YouTube channel.
The post BSidesLV24 – HireGround – You Need a Jay-z and a Beyoncé: How Sponsors and Mentors Can Supercharge Your Career in Cybersecurity appeared first on Security Boulevard.
