The telecommunications sector is the backbone of many processes in life and business and must improve its cybersecurity posture.
The post Cybersecurity Challenges in the Telecom Sector: Protecting Data and Infrastructure appeared first on Security Boulevard.
Companies are drowning in high-risk software security debt, with critical vulnerabilities festering for an average of 252 days before they’re fixed — long enough to turn your tech stack into a hacker’s swamp. The old-guard application security tools — like Static Application Security Testing (SAST) — are failing spectacularly, proving as effective as a paper umbrella in a hurricane. Enter Application Detection and Response (ADR) — the bold, real-time solution that doesn’t just spot threats but neutralizes them on the fly, keeping pace with today’s breakneck development cycles. While SAST is stuck in the past, ADR is the future: proactive, agile and built for the chaos of modern software. Clinging to outdated tools isn’t just risky — it’s a fast track to breach headlines. The choice is clear: Evolve to ADR or get left behind in the wreckage. Your move, tech world.
The post Cybersecurity Insights with Contrast CISO David Lindner | 03/14/25 appeared first on Security Boulevard.
APIs serve as essential links in today’s digital infrastructure, enabling data sharing and application integration. However, their widespread use has made them prime targets for attackers. Hence, strict compliance with security regulations is not just optional; it is imperative for business success.
The increasing frequency of data breaches and the sophistication of cyber threats highlight the pressing need for strong API security. Regulatory agencies globally are responding with stricter requirements, compelling organizations to reassess their security strategies.
Understanding the Regulatory Landscape:Simply meeting regulatory minimums is not enough; organizations should embrace a thorough and proactive approach to API security, which entails:
Failing to prioritize API security can have dire consequences. Data breaches may result in significant financial damage, reputational harm, and legal repercussions. In a connected digital landscape, even a single compromised API can lead to a series of detrimental outcomes for an organization.
Taking Decisive ActionOrganizations need to view API security as a fundamental business priority by:
Solutions like Salt Security can effectively aid in achieving these goals through comprehensive API discovery, threat protection, and posture management. Proactively investing in API security is key to mitigating risks and ensuring business continuity.
If you want to learn more about Salt and how we can help you on your API Security journey through discovery, posture governance, and run-time threat protection, please contact us, schedule a demo, or check out our website.
The post Beyond Checkboxes: The Essential Need for Robust API Compliance appeared first on Security Boulevard.
A devastating new remote code execution (RCE) vulnerability, CVE-2025-24813, is now actively exploited in the wild. Attackers need just one PUT API request to take over vulnerable Apache Tomcat servers. The exploit, originally published by a Chinese forum user iSee857, is already available online: CVE-2025-24813 PoC by iSee857. Exploit Breakdown: How a Simple PUT Request [...]
The post One PUT Request to Own Tomcat: CVE-2025-24813 RCE is in the Wild appeared first on Wallarm.
The post One PUT Request to Own Tomcat: CVE-2025-24813 RCE is in the Wild appeared first on Security Boulevard.
Cybersecurity failures are now business risks that CEOs and Boards must own. The world of business owners, investors, and their representatives are collectively realizing the potentially catastrophic impacts of cybersecurity incidents if not incorporated into the strategic management of the most senior business leadership. Many regulatory bodies, insurance providers, business partners, and customers take cybersecurity very seriously and now hold the CEO and Board accountable. As a result, the oversight of cybersecurity is being elevated to the CEO and Board of Directors.
The newfound importance has rapidly elevated the career trajectory of security leaders into the ranks of the C-suite. The adoption of the Chief Information Security Officer (CISO) role is now common in medium to large businesses, and these professionals have a growing amount of visibility to the CEO and senior staff. Boards too are now under pressure to include oversight of cybersecurity as part of their fiduciary duties. CISOs have become a focal point, being the leader and subject matter expert, often providing regular status reports and conversing directly with the Board. This was unheard of just a few years ago when many top information security leaders were no higher than the Director level, existing several layers removed from the CEO with limited influence.
Times change.
Newfound Connections Between the Board and CISOMost CISOs now have a regular audience with their respective Boards. For privately held companies, nearly 39% of CISOs provide reports to the Board of Directors quarterly, and 74% at least once a year. For Publicly traded companies, the numbers are even higher, with 89% providing a report at least once a year. Never has the CISO benefitted from such exposure to the Board as they do today. (Source: Hitch Partners 2024 report)
With that newfound engagement comes expectations. Boards feel the pressure to oversee cybersecurity in the same strategic manner they manage other business risks, operations, and long-term strategies. However, most Board members are not familiar with the chaotic, ambiguous, and non-linear world of cybersecurity. It seems like it would be relatively simple, but the deeper one goes, the more it is revealed to be atypical and unpredictable.
Given the potential stakes, it is common for Fear, Uncertainty, and Doubt (FUD) to run rampant at the most superficial level because value is difficult to estimate. Regular tools, such as Return On Investment calculators, don’t apply. Potential losses seem obscured somewhere between zero and utter destruction. It is not uncommon for cyber risk estimates to be orders of magnitude off. The metrics for investment, success, and optimization are not robust or mature for cybersecurity, as they are for other domains the Board oversees. Even the insurance industry cannot get an accurate grasp of cybersecurity. The result of this ambiguity is that every company and Board evaluates and measures cybersecurity differently. Understandably, it is an ugly mess that the Boards now feel burdened with.
New Challenges for Board OversightNormally, when faced with new challenges, the Board would simply enlist the assistance of an executive expert to help fill in the gaps, make recommendations, and provide answers to the myriad of deep questions from Board members. Unfortunately, that is not working very well today when Boards call upon the CISOs. This is because most CISOs grew up from the technical ranks and rose quickly into management positions, without the benefit of business leadership and communication skills. It is very common that CISOs find themselves unprepared to effectively convey pertinent information and collaborate well with the Board. They are experts at the technology aspects of attack prevention, detection, and remediation, but not corporate savvy to explain the relevance in business terms that the Board can embrace.
The combination of Board unfamiliarity with cybersecurity and the CISOs’ less than mature skills to convey cyber risk in terms of business relevance, creates a chasm where Boards feel deficient in their new responsibilities to oversee cybersecurity and CISOs realize they are ineffective at explaining the significance, value, and unpredictability inherent to managing cyber risks.
This chasm must be crossed in order to establish productive communication and effective collaboration. CISOs must grow to fill the elevated role, but at the same time, the Boards must evolve as well.
Boards must improve their ability to absorb critical cyber risk information to make good business decisions, establish optimized cybersecurity goals for the CISO based upon overall business strategies, and properly support the effort to achieve those objectives.
Envisioning Board NeedsTo set cybersecurity risk goals, decide on business risk tradeoffs, and be confidently accountable for the security of the organization, Boards need more than just information. They need a framework that paints an overlay to the business so opportunities and issues can be identified and strategies be pursued. Understanding cyber risk at this level is not about technology, telemetry, or security operations actions.
Instead, cybersecurity data must be transformed into business information with context on how cybersecurity may impact the core business or future plans. It must convey not only the risks but also the potential benefits of how cybersecurity can add additional value, improve competitive advantage, preserve important relationships, or contribute to the bottom line.
CEOs and Boards engage with CISOs in several ways:
CISO and Board Collaborative Objectives and Results — © Matthew Rosenquist Adapting to ChallengesBoth CISOs and the CEO/Board must work to close the gaps. A big challenge for any board is to understand the nuances of how cyber risk varies from other business risks. It must be handled with a different framework, that incorporates agility to counter adversaries who can operate without the burden of rules, in a highly chaotic and ambiguous environment, and with objectives that impact every aspect of the business. With the right framework, that has little requirement to understand technical details or operational minutia, Boards can adeptly incorporate cybersecurity into their normal business oversight processes with confidence.
The CISO Transformation — A Path to Business LeadershipAs I outlined in a previous article “The CISO Transformation — A Path to Business Leadership”, much of the onus rests with the CISO to better communicate and represent what the C-suite and Board needs. It is necessary that a transformation of the CISO occurs so they may better communicate to provide relevant and understandable guidance — thereby enabling collaborative organizational strategic planning, compliance, and enterprise risk management.
A Board must also adapt so it can successfully position itself to integrate cybersecurity factors into the greater business oversight and make well-informed decisions that represent the best course for the success of the organization. This includes being able to decide strategic tradeoffs and provide clear guidance for the CISO.
Success is a CEO and Board that are well attuned to the strategic business considerations so they may confidently represent the inclusion of cyber risks into the overall business risk picture at a level that aligns with their fiduciary responsibilities.
Guiding the CISO for SuccessCEOs and Boards have the highest level of accountability and the CISOs are expert functionaries to deliver to the cybersecurity business goals. By evolving in parallel, both Boards and CISOs can bridge the communication gap, enabling more strategic oversight of cyber risks. Boards that establish clear frameworks, adopt informed risk strategies, and support the CISO in delivering relevant insights will be better positioned to manage cybersecurity as a core element of business success. This collaborative evolution is essential for organizations to thrive amid a rapidly shifting cyber threat landscape.
The post Boards Challenged to Embrace Cybersecurity Oversight appeared first on Security Boulevard.
How Can Automated NHI Auditing Enhance Your Cybersecurity Strategy? Is your organization struggling with managing the ever-increasing volume of Non-Human Identities (NHIs) within your IT infrastructure? The NHI universe comprises machine identities created by combining a unique identifier or ‘Secret’ and the permissions granted to that Secret by a destination server. The challenge lies in […]
The post How can I integrate automated NHI auditing into our pipeline? appeared first on Entro.
The post How can I integrate automated NHI auditing into our pipeline? appeared first on Security Boulevard.
Why are Security Considerations Essential for Non-Human Identities Automation? The age of automation has dawned upon us. Automation carries the promise of immense business benefits, yet, it brings forth its own set of security challenges. For organizations heavily invested in leveraging Non-Human Identities (NHIs) for automation, how can these security considerations be comprehensively addressed and […]
The post What security considerations should I keep in mind for NHI automation? appeared first on Entro.
The post What security considerations should I keep in mind for NHI automation? appeared first on Security Boulevard.
Could API Automation Be The Missing Piece In Your NHI Management? One critical question stands out: Could the underutilized potential of API automation be the missing piece in your Non-Human Identities (NHI) management strategy? With the increasing complexity of cloud environments and the mounting demand for robust security measures, the answer is a resounding yes. […]
The post What role do APIs play in automating NHI management? appeared first on Entro.
The post What role do APIs play in automating NHI management? appeared first on Security Boulevard.
AI Copilots and Agentic AI (those capable of independently taking actions to achieve specified goals) remain the talk of the...
The post 5 Ways to Prepare Your Data Estate for Copilot Adoption and Agentic AI appeared first on Symmetry Systems.
The post 5 Ways to Prepare Your Data Estate for Copilot Adoption and Agentic AI appeared first on Security Boulevard.
AttackIQ has released a new assessment template in response to the CISA Advisory (AA25-071A) published on March 12, 2025, which details new behaviors exhibited by Medusa Ransomware.
The post Response to CISA Advisory (AA25-071A): #StopRansomware: Medusa Ransomware appeared first on AttackIQ.
The post Response to CISA Advisory (AA25-071A): #StopRansomware: Medusa Ransomware appeared first on Security Boulevard.
Author/Presenter: James Phillips
Our thanks to Bsides Exeter, and the Presenters/Authors for publishing their timely Bsides Exeter Conference content. All brought to you via the organizations YouTube channel.
The post BSides Exeter 2024 – Blue Track – DFIR – Are We There Yet? appeared first on Security Boulevard.
Cybersecurity risk affects every business. A single cyber incident, such as a data breach or ransomware attack, can disrupt operations, expose sensitive data, and create costly compliance issues. The challenge is knowing which risks pose the biggest threat to your organization.
The post What Is Cybersecurity Risk? A Guide to Protect Your Business appeared first on Security Boulevard.
Software vulnerabilities pose serious security and business risks. Writing secure code prevents these issues by integrating security into the development process. Instead of fixing vulnerabilities after deployment, developers apply secure coding practices from the start, reducing risk and building stronger, more resilient applications.
The post What Is Secure Coding? Best Practices and Techniques to Apply appeared first on Security Boulevard.
SafeBreach has added coverage against the Medusa ransomware variant, which has been used to target critical infrastructure organizations, demand ransom payment, and threaten to leak stolen data.
The post SafeBreach Coverage for US CERT AA25-071A (Medusa Ransomware) appeared first on SafeBreach.
The post SafeBreach Coverage for US CERT AA25-071A (Medusa Ransomware) appeared first on Security Boulevard.
2024 Enzoic AD Lite Password Auditor Report In an era where cyber threats continue to evolve, password security remains one of the most critical yet often overlooked components of an organization’s security posture. Enzoic’s 2024 AD Lite Password Auditor Report highlights the ongoing risks associated with compromised credentials in Active Directory (AD) environments, emphasizing the […]
The post AD Lite Password Auditor Report: Key Insights and Data appeared first on Security Boulevard.
Microsoft Threat Intelligence has issued new reporting about tactics being used by Silk Typhoon (also called APT27 or HAFNIUM by some researchers). Silk Typhoon is a Chinese espionage group, observed targeting Microsoft Exchange Servers in 2021, now reported to be targeting common IT solutions for initial access. Microsoft reports that Silk Typhoon exploits unpatched applications, […]
The post Silk Typhoon Targeting IT Supply Chains and Network Devices, Microsoft Reports appeared first on Eclypsium | Supply Chain Security for the Modern Enterprise.
The post Silk Typhoon Targeting IT Supply Chains and Network Devices, Microsoft Reports appeared first on Security Boulevard.
via the comic humor & dry wit of Randall Munroe, creator of XKCD
The post Randall Munroe’s XKCD ‘Water Damage’ appeared first on Security Boulevard.
With the deadline for PCI DSS 4.0 compliance just around the corner, it’s decision time for organizations. For many, compensating controls are a godsend, introducing a degree of flexibility into what is otherwise a rigorous, demanding and heavily detailed standard. But while this approach can be a useful means of temporarily meeting PCI DSS 4.0 requirements when technical or business constraints get in the way, it can be burdensome in the long term.
The post Moving Past Compensating Controls: The Long-Term Value of Tokenization for PCI DSS appeared first on Security Boulevard.
The water industry provides the drinking water and wastewater systems we all use every day. As such, it counts as a key piece of the nation’s critical infrastructure. But it is also in the crosshairs of a dangerous new wave of cyberattacks, originating from cyber criminals and hostile nation-states.
The post Cyberattacks on Water Facilities Are Growing | Aria Cybersecurity appeared first on Security Boulevard.
We had a good time talking to folks last week in our ColorTokens booth at the Healthcare Information and Management Systems Society conference in Las Vegas. The crowd was plentiful and engaged at the Venetian Convention Center and Ceasar’s Forum. Perhaps even more interesting than the keynote addresses and the latest-and-greatest information from the vendor […]
The post ICYMI: Interesting Things We Learned at the HIMSS 2025 Conference appeared first on ColorTokens.
The post ICYMI: Interesting Things We Learned at the HIMSS 2025 Conference appeared first on Security Boulevard.
