Security Boulevard

How Are Non-Human Identities Revolutionizing Cybersecurity? Did you know that machine identities, also known as Non-Human Identities (NHIs), are becoming pivotal? With digital continues to expand, the need for robust security measures grows in parallel. NHIs, a crucial component, are quickly transforming the way organizations approach security, particularly in cloud-based environments. The Role of Non-Human […]

The post What new technologies are boosting Agentic AI capabilities appeared first on Entro.

The post What new technologies are boosting Agentic AI capabilities appeared first on Security Boulevard.

Session 11A: Blockchain Security 2

Authors, Creators & Presenters: Giulia Scaffino (TU Wien), Lukas Aumayr (TU Wien), Mahsa Bastankhah (Princeton University), Zeta Avarikioti (TU Wien), Matteo Maffei (TU Wien)

PAPER
Alba: The Dawn of Scalable Bridges for Blockchains

Over the past decade, cryptocurrencies have garnered attention from academia and industry alike, fostering a diverse blockchain ecosystem and novel applications. The inception of bridges improved interoperability, enabling asset transfers across different blockchains to capitalize on their unique features. Despite their surge in popularity and the emergence of Decentralized Finance (DeFi), trustless bridge protocols remain inefficient, either relaying too much information (e.g., light-client-based bridges) or demanding expensive computation (e.g., zk-based bridges). These inefficiencies arise because existing bridges securely prove a transaction's on-chain inclusion on another blockchain. Yet this is unnecessary as off-chain solutions, like payment and state channels, permit safe transactions without on-chain publication. However, existing bridges do not support the verification of off-chain payments. This paper fills this gap by introducing the concept of Pay2Chain bridges that leverage the advantages of off-chain solutions like payment channels to overcome current bridges' limitations. Our proposed Pay2Chain bridge, named Alba, facilitates the efficient, secure, and trustless execution of conditional payments or smart contracts on a target blockchain based on off-chain events. Alba, besides its technical advantages, enriches the source blockchain's ecosystem by facilitating DeFi applications, multi-asset payment channels, and optimistic stateful off-chain computation. We formalize the security of Alba against Byzantine adversaries in the UC framework and complement it with a game theoretic analysis. We further introduce formal scalability metrics to demonstrate Alba's efficiency. Our empirical evaluation confirms Alba's efficiency in terms of communication complexity and on-chain costs, with its optimistic case incurring only twice the cost of a standard Ethereum transaction of token ownership transfer.

ABOUT NDSS
The Network and Distributed System Security Symposium (NDSS) fosters information exchange among researchers and practitioners of network and distributed system security. The target audience includes those interested in practical aspects of network and distributed system security, with a focus on actual system design and implementation. A major goal is to encourage and enable the Internet community to apply, deploy, and advance the state of available security technologies.

Our thanks to the Network and Distributed System Security (NDSS) Symposium for publishing their Creators, Authors and Presenter’s superb NDSS Symposium 2025 Conference content on the Organizations' YouTube Channel.

Permalink

The post NDSS 2025 – Alba: The Dawn Of Scalable Bridges For Blockchains appeared first on Security Boulevard.

As federal and state governments extend their lists of banned foreign technologies, where is this trend heading next? Is your home network safe for work use?

The post After TikTok: Navigating the Complex Web of Foreign Tech Bans appeared first on Security Boulevard.

Blockchain Penetration Testing simulates real-world cyberattacks on blockchain systems to identify vulnerabilities before attackers can exploit them.  On September 14, 2021, the Solana blockchain network went offline for 17 hours during the Grape Protocol IDO (Initial DEX Offering) due to a Distributed Denial-of-Service (DDoS) attack.  In distributed blockchain applications, penetration testing frameworks have demonstrated throughput […]

The post Blockchain Penetration Testing: Definition, Process, and Tools appeared first on Security Boulevard.

AI-powered penetration testing is an advanced approach to security testing that uses artificial intelligence, machine learning, and autonomous agents to simulate real-world cyberattacks, identify vulnerabilities, and assess exploitability faster and more intelligently than traditional manual testing. According to Mariia Kozlovska et al. in their research “Artificial intelligence in penetration testing: leveraging AI for advanced vulnerability […]

The post AI-powered penetration testing: Definition, Tools and Process appeared first on Security Boulevard.

IoT penetration testing is a security assessment of the complete IoT ecosystem, from backend systems and cloud services to mobile devices and hardware. It involves a multi-stage simulated attack on IoT devices and their supporting system to identify security risks before attackers can exploit them. Unpatched firmware is responsible for 60% of IoT security breaches, […]

The post IoT Penetration Testing: Definition, Process, Tools, and Benefits appeared first on Security Boulevard.

How Can Least Privilege Transform Secure Cloud Operations? Have you ever pondered the repercussions of over-privileged access in cloud environments? With the rapid adoption of cloud technologies, the concept of least privilege has emerged when a cornerstone for secure cloud operations. This principle, while seemingly simple, significantly influences various sectors, enhancing security and operational efficiency. […]

The post What makes least privilege essential in secure cloud operations appeared first on Entro.

The post What makes least privilege essential in secure cloud operations appeared first on Security Boulevard.

How Secure is Secrets Encryption in Financial Services? Have you ever wondered how financial services ensure the safety of critical information? The key lies in the sophisticated management of Non-Human Identities (NHIs) and the rigorous approach to secrets encryption. These elements are essential to safeguarding sensitive data from falling into the wrong hands. The Role […]

The post How impenetrable is secrets encryption in financial services appeared first on Entro.

The post How impenetrable is secrets encryption in financial services appeared first on Security Boulevard.

How Do Non-Human Identities Impact Disaster Recovery and Cybersecurity? When considering disaster recovery and cybersecurity in cloud environments, have you thought about the role of Non-Human Identities (NHIs)? These machine identities—essentially digital passports with their own permissions—play a critical role in modern organizations. NHIs are at the forefront of data management and cybersecurity, providing a […]

The post Why is disaster recovery vital with NHI appeared first on Entro.

The post Why is disaster recovery vital with NHI appeared first on Security Boulevard.

What is the Role of Agentic AI in DevOps Security? How can organizations ensure the security of machine identities and secrets? A comprehensive security strategy, encompassing Non-Human Identities (NHIs) and Secrets Security Management, is crucial. This necessitates a reimagining of how cybersecurity frameworks can adapt to the rapid advancements in technology, particularly through the integration […]

The post How can Agentic AI transform DevOps security appeared first on Entro.

The post How can Agentic AI transform DevOps security appeared first on Security Boulevard.

Session 11A: Blockchain Security 2

Authors, Creators & Presenters: Ye Liu (Singapore Management University), Yue Xue (MetaTrust Labs), Daoyuan Wu (The Hong Kong University of Science and Technology), Yuqiang Sun (Nanyang Technological University), Yi Li (Nanyang Technological University), Miaolei Shi (MetaTrust Labs), Yang Liu (Nanyang Technological University)

PAPER
PropertyGPT: LLM-driven Formal Verification of Smart Contracts through Retrieval-Augmented Property Generation

Formal verification is a technique that can prove the correctness of a system with respect to a certain specification or property. It is especially valuable for security-sensitive smart contracts that manage billions in cryptocurrency assets. Although existing research has developed various static verification tools (or provers) for smart contracts, a key missing component is the automated generation of comprehensive properties, including invariants, pre-/post-conditions, and rules. Hence, industry-leading players like Certora have to rely on their own or crowdsourced experts to manually write properties case by case. With recent advances in large language models (LLMs), this paper explores the potential of leveraging state-of-the-art LLMs, such as GPT-4, to transfer existing human-written properties (e.g., those from Certora auditing reports) and automatically generate customized properties for unknown code. To this end, we embed existing properties into a vector database and retrieve a reference property for LLM-based in-context learning to generate a new property for a given code. While this basic process is relatively straightforward, ensuring that the generated properties are (i) compilable, (ii) appropriate, and (iii) verifiable presents challenges. To address (i), we use the compilation and static analysis feedback as an external oracle to guide LLMs in iteratively revising the generated properties. For (ii), we consider multiple dimensions of similarity to rank the properties and employ a weighted algorithm to identify the top-K properties as the final result. For (iii), we design a dedicated prover to formally verify the correctness of the generated properties. We have implemented these strategies into a novel LLM-based property generation tool called PropertyGPT. Our experiments show that PropertyGPT can generate comprehensive and high-quality properties, achieving an 80% recall compared to the ground truth. It successfully detected 26 CVEs/attack incidents out of 37 tested and also uncovered 12 zero-day vulnerabilities, leading to $8,256 in bug bounty rewards.

ABOUT NDSS
The Network and Distributed System Security Symposium (NDSS) fosters information exchange among researchers and practitioners of network and distributed system security. The target audience includes those interested in practical aspects of network and distributed system security, with a focus on actual system design and implementation. A major goal is to encourage and enable the Internet community to apply, deploy, and advance the state of available security technologies.

Our thanks to the Network and Distributed System Security (NDSS) Symposium for publishing their Creators, Authors and Presenter’s superb NDSS Symposium 2025 Conference content on the Organizations' YouTube Channel.

Permalink

The post NDSS 2025 – PropertyGPT appeared first on Security Boulevard.

SOC teams keep asking how the AI SOC differs from traditional SOAR. Here's what Morpheus does differently—from integration maintenance to false negatives.

The post We Keep Hearing the Same Question: Morpheus (AI SOC) vs. Traditional SOAR appeared first on D3 Security.

The post We Keep Hearing the Same Question: Morpheus (AI SOC) vs. Traditional SOAR appeared first on Security Boulevard.

With any security framework, be it ISO 27001, FedRAMP, or CMMC, the goal is not to secure “your business.” It’s to secure sensitive and controlled information that your business handles. This is a fundamentally important way of looking at your security. Why does this matter? It’s all about borders. Where do you draw the line […]

The post CMMC Enclave Strategy vs Full Environment Compliance appeared first on Security Boulevard.

A new species of squid. pretends to be a plant:

Scientists have filmed a never-before-seen species of deep-sea squid burying itself upside down in the seafloor—a behavior never documented in cephalopods. They captured the bizarre scene while studying the depths of the Clarion-Clipperton Zone (CCZ), an abyssal plain in the Pacific Ocean targeted for deep-sea mining.

The team described the encounter in a study published Nov. 25 in the journal Ecology, writing that the animal appears to be an undescribed species of whiplash squid. At a depth of roughly 13,450 feet (4,100 meters), the squid had buried almost its entire body in sediment and was hanging upside down, with its siphon and two long ...

The post Friday Squid Blogging: New Squid Species Discovered appeared first on Security Boulevard.

How Does Agentic AI Revolutionize Healthcare Security? Are you prepared to explore the transformative power of Agentic AI in securing the healthcare industry? The intersection of artificial intelligence and cybersecurity has opened doors to innovative methodologies. This sector is under constant scrutiny due to the sensitive nature of its data. While we delve deeper into […]

The post How is Agentic AI changing healthcare security appeared first on Entro.

The post How is Agentic AI changing healthcare security appeared first on Security Boulevard.

How Are Non-Human Identities Shaping Cloud Security? What does it take to bridge the gap between security and R&D teams when managing non-human identities in cloud environments? Non-human identities (NHIs) are pivotal in modern cybersecurity frameworks, acting as machine identities that ensure secure interaction between different technological entities. Understanding their role and maintaining effective security […]

The post What future trends will define Agentic AI governance appeared first on Entro.

The post What future trends will define Agentic AI governance appeared first on Security Boulevard.

Why Are Non-Human Identities Crucial for Cloud Security? Does your organization fully understand the importance of Non-Human Identities (NHIs) in cybersecurity? With a crucial component of cloud security, managing these machine identities effectively can be the key to minimizing risks and ensuring robust access management. Where systems and services interact automatically, establishing a comprehensive strategy […]

The post Can Agentic AI ensure full IAM compliance appeared first on Entro.

The post Can Agentic AI ensure full IAM compliance appeared first on Security Boulevard.

Are You Overlooking Non-Human Identities in Cloud Security? Machine identities have emerged as critical components that require immediate attention and robust management. Where organizations increasingly rely on digital transformations and cloud environments, the security of Non-Human Identities (NHIs) and their secrets vaults cannot be overstated. The management of machine identities, often called NHIs, combines encrypted […]

The post How secure are secrets vaults in cloud environments appeared first on Entro.

The post How secure are secrets vaults in cloud environments appeared first on Security Boulevard.

Session 11A: Blockchain Security 2

Authors, Creators & Presenters: Qiyang Song (Institute of Information Engineering, Chinese Academy of Sciences; School of Cyber Security, University of Chinese Academy of Sciences), Heqing Huang (Institute of Information Engineering, Chinese Academy of Sciences), Xiaoqi Jia (Institute of Information Engineering, Chinese Academy of Sciences; School of Cyber Security, University of Chinese Academy of Sciences), Yuanbo Xie (Institute of Information Engineering, Chinese Academy of Sciences; School of Cyber Security, University of Chinese Academy of Sciences), Jiahao Cao (Institute for Network Sciences and Cyberspace, Tsinghua University)

PAPER
Silence False Alarms: Identifying Anti-Reentrancy Patterns on Ethereum to Refine Smart Contract Reentrancy Detection

Reentrancy vulnerabilities in Ethereum smart contracts have caused significant financial losses, prompting the creation of several automated reentrancy detectors. However, these detectors frequently yield a high rate of false positives due to coarse detection rules, often misclassifying contracts protected by anti-reentrancy patterns as vulnerable. Thus, there is a critical need for the development of specialized automated tools to assist these detectors in accurately identifying anti-reentrancy patterns. While existing code analysis techniques show promise for this specific task, they still face significant challenges in recognizing anti-reentrancy patterns. These challenges are primarily due to the complex and varied features of anti-reentrancy patterns, compounded by insufficient prior knowledge about these features. This paper introduces AutoAR, an automated recognition system designed to explore and identify prevalent anti-reentrancy patterns in Ethereum contracts. AutoAR utilizes a specialized graph representation, RentPDG, combined with a data filtration approach, to effectively capture anti-reentrancy-related semantics from a large pool of contracts. Based on RentPDGs extracted from these contracts, AutoAR employs a recognition model that integrates a graph auto-encoder with a clustering technique, specifically tailored for precise anti-reentrancy pattern identification. Experimental results show AutoAR can assist existing detectors in identifying 12 prevalent anti-reentrancy patterns with 89% accuracy, and when integrated into the detection workflow, it significantly reduces false positives by over 85%.

ABOUT NDSS
The Network and Distributed System Security Symposium (NDSS) fosters information exchange among researchers and practitioners of network and distributed system security. The target audience includes those interested in practical aspects of network and distributed system security, with a focus on actual system design and implementation. A major goal is to encourage and enable the Internet community to apply, deploy, and advance the state of available security technologies.

Our thanks to the Network and Distributed System Security (NDSS) Symposium for publishing their Creators, Authors and Presenter’s superb NDSS Symposium 2025 Conference content on the Organizations' YouTube Channel.

Permalink

The post NDSS 2025 – Silence False Alarms appeared first on Security Boulevard.

As we look back on 2025, AI and open source have fundamentally changed how software is built. Generative AI, automated pipelines, and ubiquitous open source have dramatically increased developer velocity and expanded what teams can deliver — while shifting risk into the everyday decisions developers make as code is written, generated, and assembled.

The post The Great Shift: Cybersecurity Predictions for 2026 and the New Era of Threat Intelligence appeared first on Security Boulevard.