Security Boulevard

LAS VEGAS — A decade ago, the rise of public cloud brought with it a familiar pattern: runaway innovation on one side, and on the other, a scramble to retrofit security practices not built for the new terrain.

Related: GenAI … (more…)

The post MY TAKE: The GenAI security crisis few can see — but these startups are mapping the gaps first appeared on The Last Watchdog.

The post MY TAKE: The GenAI security crisis few can see — but these startups are mapping the gaps appeared first on Security Boulevard.

Discover how passwordless authentication secures online academic writing platforms while enhancing user privacy and trust.

The post Securing Online Writing Platforms with Passwordless Authentication appeared first on Security Boulevard.

Multiple ransomware vendors are using the same EDR killer tool, which not only adds to the trend in developing such payloads to terminate protections for systems but also suggests that competing threat actors are sharing tools and technical knowledge, which is another challenge for security vendors, Sophos says.

The post Multiple Ransomware Groups are Using Tool to Kill EDR Defenses: Sophos appeared first on Security Boulevard.

MojoAuth adds passwordless security to Lemlist alternative platforms, safeguarding sales funnels and boosting trust, compliance, and deliverability

The post The Overlooked Part of Sales Funnels: How MojoAuth Secures Lemlist Alternative Platforms appeared first on Security Boulevard.

Organizations should remember that the proactive hunts conducted by CISA, which has been stripped down and is under assault by the Trump administration, are invaluable.

The post CISA, Coast Guard Hunt Engagement Offer Path to Protect Critical Infrastructure    appeared first on Security Boulevard.

Most growing B2B companies are making the same expensive mistake with AI that they made with cloud computing 15 years ago. Here's why building your own AI infrastructure will kill your competitive advantage and what smart leaders are doing instead.

The post Why Your Growing B2B Company Shouldn’t Build AI Infrastructure (And What to Do Instead) appeared first on Security Boulevard.

Cloudflare recently introduced a new authentication standard, HTTP message signatures, designed to securely verify automated traffic from known bot operators. OpenAI has adopted this standard in its OpenAI Operator product, which allows ChatGPT agents to perform actions on behalf of users.

This new approach replaces the traditional method of IP-based

The post How to authenticate OpenAI Operator requests using HTTP message signatures appeared first on Security Boulevard.

California Consumer Privacy Act (CCPA): CCPA and CPRA, Simplified On July 1, 2025, the California Attorney General settled with Healthline for $1.55 million, the highest CCPA-related fine to date, citing...

The post Everything You Need to Know About the California Consumer Privacy Act (CCPA) in 2025 appeared first on Strobes Security.

The post Everything You Need to Know About the California Consumer Privacy Act (CCPA) in 2025 appeared first on Security Boulevard.

Why a secrets management strategy is now critical for modern security.

The post Secrets Management Fireside Chat: Doppler, Financial Times, BODi, and Secureframe appeared first on Security Boulevard.

Project Red Hook is a Homeland Security Investigations operation examining how Chinese Organized Crime is committing wholesale Gift Card Fraud by using Chinese illegal immigrants to steal gift cards, reveal their PIN, reseal the cards, and return them to store racks.  When the card is later purchased and activated, operators are standing by to quickly drain the card before the customer can use it. How many cards are we talking about?  More than $1 Billion worth! 

Here are a few cases of interest to me - especially the first one! 

Birmingham, Alabama 

https://www.justice.gov/usao-ndal/pr/chinese-nationals-charged-illegally-possessing-counterfeit-and-unauthorized-gift-cards

25JUN2025 - the Hoover Alabama Police Department put out a BOLO for two Asian males in a gray Lexus SUV with California tag DE53Y62 who were switching gift cards in racks at local CVS stores.  Jiadong Cao, 36, and Xuejun Zheng, 48, were stopped and arrested the following day in Pelham, Alabama and found to possess more than 5,000 gift cards.  Portions of the gift card numbers had been destroyed on the cards, which would allow the cards to be activated at the register, but not used by the customer who purchased them. 300 altered cards for Home Depot, Amazon, Sephora, Macy's and Nike were found in their car.  Home Depot reviewed their cards and confirmed they had not been sold.

The Federal criminal complaint was written up by a former student of mine!  USSS Special Agent Scott Easterwood! Jiadong Cao is a Chinese citizen who entered the US in September 2024 and is illegally in the country now.  Xuejun Zheng also entered the US in September and has filed for asylum in the US. In the CVS store that started this investigation, they had added altered gift cards to the rack, including six Nike cards, ten Macy's cards, and nine Best Buy cards. 

Louisville, Kentucky https://www.wlky.com/article/men-arrested-gift-card-scam-louisville-millions-lost/62673181 19OCT2024 - Kroger security personnel observed Chaoming Lin placing gift cards back on a rack at a store on North Hubbards Lane. He was stopped shortly thereafter by St. Matthews Police, who found him in the car with Zhiqiang Huang.  Around 5,000 gift cards were found in a search of the vehicle, with at least 2,000 appearing to have been altered. That same day, Kroger loss prevention reported another instance and that an Asian man was seen leaving in a black Dodge Charger.  That car was also stopped with Tianlong Chen and Huixing Yu in the car with several cell phones and 658 gift cards in the car.   These four had hit stores in Ohio, Pennsylvania, and New York before being arrested in Kentucky. 

St. Matthew's Police chief Barry Wilkerson said the gift cards they recovered were worth at least $1 million. Tianlong Chen entered a guilty plea on 11JUL2025 and will remain in custody until sentencing on 16OCT2025. 

Gainesville, Florida
https://www.documentcloud.org/documents/24536188-gainesville-case-detailed-arrest-report/ 24AUG2024 - The Alachua County Sheriff's office pulled over a Hertz rental vehicle being driven by Cheng Li, 25, with female passenger Jiaxin Jiang, 24.   The car was rented by Jiang despite him only possessing a New York Learner's permit.  After a narcotics K-9 hit on the car, the car was searched and found to contain 1,764 gift cards from Apple, Target, Visa, Mastercard, and American Express.  A GPS review provided by Hertz confirmed that the pair had left Long Island, New York, stopping at two Target stores in Laurel, Virginia, ten Target stores in the Duluth/Atlanta Georgia area, two Target stores in Knoxville, Tennessee, and a Target store in Johnson City, North Carolina before being arrested after a stop at the Target store in Gainesville, Florida.  Their mapping software indicated they were headed to a Target store in Ocala, Florida next. 

A review of Cheng's cell phones (after a search warrant) revealed that he had been involved in "Target fraud" chats on WeChat since as far back as December 2022. Ledgers on Jiang's computer showed they had been collecting gift card numbers and their associated PINs going back as far as 09AUG2022. WeChat groups retrieved by the phone show groups with as many as 1558 messages and 257 photos with some groups having as many as eleven members who all seemed involved in the same types of activities. 

The Chinese language website "https://www.uscardforum.com/t/topic/321165" shared a Chinese version of the traffic stop, complete with opening the trunk and finding the cards! 

The couple tell the police they are in Florida because they wanted to see a crocodile! 

 (Watch on YouTube here: https://www.youtube.com/watch?v=YChGKg2KrDo - jump to 16:40 for the "trunk reveal." ) 

Ventura, California

15MAY2024 - Ventura County detectives are part of the Ventura County Organized Retail Theft Task Force (VCORTTF).  They were operating a "blitz" against organized retail crime, deploying detectives in coordination with loss prevention specialists in retail stores. when they arrested Tingxiang Yang, 39, and Lingyu Chen, 35.  They were in possession of 800 gift cards stolen from a Moorpark Target store. They were released after posting $20,000 bail. 

Ocala, Florida

 https://www.ice.gov/news/releases/chinese-national-pleads-guilty-gift-card-fraud-scheme

17OCT2023 - a police officer in Ocala, Florida arrested Donghui Liao, age 32.  Liao was observed taking gift cards from his black shoulder back and placing those gift cards on a gift card display in a Target store. Seventy-one cards on the rack were found to have been altered.  The cards had been shop-lifted, scratched to reveal their PIN, "re-silvered" so that they did not appear to have been scratched, and then returned to card racks in stores.  Liao was found to be on surveillance camera imagery at stores in Ohio, Georgia, North Carolina, and Florida. 

When police searched his car, they found 6,032 additional gift cards with a face value of $1,886,000! 

Donghui was sentenced to 33 months in prison with 3 years supervised release to follow. 

The post Project Red Hook: Chinese Gift Card Fraud at Scale appeared first on Security Boulevard.

Palo Alto Networks this week revealed it is providing early access to an application security posture management (ASPM) module for its Cortex security platform as part of a larger effort to streamline cybersecurity workflows. The Cortex Cloud combines a cloud native application protection platform (CNAPP) and a set of cloud detection and response (CDR) capabilities..

The post Palo Alto Networks Previews ASPM Module for Cortex Cloud Platform appeared first on Security Boulevard.

This week at the Black Hat USA 2025 conference, Contrast Security added integrations with GitHub Copilot and the security information and event management (SIEM) platform from Sumo Logic to the Northstar edition of its application detection and response (ADR) platform. The ADR platform from Contrast Security maps live attack paths and correlates runtime behavior to surface..

The post Contrast Security Adds GitHub Copilot and Sumo Logic Integrations to ADR Platform appeared first on Security Boulevard.

Creator/Author/Presenter: Eleanor Mount

Our deep appreciation to Security BSides - San Francisco and the Creators/Authors/Presenters for publishing their BSidesSF 2025 video content on YouTube. Originating from the conference’s events held at the lauded CityView / AMC Metreon - certainly a venue like no other; and via the organization's YouTube channel.

Additionally, the organization is welcoming volunteers for the BSidesSF Volunteer Force, as well as their Program Team & Operations roles. See their succinct BSidesSF 'Work With Us' page, in which, the appropriate information is to be had!

Permalink

The post BSidesSF 2025: Third-Party Risk Management: SOC 2s, Security Questionnaires, And Psychosis appeared first on Security Boulevard.

Trend Micro releases a temporary mitigation tool to reduce exposure to two unpatched zero-day command injection vulnerabilities which have been exploited.

Background

On August 5, Trend Micro released a security advisory for two critical flaws affecting on-prem versions of Apex One Management Console. According to the advisory, Trend Micro has observed active exploitation of the vulnerabilities.

CVE Description CVSSv3 CVE-2025-54987 Trend Micro Apex One Management Console Command Injection Vulnerability 9.4 CVE-2025-54948 Trend Micro Apex One Management Console Command Injection Vulnerability 9.4

According to Trend Micro, these two CVEs are the same, however CVE-2025-54987 was issued for a different CPU architecture.

Analysis

CVE-2025-54987 and CVE-2025-54948 are both command injection vulnerabilities affecting the management console of on-prem installations of Trend Micro Apex One. An unauthenticated attacker with network or physical access to a vulnerable machine can upload arbitrary files, allowing the attacker to execute commands and achieve code execution. While two CVEs were issued, the advisory notes that CVE-2025-54987 was issued for a different CPU architecture than CVE-2025-54948.

Trend Micro Apex One™ as a Service and Trend Vision One Endpoint Security - Standard Endpoint Protection have been mitigated to these vulnerabilities as of July 31 and are not impacted by them. At this time, only on-prem installations of Apex One are affected.

Historical exploitation of Apex One

Apex One has been targeted by threat actors in the past, including zero-day exploitation of flaws affecting on-prem installations. CVE-2020-8467 and CVE-2020-8468 were addressed in March 2020 after in the wild exploitation was discovered, followed by CVE-2022-40139 in September 2022. As of the time this blog was published on August 6, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) lists nine vulnerabilities in Apex One in its Catalog of Known Exploited Vulnerabilities (KEV).

Vendor response

As of the time this blog was published on August 6, Trend Micro’s security advisory for these vulnerabilities notes that a patch has not yet been released and is to be expected “around the middle of August 2025.” We will update the blog with further updates and solution steps once patches are released.

In the meantime, a short-term mitigation tool has been released. This tool can be used to protect against known exploits and disables “the ability for administrators to utilize the Remote Install Agent function to deploy agents.”

While successful exploitation requires an attacker to either have physical access or network access to the management interface, Trend Micro suggests that customers who have publicly exposed the management console's IP address also consider additional mitigation factors to restrict access to the management console.

Identifying affected systems

A list of Tenable plugins for this vulnerability can be found on the individual CVE pages for CVE-2025-54987 and CVE-2025-54948 as they’re released. This link will display all available plugins for these vulnerabilities, including upcoming plugins in our Plugins Pipeline.

Get more information

• Trend Micro Security Advisory: ITW CRITICAL SECURITY BULLETIN: Trend Micro Apex One™ (On-Premise) Management Console Command Injection RCE Vulnerabilities

Join Tenable's Research Special Operations (RSO) Team on the Tenable Community.

Learn more about Tenable One, the Exposure Management Platform for the modern attack surface.

The post CVE-2025-54987, CVE-2025-54948: Trend Micro Apex One Command Injection Zero-Days Exploited In The Wild appeared first on Security Boulevard.

With over $100 million on the table in FY25 cybersecurity grants, state, local and tribal governments have until August 15, 2025 to apply to secure critical cyber funding to strengthen their defenses.

On August 1st, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) and the Federal Emergency Management Agency (FEMA) announced the FY 2025 Notice of Funding Opportunity (NOFO) for the State and Local Cybersecurity Grant Program (SLCGP), releasing over $100 million in federal grants to help state, local, tribal and territorial governments build critical cyber resilience. 

The funding supports two programs:

• SLCGP: $91.7 million for state and local governments
• Tribal Cybersecurity Grant Program (TCGP): $12.1 million for tribal governments

SLTT governments face growing threats -- from ransomware and data breaches to rising attacks on operational technology (OT) systems like water, transportation and emergency services. With limited resources and aging infrastructure, many are vulnerable to disruptions with real world consequences. The grants offer a critical opportunity to strengthen defenses and build lasting cyber resilience. 

Critical dates

• Application deadline: August 15, 2025 at 5:00 p.m. ET via FEMA’s Grants.gov submission portal.
• Awards announced: September 9, 2025
• Cybersecurity plan deadline: All applicants must resubmit their current CISA-approved plan, revised if necessary, by January 30, 2026, and annually thereafter.

FY 2025 grant priorities

As in previous years, your application must address at least one of these program objectives:

• Establish governance: Build or improve cybersecurity governance structures and cybersecurity plans to strengthen incident response and operational continuity.
• Assess cyber posture: Understand your current cybersecurity maturity and identify gaps through continuous testing, evaluation and structured assessments.
• Implement risk-based protections: Apply security measures aligned with your organization’s specific risks.
• Train the workforce: Provide role-based cybersecurity training for all relevant staff. 

These objectives align with CISA’s Cybersecurity Performance Goals (CPGs), ensuring funded activities deliver measurable, sustainable improvements in cyber resilience. 

Eligibility and funding Details

• SLCGP: States apply through their State Administrative Agencies (SAAs), with 80% of funds passed to local governments.
• TCGP: Tribal governments apply directly.

How Tenable helps SLTTs advance SLCGP goals

Tenable’s unified cybersecurity solutions directly align with SLCGP objectives and priorities, helping SLTTs gain visibility, reduce risk and build sustainable cyber resilience across IT and OT environments. 

Meet SLCGP objectives with Tenable One

The Tenable One Exposure Management Platform gives governments a complete, unified view of their cyber risk across IT, cloud , OT, IoT, web applications and identity systems. It supports multiple objectives by helping agencies:

• Understand their cybersecurity posture through continuous asset discovery, vulnerability assessment and risk-based prioritization.
• Implement risk-based protections using contextualized insights and attack path analysis
• Support governance and planning efforts with reporting and metrics that align with CISA’s CPGs. 

Protect critical infrastructure with Tenable OT security

As threats to critical infrastructure like water systems and emergency services increase, it's crucial to secure both IT and OT environments. The FY25 NOFO specifically funds “targeted cybersecurity investments” to help SLTT governments strengthen the security and resilience of their critical infrastructure and services. 

OT systems are increasingly targeted in cyberattacks and SLTTs often lack dedicated resources or tools to monitor these environments. With Tenable OT Security, agencies can:

• Gain deep visibility into OT and IoT assets and their vulnerabilities.
• Detect threats across converged IT/OT environments.
• Automatically identify network anomalies and policy violations, detect anomalous behavior and track signatures for potential high risk events with context-rich alerts.
• Prioritize remediation of high risk vulnerabilities with risk scores based on vulnerability context and potential impact.
• Streamline audit, compliance and reporting.

Learn more: 

• Read the CISA press release: DHS Launches Over $100 Million in Funding to Strengthen Communities’ Cyber Defenses
• Visit CISA’s Cyber Grants Home Page
• Visit the Tenable SLCGP website to review resources on how Tenable can help
• Read our blog: How Exposure Management Can Efficiently and Effectively Improve Cyber Resilience for State and Local Governments
• Read our whitepaper on strengthening state and local government cyber resilience for critical infrastructure

The post Act Now: $100M in FY25 Cyber Grants for SLTTs Available Before August 15 appeared first on Security Boulevard.

via the comic artistry and dry wit of Randall Munroe, creator of XKCD

Permalink

The post Randall Munroe’s XKCD ‘Flettner Rotor’ appeared first on Security Boulevard.

Short-lived credentials reduce exposure – but they aren’t secure by default. Here’s what ephemeral identity gets right, and where it can fail.

The post The Promise and Pitfalls of Ephemeral Identities appeared first on Security Boulevard.

7 min readManaging identity across cloud providers used to be a human problem – think SSO portals and workforce identity sync. However, as infrastructure becomes more automated, the real fragmentation now resides between workloads: CI/CD pipelines authenticating to SaaS tools, containers accessing APIs, and jobs calling into services across clouds. Each environment has its identity system, and […]

The post What Identity Federation Means for Workloads in Cloud-Native Environments appeared first on Aembit.

The post What Identity Federation Means for Workloads in Cloud-Native Environments appeared first on Security Boulevard.

DataDome and TollBit partner to help businesses protect content and monetize compliant AI traffic. Gain real-time protection, actionable insights, and new revenue from agentic AI.

The post DataDome & TollBit Partner to Protect and Monetize AI traffic appeared first on Security Boulevard.

Creators/Authors/Presenters: Ashish Rajan, Jackie Bow, Kane Narraway

Our deep appreciation to Security BSides - San Francisco and the Creators/Authors/Presenters for publishing their BSidesSF 2025 video content on YouTube. Originating from the conference’s events held at the lauded CityView / AMC Metreon - certainly a venue like no other; and via the organization's YouTube channel.

Additionally, the organization is welcoming volunteers for the BSidesSF Volunteer Force, as well as their Program Team & Operations roles. See their succinct BSidesSF 'Work With Us' page, in which, the appropriate information is to be had!

Permalink

The post https://www.youtube-nocookie.com/embed/IPusFv_iEI8?si=Kr-IckosVNP0Azou appeared first on Security Boulevard.