Help Net Security

PlainID announces the PlainID Authorizer for Zscaler, available via PlainID SaaS Authorization Management, centralizes policy management for Zscaler and SaaS applications and tools. Zscaler and other SASE (Secure Access Service Edge) solutions have made significant strides in integrating identity-aware controls into their authorization frameworks – marking a crucial step forward. However, more can be done to address a critical gap. It’s imperative that any security enforcement point responsible for managing network connectivity must also align … More →

The post PlainID introduces identity security for Zscaler appeared first on Help Net Security.

Verimatrix intoduced its Verimatrix XTD Network Monitoring feature, expanding its suite of application cybersecurity solutions to combat evolving network-related threats. Verimatrix XTD has long been at the forefront of identifying and neutralizing mobile app cyberthreats. The new Verimatrix XTD Network Monitoring feature builds on this expertise, offering advanced capabilities to detect and prevent communication with malicious servers. By performing in-depth DNS cache analysis, monitoring for phishing sites, and implementing malware command-and-control (C2) detection, Verimatrix XTD … More →

The post Verimatrix XTD Network Monitoring provides real-time detection of malicious activities appeared first on Help Net Security.

Intezer announced that it has raised $33 million in Series C funding, bringing its total capital raised to $60 million. The funding round was led by Norwest Venture Partners, with participation from all existing investors, including Intel Capital, OpenView, Magma, and Alon Cohen, founder of CyberArk. With these funds, Intezer will expand its go-to-market and product teams. “I know what it’s like to work in SOC and incident response teams, while every day you have … More →

The post Intezer raises $33 million to further develop its AI-based security operations solution appeared first on Help Net Security.

Hydden announced that it has closed $4.4 million in seed funding led by Access Venture Partners. Other investors include Lockstep, the venture fund of CISOs Rinki Sethi and Lucas Moody, Service Provider Capital, and several cybersecurity angel investors including Andy Grolnick and Paul Trulove. Founded by a team of seasoned identity security product and engineering leaders, Hydden’s innovative platform is used by security leaders to gain control over the identity attack surface. Hydden’s identity security … More →

The post Hydden raises $4.4 million to improve identity security appeared first on Help Net Security.

Crowdsec is an open-source solution that offers crowdsourced protection against malicious IPs. CrowdSec features For this project, the developers have two objectives: Provide free top-quality intrusion detection and protection software. There’s community participation in creating new detection rules as new vulnerabilities are uncovered. Share and validate the attackers’ IPs with the network participants to render hackers’ resources useless as soon as possible. A consensus system gives a real-time actionable blocklist with no false positives. “CrowdSec … More →

The post CrowdSec: Open-source security solution offering crowdsourced protection appeared first on Help Net Security.

Organizations are combating excessive remote access demands with an equally excessive number of tools that provide varying degrees of security, according to Claroty. Data from more than 50,000 remote-access-enabled devices showed that the volume of remote access tools deployed is excessive, with 55% of organizations having four or more and 33% having six or more. Worse, almost 22% have eight or more, with some managing as many as 15 or 16 remote access tools. Remote … More →

The post Organizations overwhelmed by numerous and insecure remote access tools appeared first on Help Net Security.

WTW has launched Indigo Vault, a document protection platform that provides advanced cybersecurity for sharing and storage of business sensitive files. The platform is a combination of cloud and local document management systems, that provides protection against insider threats, AI system exposure and cyber theft, by ensuring documents and assets such as Word, Excel spreadsheets, PowerPoint presentations, PDFs and Outlook messages are protected and controlled, while providing minimal disruption to the user. Using WTW-patented, end-to-end … More →

The post WTW Indigo Vault secures business sensitive files appeared first on Help Net Security.

Apple has launched iOS 18, the latest significant iteration of the operating system powering its iPhones. Along with many new features and welcome customization options, iOS 18 brings several changes for improving users’ security and privacy. A standalone Passwords app In previous iOS versions, there was a Passwords tool in the Settings and it allowed users to leverage iCloud Keychain to generate and save passwords. In iOS 18, that tool has become a standalone app … More →

The post Apple releases iOS 18, with security and privacy improvements appeared first on Help Net Security.

Veritas Technologies unveiled new AI-driven capabilities to further expand the strength and functionality of the Veritas cyber resilience portfolio. The new innovations, including AI-powered automation and user interface enhancements, provide data protection specialists and IT generalists with intelligent, easy-to-use solutions that remove the uncertainty from cyber recovery. Deepak Mohan, EVP of engineering at Veritas, said: “Data security is becoming increasingly complex, and IT teams are under mounting pressure to ensure that data is always available, … More →

The post Veritas unveils AI-driven features to simplify cyber recovery appeared first on Help Net Security.

F5 launched F5 NGINX One, combining advanced load balancing, web and application server capabilities, API gateway functionalities, and security features in a dedicated package. Customers are now able to simply manage and secure F5 NGINX instances and NGINX Open Source from a single cloud management interface. End-to-end visibility speeds apps to market and enables advanced features like AI more efficiently versus a traditional siloed approach. This new offering makes NGINX technology easier to deploy, unlocking … More →

The post F5 NGINX One improves app delivery and security functions appeared first on Help Net Security.

RunSafe Security announced the successful completion of a $12 million Series B funding round. This investment round, which includes participation from new and existing investors, will accelerate new product development and market expansion to EMEA and APAC. Continue ReadingThe investment round led by Critical Ventures and SineWave Venture Partners also includes BMW i Ventures, Working Lab Capital, Lockheed Martin Ventures, HyperLink Ventures, Iron Gate Ventures, Alsop Louie Partners, and NextGen Venture Partners. “This investment round will enable … More →

The post RunSafe Security raises $12 million to reduce attack surface in critical infrastructure appeared first on Help Net Security.

Gcore launched Gcore WAAP, its end-to-end web application and API protection solution. Leveraging AI capabilities, Gcore WAAP integrates four products in one solution: web application firewall (WAF), application-layer DDoS protection, bot management, and API security, all managed through an intuitive user interface. This comprehensive, multi-layered security solution protects digital assets across a wide range of verticals, including retail, financial services, healthcare, public sector, media and entertainment, and technology. Gcore WAAP was developed following the company’s … More →

The post Gcore WAAP protects websites, web applications, and APIs appeared first on Help Net Security.

CVE-2024-8190, an OS command injection vulnerability in Ivanti Cloud Services Appliance (CSA) v4.6, is under active exploitation. Details about the attacks are still unknown, but there may be more in the near future: Horizon3.ai researchers have published their analysis of the flaw and a PoC exploit for it. About CVE-2024-8190 CVE-2024-8190 is a command injection vulnerability that can only be exploited if the attacker manages to log into the appliance’s admin login page first. According … More →

The post PoC exploit for exploited Ivanti Cloud Services Appliance flaw released (CVE-2024-8190) appeared first on Help Net Security.

Service accounts are non-human identities used to automate machine-to-machine interactions. They support critical functions – such as running scripts, services, and applications like websites, APIs, and databases – and facilitate integrations, operating as a proxy to humans and supporting business processes. In an ideal world, service accounts have one singular “job”, are granted least privileged access to resources, and are monitored and managed with identity security hygiene best practices in mind. In this utopia, threat … More →

The post Gateways to havoc: Overprivileged dormant service accounts appeared first on Help Net Security.

In this Help Net Security interview, Robert Ramsey, CEO at Rain Technology, discusses the growing threat of visual hacking, how it bypasses traditional cybersecurity measures, and the importance of physical barriers like switchable privacy screens. Could you explain visual hacking and why it poses a significant threat to individuals and organizations? Visual hacking describes any attempt by an individual to see or capture information they have not been authorized to view. Also referred to as … More →

The post The growing danger of visual hacking and how to protect against it appeared first on Help Net Security.

Remember when managing user accounts was your biggest headache? Those were simpler times. Today, we’re drowning in a sea of machine identities, and it’s time to learn how to swim – or risk going under. In the ever-expanding universe of hybrid and multicloud environments, machine identities have proliferated faster than cat videos on the Internet. According to CyberArk, these non-human entities—think workloads, services, and anything else that goes ‘beep’ in the night—now outnumber human identities … More →

The post Beyond human IAM: The rising tide of machine identities appeared first on Help Net Security.

Sourcepoint announced significant enhancements to its compliance monitoring suite. These solutions are designed to help companies navigate the increasingly complex landscape of digital privacy laws and mitigate risks associated with the growing trend of tracker-based litigation. Companies today face a multifaceted legal landscape in the US, with potential lawsuits stemming from various sources including the California Invasion of Privacy Act (CIPA), wiretapping laws, Video Privacy Protection Act (VPPA), pen register statutes, and critically, Unfair and … More →

The post Sourcepoint helps companies mitigate vulnerabilities across various privacy regulations appeared first on Help Net Security.

CVE-2024-43461, a spoofing vulnerability affecting Windows MSHTML – a software component used by various apps for rendering render web pages on Windows – “was exploited as a part of an attack chain relating to CVE-2024-38112, prior to July 2024,” Microsoft has revealed. The latter vulnerability was patched by the company in July 2024, and threat hunters with Trend Micro’s Zero Day Initiative explained that it had been used by the Void Banshee APT group to … More →

The post Microsoft confirms second 0-day exploited by Void Banshee APT (CVE-2024-43461) appeared first on Help Net Security.

EchoStrike is an open-source tool designed to generate undetectable reverse shells and execute process injection on Windows systems. “EchoStrike allows you to generate binaries that, when executed, create an undetectable RevShell, which can be the first entry point into a company. On the other hand, it features a Python wizard that makes it very easy to use compared to other industry tools, allowing almost anyone to use it,” Stiven Mayorga, the creator of EchoStrike, told … More →

The post EchoStrike: Generate undetectable reverse shells, perform process injection appeared first on Help Net Security.

In this Help Net Security interview, Kristian Kamber, CEO at SplxAI, discusses how security challenges for GenAI differ from traditional software. Unlike predictable software, GenAI introduces dynamic, evolving threats, requiring new strategies for defense and compliance. Kamber highlights the need for continuous monitoring and adaptive security measures. How do the security challenges of GenAI applications diverge from those of traditional software systems? Defending GenAI applications is like moving from a fixed castle to a living, … More →

The post Compliance frameworks and GenAI: The Wild West of security standards appeared first on Help Net Security.