Help Net Security

Cisco has fixed a critical command injection vulnerability (CVE-2024-20418) affecting its Ultra-Reliable Wireless Backhaul (URWB) Access Points that can be exploited via a HTTP requests and allows complete compromise of the devices. There are no workarounds to address this flaw, though vulnerable access points can be protected by switching off URWB mode, the company shared in the advisory. The good news is that the vulnerability was discovered by a Cisco employee during internal security testing … More →

The post Critical vulnerability in Cisco industrial wireless access points fixed (CVE-2024-20418) appeared first on Help Net Security.

Zywave announced an enhancement to its Cyber Quoting solution with the addition of embedded benchmarking. Brokers can now leverage industry data and loss profiles from similar organizations to provide their clients with more sophisticated insight into coverage limit adequacy and potential loss gaps. Launched in April 2024, Cyber Quoting is a centralized quoting platform that brings together global cyber insurers and U.S. distributors, connecting them through a simplified, transparent submission process that provides key insights … More →

The post Zywave enhances Cyber Quoting to provide insight into coverage limit adequacy and potential loss gaps appeared first on Help Net Security.

In this Help Net Security interview, Buzz Hillestad, CISO at Prismatic, discusses how AI’s advancement reshapes cybercriminal skillsets and lowers entry barriers for potential attackers. Hillestad highlights that, as AI tools become more accessible, organizations must adapt their defenses to anticipate evolving threats. How might the development of AI technology impact the skillsets required for cybercriminals? Will AI lower the barrier to entry for potential attackers? The development of AI technology will dramatically shift the … More →

The post How AI will shape the next generation of cyber threats appeared first on Help Net Security.

AWS offers a comprehensive suite of security tools to help organizations manage compliance, protect sensitive data, and detect threats within their environments. From AWS Security Hub and Amazon GuardDuty to Amazon Macie and AWS Config, each tool is vital in enhancing visibility, automating responses, and maintaining a secure cloud infrastructure. This article explores these AWS security essentials, providing insights into how they work together to protect cloud environments from potential risks and ensure robust compliance. … More →

The post AWS security essentials for managing compliance, data protection, and threat detection appeared first on Help Net Security.

In September 2024, the Federal Trade Commission (FTC) released an eye-opening report that digs into the data habits of nine major tech giants, including Amazon (Twitch), ByteDance (TikTok), Discord, Facebook, Reddit, Snap, Twitter, WhatsApp, and YouTube. The findings reveal extensive, often unsettling, data aggregation practices that go beyond user expectations and present considerable privacy risks. This article breaks down key privacy challenges and offers practical guidance to help organizations safeguard consumer data in today’s complex … More →

The post Consumer privacy risks of data aggregation: What should organizations do? appeared first on Help Net Security.

Google has announced that, by the end of 2025, multi-factor authentication (MFA) – aka 2-step verification – will become mandatory for all Google Cloud accounts. “Given the sensitive nature of cloud deployments — and with phishing and stolen credentials remaining a top attack vector observed by our Mandiant Threat Intelligence team — we believe it’s time to require [2-step verification] for all users of Google Cloud,” said Mayank Upadhyay, VP of Engineering and Distinguished Engineer, … More →

The post All Google Cloud users will have to enable MFA by 2025 appeared first on Help Net Security.

Atakama announced the latest expansion of its Managed Browser Security Platform, introducing DNS filtering explicitly designed for Managed Service Providers (MSPs). This new feature enables comprehensive in-browser and network-level filtering, providing a full-spectrum DNS solution that secures browsers and entire network environments. Atakama’s Managed Browser Security Platform transforms the browser into a secure foundation, empowering MSPs with enhanced visibility and control over client web activity. The platform now includes advanced capabilities such as category-based filtering … More →

The post Atakama introduces DNS filtering designed for MSPs appeared first on Help Net Security.

A new ransomware dubbed GoZone is being leveraged by attackers that don’t seem to be very greedy: they are asking the victims to pay just $1,000 in Bitcoin if they want their files decrypted. The GoZone HTML ransom note (Source: SonicWall) The ransom notes shown by the malware lay out another incentive for paying up: they claim that child sexual abuse material has been found on the targeted computer and urge the victim to pay … More →

The post GoZone ransomware accuses and threatens victims appeared first on Help Net Security.

Authlete launched Authlete 3.0, offering support for OpenID for Verifiable Credential Issuance (OID4VCI). This new capability empowers organizations—including governments, financial institutions, and educational establishments—to revolutionize how they issue and manage user credentials. With the introduction of Authlete 3.0, Authlete now offers a simple API solution for quickly issuing interoperable verifiable credentials (VCs) conformant with OID4VCI. Built on OAuth and OIDC—proven and widely used global standards for authentication and authorization—OID4VCI supports various credential formats, including SD-JWT … More →

The post Authlete 3.0 empowers organizations to improve how they issue and manage user credentials appeared first on Help Net Security.

Symbiotic Security launched a real-time security for software development that combines detection and remediation with just-in-time training – incorporating security testing and training directly into the development process without breaking developers’ workflows. Backed with $3 million of seed funding from investors including Lerer Hippeau, Axeleo Capital, Factorial Capital, and others, the company has introduced its software-as-a-service that works with the developer’s Integrated Development Environment (IDE) and enables them to develop software more securely. A Ponemon … More →

The post Symbiotic provides developers with real-time feedback on potential security vulnerabilities appeared first on Help Net Security.

In this Help Net Security interview, Julie Madhusoodanan, Head of CyberSecurity at LinkedIn, discusses how closing the gender gap could enhance cybersecurity’s effectiveness in combating emerging threats. With women still underrepresented in cybersecurity roles, she emphasizes how diverse teams bring essential skills and innovative perspectives. Madhusoodanan outlines strategies like inclusive hiring, mentorship, and flexible work policies as essential steps to foster gender balance in the field. What impact would closing the gender gap in cybersecurity … More →

The post The cybersecurity gender gap: How diverse teams improve threat response appeared first on Help Net Security.

Osmedeus is an open-source workflow engine designed for offensive security. It serves as a versatile foundation, enabling users to easily create customized reconnaissance systems and scale them across extensive target lists. Osmedeus key features Speed up your recon process Organize your scan results Customize and optimize your recon process Integrate with new public and private tools Scale across a large number of targets Synchronize the results across many places Osmedeus is available for free on … More →

The post Osmedeus: Open-source workflow engine for offensive security appeared first on Help Net Security.

In this Help Net Security video, Chris Gibson, CEO at FIRST, discusses the evolving threat landscape and provides a unique take on where data breaches and cyber attacks will be in 2025.

The post Key cybersecurity predictions for 2025 appeared first on Help Net Security.

Identity-related data breaches are more severe and costly than run-of-the-mill incidents, according to RSA. 40% of respondents reported an identity-related security breach. Of those, 66% reported it as a severe event that affected their organization. 44% estimated that the total costs of identity-related data breaches exceeded the cost of a typical data breach. These findings underscore why organizations should prioritize investing in security capabilities that can mitigate the high costs of identity-related breaches. AI seen … More →

The post Identity-related data breaches cost more than average incidents appeared first on Help Net Security.

Lumifi announces the acquisition of Critical Insight, marking its third acquisition in 13 months. This strategic move expands Lumifi’s service offerings and strengthens its presence in the healthcare and critical infrastructure cybersecurity sector. The acquisition adds to Lumifi’s existing offerings, including its 24/7 Security Operations Center (SOC), managed detection and response, and ShieldVision platform. Critical Insight’s incident response capabilities complement Lumifi’s real-time threat monitoring, while its professional services expand the ability to provide tailored cybersecurity … More →

The post Lumifi acquires Critical Insight to boost incident response capabilities appeared first on Help Net Security.

Unknown attackers are trying to trick Windows users into spinning up a custom Linux virtual machine (VM) with a pre-configured backdoor, Securonix researchers have discovered. The campaign The attack began with a phishing email, they believe, but they weren’t able to pinpoint the intendend victims. The email included a link pointing to an unusually big ZIP file (285 MB), and its name – OneAmerica Survey.zip – points to the likely lure: a survey by OneAmerica … More →

The post Beware of phishing emails delivering backdoored Linux VMs! appeared first on Help Net Security.

Google has delivered fixes for two vulnerabilities endangering Android users that “may be under limited, targeted exploitation”: CVE-2024-43047, a flaw affecting Qualcomm chipsets, and CVE-2024-43093, a vulnerability in the Google Play framework. The exploited vulnerabilities (CVE-2024-43047, CVE-2024-43093) Qualcomm patched CVE-2024-43047 – a use-after-free vulnerability in the Digital Signal Processor (DSP) service that could be exploited to escalate privileges on targeted devices – in October 2024, and urged original equipment manufacturers (OEMs) to deploy the patches … More →

The post Google patches actively exploited Android vulnerability (CVE-2024-43093) appeared first on Help Net Security.

In this study, GitGuardian and CyberArk reveal the stark reality of secrets management across 1,000 organizations. With 79% experiencing secrets leaks and an average remediation time of 27 days, the findings expose critical gaps between security confidence and reality. Learn how leading organizations tackle the secrets sprawl crisis and what sets successful security programs apart from the rest. Get actionable insights into modernizing your secrets security strategy for today’s cloud-native world. Download the Voice of … More →

The post Report: Voice of Practitioners 2024 – The True State of Secrets Security appeared first on Help Net Security.

BigID launched Data Security Posture Management (DSPM) Starter App, built natively in Snowflake and using the Snowflake Native App Framework. BigID’s DSPM Starter App will be available via Snowflake Marketplace and provide rapid data discovery and classification assessment natively in the Snowflake AI Data Cloud. As data environments grow more complex, with fragmented sources, rising breaches, and increasing demands for AI governance, organizations are under greater pressure to safeguard their sensitive data. BigID DSPM Starter … More →

The post BigID DSPM Starter App enhances data security posture for Snowflake customers appeared first on Help Net Security.

The open-source software (OSS) industry is developing the core software for the global infrastructure, to the point that even some proprietary software giants adopt Linux servers for their cloud services. Still, it has never been able to get organized by creating representative bodies capable of giving an organic response to issues such as those raised at the European level by the Cyber Resilience Act. I have been advocating for years the need to transform a … More →

The post Open-source software: A first attempt at organization after CRA appeared first on Help Net Security.