Help Net Security

Researchers have unearthed a cryptographic vulnerability in popular Yubico (FIDO) hardware security keys and modules that may allow attackers to clone the devices. But the news is not as catastrophic as it may seem at first glance. “The attacker would need physical possession of the YubiKey, Security Key, or YubiHSM [hardware security module], knowledge of the accounts they want to target, and specialized equipment to perform the necessary attack. Depending on the use case, the … More →

The post Vulnerability allows Yubico security keys to be cloned appeared first on Help Net Security.

Proofpoint launched a proprietary, partner-friendly, end-to-end information protection framework, providing organizations access to expertise, industry benchmark data and proven methodology in designing, implementing and maturing data loss prevention (DLP) programs. While DLP programs and technology are undoubtedly maturing, only 38% of organizations say they have a “mature” DLP program. Today, organizations with complex needs are looking for more comprehensive solutions that go beyond traditional DLP measures. Until now, the industry has been lacking a practical … More →

The post Proofpoint launches NIST-inspired framework to tackle data loss prevention challenges appeared first on Help Net Security.

Samba is the standard suite of programs that enables seamless interoperability between Linux/Unix and Windows systems. Version 4.21 has been officially released. Hardening In previous versions of Samba, if a user or group name in either option could not be resolved to a valid SID, the user (or group) would be skipped without any notification. This could result in unexpected and insecure behavior. Starting with this version of Samba, if any user or group name … More →

The post Samba 4.21 comes with upgraded security features appeared first on Help Net Security.

The Bluetooth Special Interest Group (SIG), the organization that oversees Bluetooth technology, released Bluetooth Channel Sounding, a new secure, fine-ranging feature that promises to enhance the convenience, safety, and security of Bluetooth connected devices. By enabling true distance awareness in billions of everyday devices, Bluetooth Channel Sounding opens countless possibilities for developers and users alike. “Bluetooth technology has become an ingredient of everyday life,” said Neville Meijers, CEO, Bluetooth Special Interest Group. “When connected devices … More →

The post Bluetooth Channel Sounding enhances security of Bluetooth connected devices appeared first on Help Net Security.

With cyber threats becoming increasingly sophisticated and targeting critical infrastructure, in this Help Net Security interview, David Ferbrache, managing director of Beyond Blue, discusses the current state of cybersecurity readiness and resilience. Ferbrache talks about the complexities of managing both traditional and digital infrastructures, the critical role of regulatory bodies, the urgent need for public and private sector collaboration to counteract these threats, and much more. With the increasing sophistication of cyber threats targeting national … More →

The post Protecting national interests: Balancing cybersecurity and operational realities appeared first on Help Net Security.

OpenBAS is an open-source platform that enables organizations to plan, schedule, and execute crisis exercises, adversary simulations, and breach simulations. Compliant with ISO 22398 standards, OpenBAS is built as a modern web application featuring a user-centric interface and a RESTful API. The platform includes various modules – scenarios, team management, simulations, communication verification, and encryption – offering benefits like collaborative workflows, real-time monitoring, detailed analytics, and feedback management. “OpenBAS is unique in its capability to … More →

The post OpenBAS: Open-source breach and attack simulation platform appeared first on Help Net Security.

Cyber Systems Operations United States Air Force | USA | On-site – View job details The United States Air Force is looking for a Cyber Systems Operations Specialist to design, install, and support systems to ensure they operate properly and remain secure from outside intrusion. Cloud Security Service Manager SAP Fioneer | Germany | Remote – View job details You will be responsible for driving continuous improvement of security standards and system hardening, supporting audits … More →

The post Cybersecurity jobs available right now: September 4, 2024 appeared first on Help Net Security.

Ransomware remains a concerning cybersecurity threat, with attacks becoming more frequent, severe, and costly. Recent reports highlight alarming trends, including increased attacks on critical sectors like healthcare, education, and manufacturing. The US, leading in global ransomware incidents, faces an exceptionally high risk, especially in education and healthcare. Organizations are frequently hit multiple times, and ransom payments, while common, often fail to prevent further disruption. Most ransomware attacks occur between 1 a.m. and 5 a.m. Malwarebytes … More →

The post Ransomware attacks escalate as critical sectors struggle to keep up appeared first on Help Net Security.

Ping Identity announced the addition of key identity capabilities to its FedRAMP High & DoD IL5 offerings. With Ping Government Identity Cloud, federal agencies and government suppliers now have access to capabilities that enable them to boost compliance, security and experiences through modernizing identity, credential and access management. Following FedRAMP High certification, DOD Impact Level 5 (IL5) authorization, and joining with ForgeRock, Ping Government Identity Cloud now offers authorized identity capabilities for multi-factor authentication (MFA), … More →

The post Ping Identity strengthens security for federal agencies and government suppliers appeared first on Help Net Security.

Veeam Software announced Veeam Backup for Microsoft 365 v8, which delivers comprehensive and flexible immutability for Microsoft 365 data. Now organizations can ensure their Microsoft 365 data is resilient employing a zero-trust, multi-layered immutable strategy, making certain backup data is safe from potential changes or deletions so that its original integrity stays intact. Currently protecting more than 21 million Microsoft 365 users, Veeam safeguards customers’ critical Microsoft 365 data to ensure that their business keeps … More →

The post Veeam Software expands protection for Microsoft 365 appeared first on Help Net Security.

HackerOne announced that it has appointed Kara Sprague to succeed Marten Mickos as CEO. Sprague joins HackerOne at a powerful moment in its evolution, having seen 200% product growth in its pentesting and AI red teaming business and 120% growth in vulnerability findings and hacker rewards in the past 12 months. The company also recently introduced GenAI capabilities into the HackerOne platform with its copilot, Hai, to accelerate find-to-fix cycles with insights and recommendations. Sprague … More →

The post Kara Sprague joins HackerOne as CEO appeared first on Help Net Security.

Zyxel has patched a myriad of vulnerabilities in its various networking devices, including a critical one (CVE-2024-7261) that may allow unauthenticated attackers to execute OS commands on many Zyxel access points (APs) and security routers by sending a specially crafted cookie to the vulnerable devices. CVE-2024-7261 CVE-2024-7261 is an OS command injection vulnerability that stems from the improper neutralization of special elements in the parameter “host” in the CGI program of some AP and security … More →

The post Critical flaw in Zyxel’s secure routers allows OS command execution via cookie (CVE-2024-7261) appeared first on Help Net Security.

VIVOTEK has announced an upgrade to its comprehensive AI security solution with the release of the new AI feature, RealSight Engine. This feature transforms images captured by network cameras into clear, visible facial images under any lighting conditions. Even in backlit environments, facial expressions are rendered with exceptional clear. The solution eliminates complex settings, enabling immediate activation upon installation. It optimizes operational efficiency in environments such as dimly lit galleries, suburban dark parks, and low-light … More →

The post VIVOTEK RealSight Engine improves images clarity in various scenarios appeared first on Help Net Security.

Transport for London (TfL) has sent out notifications to customers on Sunday evening saying that they “are currently dealing with an ongoing cyber security incident.” The government body that manages most of the transport network of United Kingdom’s capital did not provide additional details about the cyber incident, though BBC sources said that the organization’s “backroom systems at the corporate headquarters” are mainly affected. Transport for London has yet to provide an update on the … More →

The post Transport for London is dealing with a cyber security incident appeared first on Help Net Security.

ACI Worldwide announced a collaboration with Red Hat to make ACI’s cloud-native Enterprise Payments Platform available on any cloud infrastructure. With this collaboration, ACI will help customers ease their migration to the cloud to better adapt to the rapidly evolving digital economy and power the next generation of payment services. Using Red Hat OpenShift empowers banks, merchants, and billers with more flexibility and choice on how they wish to deploy their payment services, whether that … More →

The post ACI Worldwide partners with Red Hat to simplify payment operations appeared first on Help Net Security.

Continuous threat exposure management (CTEM) – a concept introduced by Gartner – monitors cybersecurity threats continuously rather than intermittently. This five-stage framework (scoping, discovery, prioritization, validation, and mobilization) allows organizations to constantly assess and manage their security posture, reduce exposure to threats, and integrate risk management into a continuous assessment and action loop. A prime candidate for inclusion under the CTEM umbrella is software created in low-code/ no-code (LCNC) and robotic process automation (RPA) environments. … More →

The post Managing low-code/no-code security risks appeared first on Help Net Security.

In this Help Net Security interview, Tim West, Director of Threat Intelligence and Outreach at WithSecure, discusses Ransomware-as-a-Service (RaaS) with a focus on how these cybercriminal operations are adapting to increased competition, shifting structures, and a fragmented ecosystem. West talks about the implications of these changes for targeted industries, particularly engineering and manufacturing, and examines ransomware actors’ growing reliance on dual-use tools. How has the ransomware-as-a-service (RaaS) landscape evolved? Are we seeing a shift in … More →

The post How ransomware tactics are shifting, and what it means for your business appeared first on Help Net Security.

Bad actors leverage premium-rate phone numbers and bots to steal billions of dollars from businesses. In this Help Net Security video, Frank Teruel, CFO at Arkose Labs, discusses how to spot and stop them.

The post The attack with many names: SMS Toll Fraud appeared first on Help Net Security.

While SaaS security is finally getting the attention it deserves, there’s still a significant gap between intent and implementation. Ad hoc strategies and other practices still fall short of a security program. The move toward decentralization has generated confusion over responsibilities, and many organizations remain unaware of which SaaS applications are used, by whom, and what is risky, according to AppOmni. Source: AppOmni “Despite greater awareness and effort, things are getting worse. Just as there … More →

The post A third of organizations suffered a SaaS data breach this year appeared first on Help Net Security.

Version 4.0.1 of the Payment Card Industry Data Security Standard (PCI DSS), which came into effect back in April, incorporates a few important changes to make it fit for the modern digital world, addressing how technologies, the threat landscape and payment processes have changed. For example, it includes a new customized approach for a more flexible and tailored implementation of security controls, through to a new focus on vulnerability management and authentication. However, some of … More →

The post Complying with PCI DSS requirements by 2025 appeared first on Help Net Security.