Four actionable tips that will enable you to enhance the human element of your cybersecurity posture, transforming potential vulnerabilities into robust defenses.
The post 4 Tips to Fortify the Human Element in Your Cybersecurity Posture appeared first on Security Boulevard.
Knowing that insider threats and poor cyber hygiene are well-known as some of the worst threat vectors, prioritizing security controls that can keep pace with modern threats is fundamental for all organizations moving forward.
The post Poor Cyber Hygiene can Cost Organizations up to an Average of $677 Million appeared first on Security Boulevard.
Online marketplace sales are projected to reach $3.832 trillion in 2024. Every small e-commerce business should capture market share.
The post Online Marketplaces: Helping Small Businesses Grow and Stay Cyber Safe appeared first on Security Boulevard.
Join us as we reminisce about Y2K, the panic, the preparations, and the lessons learned 25 years later. We also discuss the implications for future technology like AI and potential cybersecurity crises. Plus, in our ‘Aware Much’ segment, Scott shares tips on protecting your data if your phone is stolen. Happy New Year and welcome […]
The post Reflecting on Y2K: Lessons for the Next Tech Crisis and AI Safety appeared first on Shared Security Podcast.
The post Reflecting on Y2K: Lessons for the Next Tech Crisis and AI Safety appeared first on Security Boulevard.
It is with profound sadness that we share the news of the passing of our beloved CEO Amit Yoran on January 3. Amit was not only a visionary leader but also a guiding force who profoundly impacted our industry, our company, our culture and our community.
Amit Yoran, chairman and CEO of Tenable, died on January 3
Under Amit's leadership, Tenable achieved significant milestones and he inspired each one of us with his dedication, passion and commitment to make a difference. Amit leaves behind an incredible legacy as a visionary, leader, colleague, mentor, brother, father and friend. He touched the lives of so many within and beyond our company and he will be missed.
As we navigate the days ahead, Mark Thurmond (Tenable COO) and Steve Vintz (Tenable CFO), who took over co-CEO duties on December 5, 2024, will ensure that we communicate any important updates as we drive the business forward just as Amit would have wanted.
As additional details regarding his memorial services are available we will keep you informed. We issued a press release with more details here: https://www.tenable.com/press-releases/tenable-announces-the-passing-of-chairman-and-ceo-amit-yoran
Please join us in remembering and honoring Amit for the indelible mark he left on all of us.
The post Tenable Chairman and CEO Amit Yoran Has Died appeared first on Security Boulevard.
Why Does Machine Identity Management Matter? Why should advanced machine identity management be a key concern for CISOs? With rapid technological advancements and the increasing dependence on cloud environments, businesses are confronted with a new array of security challenges. One such critical challenge is the safe management of Non-Human Identities (NHIs) along with their corresponding […]
The post Feel Supported by Advanced Machine Identity Management appeared first on Entro.
The post Feel Supported by Advanced Machine Identity Management appeared first on Security Boulevard.
The Untapped Potential of Machine Identity Management Are you aligning your cybersecurity efforts with the contemporary needs and trends? Organizations often overlook the significance and strategic depth of Non-Human Identities (NHIs) and Secrets Security Management. This lapse can expose businesses, particularly those operating in the cloud, to potential security breaches and data leaks. The Concept […]
The post Unlocking the Potential of Machine Identity Management appeared first on Entro.
The post Unlocking the Potential of Machine Identity Management appeared first on Security Boulevard.
Why is Effective Secret Storage So Crucial to Cloud Security? In an increasingly digitized world where every information is stored in the digital form, it’s crucial to question: how are these confidential secrets stored, and how do they affect our overall cloud security? This question lies at the heart of effective data protection strategies today. […]
The post How Reliable Secret Storage Enhances Cloud Security appeared first on Entro.
The post How Reliable Secret Storage Enhances Cloud Security appeared first on Security Boulevard.
This is Episode 4 of Threat Intelligence Hot Shots. Sr. Threat Intelligence Analyst, Alex Ryan, and Peter discuss the recent shutdown of breach forums by the FDI, the increasing pace of advanced techniques and target scope of Russian state-sponsored threat actors, and two new vulnerabilities for Dealing routers. They advise limiting access to these devices […]
The post Threat Intelligence Hot Shots Part 3: Episodes 4-13 (Compilation) appeared first on Security Boulevard.
I had rehearsed a whole opening for Episode 6 of The Unemployed: My Laid-Off Life but alas, I did not get the gig. This week, I share how I came close to landing a role through an internal referral—only to face rejection. But it’s not all bad news! I received some helpful feedback that I’m […]
The post The Unemployed Chronicles: Learn from My Mistakes appeared first on Security Boulevard.
OMB Memo M-24-15 published on July 24, 2024 directed GSA and the FedRAMP PMO to streamline the FedRAMP ATO process using NIST OSCAL. By late 2025 or early 2026 (18 months after the issuance of the memo), GSA must ensure the ability to receive FedRAMP authorization and continuous monitoring artifacts through automated, machine-readable means. Additionally, […]
The post Making FedRAMP ATOs Great with OSCAL and Components appeared first on Security Boulevard.
Why is Harnessing Non-Human Identities Central to Your Cybersecurity Strategy? In the realm of information security, managing identities – whether human or machine – is critical. This attention escalates further when you delve into the realm of Non-Human Identity (NHI) management. The importance can easily get obscured in the vast sphere of cybersecurity, but why […]
The post Confidently Secure: Leveraging PAM for Enhanced Protections appeared first on Entro.
The post Confidently Secure: Leveraging PAM for Enhanced Protections appeared first on Security Boulevard.
Why Is Secrets Rotation a Critical Aspect of Cybersecurity? Isn’t it intriguing how an object as intangible as ‘information’ can hold immense value in today’s digitally connected world? In the realm of cybersecurity, Secrets Rotation plays a key role in safeguarding this valuable asset. Secrets Rotation constitutes a dynamic process of creating, dispensing, and disabling […]
The post Stay Assured: Critical Insights into Secrets Rotation appeared first on Entro.
The post Stay Assured: Critical Insights into Secrets Rotation appeared first on Security Boulevard.
Author/Presenter: Lillian Ash Baker
Our sincere appreciation to DEF CON, and the Authors/Presenters for publishing their erudite DEF CON 32 content. Originating from the conference’s events located at the Las Vegas Convention Center; and via the organizations YouTube channel.
The post DEF CON 32 – The Interplay between Safety and Security in Aviation Systems3 appeared first on Security Boulevard.
This is a news item roundup of privacy or privacy-related news items for 29 DEC 2024 - 4 JAN 2024. Information and summaries provided here are as-is for warranty purposes.
Note: You may see some traditional "security" content mixed-in here due to the close relationship between online privacy and cybersecurity - many things overlap; for example, major vulnerabilities in popular software, which may compromise the security of user's devices (and therefore pose a threat to their privacy) and large data breaches where significant personal information is exposed.
Items presented here are typically curated with the end user and small groups (such as families and small/micro businesses) in mind. Due to this focus, items primarily affecting enterprises or large organizations may not be included, even if they are widespread or "popular" stories.
TABLE OF CONTENTS
Primarily covers tools and services with a focus on maintaining/improving/respecting user privacy. Generally includes recommended services/tools found on avoidthehack, but also may feature upcoming/other privacy services not necessarily recommended or promoted by avoidthehack.com
Privacy ToolsDivestOS, Mull, Mulch, and Hypatia discontinued
DivestOS Mobile
The developer behind DivestOS (a privacy-oriented Android operating system forked from LineageOS), Mull (a privacy browser for Android), Mulch (security-oriented webview for Android), and Hypatia (an open source virus scanner for Android) has announced these projects will no longer be supported/updated as of December 2024.
For years DivestOS was a recommended alternative privacy-oriented Android operating system on avoidthehack. In a future site update, I will regretfully remove it as an official recommendation due to its EOL status.
Vulnerabilities and MalwarePrimarily includes severe and exploited vulnerabilities in devices or software used by end users (ex: a major router firmware flaw). Malware campaigns covered generally target/affect the end user.
This section will not contain every vulnerability/CVE or malware campaign reported, but will focus on those with the largest potential impact on a wide range of end users.
VulnerabilitiesHackers exploit Four-Faith router flaw to open reverse shells
Bleeping Computer
Attackers are exploiting an OS command injection vulnerability, tracked as CVE-2024-12856, to open reverse shells, which can be used for further exploitation of the device. Specifically, a command used for adjusting the system time can be manipulated (via HTTP POST request) to include a shell command.
As of writing, there is no security update available. It appears that primarily internet-facing devices are vulnerable (they typically have remote management interfaces exposed to the internet in most cases). Users should keep routers updated, use strong admin passwords (avoid using the default credentials), and avoid exposing the admin login page to the internet.
Note that affected router models are typically deployed in some critical infrastructure sectors, but may apply to some users.
Malware botnets exploit outdated D-Link routers in recent attacks
Bleeping Computer
Two botnets (Ficora and Capsaicin) continue to target D-Link routers that are EOL or running outdated firmware. Commonly, these botnets exploit CVE-2015-2051, CVE-2019-10891, CVE-2022-37056, and CVE-2024-33112 for initial access to vulnerable D-Link routers. They then execute their payloads, which can steal data and/or recruit the device into the botnet.
Users should be sure to keep their devices updated - especially routers. EOL devices should be replaced as soon as possible, as they are no longer supported by the manufacturer. For EOL devices, depending on model and/or submodel, users may be able to flash firmware (such as OpenWRT) to extend the life of the device.
MalwareNew details reveal how hackers hijacked 35 Google Chrome extensions
Bleeping Computer
A phishing campaign targeting Chrome extension developers (including a cybersecurity firm, Cyberhaven) has enabled attackers to compromise multiple Google Chrome extensions. The compromised extensions were injected with data-stealing code.
Developers were sent phishing emails pretending to be from Google; the emails linked to Google's OAuth authorization flow for the threat actor controlled app "Privacy Policy Extension," requesting permissions such as editing/updating Chrome store extensions users have access to. Naturally, after permissions are granted, the threat actors publish an "updated" (malicious version of the extension).
It appears threat actors in this campaign were specifically interested in targeting and hijacking Facebook business accounts, attempting to grab information such as the user's Facebook ID, access token, account info, account information, and any CAPTCHA mechanisms/QR code images associated with MFA.
Service Providers' Privacy PracticesThis section is dedicated to notable changes or developments in popular/large service provider's privacy practices.
Service providers listed here are not necessarily "privacy-focused," but may have privacy practice changes positively (ex: adopting end-to-end encryption for messaging or) or negatively (ex: increased sharing of data with affiliates) affecting a large amount of users.
Negative changesApple auto-opts everyone into having their photos analyzed by AI for landmarks
The Register
Apple appears to have auto-opted users into a new feature, likely introduced in an iOS 18.1 update, known as Enhanced Visual Search. The auto opt-in is believed to have happened in late October 2024.
Apparently, the process by which this feature works is "private enough," but the lack of notification and not seeking consent from users is concerning.
Legislation/Lawsuits/RegulationsPredominately focused on legal/regulation privacy practices outlined in US law (ex: FTC banning certain companies from sharing location data), but large enough changes in EU law may also be covered here. Also notable privacy-related lawsuits (again, predominately in the US) are found here.
LawsuitsApple to pay $95 million to settle Siri privacy lawsuit
Reuters
Lawsuit alleges Apple used Siri to listen to what people were saying - ads were then targeted at them based on what they mentioned.
Apple pays the settlement but continues to deny any "wrongdoing." Interestingly, Google is being sued by the same law firm for similar concerning Google Assistant (Google's answer to Siri).
LegislationThe US proposes rules to make healthcare data more secure
The Verge
US Department of Health and Human Services has proposed new cybersecurity requirements for covered entities (healthcare organizations). This is in response to the severity and scale of data breaches in the healthcare sector in the last ~3 years.
The requirements will require these organizations to encrypt patient data (I'm assuming both in transit and at rest), use multifactor authentications (MFA) for accessing systems, and keep compliance documentation.
Will be the first update to HIPAA in over a decade (the last update was in 2013)
Data Breaches and LeaksGenerally covers large data breaches (or data leaks) exposing sensitive information of users - typically the focus is on US companies and on data breaches...
The post Privacy Roundup: Week 1 of Year 2025 appeared first on Security Boulevard.
The post Top 5 Mistakes SAQ A-EP Merchants Are Making in 2025 That Will Knock Them Out of PCI 4.0 Compliance appeared first on Feroot Security.
The post Top 5 Mistakes SAQ A-EP Merchants Are Making in 2025 That Will Knock Them Out of PCI 4.0 Compliance appeared first on Security Boulevard.
Could Advanced Secrets Management be Your Way to Feeling Relieved? Think about it. If you could significantly decrease the likelihood of security breaches and data leaks in your organization, wouldn’t that be a massive weight lifted off your shoulders? But how to systematically fortify your cybersecurity? The answer lies in Non-Human Identities (NHIs) and Secrets […]
The post Feel Relieved: Advanced Secrets Management Techniques appeared first on Entro.
The post Feel Relieved: Advanced Secrets Management Techniques appeared first on Security Boulevard.
Where Does Your Cloud Security Stand? Does your organization’s data management strategy consider non-human identities (NHIs) and secret security management? In the intricate dance of safeguarding data, ensuring the security of machine identities, or NHIs, and their corresponding secrets is pivotal. This practice remains an essential element of best cloud security practices and an effective […]
The post Ensure Your Data’s Safety: Best Practices in Cloud Security appeared first on Entro.
The post Ensure Your Data’s Safety: Best Practices in Cloud Security appeared first on Security Boulevard.
Humans are spectacularly bad at predicting the future. Which is why, when someone appears to be able to do it on a regular basis, they are hailed as visionaries, luminaries and celebrated with cool names like Nostradamus and The Amazing Kreskin. Nostradamus made his fame on predictions about the distant future, but that technique has […]
The post Imperva’s Wildest 2025 AppSec Predictions appeared first on Blog.
The post Imperva’s Wildest 2025 AppSec Predictions appeared first on Security Boulevard.
Authors/Presenters: Lucas Potter, Meow-Ludo Disco Gamma Meow-Meow, Xavier Palmer
Our sincere appreciation to DEF CON, and the Authors/Presenters for publishing their erudite DEF CON 32 content. Originating from the conference’s events located at the Las Vegas Convention Center; and via the organizations YouTube channel.
The post DEF CON 32 – The Past, Present, and Future of Bioweapons appeared first on Security Boulevard.
