Help Net Security

Last week, CISA added CVE-2024-23113 – a critical vulnerability that allows unauthenticated remote code/command execution on unpatched Fortinet FortiGate firewalls – to its Known Exploited Vulnerabilities catalog, thus confirming that it’s being leveraged by attackers in the wild. The Shadowserver Foundation shared on Sunday that there are still 87,000+ internet-facing Fortinet devices likely vulnerable to the flaw. About CVE-2024-23113 CVE-2024-23113, a format string vulnerability that affects the FortiOS FGFM (FortiGate to FortiManager) daemon and can … More →

The post 87,000+ Fortinet devices still open to attack, are yours among them? (CVE-2024-23113) appeared first on Help Net Security.

Calix announced significant updates to Calix SmartHome that will help broadband service providers (BSPs) meet every home internet need with enhanced security and comprehensive offerings. These SmartHome innovations make it easier for BSPs to support the growing demands of residential subscribers, seamlessly handling online work, play, and more—all on one network. The redesigned Calix Command IQ app lets subscribers manage advanced network settings, ensuring a smooth experience for everyone in the home. Critical security services—Protect … More →

The post Calix enhances SmartHome to improve protection for residential subscribers appeared first on Help Net Security.

Netwrix announced that Grady Summers has been appointed CEO effective immediately. Summers succeeds Steve Dickson, who has successfully led the company through record growth during his six-year tenure. Under Dickson’s leadership, Netwrix achieved significant growth and value creation. Since joining the Netwrix board in 2017 and becoming CEO in 2018, Dickson has expanded the portfolio organically and through twelve acquisitions from one to more than fifteen product families, leading to a 23x growth in annual … More →

The post Netwrix appoints Grady Summers as CEO appeared first on Help Net Security.

An employee is exiting your organization. Regardless of the terms of departure, an ex-staffer has the potential when they leave or change roles to impact a wide range of non-human identities, digital credentials, and other secrets. Those secrets include the credentials for accessing corporate networks, sending and receiving email, and sharing files. For each non-human identity in an enterprise, an average of 92 non-human identities (NHIs) are created. When employees exit, NHIs can become unmanaged, … More →

The post The NHI management challenge: When employees leave appeared first on Help Net Security.

In this Help Net Security interview, Ismael Valenzuela, Vice President of Threat Research & Intelligence at BlackBerry, discusses the impact of geopolitical tensions on the frequency and sophistication of cyberattacks. He explains how nation-states and politically motivated groups exploit unrest for strategic advantages, providing examples of recent conflicts and their cyber implications. How do geopolitical tensions directly affect the frequency and sophistication of cyberattacks? Can you give examples of how nation-states or politically motivated groups … More →

The post How nation-states exploit political instability to launch cyber operations appeared first on Help Net Security.

APIs are the backbone of digital transformation efforts, connecting applications across organizations, so their security is of the utmost importance. In this Help Net Security video, Lori MacVittie, a Distinguished Engineer at F5, discusses the current state of API security. A recent F5 State of Application Strategy report found that: Most organizations’ API estates are expected to expand by 10% over the next two to three years, making security a major priority. Less than 70% … More →

The post The dark side of API security appeared first on Help Net Security.

Cyber claims have continued their upwards trend over the past year, driven in large part by a rise in data and privacy breach incidents, according to Allianz. Cyber claims frequency exceeds €1 million The frequency of large cyber claims (>€1 million) in the first six months of 2024 was up 14% while severity increased by 17%, according to the insurer’s claims analysis, following just a 1% increase in severity during 2023. Data and privacy breach-related … More →

The post Data breaches trigger increase in cyber insurance claims appeared first on Help Net Security.

Starting with iOS 18, iPadOS 18, macOS Sequoia, and visionOS 2, the Apple Passwords app enables you to manage your passwords, passkeys, and verification codes. For websites and apps that support two-factor (2FA) or multi-factor authentication (MFA), the Passwords app can generate and store automatic verification codes. This allows you to benefit from 2FA security without relying on SMS messages or external apps. If a site supports 2FA, you can set up verification codes directly … More →

The post How to create verification codes in Apple Passwords app appeared first on Help Net Security.

Ridge Security released RidgeBot 5.0, a substantial upgrade to its automated penetration testing platform. This release introduces AI-driven Web API testing, expanded vulnerability management integrations, and an upgraded operating system. RidgeBot 5.0 is an automated penetration testing platform to support HTTP-based API testing, a critical feature in today’s security landscape. This capability allows RidgeBot to perform Web API penetration testing, detecting and validating vulnerabilities such as OWASP API security Top 10 risks, Broken Authentication, hidden … More →

The post Ridge Security delivers enhanced capabilities for web application security appeared first on Help Net Security.

OneSpan announced an innovation in phishing-resistant transaction security, VISION FX. This new solution combines OneSpan’s patented CRONTO transaction signing with FIDO2 protocols that strengthen protection against phishing and account takeover threats (ATO), setting a standard for banking security. Merging both technologies into a single authentication solution delivers secure and user-friendly option on the market for banking customers logging on to execute transactions. Changes in the banking sector associated with new digital initiatives have ushered in … More →

The post OneSpan strenghtens banking security with phishing-resistant authentication appeared first on Help Net Security.

Rancher Government Solutions launched Harvester Government, the first fully compliant, out-of-the-box Hyperconverged Infrastructure (HCI) solution tailored specifically for US Government and Military operations. Designed to meet the strict security standards required for government use cases, Harvester Government offers a pre-hardened HCI infrastructure platform that seamlessly combines compliance, security, and flexibility. Harvester Government is derived from the upstream open-source product but reimagined and enhanced to meet the unique operational and security needs of the US Government. … More →

The post Rancher Government Solutions introduces Harvester Government appeared first on Help Net Security.

Stolen credentials remain the most common cause of a data breach. Various methods exist to prevent such breaches, and the most effective ones will have the least impact on developer productivity while catching issues as early as possible in the development process, when they’re still inexpensive and easy to fix. That’s precisely the mission of GitGuardian’s new Visual Studio Code extension: bringing robust shift-left security practices directly into the developer’s workflow. The extension works by … More →

The post GitGuardian Visual Studio Code extension helps developers protect their sensitive information appeared first on Help Net Security.

If someone told you five years ago that you could pose questions to an AI agent about the most vexing issues in science and it could answer back swiftly and meaningfully, you would’ve thought they were joking. But AI has ushered in this reality. The same holds true for quantum computing. For those that need a refresher on quantum computing, it’s considered ground-breaking technology: a super computer that uses the principles of quantum mechanics to … More →

The post The quantum dilemma: Game-changer or game-ender appeared first on Help Net Security.

In this Help Net Security interview, Rickard Carlsson, CEO at Detectify, discusses the evolution of attack surface management in the context of remote work and digital transformation. Carlsson highlights the challenges CISOs face today, including maintaining visibility and managing compliance in an expanding attack surface, all while dealing with limited resources and rising business demands. With the shift towards remote work and digital transformation, how has the traditional concept of attack surface management evolved? What … More →

The post CISOs’ strategies for managing a growing attack surface appeared first on Help Net Security.

33.9% of tech professionals report a shortage of AI security skills, particularly around emerging vulnerabilities like prompt injection, according to O’Reilly. This highlights the need for specialized training as AI adoption continues to accelerate across industries. Critical skills gaps emerging in AI and cloud security Cloud security expertise also emerges as a significant concern. Despite cloud computing’s two-decade presence, 38.9% of respondents identified cloud security as the most significant skills shortage. This revelation underscores a … More →

The post CISSP and CompTIA Security+ lead as most desired security credentials appeared first on Help Net Security.

While AI has captured the attention of the technology industry, the majority of CIOs and senior IT leaders are primarily focused on the convergence of networking and security, according to Extreme Networks. The survey, fielded in July and August 2024, polled 200 CIOs and senior IT leaders across a variety of vertical markets and found that CIOs stack ranked their top three IT priorities for the second half of 2024 as 1) securing their enterprise … More →

The post CIOs want a platform that combines AI, networking, and security appeared first on Help Net Security.

We present a list of selected cybersecurity companies that received funding during the third quarter of 2024 (Q3 2024). Apono October | 15.5 million Apono has raised $15.5 million in a Series A funding led by New Era Capital Partners, with participation from Mindset Ventures, Redseed Ventures, Silvertech Ventures, initial seed investors, and more. Chainguard July | $140 million Chainguard has completed a $140 million Series C round of funding led by Redpoint Ventures, Lightspeed … More →

The post Breaking down the numbers: Q3 2024 cybersecurity funding activity recap appeared first on Help Net Security.

Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: Microsoft patches two zero-days exploited in the wild (CVE-2024-43573, CVE-2024-43572) For October 2024 Patch Tuesday, Microsoft has released fixes for 117 security vulnerabilities, including two under active exploitation: CVE-2024-43573, a spoofing bug affecting the Windows MSHTML Platform, and CVE-2024-43572, a remote code execution flaw in the Microsoft Management Console (MMC). SOC teams are frustrated with their security tools Security operations … More →

The post Week in review: Microsoft fixes two exploited zero-days, SOC teams are losing trust in security tools appeared first on Help Net Security.

The EU Council has adopted the Cyber Resilience Act (CRA), a new law that aims to make consumer products with digital components safe(r) to use. CRA requirements The CRA outlines EU-wide cybersecurity standards for digital products, i.e. products that are connected – either directly or indirectly – to another device or to a network. This category includes “smart” home appliances, TVs, thermostats, toys, wearable health technology, baby monitoring systems, and so on. Some connected products … More →

The post EU adopts Cyber Resilience Act to secure connected products appeared first on Help Net Security.

Canonical released Ubuntu 24.10 Oracular Oriole, which brings notable advancements, including an updated kernel, new toolchains, and the GNOME 47 desktop environment, along with significant enhancements in software security. “Oracular Oriole sets a new pace for delivering the latest upstream kernel and toolchains,” said Mark Shuttleworth, CEO of Canonical, “Experimental new security features demonstrate our commitment to continually elevate the Linux desktop experience in conversation with the community for the next 20 years and beyond.” … More →

The post Ubuntu 24.10 Oracular Oriole brings tighter security controls appeared first on Help Net Security.