Help Net Security

For the fourth time in the last five months, Apache OFBiz users have been advised to upgrade their installations to fix a critical flaw (CVE-2024-45195) that could lead to unauthenticated remote code execution. About CVE-2024-45195 Apache OFBiz is an open-source suite for enterprise resource planning (ERP), which contains web applications for human resources management, customer relationship management, accounting, marketing, etc. “Apache OFBiz is used by numerous large organizations, and previously disclosed vulnerabilities for it have … More →

The post Apache OFBiz team patches critical RCE vulnerability (CVE-2024-45195) appeared first on Help Net Security.

Cequence Security announced a new partnership with Netskope. Through the partnership, Netskope customers can now leverage unique API threat intelligence from the Cequence Unified API Protection (UAP) platform to unlock insights into real-world threats and ultimately strengthen organizational security posture. Cybercriminals increasingly target APIs and deploy automated attacks such as bots, exposing organizations to data breaches, compliance violations, and financial loss. The explosive growth of APIs has created a complex threat landscape, requiring comprehensive solutions … More →

The post Cequence Security partners with Netskope to provide protection for business-critical APIs appeared first on Help Net Security.

Veza announced a partnership with HashiCorp to deliver an integrated solution for solving modern identity security challenges. Together, the Veza Access Platform and HashiCorp Vault empower joint customers to strengthen their identity security posture by bringing least privilege to the management of secrets and keys. With cloud and SaaS investments maturing rapidly, coupled with the advent of new technologies like Generative AI (GenAI), the complexity of enterprise environments has created a significant challenge for security … More →

The post Veza and HashiCorp join forces to help prevent credential exposure appeared first on Help Net Security.

I asked for a calm August 2024 Patch Tuesday in last month’s forecast article and that came to pass. The updates released were limited to the regular operating systems and all forms of Office applications. Six zero-day vulnerabilities were announced, with five in the operating systems and one in the Office applications. There were 63 CVEs addressed in the Windows 10 operating systems and associated servers and 55 CVEs addressed in Windows 11. Overall, it … More →

The post September 2024 Patch Tuesday forecast: Downgrade is the new exploit appeared first on Help Net Security.

Businesses run on SaaS solutions: nearly every business function relies on multiple cloud-based tech platforms and collaborative work tools like Slack, Google Workspace apps, Jira, Zendesk and others. We recently surveyed security leaders and CISOs on top data security priorities and challenges. We discovered that over 70% work in organizations using 50 or more SaaS solutions, and nearly a third of the respondents reported their organization’s SaaS environments include 200 or more apps. With so … More →

The post Human firewalls are essential to keeping SaaS environments safe appeared first on Help Net Security.

Respotter is an open-source honeypot designed to detect attackers when they launch Responder within your environment. This application identifies active instances of Responder by exploiting its behavior when responding to any DNS query. Respotter leverages LLMNR, mDNS, and NBNS protocols to query a non-existent hostname (default: Loremipsumdolorsitamet). If any of these requests receive a response, Responder is likely operating on your network. Respotter can send webhooks to Slack, Teams, or Discord. It also supports sending … More →

The post Respotter: Open-source Responder honeypot appeared first on Help Net Security.

As cybercriminals continue to refine their methods, blending traditional strategies with new technologies, the financial toll on individuals and organizations has reached alarming levels. Businesses are also grappling with mounting cybercrime costs from ransomware and DDoS attacks, which can inflict hundreds of thousands of dollars in damage within minutes. These statistics highlight a growing concern: as cybercrime costs rise and threats become more complex and widespread, they impact organizations of all sizes. Old methods, new … More →

The post The true cost of cybercrime for your business appeared first on Help Net Security.

Ransomware is an all-too-common occurrence: 83% of organizations have experienced at least one ransomware attack in the last year, 46% of respondents experienced four or more and 14% indicated they experienced 10 or more. Of those respondents who experienced at least one ransomware attack in the last year, 61% said it resulted in downtime of at least 24 hours, according to Onapsis. Source: Onapsis Of those organizations that experienced ransomware attacks, 89% said their Enterprise … More →

The post 83% of organizations experienced at least one ransomware attack in the last year appeared first on Help Net Security.

Here’s a look at the most interesting products from the past week, featuring releases from Binarly, Bitdefender, Prompt Security, Revenera, Skyhigh Security, and Vanta. Bitdefender Security for Creators protects YouTube content creators and influencers from hackers Bitdefender Security for Creators safeguards content channels and social media accounts from takeovers and supports Windows, Mac, Android, and iOS. Set-up takes a few moments and connects to both content channel and owner. Once activated, Bitdefender continuously monitors for … More →

The post New infosec products of the week: September 6, 2024 appeared first on Help Net Security.

Vanta announced new product features and milestones, allowing customers to automate existing GRC workflows and gain continuous visibility across their security and compliance program. Vanta’s new Report Center, enhancements to VRM and milestone achievements for pre-built integrations and frameworks give GRC and security teams always-on visibility with actionable insights so they can establish and promote trust internally and externally. Vanta’s latest releases and milestones help resource-strapped teams to maintain a strong security and compliance posture. … More →

The post Vanta empowers GRC teams to make their security and compliance automated appeared first on Help Net Security.

Proofpoint introduced its Digital Communications Governance (DCG) offering, bolstering its existing offerings in pace with the evolving modern data governance and enterprise archiving market. The new offering helps organizations simplify governance of communication data and provides security insights across all major digital channels for conduct risk. It leverages artificial intelligence (AI) to surface key data insights, reducing false positives while facilitating high efficacy information discovery and supervisory review. Today’s data governance and compliance market has … More →

The post Proofpoint helps organizations simplify governance of communication data appeared first on Help Net Security.

Bitdefender unveiled Bitdefender Security for Creators, a service specifically designed for digital content producers, online creative professionals and social media influencers who are prime targets for account takeovers, fraud, and other cybercrimes. Initially the new offering protects YouTube accounts with additional platform support such as Facebook, TikTok, Instagram and others to follow. In the 2024 Consumer Cybersecurity Assessment Report, based on an independent global survey of over 7,000 consumers, nearly a quarter (24.3%) experienced a … More →

The post Bitdefender Security for Creators protects YouTube content creators and influencers from hackers appeared first on Help Net Security.

Binarly announced Binarly Transparency Platform 2.5 with several features designed to enhance software vulnerability management and improve security posture across enterprise environments. The key highlight of this release is the innovative Reachability Analysis, a feature that identifies and prioritizes vulnerabilities based on their exploitability within the system’s execution flow, allowing for more targeted and effective remediation. With the introduction of Reachability Analysis, Binarly’s Transparency Platform 2.5 provides a truly innovative method to evaluate risk by … More →

The post Binarly Transparency Platform 2.5 identifies critical vulnerabilities before they can be exploited appeared first on Help Net Security.

The automotive industry is facing many of the same cybersecurity risks and threats that successful organizations in other sectors are up against, but it’s also battling some distinct ones. In this Help Net Security interview, Josh Smith, Principal Threat Analyst at Nuspire – a managed security services provider that has deep roots in the automotive sector and protects clients like GM and Subaru – talks about the present risks and threats and opines on the … More →

The post The future of automotive cybersecurity: Treating vehicles as endpoints appeared first on Help Net Security.

Organizations’ preparedness and resilience against threats isn’t keeping pace with cybercriminals’ advancements. Some CEOs still believe that cybersecurity requires episodic intervention rather than ongoing attention. That isn’t the reality for many companies; cyber threat preparedness requires a concerted training effort, so cybersecurity teams are ready when an attack occurs. Cybersecurity practitioners often share curiosity as a key personality trait, and many enjoy hands-on learning approaches. This naturally makes gamified experiences like competitions and capture-the-flags a … More →

The post How to gamify cybersecurity preparedness appeared first on Help Net Security.

In this Help Net Security video, Jesse Sedler, VP of Product at 1touch.io, provides a compelling overview of the company’s innovative data security posture management solutions. Founded in 2017 by industry veterans, 1touch.io leverages cutting-edge AI to deliver continuous monitoring and contextual visibility of sensitive data across industries such as finance, healthcare, technology, etc. Sedler highlights how the platform addresses key challenges like risk mitigation, compliance, digital transformation, and governance automation. With its unique approach … More →

The post Enterprise DSPM for Fortune 500 – 1touch.io is your go-to solution appeared first on Help Net Security.

While 75% of service providers report high customer demand for vCISO functionality, a new Cynomi report reveals that only 21% are actively offering it—opening a window onto a growth area for service providers while emphasizing the growing centrality of vCISO services to cybersecurity operations. This increased demand for vCISO services among SMB customers can be attributed to several factors. Compliance frameworks and regulations are proliferating, cyberattacks continue to escalate in number and intensity, and the … More →

The post vCISO services thrive, but challenges persist appeared first on Help Net Security.

trackd has released a powerful rules engine that uses its patch disruption data to enable auto-patching with confidence, and based on actual data. “There’s only one reason that vulnerability management exists as a discipline in cyber security, and that’s because operators are afraid that applying patches will break things,” noted Mike Starr, CEO of trackd. “If there were no fear of disruption, everyone would auto-patch everything immediately and be done with it. trackd’s new AutoPilot … More →

The post trackd AutoPilot leverages historical patch disruption data appeared first on Help Net Security.

“North Korean malicious cyber actors conducted research on a variety of targets connected to cryptocurrency exchange-traded funds (ETFs) over the last several months,” the FBI has warned through a public service announcement. This suggests that they are likely to target companies associated with cryptocurrency ETFs or other cryptocurrency-related financial products, the Bureau added. North Korean hackers are after money State-sponsored North Korean hackers have specialized in brazen crypto-heists, aimed at bringing income into the hermit … More →

The post North Korean hackers’ social engineering tricks appeared first on Help Net Security.

Prompt Security launched a security and governance solution for Copilot for Microsoft 365, marking a significant milestone in GenAI Security for enterprise applications. As organizations rapidly adopt GenAI tools to boost productivity and innovation, the need for robust security measures has never been more critical. Prompt Security’s latest offering addresses this need by providing comprehensive protection for the full suite of AI-powered tools integrated into Microsoft’s popular productivity applications, including Microsoft’s Office applications and Windows … More →

The post Prompt Security helps organizations monitor data shared with Microsoft 365 Copilot appeared first on Help Net Security.