Help Net Security

In this Help Net Security interview, Barry Mainz, CEO at Forescout, discusses the obstacles organizations encounter in attaining security visibility, particularly within cloud and hybrid environments. He explains why asset intelligence—going beyond basic visibility to understand device behavior and risk—is essential. Mainz also discusses how AI and machine learning can help organizations stay proactive as the attack surface continues to grow. What are the primary challenges organizations face when trying to achieve security visibility, particularly … More →

The post Maximizing security visibility on a budget appeared first on Help Net Security.

Application Security Engineer MassMutual | USA | Hybrid – View job details As an Application Security Engineer, you will conduct in-depth security assessments, including vulnerability scanning, and code reviews. Ensure secure coding practices are followed, and security controls are incorporated into software designs. Conduct detailed threat modeling to identify attack vectors and potential weaknesses. Ensure compliance with security regulations, frameworks, and industry standards such as OWASP. Cybersecurity Engineer, Resilience Electrolux Group | Italy | On-site … More →

The post Cybersecurity jobs available right now: November 5, 2024 appeared first on Help Net Security.

The proliferation of non-human identities and the complexity of modern application architectures have created significant security challenges, particularly in managing sensitive credentials, according to GitGuardian and CyberArk. Based on a survey of 1,000 IT decision-makers in organizations with over 500 employees across the US, UK, Germany, and France, the report reveals a significant rise in awareness and concern regarding the risks associated with secrets sprawl. Secrets leaks are on the rise 79% of respondents reported … More →

The post AI learning mechanisms may lead to increase in codebase leaks appeared first on Help Net Security.

Synology has released fixes for an unauthenticated “zero-click” remote code execution flaw (CVE-2024-10443, aka RISK:STATION) affecting its popular DiskStation and BeeStation network attached storage (NAS) devices. About CVE-2024-10443 CVE-2024-10443 was discovered by Rick de Jager, a security researcher at Midnight Blue, and has been exploited at the Pwn2Own Ireland 2024 hacking competition ten days ago. The specifics of CVE-2024-10443 are under wraps for the moment, but we know that it may allow unauthenticated attackers to … More →

The post Millions of Synology NAS devices vulnerable to zero-click attacks (CVE-2024-10443) appeared first on Help Net Security.

The IRISSCERT Cyber Crime Conference (IRISSCON) returns on November 6th at the Aviva Stadium, where global cybersecurity leaders will explore AI’s revolutionary role in defending against and contributing to cyber threats. As Ireland’s longest-standing cybersecurity conference, IRISSCON 2024 will dive into AI’s impact on how it both enhances security and enables cybercriminals to scale and automate attacks. With generous support from diamond sponsors ESET, Symantec, and BH Consulting, the event will highlight cutting-edge AI strategies … More →

The post IRISSCON 2024 to address AI’s dual impact on cybersecurity appeared first on Help Net Security.

In this Help Net Security interview, Rachel Barouch, an Organizational Coach for VCs and startups and a former VP HR in both a VC and a Cybersecurity startup, discusses the dynamics of cybersecurity researchers and team-building strategies. She highlights that these researchers, often brilliant and introverted, come with distinctive working styles, making it challenging to foster collaboration. However, with the right approach to assessing, managing, retaining and developing them, organizations can unlock their potential and … More →

The post Hiring guide: Key skills for cybersecurity researchers appeared first on Help Net Security.

Whispr is an open-source CLI tool designed to securely inject secrets from secret vaults, such as AWS Secrets Manager and Azure Key Vault, directly into your application’s environment. This enhances secure local software development by seamlessly managing sensitive information. Whispr key features Safe secret injection: Fetch and inject secrets from your desired vault using HTTPS, SSL encryption, and strict CERT validation. Just In Time (JIT) privilege: Set environment variables for developers only when they’re needed. … More →

The post Whispr: Open-source multi-vault secret injection tool appeared first on Help Net Security.

In this Help Net Security video, James Edgar, CISO at Corpay, reveals insights into cybersecurity health, concerns, challenges, and other considerations for building a solid defense program. Key insights revealed in Corpay’s 2024 State of Business Cybersecurity Report: 67% of respondents blame lack of capital resources for preventing companies from reaching their desired level of cyber protection. 61% of respondents plan to test or implement AI tools for cybersecurity purposes in the next 12 months. … More →

The post Cybersecurity in crisis: Are we ready for what’s coming? appeared first on Help Net Security.

53% of consumers report being aware of their national privacy laws, a 17-percentage point increase compared to 2019, according to Cisco. Informed consumers are also much more likely to feel their data is protected (81%) compared to those who are unaware (44%). “Our survey highlights the importance of privacy awareness in building consumer trust in brands and AI technologies,” says Harvey Jang, Cisco VP and Chief Privacy Officer. “Nearly 60% of consumers aware of privacy … More →

The post Strong privacy laws boost confidence in sharing information with AI appeared first on Help Net Security.

Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: Patching problems: The “return” of a Windows Themes spoofing vulnerability Despite two patching attempts, a security issue that may allow attackers to compromise Windows user’s NTLM (authentication) credentials via a malicious Windows themes file still affects Microsoft’s operating system, 0patch researchers have discovered. Black Basta operators phish employees via Microsoft Teams Black Basta ransomware affiliates are still trying to trick … More →

The post Week in review: Windows Themes spoofing bug “returns”, employees phished via Microsoft Teams appeared first on Help Net Security.

Security debt, defined for this report as flaws that remain unfixed for longer than a year, exists in 76% of organizations in the financial services sector, with 50% of organizations carrying critical security debt, according to Veracode. Financial sector apps accumulate more security debt With the average cost of a data breach in the financial industry estimated to be $6.08 million, the research comes at a critical time for one of the most highly targeted … More →

The post 50% of financial orgs have high-severity security flaws in their apps appeared first on Help Net Security.

In this Help Net Security interview, Mike McNeil, CEO at Fleet, talks about the security risks posed by unmanaged mobile devices and how mobile device management (MDM) solutions help address them. He also discusses employee resistance to MDM and how open-source transparency can build trust. Lastly, McNeil shares insights on managing devices in remote locations and what’s next for MDM technology. What are some of the biggest threats of unmanaged mobile devices, and how does … More →

The post How open-source MDM solutions simplify cross-platform device management appeared first on Help Net Security.

OpenPaX is an open-source kernel patch that mitigates common memory safety errors, re-hardening systems against application-level memory safety attacks using a simple Linux kernel patch. It’s available under the same GPLv2 license terms as the Linux kernel. “We are pleased to be able to bring this to the industry at large and as an integrated offering for our customers with Edera Protect,” said Ariadne Conill, distinguished engineer at Edera and maintainer of Alpine Linux. “Until … More →

The post OpenPaX: Open-source kernel patch that mitigates memory safety errors appeared first on Help Net Security.

Although most organizations use emails with built-in security features that filter out suspicious messages, criminals always find a way to bypass these systems. With the development of AI technology, phishing is becoming increasingly difficult to recognize, allowing them to circumvent security measures. While most attempts do not succeed, it only takes one to cause significant damage to a company’s operations. Mick Leach, Field CISO at Abnormal Security, discusses why the automotive industry is the new … More →

The post Threat actors are stepping up their tactics to bypass email protections appeared first on Help Net Security.

Here’s a look at the most interesting products from the past month, featuring releases from: Action1, Balbix, BreachLock, Commvault, Dashlane, Data Theorem, Edgio, ExtraHop, Fastly, Frontegg, GitGuardian, IBM, Ivanti, Jumio, Kusari, Legit Security, Metomic, Nametag, Neon, Nucleus Security, Okta, Qualys, Rubrik, SAFE Security, Sectigo, Securiti, Veeam Software, and XM Cyber. Qualys Enterprise TruRisk Management unifies asset inventory and risk factors Qualys launched the Risk Operations Center (ROC) with Enterprise TruRisk Management (ETM). The solution enables … More →

The post Infosec products of the month: October 2024 appeared first on Help Net Security.

Sophos conducted defensive and counter-offensive operation over the last five years with multiple interlinked nation-state adversaries based in China targeting perimeter devices, including Sophos Firewalls. Espionage campaigns tied to Chinese hacking groups The attackers used a series of campaigns with novel exploits and customized malware to embed tools to conduct surveillance, sabotage and cyberespionage as well as overlapping tactics, tools and procedures (TTPs) with well-known Chinese nation-state groups including Volt Typhoon, APT31 and APT41. The … More →

The post Sophos mounted counter-offensive operation to foil Chinese attackers appeared first on Help Net Security.

In this Help Net Security interview, Miguel Guevara, Product Manager, Privacy Safety and Security at Google, discusses the complexities involved in scaling differential privacy technology across large systems. He emphasizes the need to develop secure, private, and user-controlled products while effectively addressing the complexities of integrating such technologies into existing systems. Guevara also outlines the rigorous processes of optimizing these technologies to ensure user data is protected without sacrificing functionality. Google recently achieved the largest … More →

The post Google on scaling differential privacy across nearly three billion devices appeared first on Help Net Security.

A supply chain compromise involving Lottie Player, a widely used web component for playing site and app animations, has made popular decentralized finance apps show pop-ups urging users to connect their wallets, TradingView has reported. The pop-up (Source: Lottie Player GitHub repository) Users who did it – and it seems that there was at least one victim – had their wallets drained. The Lottie Player compromise Website admins began complaining about the pop-up and asking … More →

The post Lottie Player supply chain compromise: Sites, apps showing crypto scam pop-ups appeared first on Help Net Security.

Cost savings and business benefits were quantified in “The Total Economic Impact of Cynet All-in-One Security,” a commissioned study conducted by Forrester Consulting on behalf of Cynet in October 2024. The Total Economic Impact Study framework helps organizations understand the financial effects of their strategic technology investments. Based on interviewed customers with experience using Cynet, Forrester found that Cynet’s All-in-One Cybersecurity Platform generated $2.73 million in savings, paying for itself in under six months, for … More →

The post Cynet enables 426% ROI in Forrester Total Economic Impact Study appeared first on Help Net Security.

North Korean state-sponsored hackers – Jumpy Pisces, aka Andariel, aka Onyx Sleet – have been spotted burrowing into enterprise systems, then seemingly handing matters over to the Play ransomware group. Timeline of the attack (Source: Palo Alto Networks) The attack The ransomware attack was investigated by Palo Alto Networks’ Unit 42 in September 2024, and they determined that North Korean hackers: Gained access to a host using a compromised users account Moved laterally to other … More →

The post North Korean hackers pave the way for Play ransomware appeared first on Help Net Security.