Security Boulevard

Insight No. 1: Stop patching the CVE dumpster fire with Vulnrichment

It's time to integrate the crucial data — Common Vulnerability Scoring System (CVSS) scores and other crucial information  — from CISA's Vulnrichment program directly into the NVD. Centralize, streamline, and then focus on what really matters: runtime analysis of your applications.

Insight No. 2: Zero days don't give a damn about your CVE backlog

Assume there’s been a breach, ditch the outdated tools, and get proactive with deep visibility and context-aware detection. Detect and block attacks before they even know what hit them.

Insight No. 3: Volunteers are noble, but they won't save us from the cyber apocalypse

Cybersecurity needs serious investment, not just spare time and good intentions. Time to step up with government funding, private sector muscle and global collaboration.

The post Cybersecurity Insights with Contrast CISO David Lindner | 12/13/24 appeared first on Security Boulevard.

In today’s interconnected digital ecosystems, traditional security mechanisms like Web Application Firewalls (WAFs), API gateways, and Content Delivery Networks (CDNs) act as enforcement points. Think of them as bouncers at the entrance of a high-profile nightclub—they decide who gets in and who doesn’t. However, relying solely on these edge solutions to secure APIs is like assuming a bouncer can stop someone sneaking in through a side door or an open window.

Here are three real-world reasons why API security cannot be fully addressed at the edge:

1. API Discovery is Limited at the Edge

Edge solutions, like API gateways, can uncover some APIs, but their discovery capabilities are inherently limited. The real challenge lies in identifying rogue APIs—those shadow endpoints that developers deploy directly into production, bypassing gateways, CDNs, and WAFs.

Example: Imagine a company launches a mobile app in a rush to meet a product deadline. A developer quickly creates a new API for a feature and deploys it without following standard procedures. This API doesn’t pass through the gateway, making it invisible to edge tools. It’s like leaving a side window open in your house and assuming burglars won’t notice.

Edge solutions only see traffic passing through them. They miss APIs that are hidden, misconfigured, or directly exposed, creating blind spots. Without a solution that digs deeper, like a neighborhood watch keeping an eye on every entry point, organizations remain vulnerable to unmonitored risks.

2. Third-Party API Consumption Happens Beyond the Edge

Modern applications increasingly rely on third-party APIs, from payment processors like Stripe to AI-powered tools like ChatGPT. These APIs often operate outside the reach of edge solutions, as communication between internal workloads and third-party services bypasses the edge entirely.

Example: A logistics app might use a third-party API to calculate shipping rates. If this API mishandles sensitive data—like accidentally logging user payment information—the company might never know because the data flow happens directly between internal servers and the external API, avoiding the edge entirely.

Without visibility inside your infrastructure, these interactions are like sending sensitive documents by courier and assuming the delivery process is secure, despite having no insight into who might intercept it. Protecting against third-party API risks requires monitoring within your application environment, not just at the perimeter.

3. Edge Solutions Lack the "Brain" for Sophisticated Detection

Edge tools prioritize speed. Positioned in critical paths, every millisecond counts, so they excel at quick rule-based detections but lack the depth for context-aware analysis. This is like asking a tollbooth operator to spot counterfeit money—they’re focused on speed, not forensic examination.

Example: One of the most common API vulnerabilities, Broken Object Level Authorization (BOLA), requires analyzing user activity over hours or even days. Imagine a hacker incrementally cycling through user IDs to access unauthorized accounts—like testing door keys until one works. Catching this attack requires long-term session tracking and advanced pattern analysis, which edge solutions can’t handle due to their limited computational scope.

Instead, edge tools are like speed cameras—they catch obvious violations but miss nuanced behavior that unfolds over time, such as someone gradually casing a neighborhood before committing a burglary.

The Need for a Comprehensive Approach

To effectively secure APIs, organizations must adopt a holistic strategy that extends beyond traditional edge solutions. Salt Security offers a comprehensive approach encompassing API discovery, posture governance, and threat protection:

1. Comprehensive API Discovery

Salt Security provides automated, continuous visibility into all APIs, including those that are undocumented or hidden. This ensures that organizations can identify and manage every API in their environment, eliminating blind spots. citeturn0search2

Example: A financial institution discovers several shadow APIs that were deployed without proper oversight, allowing them to secure these endpoints before any potential exploitation.

2. Posture Governance

Beyond discovery, Salt Security's platform includes an API posture governance engine that enables organizations to create and enforce custom corporate standards. This ensures compliance throughout the API lifecycle and aligns all stakeholders. citeturn0search8

Example: A healthcare provider uses Salt's posture governance to ensure all APIs handling patient data comply with HIPAA regulations, thereby safeguarding sensitive information.

3. Threat Protection

Salt Security employs AI and machine learning to analyze and correlate activity across millions of APIs and users over time. This approach enables the detection and prevention of sophisticated API attacks, such as those involving credential stuffing or BOLA (Broken Object Level Authorization). citeturn0search2

Example: An e-commerce platform detects and blocks an attacker attempting to enumerate user IDs to access unauthorized accounts, preventing a potential data breach.

By integrating these capabilities, Salt Security ensures organizations have the visibility, control, and intelligence needed to protect APIs comprehensively—not just at the edge but throughout their entire lifecycle.

Looking Beyond the Front Door

Edge security is a crucial component of an organization’s defense, but it’s just one piece of the puzzle. API security requires a broader view—ensuring that every potential entry point, whether it’s a front door, a side window, or a basement hatch, is accounted for and protected. Only then can organizations truly secure their digital ecosystems.  

For more information, you can schedule a free demo and also download the whitepaper that goes into more detail. Register for our December 19th Webinar: Beyond the Perimeter: Achieving Comprehensive API Security.

The post API Security is Not a Problem You Can Solve at the Edge appeared first on Security Boulevard.

By focusing on prioritized, actionable insights, security teams can keep pace with the rapid expansion of the attack surface, manage frequent changes across their digital infrastructure and proactively address evolving attack tactics, techniques and procedures (TTPs).

The post Drowning in Visibility? Why Cybersecurity Needs to Shift from Visibility to Actionable Insight appeared first on Security Boulevard.

Thales and Imperva Win Big in 2024
madhav
Fri, 12/13/2024 - 09:36

At Thales and Imperva, we are driven by our commitment to make the world safer, and nothing brings us more satisfaction than protecting our customers from daily cybersecurity threats. But that doesn’t mean we don’t appreciate winning the occasional award. In the year since Imperva joined forces with Thales, let’s review the cybersecurity industry accolades and recognition we’ve both received this year.

Industry Awards

We love an Industry Awards ceremony. Coming together with our peers to celebrate the industry’s achievements is always a special treat. But they are always better when you win something. Luckily, we did!

Microsoft Security Excellence Awards

Thales was announced as the overall winner in the Identity Trailblazer category at the Microsoft Security Excellence Awards. Microsoft recognized our leadership in the identity space, innovative IAM and CIAM solutions, and driving identity-related initiatives.

CyberSecurity Breakthrough Awards

This year’s CyberSecurity Breakthrough Awards saw Imperva pick up the Overall Web Security Solution Provider of the Year for the third consecutive year. It’s a recognition of Imperva’s market-leading solutions and ability to protect customers from DDoS attacks, malicious bots, business logic abuse, and more.

CyberSecAsia Readers’ Choice Awards

In a major triumph for our APAC team, Thales won the CyberSecAsia Readers’ Choice Award in the Data Privacy and Protection and Application Security categories. We’re especially proud of making the Hall of Fame—a special recognition for winning at four of the past five awards ceremonies!

Fortress Awards

The Business Intelligence Fortress Awards recognized Imperva’s application security offering. Imperva’s Application Security Platform offers automated protection for automated attacks, protecting critical applications and providing best-in-class security.

MarCom Awards

It’s not only our technical solutions that win awards—our communications efforts do, too. This year, MarCom recognized the success of our Data Threat Report (DTR), which achieved nearly 800 media mentions, 295 million impressions, and more than €5 million in the sales pipeline.

Global Infosec Awards

At the 2024 RSA Conference, Imperva nabbed an astounding eleven Cyber Defense Magazine Global InfoSec Awards. These awards recognized Imperva’s market-leading security solutions and innovative threat research. Head to the awards website to find out what Imperva picked up.

CRN Channel Chiefs

2024 also saw John Polly, our VP for Worldwide Channel and Alliances, named in the Channel Company 2024 Channel Chiefs list. While we already knew how great John is, it’s heartening to see that the wider industry recognizes his exceptional leadership, influence, and innovation in driving our channel strategies!

Globee Awards

Imperva seems to have a knack for winning multiple awards on the same night, picking up six at this year’s Globee Awards. They were recognized for their unique ability to protect customers’ critical applications, APIs, and data anywhere, at scale, and with the highest ROI.

Expert Insights Recognition

We’re thrilled to be recognized by tech review platform Expert Insights in their shortlist of leading B2B tech software for CISOs and IT managers. Even better, Thales has been shortlisted in a whopping five of the following guides:

• Top Identity And Access Management Solutions
• Top Multi-Factor Authentication (MFA) Solutions For Business
• Top User Authentication And Access Management Solutions
• Top Single Sign-On Solutions For Business
• Top Customer Identity And Access Management (CIAM) Solutions

Check out the Expert Insights website for more information about why they shortlisted our solutions!

Industry Analyst Recognition

2024 hasn’t just been a big year for industry awards; it was also a great year for analyst recognitions.

IDC MarketScape for Web Application and API Protection

IDC named Imperva a Leader in its 2024 IDC MarketScape for Web Application and API Protection enterprise platforms this year. Imperva’s Web Application and API Protection (WAAP) is a converged security solution that ensures comprehensive protection while reducing security gaps and simplifying management – it’s great to see it get the recognition it deserves.

Gartner® Magic Quadrant for Access Management

We have been recognized as a Visionary in the Gartner Magic Quadrant for Access Management, highlighting our commitment to innovation and customer-centric solutions. Our OneWelcome Identity Platform (for CIAM) and SafeNet Trusted Access (for workforce) deliver flexible, SaaS-first offerings that cater to diverse industries like banking, insurance, and media across North America and Europe.

KuppingerCole European Identity and Cloud Awards

In June, our partnership with LEITNER, part of the HTI Group, won the Identity Fabrics and IDaaS category at the KuppingerCole European Identity and Cloud Awards. KuppingerCole honored HTI Group for demonstrating how digital identity can enable digital services and new products.

KuppingerCole Leadership Compass

Sticking with the KuppingerCole theme, Thales was recognized in three Leadership Compass reports this year. We were:

• An Overall Leader, Market Leader, Innovation Leader, and Product Leader in Passwordless Authentication for Enterprises
• An Overall Leader, Market Leader, and Product Leader in Passwordless Authentication for Consumers
• A Leader in Customer Identity and Access Management
• An Overall Leader in Data Security Platform

KuppingerCole also recognized Imperva as an overall leader in the Leadership Compass for Application Firewalls. Check out the full report to find out why.

The year 2024 brought us remarkable achievements. As we set our sights on 2025, we aspire for a more secure digital landscape, where Thales and Imperva can persist as leaders in innovation and security.

2024 Forrester Wave for Bot Management Software

Imperva listed as a Strong Performer in the 2024 Forrester Wave for Bot Management Software.

Imperva excels at out-of-the-box and customizable response policies, with a range of general and use-case-based policies that can be applied per application, path, or group. The company differentiates by including a simulator that lets customers see the results of potential policies before deploying them.

Forrester Wave for Data Security Platforms

Imperva listed as a Strong Performer in the 2023 Forrester Wave for Data Security Platforms

Imperva has made great strides in data security but needs more customer enablement. From its 2020 acquisition of jSonar to the launches of a data security business unit as well as the Tech Alliance Program (TAP), Imperva has taken major steps to enable a vision for protecting all data as organizations move their workloads to the cloud. The Imperva Data Security Fabric (DSF) is the result of this continued transformation, bringing together capabilities for database activity monitoring, access control, data risk analytics, discovery and classification, and more.

Data Security Identity & Access Management Access Control Cloud Security Application Encryption

Thales | Cloud Protection & Licensing Solutions
More About This Author > Schema {
"@context": "https://schema.org",
"@type": "BlogPosting",
"headline": "Thales and Imperva Win Big in 2024",
"description": "Highlighting the awards and recognition Thales and Imperva received in 2024 for their cybersecurity leadership and innovative solutions.",
"image": "https://cpl.thalesgroup.com/sites/default/files/default-image.png",
"author": {
"@type": "Person",
"name": "Anina Steele",
"url": "https://cpl.thalesgroup.com/blog/author/asteele"
},
"publisher": {
"@type": "Organization",
"name": "Thales Group",
"description": "The world relies on Thales to protect and secure access to your most sensitive data and software wherever it is created, shared, or stored. Whether building an encryption strategy, licensing software, providing trusted access to the cloud, or meeting compliance mandates, you can rely on Thales to secure your digital transformation.",
"url": "https://cpl.thalesgroup.com",
"logo": "https://cpl.thalesgroup.com/sites/default/files/content/footer/thaleslogo-white.png",
"sameAs": [
"https://www.facebook.com/ThalesCloudSec",
"https://www.twitter.com/ThalesCloudSec",
"https://www.linkedin.com/company/thalescloudsec",
"https://www.youtube.com/ThalesCloudSec"
]
},
"datePublished": "2024-12-13",
"dateModified": "2024-12-13",
"url": "https://cpl.thalesgroup.com/blog/identity-data-security/thales-and-imperva-win-big-2024",
"mainEntityOfPage": {
"@type": "WebPage",
"@id": "https://cpl.thalesgroup.com/blog/identity-data-security/thales-and-imperva-win-big-2024"
},
"award": [
"Identity Trailblazer at Microsoft Security Excellence Awards",
"Overall Web Security Solution Provider of the Year at CyberSecurity Breakthrough Awards",
"CyberSecAsia Readers' Choice Award in Data Privacy and Protection",
"CyberSecAsia Readers' Choice Award in Application Security",
"Application Security Platform Award from Fortress Awards",
"Best Communication Campaign for the Data Threat Report at MarCom Awards",
"11 Global Infosec Awards at RSA Conference 2024",
"6 Globee Awards for critical application and API protection",
"Top Identity and Access Management Solutions by Expert Insights",
"Top Multi-Factor Authentication (MFA) Solutions for Business by Expert Insights",
"Top User Authentication and Access Management Solutions by Expert Insights",
"Top Single Sign-On Solutions for Business by Expert Insights",
"Top Customer Identity and Access Management (CIAM) Solutions by Expert Insights",
"Leader in the 2024 IDC MarketScape for Web Application and API Protection",
"Visionary in the Gartner Magic Quadrant for Access Management",
"Winner of the KuppingerCole European Identity and Cloud Award for Identity Fabrics and IDaaS",
"Overall Leader in Passwordless Authentication for Enterprises by KuppingerCole Leadership Compass",
"Overall Leader in Passwordless Authentication for Consumers by KuppingerCole Leadership Compass",
"Overall Leader in Customer Identity and Access Management by KuppingerCole Leadership Compass",
"Overall Leader in Data Security Platforms by KuppingerCole Leadership Compass",
"Overall Leader in Application Firewalls by KuppingerCole Leadership Compass",
"Strong Performer in the 2024 Forrester Wave for Bot Management Software",
"Strong Performer in the 2023 Forrester Wave for Data Security Platforms"
],
"creator": {
"@type": "Organization",
"name": "Thales Group",
"url": "https://cpl.thalesgroup.com"
}
}

basic

The post Thales and Imperva Win Big in 2024 appeared first on Security Boulevard.

Data warehousing firm Snowflake, which saw a lot of user accounts get hacked due to poor security hygiene, is making MFA mandatory for all user accounts by November 2025.

The post Snowflake Will Make MFA Mandatory Next Year appeared first on Security Boulevard.

CyberSecure Canada aims to help enterprises improve their security posture by implementing a baseline set of security controls.

The post Achieving CyberSecure Canada Certification appeared first on Security Boulevard.

Every application is susceptible to attacks, but web applications are more vulnerable than others. They interact with more networks and users—and every interaction is a risk. Any flaws or errors can lead to serious problems like unauthorized access, stolen data, and service disruptions. Whether you run a small team or manage a large organization, staying ahead of web application vulnerabilities keeps your software secure.

The post What Is an Application Vulnerability? 8 Common Types appeared first on Security Boulevard.

Artificial intelligence (AI) is reshaping the cybersecurity landscape—both potential attacks and impactful protections. Understanding how AI can be used in cybersecurity can help you build more efficient and adaptive defenses capable of handling these rapidly evolving threats.

The post Understanding the Role of AI in Cybersecurity appeared first on Security Boulevard.

Containers boost your application's scalability and efficiency. But without proper security, containerized environments can be vulnerable to data breaches, supply chain attacks, and other risks that derail projects.

The post 10 Container Security Best Practices: A Guide appeared first on Security Boulevard.

Zero-day vulnerabilities are serious threats. They’re completely unknown to both the vendor and the user. That gives attackers a significant advantage, allowing them to attack systems before patches are available.

The post What’s a Zero-Day Vulnerability? Prevent Exploits and Attacks appeared first on Security Boulevard.

Why Should Cloud Data Protection Be Your Top Priority? With the steep rise in digitalization, sensitive data has moved from the physical world into the boundless digital realm. Cloud computing has become a crucial part of this transition, thus making cloud data protection a top priority. But what does it mean to secure this data, […]

The post Critical Steps to Keep Your Cloud Data Protected appeared first on Entro.

The post Critical Steps to Keep Your Cloud Data Protected appeared first on Security Boulevard.

Explore the Salesforce security practices that are essential to your business and understand how AppOmni can empower Salesforce customers across industries.

The post 7 Must-Have Salesforce Security Practices appeared first on AppOmni.

The post 7 Must-Have Salesforce Security Practices appeared first on Security Boulevard.

Over the past several years, US Federal Agencies and private sector companies have observed China-based threat actors targeting network and telecommunication critical infrastructure. A wave of recent reports have disclosed that these attacks have succeeded in compromising government and industry targets to a far greater extent than previously thought. As a result, CISA has issued […]

The post Holding Back Salt Typhoon + Other Chinese APT CVEs appeared first on Eclypsium | Supply Chain Security for the Modern Enterprise.

The post Holding Back Salt Typhoon + Other Chinese APT CVEs appeared first on Security Boulevard.

Authors/Presenters: WanJunJie Zhang, Yisheng He

Our sincere appreciation to DEF CON, and the Presenters/Authors for publishing their erudite DEF CON 32 content. Originating from the conference’s events located at the Las Vegas Convention Center; and via the organizations YouTube channel.

Permalink

The post DEF CON 32 – Using ALPC Security Features To Compromise RPC Services appeared first on Security Boulevard.

A survey of IT security pros by cybersecurity firm BlackFog found that 70% of them said federal cases like that against SolarWinds' CISO hurt their opinion about the position, but some said they expected the boards of directors would take the issues of security more seriously.

The post Charges Against CISOs Create Worries, Hope in Security Industry: Survey appeared first on Security Boulevard.

Artificial stupidity: Large language models are terrible if you need reasoning or actual understanding.

The post AI Slop is Hurting Security — LLMs are Dumb and People are Dim appeared first on Security Boulevard.

With a market share of 66.68%, Google Chrome remains a prime target for cyberattacks. In 2024, this widely used browser faced numerous critical Chrome vulnerabilities that put businesses and individuals at risk and led to significant damage. Attackers exploited these flaws to bypass security measures, steal sensitive information, and deploy malicious payloads.   Security managers are...

The post 2024 Recap: 8 Notable and Dangerous Chrome Vulnerabilities appeared first on TrueFort.

The post 2024 Recap: 8 Notable and Dangerous Chrome Vulnerabilities appeared first on Security Boulevard.

CISA has released new cybersecurity guidelines for communications infrastructure. The guidance comes in the wake of a series of disclosures that massive Telecommunications Carriers have been compromised by Salt Typhoon and other China-sponsored adversaries.  At the same time, the U.S. Federal Communications Commission (FCC) has proposed a Declaratory Ruling to require telecommunications carriers to protect […]

The post CISA and FCC Issue Urgent Call for Cyber Hardening for Communications Infrastructure appeared first on Eclypsium | Supply Chain Security for the Modern Enterprise.

The post CISA and FCC Issue Urgent Call for Cyber Hardening for Communications Infrastructure appeared first on Security Boulevard.

The largest repackage and re-post of an old leak In November 2024, a hacker known as “Nam3L3ss” allegedly released previously undisclosed data from the MOVEit breach in May 2023. This leak consisted of millions of records, including sensitive employee and big brand corporate information, significantly escalating the breach’s impact. Digging into this story reveals that […]

The post MOVEit Repackaged and Recycled appeared first on Flare | Cyber Threat Intel | Digital Risk Protection.

The post MOVEit Repackaged and Recycled appeared first on Security Boulevard.

CodeSonar 8.3 is a significant upgrade, containing new features and integrations, improved compiler and language support, and more checkers. The highlights are listed below; for more complete details, please consult the Release Notes. We recommend customers update to this version of CodeSonar as soon as possible to get access to these benefits.  Explore the latest…

The post What’s New in CodeSonar 8.3 appeared first on CodeSecure.

The post What’s New in CodeSonar 8.3 appeared first on Security Boulevard.