Security Boulevard

Ivanti CSA Investigation/Detection Details   Authors: Rui Ataide, Andrew Nelson, and Hermes Bojaxhi GuidePoint Security has recently been engaged on […]

The post Update from the Trenches appeared first on Security Boulevard.

Ramezani, Fan Wang, Zeliang Chen, Yue Dong, Maomao Ding, Zhiwei Zhao, Zhengyu Zhang, Ellie Wen, Assaf Eisenman

Our sincere thanks to USENIX, and the Presenters & Authors for publishing their superb 21st USENIX Symposium on Networked Systems Design and Implementation (NSDI '24) content, placing the organizations enduring commitment to Open Access front and center. Originating from the conference’s events situated at the Hyatt Regency Santa Clara; and via the organizations YouTube channel.

Permalink

The post USENIX NSDI ’24 – QuickUpdate: A Real-Time Personalization System For Large-Scale Recommendation Models appeared first on Security Boulevard.

Managing test data in on-prem environments can feel like an uphill battle. As cloud adoption grows, many companies still depend on on-premise environments to handle sensitive, regulated data. This isn’t just a legacy decision—industries like finance, healthcare, and government face strict regulations that make on-prem environments necessary for maintaining security and compliance, especially when it […]

The post Test Data Management & Compliance Challenges For On-Prem Environments first appeared on Accutive Security.

The post Test Data Management & Compliance Challenges For On-Prem Environments appeared first on Security Boulevard.

via the respected Software Engineering expertise of Mikkel Noe-Nygaard and the lauded Software Engineering / Enterprise Agile Coaching work of Luxshan Ratnaravi at Comic Agilé!

Permalink

The post Comic Agilé – Mikkel Noe-Nygaard, Luxshan Ratnaravi – #308 – What Are Those? appeared first on Security Boulevard.

On July 10, 2024, Palo Alto released a security advisory for CVE-2024-5910, a vulnerability which allowed attackers to remotely reset the Expedition application admin credentials. While we had never heard of Expedition application before, it’s advertised as: The purpose of this tool is to help reduce the time and efforts of migrating a configuration from a supported vendor to Palo Alto Networks. By using Expedition, everyone can convert a configuration from Checkpoint, Cisco, or any other vendor to a PAN-OS and give you more time to improve the results. Further reading the documentation, it became clear that this application might have more attacker value than initially expected. The Expedition application is deployed on Ubuntu server, interacted with via a web service, and users remotely integrate vendor devices by adding each system’s credentials. Figure 1. Integrating a device with credentials This blog details finding CVE-2024-5910, but also how we ended up discovering 3 additional vulnerabilities which we reported to Palo Alto: CVE-2024-9464: Authenticated Command Injection CVE-2024-9465: Unauthenticated SQL Injection CVE-2024-9466: Cleartext Credentials in Logs CVE-2024-5910: No Reversing Needed Given the description of the vulnerability, it sounded like there existed some built in function that allowed reseting the admin credential. Missing authentication […]

The post Palo Alto Expedition: From N-Day to Full Compromise appeared first on Horizon3.ai.

The post Palo Alto Expedition: From N-Day to Full Compromise appeared first on Security Boulevard.

For You Plague: TikTok’s in trouble once more—this time, some states complain it’s breaking laws by harvesting children’s data and keeping them addicted.

The post Digital Crack for Kids: TikTok Sued Again by 14 AGs appeared first on Security Boulevard.

On October 10, 2024, Microsoft released its latest round of security updates as part of the monthly Patch Tuesday. This month’s update addresses a total of 118 vulnerabilities, including five zero-days, two of which are actively being exploited. These vulnerabilities impact various Microsoft products, making it crucial for organizations to apply patches promptly and review any mitigations or workarounds.  Let’s ... Read More

The post Microsoft’s October 2024 Patch Tuesday: Addressing 5 Zero-Days and 118 Vulnerabilities appeared first on Nuspire.

The post Microsoft’s October 2024 Patch Tuesday: Addressing 5 Zero-Days and 118 Vulnerabilities appeared first on Security Boulevard.

At Seceon’s 2024 Innovation and Certification Days, we had the privilege of hearing from one of our valued partners, Keith Johnson, Executive Vice President of Obviam. Keith shared his journey in cybersecurity and explained why Seceon’s aiXDR platform is the solution of choice for his MSP and MSSP clients. His insights were not only valuable

The post Partner Spotlight: Why Obviam Chose Seceon for AI-Driven XDR appeared first on Seceon Inc.

The post Partner Spotlight: Why Obviam Chose Seceon for AI-Driven XDR appeared first on Security Boulevard.

If there’s one thing Microsoft, Spotify, Google Voice, and the Bank of England have in common, what would it be? All of them have recently been rocked by a major outage caused by an expired TLS certificate that significantly disrupted their operations and essential public services. The ripple effect of these outages reached far beyond […]

The post Don’t Let an Expired Certificate Cause Critical Downtime. Prevent Outages with a Smart CLM appeared first on Security Boulevard.

New Carbon Footprint Reporting delivers unmatched insights, optimizing sustainability and performance Vancouver, British Columbia, October 9, 2024 – Hyperview, the leading cloud-based data center infrastructure management (DCIM) platform, today unveiled a suite of groundbreaking features set to transform data center management through detailed measurement and comprehensive sustainability tools. At the heart of this ...

The post Hyperview Revolutionizes Data Center Management with Advanced DCIM Suite appeared first on Hyperview.

The post Hyperview Revolutionizes Data Center Management with Advanced DCIM Suite appeared first on Security Boulevard.

Active Directory can be exploited through password spraying attacks and compromised credentials. Five Eyes recommends the following controls.

The post Enhancing AD Security Against Password Spraying Attacks appeared first on Security Boulevard.

Enterprise organizations in recent years have come to recognize that attacks targeting software supply chains are a major threat. But the focus has been on attacks involving open-source software, since commercial software is a black box for many enterprises.

Cybersecurity incidents such as the one that SolarWinds disclosed in December 2020 have become increasingly common — as have vulnerability exploits used against trusted vendors and attacks on organizations handling enterprise data.

Here are five major commercial supply chain security incidents from the past year — and the lessons they offer for security stakeholders.

The post 5 commercial software attacks — and what you can learn from them appeared first on Security Boulevard.

The shift to 90-day certificates, Post-Quantum Cryptography (PQC), and crypto agility are interconnected strategies for enhancing cybersecurity. Shortened certificate lifespans improve agility and readiness for PQC, ensuring a seamless transition to future quantum-safe encryption. These trends reflect a proactive approach to building a resilient and adaptable digital security infrastructure.

The post Why 90-Day certificates, PQC, and crypto agility are more interconnected than you think appeared first on Security Boulevard.

Intel Microcode, a critical component of Intel CPUs, has been found to contain security vulnerabilities. These vulnerabilities could potentially allow attackers to gain unauthorized access to sensitive information or even crash systems.   Intel Microcode Vulnerabilities Fixed   Following two vulnerabilities have been identified in Intel Microcode, affecting some Intel processors.   CVE-2024-23984 This vulnerability […]

The post Extended Support for Ubuntu: Patch Intel Microcode Vulnerabilities appeared first on TuxCare.

The post Extended Support for Ubuntu: Patch Intel Microcode Vulnerabilities appeared first on Security Boulevard.

There has been a dramatic rise in e-commerce fraud as the increasing use of AI-generated deepfakes poses an unprecedented security challenge for online merchants.

The post AI-Driven eCommerce Fraud to Top $107 Billion by 2029 appeared first on Security Boulevard.

A flaw in Apple's mirroring feature within the iOS 18 and macOS Sequoia software updates compromises personal privacy when used on work Macs, according to a report from Sevco Security.

The post iPhone Mirroring Flaw Could Expose Employee Personal Information appeared first on Security Boulevard.

  SQL has become the standard language for interacting with relational databases. An SQL database uses tables to store and manage structured data with a focus on data integrity and relationships. MySQL, MariaDB, and PostgreSQL are popular SQL databases known for their reliability, performance, and versatility. SQL (Structured Query Language) is a powerful computer language […]

The post Understanding Your SQL Database: A Comprehensive Guide appeared first on TuxCare.

The post Understanding Your SQL Database: A Comprehensive Guide appeared first on Security Boulevard.

You need an API security solution. That much is a given (although some may argue it isn’t!). While essential for business growth and innovation, APIs, or Application Programming Interfaces, expose the organizations that use them to cyber threats. Attackers are both aware of and actively exploiting this fact: Wallarm recently revealed that attacks on APIs [...]

The post Choosing the Right Deployment Option for Your API Security Solution appeared first on Wallarm.

The post Choosing the Right Deployment Option for Your API Security Solution appeared first on Security Boulevard.

Reading Time: 9 min Secure your email domain with the top DMARC providers of 2024. Find the best solution for enhanced security and delivery.

The post Top 10 DMARC Providers in the Market appeared first on Security Boulevard.

Recent media reports have shed light on the US sanctions that were imposed on two crypto exchanges. In addition, the government also issued an indictment against a Russian national who was involved in money laundering crimes. In this article we’ll dive into the details of the sanctions and determine what these exchanges are, the details […]

The post Two Crypto Exchanges Face US Sanctions For Money Laundering appeared first on TuxCare.

The post Two Crypto Exchanges Face US Sanctions For Money Laundering appeared first on Security Boulevard.