Security Boulevard

We all know the feeling: the pit in your stomach when a critical application goes down (and you have no idea what went wrong). In today's always-on world, downtime isn't just inconvenient; it can be catastrophic to your reputation and even your business. So, how can you ensure your Kubernetes infrastructure is truly resilient? The answer might surprise you: test it with a Chaos Day.

The post Is Your Kubernetes Infrastructure Resilient? Test It with a Chaos Day appeared first on Security Boulevard.

The post How to Make Website Australian Privacy Principles Compliant appeared first on Feroot Security.

The post How to Make Website Australian Privacy Principles Compliant appeared first on Security Boulevard.

Cary, NC, Apr. 11, 2025, CyberNewswire — Defense contractors are facing increased pressure to meet the Department of Defense’s stringent Cybersecurity Maturity Model Certification (CMMC) 2.0 requirements ahead of 2025 compliance deadlines.

INE Security, a leading global provider … (more…)

The post News alert: INE Security highlights why hands-on labs can help accelerate CMMC 2.0 compliance first appeared on The Last Watchdog.

The post News alert: INE Security highlights why hands-on labs can help accelerate CMMC 2.0 compliance appeared first on Security Boulevard.

Author/Presenter: Allyn Stott

Our sincere appreciation to BSidesLV, and the Presenters/Authors for publishing their erudite Security BSidesLV24 content. Originating from the conference’s events located at the Tuscany Suites & Casino; and via the organizations YouTube channel.

Permalink

The post BSidesLV24 – Breaking Ground – The Fault In Our Metrics: Rethinking How We Measure Detection & Response appeared first on Security Boulevard.

If it feels like your entire cybersecurity program is once again operating on a geopolitical fault line, you're not imagining things.

The intersection of global politics and cybersecurity has grown a whole lot messier — and more consequential — in recent weeks. With the current U.S. Administration turning up the heat on China through aggressive tariffs and foreign policy pressure, the ripple effects on cybersecurity are no longer hypothetical. They’re here. And they’re accelerating.

Trade wars mean cyber wars

Let’s start with the obvious: the U.S.-China trade war. After the administration slapped 145% tariffs on key Chinese imports, Beijing didn’t just fume — they likely leveraged their extensive access to our infrastructure. Literally. According to a recent Wall Street Journal report, Chinese officials quietly acknowledged involvement in attacks on U.S. critical infrastructure. The message? Cyber is the battlefield.

Cybersecurity advisor and author Tom Kellermann has said that attacks by the Chinese state-backed Salt Typhoon and Volt Typhoon operations have enabled infiltration of U.S. critical infrastructure. These intrusions could be leveraged today for intelligence in these times of escalating tensions as well as tomorrow for more destructive attacks if relations truly deteriorate. 

And increases in cyber activity exploiting U.S. tariff policies have been noted by BforeAI CEO Luigi Lenguito in the last few weeks, with criminals already engaging in invoice fraud and other scams involving shipping company impersonation.

This isn’t just state-on-state stuff. The private sector is feeling the pressure. A growing number of threat analysts are flagging a rise in industrial espionage and IP theft attempts, particularly targeting sectors tied to strategic national interests — energy, tech and semiconductors.

The private sector is carrying more of the cyber defense load

With the federal government currently reevaluating roles, budgets and security clearances across key cybersecurity agencies, more of the frontline burden is shifting to the private sector. This transition is happening just as geopolitical tensions are driving up the volume and sophistication of attacks.

Critical industries — like energy, finance, healthcare and manufacturing — are increasingly being targeted by state-aligned threat actors. These organizations are expected to maintain operational readiness, detect threats, and respond quickly.

For cybersecurity professionals, this shift means greater responsibility, higher stakes and a growing need for clarity around real risk. Now more than ever, visibility and proactive defense strategies are essential. Preventing an attack is so much more important, and actually cheaper, than cleaning up in the aftermath.

Your vendors are feeling it, too

The entire security ecosystem is absorbing the shockwaves from rapidly changing economic policy. Tariffs on Chinese-made chips and components are complicating hardware supply chains and raising costs across the board. Some cybersecurity vendors are bracing for delays and price hikes, which could mean you’re waiting longer (and paying more) for upgrades to critical infrastructure.

And yet — despite all of this — some U.S. companies are doubling down on their ties with China. A recent survey conducted by the U.S. Chamber of Commerce found that 70% of firms who responded plan to maintain or even increase engagement.

What you should be watching (and doing)

So, what does this mean for those of us on the front lines of cyber defense? Here are some recommendations for moving forward in these conflicted times:

• Build geopolitical risk into your threat models. These tensions aren’t going away — they’re now part of the everyday threat landscape.
• Pressure-test your supply chain visibility. Tariff-driven changes could leave you exposed to unvetted tech or delays that weaken your defenses.
• Track policy shifts like you would threat intel. What’s happening in Washington and abroad is directly shaping your risk profile. Avoid operational paralysis associated with government changes and instead double down on security to thwart learned helplessness.
• Advocate for the resources you need. If your leadership is second-guessing security investments, the headlines are your best argument.
• Routinely assess your posture management. The threat from both nation-state and cybercriminals will only increase over the next six to 12 months. Periodically measure your exposure to attack using a proven cybersecurity framework and tooling that measures compliance to the listed security controls.
• Take a proactive stance. Don’t wait for an alert to tell you something’s wrong. Implement an exposure management program to help you understand your real risk before attackers do, so you can take action before exposures become breaches.

Cybersecurity efforts are often reactive — teams scramble to respond to new cyber threats as they arise. In today’s world, reactive security is not only inadequate; it’s irresponsible, and it puts national security at risk. A proactive approach is what’s needed in these turbulent times. One in which organizations use accurate assessment of real-world risks to address the most critical vulnerabilities, misconfigurations and overprivileged identities before they can be used in an attack. The more unstable the geopolitical climate, the more essential it is to proactively reduce your organization’s exposure and bolster its proactive defenses.

The post Geopolitics Just Cranked Up Your Threat Model, Again. Here’s What Cyber Pros Need to Know appeared first on Security Boulevard.

Microsoft a year ago was about to launch Recall, a Windows feature for Copilot+ PCs that takes regular screenshots of users' systems and stores them so they can be searched for later. Privacy and security concerns forced the company to pull it back and rework it. Now it is in preview with Windows Insiders.

The post Microsoft Moves Forward With Controversial Recall Feature appeared first on Security Boulevard.

A high severity vulnerability in DICOM, the healthcare industry’s standard file protocol for medical imaging, has remained exploitable years after its initial disclosure. The flaw enables attackers to embed malicious code within legitimate medical image files. While previous research demonstrated this vulnerability’s impact on Windows-based medical systems, Praetorian’s new proof of concept, ELFDICOM, extends the […]

The post ELFDICOM: PoC Malware Polyglot Exploiting Linux-Based Medical Devices appeared first on Praetorian.

The post ELFDICOM: PoC Malware Polyglot Exploiting Linux-Based Medical Devices appeared first on Security Boulevard.

Cyber-Physical Systems (CPS) are no longer the stuff of science fiction; they are woven into the fabric of our daily lives, organizations, and critical infrastructure. From smart grids managing our power to the connected cars we drive and the automated systems in our factories, CPS offers incredible benefits. But with great power comes great responsibility […]

The post Navigating New Cyber-Physical System Security Regulations appeared first on Viakoo, Inc.

The post Navigating New Cyber-Physical System Security Regulations appeared first on Security Boulevard.

Authors/Presenters: Oreen Livni Shein, Elad Pticha

Our sincere appreciation to BSidesLV, and the Presenters/Authors for publishing their erudite Security BSidesLV24 content. Originating from the conference’s events located at the Tuscany Suites & Casino; and via the organizations YouTube channel.

Permalink

The post BSidesLV24 – Breaking Ground – Redis Or Not: Argo CD & GitOps From An Attacker’s Perspective appeared first on Security Boulevard.

Redundancy in secrets management introduces risks, as well as operational complexity, ultimately undermining overall security maturity.

The post A Security Leader’s Perspective on The Real Business Risks of Secrets Managers Redundancy appeared first on Security Boulevard.

At the start of this year, IRONSCALES launched an integration with CrowdStrike Falcon® Next-Gen SIEM, delivering enhanced threat visibility, detection, and correlation to help organizations combat phishing and account takeover (ATO) threats. This integration reflects our shared commitment to simplifying and strengthening cross-domain security—including email security—as a critical part of modern cyber defense.

The post Seeing the Big Picture in Phishing Defense: IRONSCALES & CrowdStrike appeared first on Security Boulevard.

Imagine that all of us—all of society—have landed on some alien planet and need to form a government: clean slate. We do not have any legacy systems from the United States or any other country. We do not have any special or unique interests to perturb our thinking. How would we govern ourselves? It is unlikely that we would use the systems we have today. Modern representative democracy was the best form of government that eighteenth-century technology could invent. The twenty-first century is very different: scientifically, technically, and philosophically. For example, eighteenth-century democracy was designed under the assumption that travel and communications were both hard...

The post Reimagining Democracy appeared first on Security Boulevard.

The post Agentic AI & Cybersecurity: A Powerful Partnership appeared first on AI Security Automation.

The post Agentic AI & Cybersecurity: A Powerful Partnership appeared first on Security Boulevard.

President Trump stripped former CISA head Chris Krebs of his security clearances, accusing him of disloyalty for claiming the 2020 election was safe and disagreeing with him regarding the pandemic. SentinelOne, where Krebs is an executive, also was targeted by Trump, who further ordered investigations of Krebs and CISA.

The post Trump Strips Security Clearances of Ex-CISA Head Krebs, SentinelOne appeared first on Security Boulevard.

Are You Overlooking an Essential Part of Your Cybersecurity Strategy? When it comes to solidifying your organization’s cybersecurity strategies, an often-overlooked aspect is Non-Human Identities (NHIs). Given the increasing reliance on the cloud for business operations across a multitude of industries and departments, managing NHIs effectively is crucial for stable and secure operations. The Indispensable […]

The post Ensuring Stability in Your NHI Security Strategy appeared first on Entro.

The post Ensuring Stability in Your NHI Security Strategy appeared first on Security Boulevard.

What Makes Secrets Vaulting Essential for Modern Business Security? Non-human identities (NHIs) and secrets management play a critical role in safeguarding sensitive data. NHIs, or machine identities, are created by combining a unique encrypted password, key, or token (the “Secret”) with permissions granted by a destination server. But why is managing these NHIs and their […]

The post Smart Secrets Vaulting Solutions for Modern Businesses appeared first on Entro.

The post Smart Secrets Vaulting Solutions for Modern Businesses appeared first on Security Boulevard.

The emergence of Model Context Protocol for AI is gaining significant interest due to its standardization of connecting external data sources to large language models (LLMs). While these updates are good news for AI developers, they raise some security concerns. In this blog we address FAQs about MCP.

Background

Tenable Research has compiled this blog to answer Frequently Asked Questions (FAQ) regarding Model Context Protocol (MCP).

FAQ

What is Model Context Protocol (MCP)?

Model Context Protocol (MCP) is an open-source standard created by Anthropic that provides a universal method to connect external data and actions to large language models (LLMs). It provides the methods to allow an LLM to detect what resources it has at its disposal, and understand when and why it would use those resources to answer or enhance the task it is working on.

Examples of external data that an AI could access include local file systems, databases, APIs, SaaS applications and more.

In a way, the MCP allows an LLM to provide a deterministic request of data or actions to assist in answering questions with data outside of its training.

MCP is quickly becoming a standard that many AI companies are implementing.

Why is there so much interest in MCP?

MCP is gaining significant interest due to its standardization of connecting external data sources to LLMs. A developer can now write an integration for an LLM once and use it across a variety of tools and LLMs that utilize MCP. "App stores" and "marketplaces" of MCP servers are available for quick integration into your environment. Services to help create custom MCP servers specifically for you are available.

Is this the first time LLMs could interact with external data and sources?

Agentic AI, which has the capacity to act autonomously, can take actions and work with external sources, but implementation is unique to each tool. Solutions like LangFlow help by standardizing some of the tooling and can interact with multiple LLMs within its specific framework. However, the MCP specification takes this standardization to the next level, where an integration can be created and used across multiple solutions.

How do I get started working with MCP?

MCP requires a host application, colloquially called a client and a server. The host application orchestrates communication between an LLM and the interfaces that communicate with the MCP servers.

The foundational example is using Claude Desktop to add a filesystem MCP server, as outlined at Quickstart for Claude Desktop Users. This example shows what it takes to add a filesystem server to Claude Desktop to provide local filesystem information to Claude.ai. While Claude Desktop is the proving ground for MCP servers, many other clients exist that improve the user experience.

Online directories of MCP clients and servers are becoming available, such as MCP Clients | Glama and Open-Source MCP Servers | Glama.

How does MCP work?

MCP uses a client/server architecture to allow LLMs to interact with external data. This is accomplished using three primary components; host, client and server.

• A host application is used to manage the interaction between LLMs and a number of MCP clients. Many popular MCP hosts include Claude Desktop, Claude Code, Cursor, Windsurf, and editor integrations like Cline and Continue.
• The client is an interface that runs in the host application and allows the LLM to interact with the server by maintaining a one-to-one connection with a server.
• The server is a small application that communicates with the client using the MCP protocol, and provides standardized processes to list various capabilities as well as responds to requests for relevant data or actions.

Source: Tenable, April 2025

While these components are discussed as separate components, they can be a part of a single application or separate applications. The most common configuration seen at time of publishing this FAQ consists of the client integrated into the host application and communicating to the server over secure transports using JSON-RPC.

What type of capabilities do MCP servers offer?

MCP servers offer different capabilities to clients to support the retrieval of data along with actions taken on data. The following capabilities are available:

• Resources are data stores available for the LLM to keep track of. These can include files, database schema information and console logs. Resources are loaded at time of a chat initiation and should be used to avoid repeated requests of static data.
• Tools take actions. Examples include retrieving content from files, inserting data into a database, replying to emails and more.
• Prompts allow the server to provide useful and reusable prompts to the client. Many implementations of the application hosts allow methods to list the prompts using a "quick list" concept, such as hitting a "/" key to bring up a list of prompts that are available. The prompts can also be used as templates that can be dynamically populated with user inputs.

Currently, "tools" are the most impactful capability offered by MCP and what garners much of the media's attention.

Is it safe for me to use MCP servers?

MCP relies heavily on trust.

• Trust that the host application is controlling access to the clients
• Trust that the client is using secured transports with the server
• Trust that the server has implemented secure practices when it is accessing resources

Users should seek out MCP servers from reputable sources. However, always remember to "trust but verify," and do not install unknown software in your environment.

How does the MCP host implement security?

The host application should implement controls that allow the user of the application to approve tools prior to using them. Many of the mainstream applications already have methods to verify that the tool usage is acceptable. For example, on the first time attempting to call the tool, Claude Desktop provides a choice of "use once" or "use for the entire chat session." Other applications, like Cline, may have a method to "auto approve" different tools or applications. The amount of information provided to the user in these verification dialogs can vary.

What controls are available for transport security?

There are two primary transports; STDIO and Server Sent Events (SSE).

• When the client and server exist on the same computer, STDIO is the preferred transport. STDIO sends the output of the client straight to the input of the server and the output of the server to the client. The transport can only be attacked if the local system is compromised.
• When the client and server do not exist on the same computer then SSE is used to transport the JSON messages over HTTP connections. This allows the communication to use standard HTTP security options, such as SSL transports and Open Authentication (OAuth) authorization.

Ok, so what are the biggest risks to using MCP?

The biggest risk to using MCP is the injection of malicious servers. Since all registered servers have a single point of reference in the host application and LLM, malicious servers can poison the LLM or abuse the tools of other legitimate servers. As the MCP ecosystem matures we expect to see formalization of concepts like MCP security certification, server integrity monitoring and standardization of logging for monitoring. We will begin to see MCP “App Stores” where collections of MCP servers can be easily pulled into existing tools from a central repository.

The specification for MCP highly recommends authentication and authorization for remote servers, but it is not required. However, developers of MCP servers may not consider the network security of the MCP servers and not implement these recommendations.

Any MCP servers that are remotely accessible can be susceptible to man in the middle attacks or remote attacks. Make sure any MCP servers that use a network based transport have implemented strong authentication and authorization.

What can I do to protect my information while using MCP?

As the technical solutions and capabilities for securing MCP solutions evolve the current recommendations are to use solid cybersecurity best practices. Some of the top things that you can do include the following:

• Detect and inventory your MCP installations and configurations across your environment. With MCP being in early adoption, this is not as simple as monitoring a centralized server, but more likely requires close inspection of endpoints for configuration files. Knowledge and approval of MCP usage is key to maintaining integrity in the environment.
• Control access and monitor the resources that MCP servers are accessing. Whether the resources are local to the endpoints or SaaS applications, monitoring the access of these resources through logging and auditing is a requirement.
• Train the people that are using MCP in their job duties. Make sure they understand the impact of a tool before authorizing its use. The core topics of the MCP specification is that the user must consent and authorize operations before use, and training will provide the understanding required to make that determination.

Is Tenable looking into safety and security concerns surrounding MCP implementations?

Yes, Tenable Research is actively researching MCPs and will be sharing more of our findings in future publications on the Tenable blog.

Get more information

• Anthropic: Introducing the Model Context Protocol

The post Frequently Asked Questions About Model Context Protocol (MCP) and Integrating with AI for Agentic Applications appeared first on Security Boulevard.

In the current economic environment, IT and security leaders face significant challenges. Budget optimization and prioritizing initiatives that provide real business value are crucial, particularly amidst a growingly complex and threatening threat landscape. This pressure is especially pronounced when it comes to securing the APIs essential for modern applications and linking vital data.

APIs serve as the foundation of digital innovation, yet their swift expansion results in an extensive attack surface. Development teams often operate rapidly, occasionally sidestepping standard security evaluations, leading to undocumented shadow APIs and outdated zombie APIs hiding within your environment. The task of manually identifying these APIs, ensuring compliance, and defending against sophisticated attacks can seem daunting, especially with limited resources. How can you improve security and manage costs simultaneously?

Bridging the Gap: Security and Efficiency Can Coexist

What if compromise was unnecessary? Imagine having complete visibility into your entire API ecosystem, proactively tackling threats, and streamlining security operations without increasing operational expenses.

That’s where Salt Security steps in. We recognize your challenges, and our platform is crafted to assist security and development teams in maximizing efficiency while achieving solid API security without incurring additional operational costs.

How Salt Security Empowers Your Teams:

• See Everything instantly: Eliminate the struggles of manual discovery. Salt offers Complete API Visibility, automatically identifying all your APIs, including those hidden shadow and zombie versions. Understand your entire attack surface thoroughly.
• Automate Compliance: Maintain continuous compliance with automated posture rules and real-time monitoring. Focus less on manual audits and more on strategic priorities.
• Stop Threats Sooner, Respond Faster: Why delay in the event of an attack? Salt enables preemptive threat prevention by recognizing and assisting in blocking vulnerabilities before they go into production. If an incident happens, quick detection significantly shortens MTTD/MTTR (Mean Time To Detect/Respond), reducing impact and conserving valuable security resources.
• Streamline Your DevSecOps Workflow: Salt integrates seamlessly with your development practices. Automate the generation of API documentation (Swagger/OpenAPI), detect vulnerabilities early through CI/CD pipeline integration, enforce policies automatically to prevent risky deployments, and automate security triage for quicker issue resolution. Less friction leads to more productivity.
• Protect Your Brand (and Budget): It’s crucial to safeguard essential data and your organization's reputation. Salt aids in achieving that goal effectively while showing fiscal responsibility.

Smart Security Meets Smart Procurement

Are you concerned about complicated procurement cycles or identifying new budget lines? We've simplified that process too. Salt Security is available directly through AWS, Azure, and GCP Marketplaces, enabling you to use your existing cloud budgets and streamline purchasing. It’s about optimizing your previous investments.

Don't Compromise on API Security

In an era that demands fiscal wisdom, skimping on API security is not an option—the risks are simply too great. With Salt Security, you can safeguard your APIs, reduce costs, and empower your teams to concentrate on innovation, even with tight resources. Secure your essential projects and uphold robust API security without straining your finances.

Ready to discover how you can decrease costs while enhancing your API security and compliance posture?

If you want to learn more about Salt and how we can help you on your API Security journey through discovery, posture governance, and run-time threat protection, please contact us, schedule a demo, or check out our website.

The post Unlock Total API Visibility and Control, Cost-Effectively appeared first on Security Boulevard.

Learn how to stop enumeration fraud before Visa’s new thresholds take effect. Protect your business with DataDome’s Cyberfraud Protection Platform.

The post How to Decrease Your Enumeration Fraud Before Visa’s New Rules Take Effect appeared first on Security Boulevard.

Introduction A critical security vulnerability, identified as CVE-2025-31161 (previously tracked as CVE-2025-2825), has been discovered in CrushFTP versions 10.0.0 through 10.8.3 and 11.0.0 through 11.3.0. This flaw allows unauthenticated remote attackers to access unpatched CrushFTP servers if they’re publicly exposed over HTTP(S). The vulnerability has been actively exploited since March 2025, underscoring the urgency for […]

The post Imperva Customers Are Protected Against CVE-2025-31161 in CrushFTP  appeared first on Blog.

The post Imperva Customers Are Protected Against CVE-2025-31161 in CrushFTP  appeared first on Security Boulevard.