Security Boulevard

Are You Maximizing the Potential of Your IAM Strategies? Effective data management requires a nuanced understanding of advanced Identity and Access Management (IAM) strategies. Where cyber threats are evolving at a rapid pace, an organization’s cybersecurity fortification needs to keep pace. When a crucial component of successful cybersecurity, IAM strategies are essential for controlling who […]

The post Feel Supported by Advanced IAM Strategies appeared first on Entro.

The post Feel Supported by Advanced IAM Strategies appeared first on Security Boulevard.

Is Your Secrets Management Strategy Straining Your Budget? Organizations are on the lookout for budget-friendly secrets management solutions that provide robust security without causing financial strain. I believe that a comprehensive Non-Human Identities (NHIs) management approach could be the answer. Understanding NHIs and the Need for Budget-Friendly Security Management Non-Human Identities (NHIs) are the machine […]

The post Secrets Management That Fits Your Budget appeared first on Entro.

The post Secrets Management That Fits Your Budget appeared first on Security Boulevard.

Why is the Strategic Management of NHIs Essential? How do we ensure that our cybersecurity measures keep pace? Non-Human Identities (NHIs) present a unique challenge, as they require a different approach to securing their secrets. This task can be complex. However, with a well-rounded approach, it is possible to effectively manage NHIs, reduce the risk […]

The post NHIs Solutions Tailored to Handle Your Needs appeared first on Entro.

The post NHIs Solutions Tailored to Handle Your Needs appeared first on Security Boulevard.

How Does Proactive Non-Human Identity Management Keep You Ahead? Cybersecurity, for years, has been placing humans at the center of the identity universe. But have you considered the indispensable role of Non-Human Identities (NHIs) in your organization’s security matrix? By applying proactive NHI management, you can not only mitigate risks but also enhance efficiency, thereby […]

The post Stay Ahead with Proactive Non-Human Identity Management appeared first on Entro.

The post Stay Ahead with Proactive Non-Human Identity Management appeared first on Security Boulevard.

As AI makes perfect digital impersonations increasingly accessible, distinguishing reality from fiction becomes harder. This guide breaks down deepfake technology in simple terms and provides practical protection strategies anyone can implement.

The post Deepfake 101: Understanding Digital Deception in Today’s World appeared first on Security Boulevard.

1. 5Critical
2. 66Important
3. 0Moderate
4. 0Low

Microsoft addresses 71 CVEs including seven zero-days, five of which were exploited in the wild.

Microsoft patched 71 CVEs in its May 2025 Patch Tuesday release, with five rated critical and 66 rated as important.

This month’s update includes patches for:

• .NET, Visual Studio, and Build Tools for Visual Studio
• Active Directory Certificate Services (AD CS)
• Azure
• Azure Automation
• Azure DevOps
• Azure File Sync
• Azure Storage Resource Provider
• Microsoft Brokering File System
• Microsoft Dataverse
• Microsoft Defender for Endpoint
• Microsoft Defender for Identity
• Microsoft Edge (Chromium-based)
• Microsoft Office
• Microsoft Office Excel
• Microsoft Office Outlook
• Microsoft Office PowerPoint
• Microsoft Office SharePoint
• Microsoft PC Manager
• Microsoft Power Apps
• Microsoft Scripting Engine
• Remote Desktop Gateway Service
• Role: Windows Hyper-V
• Universal Print Management Service
• UrlMon
• Visual Studio
• Visual Studio Code
• Web Threat Defense (WTD.sys)
• Windows Ancillary Function Driver for WinSock
• Windows Common Log File System Driver
• Windows Deployment Services
• Windows Drivers
• Windows DWM
• Windows File Server
• Windows Fundamentals
• Windows Hardware Lab Kit
• Windows Installer
• Windows Kernel
• Windows LDAP - Lightweight Directory Access Protocol
• Windows Media
• Windows NTFS
• Windows Remote Desktop
• Windows Routing and Remote Access Service (RRAS)
• Windows Secure Kernel Mode
• Windows SMB
• Windows Trusted Runtime Interface Driver
• Windows Virtual Machine Bus
• Windows Win32K - GRFX

Remote code execution (RCE) vulnerabilities accounted for 39.4% of the vulnerabilities patched this month, followed by elevation of privilege (EoP) vulnerabilities at 25.4%.

Important CVE-2025-30385, CVE-2025-32701 and CVE-2025-32706 | Windows Common Log File System Driver Elevation of Privilege Vulnerabilities

CVE-2025-30385, CVE-2025-32701 and CVE-2025-32706 are EoP vulnerabilities in the Windows Common Log File System (CLFS) Driver. Each was assigned a CVSSv3 score of 7.8 and are rated as important. Both CVE-2025-32701 and CVE-2025-32706 were exploited in the wild as zero-days while CVE-2025-30385 is assessed as “Exploitation More Likely” according to Microsoft’s Exploitability Index.

Prior to this month's release, Microsoft has patched two other EoP vulnerabilities in the Windows CLFS driver in 2025, including CVE-2025-29824, exploited as a zero-day vulnerability in the April 2025 Patch Tuesday release. In 2024, there were eight CLFS vulnerabilities patched, including one zero-day vulnerability in the CLFS driver that was exploited (CVE-2024-49138) and patched in the December 2024 Patch Tuesday release. Windows CLFS continues to be a popular attack vector for attackers and has been exploited by ransomware gangs.

Important CVE-2025-30400 | Microsoft DWM Core Library Elevation of Privilege Vulnerability

CVE-2025-30400 is an EoP vulnerability in the Windows Desktop Windows Manager (DWM) Core library. It was assigned a CVSSv3 score of 7.8 and is rated as important. Microsoft notes that it was exploited as a zero-day. Successful exploitation would allow an attacker to elevate their privileges by exploiting a use after free flaw.

This is the seventh EoP vulnerability in DWM Core Library patched this year. Eight DWM vulnerabilities were patched in 2024, including one zero-day vulnerability that was actively exploited (CVE-2024-30051) and patched in the May 2024 Patch Tuesday release.

Important CVE-2025-30397 | Scripting Engine Memory Corruption Vulnerability

CVE-2025-30397 is a memory corruption vulnerability in Microsoft Scripting Engine that can be exploited to achieve arbitrary code execution on a target machine. It was assigned a CVSSv3 score of 7.5 and is rated as Important. The attack complexity is rated as high, and Microsoft notes the target must first be running Microsoft Edge in Internet Explorer mode. Successful exploitation requires the user to click on a crafted URL. This vulnerability was reportedly exploited in the wild as a zero-day.

Important CVE-2025-26685 | Microsoft Defender for Identity Spoofing Vulnerability

CVE-2025-26685 is a spoofing vulnerability in Microsoft Defender for Identity. It was assigned a CVSSv3 score of 6.5 and is rated as Important. This vulnerability allows an unauthenticated attacker with Local Area Network (LAN) access to perform a spoofing attack. According to Microsoft, this vulnerability was disclosed prior to patches being made available.

Important CVE-2025-32709 | Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability

CVE-2025-32709 is a EoP vulnerability in the Windows Ancillary Function Driver for WinSock. It was assigned a CVSSv3 score of 7.8 and rated as Important. An authenticated attacker can leverage this vulnerability to elevate their privileges to administrator by exploiting a user after free condition. Microsoft notes that this vulnerability was exploited in the wild as a zero-day, the second to be exploited in 2025, preceded by CVE-2025-21418 which was addressed in February’s Patch Tuesday release.

Important CVE-2025-32702 | Visual Studio Remote Code Execution Vulnerability

CVE-2025-32702 is a RCE vulnerability in Visual Studio. It was assigned a CVSSv3 score of 7.8 and rated as Important. Microsoft notes that the attack vector for this vulnerability is local, and that an unauthenticated attacker could exploit this flaw in order to execute code. This is the third RCE vulnerability in Visual Studio that was patched in 2025.

Tenable Solutions

A list of all the plugins released for Microsoft’s May 2025 Patch Tuesday update can be found here. As always, we recommend patching systems as soon as possible and regularly scanning your environment to identify those systems yet to be patched.

For more specific guidance on best practices for vulnerability assessments, please refer to our blog post on How to Perform Efficient Vulnerability Assessments with Tenable.

Get more information

• Microsoft's May 2025 Security Updates
• Tenable plugins for Microsoft May 2025 Patch Tuesday Security Updates

Join Tenable's Security Response Team on the Tenable Community.
Learn more about Tenable One, the Exposure Management Platform for the modern attack surface.

The post Microsoft’s May 2025 Patch Tuesday Addresses 71 CVEs (CVE-2025-32701, CVE-2025-32706, CVE-2025-30400) appeared first on Security Boulevard.

Author/Presenter: Blake Hudson

Our sincere appreciation to BSidesLV, and the Presenters/Authors for publishing their erudite Security BSidesLV24 content. Originating from the conference’s events located at the Tuscany Suites & Casino; and via the organizations YouTube channel.

Permalink

The post BSidesLV24 – GroundFloor – Pipeline Pandemonium: How To Hijack The Cloud And Make It Rain Insecurity appeared first on Security Boulevard.

The recent failure of Skybox has left many companies without a supported NSPM solution. As a result, many of these previous Skybox customers have taken this opportunity to reevaluate their...

The post Network Security Policy Management (NSPM) in 2025 appeared first on Security Boulevard.

The Security Gap JPMorgan Chase’s CISO Didn’t Mention — And Why It’s in Your Browser

When the CISO of JPMorgan Chase issues a public letter to all technology vendors, the industry pays attention — and rightfully so. In his open letter, Rohan Amin lays out a firm, urgent call: prioritize secure-by-design practices, patch faster, and take full accountability for your software supply chain. And last week, in the midst of RSAC Conference, there was definitely buzz on the ground about the letter.

To me, it was a public signal that large enterprises should no longer tolerate avoidable vulnerabilities — and that too many of them are introduced through third-party vendors. Regulatory pressure, market expectations, and operational resilience all demand better.

But while the letter hit on several vital dimensions of software security, I couldn’t help but notice that it overlooked one of the fastest-growing attack surfaces in the modern enterprise: the browser.

Browsers: The New Frontline of Enterprise Work and Risk

Today, nearly every business-critical task — from accessing internal tools to using SaaS apps and collaborating with contractors — happens inside a browser. Google Workspace, Microsoft 365, Salesforce, Workday, Adobe, GitHub…the list goes on.

Yet despite this shift, most enterprises:

• Don’t inventory browser extensions
• Don’t have visibility into SaaS use from the browser (shadow SaaS)
• Don’t monitor user behavior in the browser on unmanaged or lightly managed endpoints

And more importantly, most enterprises don’t often think of browsers as a third-party application — at least not the way they do with other SaaS applications. Furthermore, use of open-source Chromium variant browsers, like Vivaldi and Arc, only increases an enterprise’s supply chain risk.

This creates a massive blind spot. The browser is no longer just a window into the internet — it’s the main gateway through which employees access third-party apps daily. And that makes it an extension of your software supply chain.

What JPMorgan’s CISO Got Right — and What Was Missed

Rohan Amin’s letter makes important demands:

• Accelerate patch cycles
• Eliminate default credentials and outdated libraries
• Design for security up front
• Be transparent about vulnerabilities and remediation timelines
• Take third-party software risk seriously

These are all essential — and most security teams would agree. But the browser sits unmentioned and is often forgotten in third-party risk assessments. And that’s a mistake.

Why?

Because browsers are:

• Full-fledged application platforms — running extensions, scripts, and even unauthorized SaaS tools
• Privileged interfaces — used to authenticate, store cookies/tokens, and transfer sensitive data across enterprise SaaS applications
• Entry points for phishing, session hijacking, and insider risk
• Totally unmanaged in many BYOD and contractor scenarios

Gartner agrees. In the recent report, Innovation Insight: Secure Enterprise Browsers, Gartner notes, “Established hybrid work patterns, increased use of lightly managed and unmanaged end user devices and BYOPC in the modern workplace, and increased SaaS adoption have led to more work being done through web browsers.”

Why is this a problem? According to Gartner, that’s because “[threat] actors frequently target employees with phishing attacks to steal credentials and bypass endpoint detection and response controls, necessitating an additional layer of visibility and control within the web browser.”

This is only complicated further with the fact that most “organizations already have two or more browsers (Google Chrome, Microsoft Edge, Apple Safari) and are not fully managing these today. IT’s desire to add another browser due to increased management overhead is low” (Gartner, Innovation Insight: Secure Enterprise Browsers, April 2025).

In other words, everything the CISO’s letter warns about is already playing out inside the browser.

Browsers Are Not in Your Third-Party Risk Program — Yet They Should Be

Let’s ask a simple question: When was the last time your security or risk team reviewed the browser extensions used across your workforce?

Or:

• Audited user behavior of contractors in browsers on personal devices?
• Inspected shadow SaaS usage from browser sessions?
• Monitored web app file uploads to unapproved destinations?

Chances are, these aren’t included in your vendor risk assessment, SBOM processes, or internal GRC controls. That’s a problem.

Because browsers:

• Load third-party code (via extensions or scripts) that can exfiltrate data
• Enable shadow SaaS use and extensions that bypass managed app policies
• Offer fertile ground for credential theft and lateral movement

The browser itself is a software platform. Like any software, it should be controlled, monitored, and included in risk modeling.

How Browser Security (Browser Detection and Response and Secure Enterprise Browsers) Closes This Risk Gap

This is where solutions like Browser Detection and Response (BDR) and Secure Enterprise Browsers (SEBs) come into play. They bring enterprise-grade visibility and control to a layer that’s been ignored for too long. Key capabilities should include:

✅ Extension control and risk profiling — Know what’s installed and block risky plugins
✅ Identity & access management — Prevent unsanctioned SaaS logins
✅ Secure access to internal apps — Ensure that users only access the apps they need, even on BYOD or unmanaged devices
✅ Browser-based DLP — Stop data exfiltration and insider threats by blocking uploads or copy/paste
✅ Shadow SaaS visibility — Detect usage of unauthorized apps, even on BYOD
✅ Phishing and session protection — Block advanced phishing attacks, credential harvesting and lateral movement
✅ Detailed session audit trails — Support threat hunting, incident investigations, and compliance mandates

Fulfilling Your CISO Mandate — Without Blind Spots

CISOs everywhere are feeling the pressure. Regulations like NIS2, DORA, and the SEC’s new cyber disclosure rules demand more transparency, more board-level accountability, and faster detection and response capabilities.

Security leaders must go beyond infrastructure and cloud tooling — and take control of the layers where users and data intersect every day.

That means:

• Including browsers and extensions in software asset inventories
• Auditing SaaS usage, including shadow SaaS
• Controlling what happens in unmanaged browser sessions on BYOD and contractor devices
• Using BDR or secure browser technologies to provide an enforceable policy perimeter

Secure the Layer Everyone Uses — But No One Is Watching

The JPMorgan CISO’s letter set a high bar. But if organizations respond only by tightening cloud APIs or endpoint agents, they’ll still be missing the most active, high-risk execution environment in their enterprise: the browser.

If you’re not monitoring and securing browser behavior, you’re flying blind — while attackers increasingly target that very space.

Let’s fix that.

Next Steps

📘 Download our white paper: “Browser Detection & Response (BDR)”

💬 Book a discovery session to explore how SquareX helps secure browser activity in real time — even on unmanaged endpoints.

Learn More: Real-World Threats in the Browser

Browser security risks are no longer theoretical. SquareX has uncovered dozens of attacks, including:

Cyberhaven’s OAuth Identity Attack — details a widespread campaign targeting Chrome extension developers and how it happened.

Browser-Native Ransomware — a novel class of ransomware that fully executes in the browser without involving any local files and processes, bypassing traditional anti-ransomware solutions.

Polymorphic Browser Extensions — malicious add-ons that can disable and impersonate installed legitimate extensions such as password managers and crypto wallets and evade static analysis tools, making them ideal for persistent, stealthy access.

These aren’t edge cases — they’re active examples of how attackers are exploiting browser-layer weaknesses today.

The Security Gap JPMorgan Chase’s CISO Didn’t Mention — And Why It’s in Your Browser was originally published in SquareX Labs on Medium, where people are continuing the conversation by highlighting and responding to this story.

The post The Security Gap JPMorgan Chase’s CISO Didn’t Mention — And Why It’s in Your Browser appeared first on Security Boulevard.

Changing your name—whether due to marriage, divorce, or personal choice—is a significant life event. However, this process involves sharing sensitive personal information across various platforms, making it a potential target for identity theft. At Avast, we prioritize your digital security. Here's how you can navigate a name change securely and protect your identity throughout the process.  

The post How to safely change your name without putting your identity at risk appeared first on Security Boulevard.

From login abuse to in-session fraud, DataDome’s unified account protection layers stop both bots and human attackers in real time—without disrupting legitimate users.

The post Unified Account Defense: How AI-Powered Layers Stop Bots and Human Fraud—Faster appeared first on Security Boulevard.

via the inimitable Daniel Stori at Turnoff.US!

Permalink

The post Randall Munroe’s XKCD ‘Pascal’s Law’ appeared first on Security Boulevard.

Author/Presenter: David French

Our sincere appreciation to BSidesLV, and the Presenters/Authors for publishing their erudite Security BSidesLV24 content. Originating from the conference’s events located at the Tuscany Suites & Casino; and via the organizations YouTube channel.

Permalink

The post BSidesLV24 – GroundFloor – Detection Engineering Demystified: Building Custom Detections For GitHub Enterprise appeared first on Security Boulevard.

Discover hidden risks in API testing tools like Postman and Insomnia. We dive into scripting vulnerabilities and explore JavaScript sandbox security pitfalls.

The post Scripting Outside the Box: API Client Security Risks (1/2) appeared first on Security Boulevard.

Apple earlier this year agreed to a $95 settlement to end a lawsuit filed in 2021 that claimed the company's AI-powered assistant Siri recorded users' conversations even when it wasn't prompted to do so. Now anyone who feels their privacy was violated by Siri have until July 2 to file a claim for a piece of the settlement.

The post Apple Device Users Can File Claims in $95 Million Siri Spying Settlement appeared first on Security Boulevard.

A global survey of 200 CISOs suggests responsibility for application security is shifting more toward the teams building and deploying software.

The post CISO Survey Surfaces Shift in Application Security Responsibilities appeared first on Security Boulevard.

Cary, North Carolina, 13th May 2025, CyberNewsWire

The post INE Security Alert: Top 5 Takeaways from RSAC 2025 appeared first on Security Boulevard.

The cybersecurity landscape has never moved faster — and the people tasked with defending it have never felt more exposed.

Related: How real people are really using GenAI

Today’s Chief Information Security Officers (CISOs) operate in a pressure cooker: responsible … (more…)

The post Author’s Q&A: It’s high time for CISOs to start leading strategically — or risk being scapegoated first appeared on The Last Watchdog.

The post Author’s Q&A: It’s high time for CISOs to start leading strategically — or risk being scapegoated appeared first on Security Boulevard.

Anthropic’s Model Context Protocol (MCP) is a breakthrough standard that allows LLM models to interact with external tools and data systems with unprecedented flexibility.

The post GenAI’s New Attack Surface: Why MCP Agents Demand a Rethink in Cybersecurity Strategy appeared first on Security Boulevard.

Artificial Intelligence is something that we as organizations need to keep up with our technology-loving contemporaries. After all, it’s the goal of every organization to be its best version and become the king of the room. To do so, we need no setbacks, the most common being the cyberattacks that are driven by AI. Digital […]

The post Artificial Intelligence in Cybersecurity – The Solutions You Need appeared first on Kratikal Blogs - Information Hub For Cyber Security Experts.

The post Artificial Intelligence in Cybersecurity – The Solutions You Need appeared first on Security Boulevard.