Help Net Security

F5 launched F5 NGINX One, combining advanced load balancing, web and application server capabilities, API gateway functionalities, and security features in a dedicated package. Customers are now able to simply manage and secure F5 NGINX instances and NGINX Open Source from a single cloud management interface. End-to-end visibility speeds apps to market and enables advanced features like AI more efficiently versus a traditional siloed approach. This new offering makes NGINX technology easier to deploy, unlocking … More →

The post F5 NGINX One improves app delivery and security functions appeared first on Help Net Security.

RunSafe Security announced the successful completion of a $12 million Series B funding round. This investment round, which includes participation from new and existing investors, will accelerate new product development and market expansion to EMEA and APAC. Continue ReadingThe investment round led by Critical Ventures and SineWave Venture Partners also includes BMW i Ventures, Working Lab Capital, Lockheed Martin Ventures, HyperLink Ventures, Iron Gate Ventures, Alsop Louie Partners, and NextGen Venture Partners. “This investment round will enable … More →

The post RunSafe Security raises $12 million to reduce attack surface in critical infrastructure appeared first on Help Net Security.

Gcore launched Gcore WAAP, its end-to-end web application and API protection solution. Leveraging AI capabilities, Gcore WAAP integrates four products in one solution: web application firewall (WAF), application-layer DDoS protection, bot management, and API security, all managed through an intuitive user interface. This comprehensive, multi-layered security solution protects digital assets across a wide range of verticals, including retail, financial services, healthcare, public sector, media and entertainment, and technology. Gcore WAAP was developed following the company’s … More →

The post Gcore WAAP protects websites, web applications, and APIs appeared first on Help Net Security.

CVE-2024-8190, an OS command injection vulnerability in Ivanti Cloud Services Appliance (CSA) v4.6, is under active exploitation. Details about the attacks are still unknown, but there may be more in the near future: Horizon3.ai researchers have published their analysis of the flaw and a PoC exploit for it. About CVE-2024-8190 CVE-2024-8190 is a command injection vulnerability that can only be exploited if the attacker manages to log into the appliance’s admin login page first. According … More →

The post PoC exploit for exploited Ivanti Cloud Services Appliance flaw released (CVE-2024-8190) appeared first on Help Net Security.

Service accounts are non-human identities used to automate machine-to-machine interactions. They support critical functions – such as running scripts, services, and applications like websites, APIs, and databases – and facilitate integrations, operating as a proxy to humans and supporting business processes. In an ideal world, service accounts have one singular “job”, are granted least privileged access to resources, and are monitored and managed with identity security hygiene best practices in mind. In this utopia, threat … More →

The post Gateways to havoc: Overprivileged dormant service accounts appeared first on Help Net Security.

In this Help Net Security interview, Robert Ramsey, CEO at Rain Technology, discusses the growing threat of visual hacking, how it bypasses traditional cybersecurity measures, and the importance of physical barriers like switchable privacy screens. Could you explain visual hacking and why it poses a significant threat to individuals and organizations? Visual hacking describes any attempt by an individual to see or capture information they have not been authorized to view. Also referred to as … More →

The post The growing danger of visual hacking and how to protect against it appeared first on Help Net Security.

Remember when managing user accounts was your biggest headache? Those were simpler times. Today, we’re drowning in a sea of machine identities, and it’s time to learn how to swim – or risk going under. In the ever-expanding universe of hybrid and multicloud environments, machine identities have proliferated faster than cat videos on the Internet. According to CyberArk, these non-human entities—think workloads, services, and anything else that goes ‘beep’ in the night—now outnumber human identities … More →

The post Beyond human IAM: The rising tide of machine identities appeared first on Help Net Security.

Sourcepoint announced significant enhancements to its compliance monitoring suite. These solutions are designed to help companies navigate the increasingly complex landscape of digital privacy laws and mitigate risks associated with the growing trend of tracker-based litigation. Companies today face a multifaceted legal landscape in the US, with potential lawsuits stemming from various sources including the California Invasion of Privacy Act (CIPA), wiretapping laws, Video Privacy Protection Act (VPPA), pen register statutes, and critically, Unfair and … More →

The post Sourcepoint helps companies mitigate vulnerabilities across various privacy regulations appeared first on Help Net Security.

CVE-2024-43461, a spoofing vulnerability affecting Windows MSHTML – a software component used by various apps for rendering render web pages on Windows – “was exploited as a part of an attack chain relating to CVE-2024-38112, prior to July 2024,” Microsoft has revealed. The latter vulnerability was patched by the company in July 2024, and threat hunters with Trend Micro’s Zero Day Initiative explained that it had been used by the Void Banshee APT group to … More →

The post Microsoft confirms second 0-day exploited by Void Banshee APT (CVE-2024-43461) appeared first on Help Net Security.

EchoStrike is an open-source tool designed to generate undetectable reverse shells and execute process injection on Windows systems. “EchoStrike allows you to generate binaries that, when executed, create an undetectable RevShell, which can be the first entry point into a company. On the other hand, it features a Python wizard that makes it very easy to use compared to other industry tools, allowing almost anyone to use it,” Stiven Mayorga, the creator of EchoStrike, told … More →

The post EchoStrike: Generate undetectable reverse shells, perform process injection appeared first on Help Net Security.

In this Help Net Security interview, Kristian Kamber, CEO at SplxAI, discusses how security challenges for GenAI differ from traditional software. Unlike predictable software, GenAI introduces dynamic, evolving threats, requiring new strategies for defense and compliance. Kamber highlights the need for continuous monitoring and adaptive security measures. How do the security challenges of GenAI applications diverge from those of traditional software systems? Defending GenAI applications is like moving from a fixed castle to a living, … More →

The post Compliance frameworks and GenAI: The Wild West of security standards appeared first on Help Net Security.

In this Help Net Security video, Sara Behar, Content Manager at YL Ventures, discusses how recent regulatory actions and high-profile legal incidents involving cybersecurity leaders have influenced CISO reporting. In a recent report of the CISO Circuit, YL Ventures set out to understand executive security needs around reporting and the impact of recent FTC and SEC actions, including those taken against SolarWinds. Throughout 50 interviews with cybersecurity executives from a broad spectrum of verticals and … More →

The post The ripple effects of regulatory actions on CISO reporting appeared first on Help Net Security.

A C-suite perspective on potential vulnerabilities within open-source dependencies or software packages reveals that, while remediation costs for dependency risks are perilously high, function-level reachability analysis still offers the best value in this critical area, according to Endor Labs. The research is based on analysis of Endor Labs vulnerability data, the Open Source Vulnerabilities (OSV) database for comparison, information from customer tenants, and Java Archives (JARs) of hundreds of versions of the top 15 open … More →

The post Trends and dangers in open-source software dependencies appeared first on Help Net Security.

As cyberattacks escalate, more regulations are being introduced to help protect organizations and their customers’ data. This has resulted in a complex web of legislation with which companies in the private sector must comply. It can be challenging, as industry standards and requirements often overlap. This e-book: Provides a practical guide to help companies understand the role of password and credential security within the regulatory landscape Outlines how Dark Web, password, and credential screening solutions … More →

The post eBook: Navigating compliance with a security-first approach appeared first on Help Net Security.

Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: Veeam Backup & Replication RCE flaw may soon be leveraged by ransomware gangs (CVE-2024-40711) CVE-2024-40711, a critical vulnerability affecting Veeam Backup & Replication (VBR), could soon be exploited by attackers to steal enterprise data. Microsoft fixes 4 exploited zero-days and a code defect that nixed earlier security fixes September 2024 Patch Tuesday is here and Microsoft has delivered 79 fixes, … More →

The post Week in review: Veeam Backup & Replication RCE could soon be exploited, Microsoft fixes 4 0-days appeared first on Help Net Security.

Rain Technology announced ATM Switchable Privacy, designed to protect consumers against visual hackers and snoopers at ATM terminals in financial institutions, retail stores, restaurants, airports, and other public settings. ATM stats and state of the market With more than three million ATMs around the world and a global ATM market size estimated to reach $28 billion by 2026, ATMs within retail and banking settings represent a significant risk point for merchants, retailers and banks as … More →

The post Rain Technology protects consumers against visual hackers and snoopers at ATM terminals appeared first on Help Net Security.

Nudge Security unveiled new SSPM (SaaS security posture management) capabilities for its SaaS security and governance platform. This enhancement creates the industry’s most comprehensive solution of its kind, combining SaaS discovery, security posture management, spend management, third-party risk, and identity governance in a single, self-service offering that deploys in minutes. As digital identities become prime targets for cyber threats, organizations are prioritizing efforts to strengthen and monitor identity infrastructure. Nudge Security’s SSPM capabilities enable IT and security … More →

The post Nudge Security unveils SSPM capabilities to strengthen SaaS security appeared first on Help Net Security.

Infrastructure as Code (IaC) has become a widely adopted practice in modern DevOps, automating the management and provisioning of technology infrastructure through machine-readable definition files. What can we to do make IaC secure by default? Security workflows for IaC First, let’s consider that the security workflows for IaC usually comprise multiple steps and practices. IaC code is stored in version control systems, such as Git, with changes tracked and reviewed before merging, which helps improve … More →

The post How to make Infrastructure as Code secure by default appeared first on Help Net Security.

Organizations must reassess their email security posture as incidents continue to escalate, leading to financial losses. Key findings reveal a significant increase in email attacks, with many successfully bypassing standard security protocols and targeting vulnerable sectors. Business email compromise, phishing, and sophisticated social engineering tactics continue to evolve, exploiting gaps in security measures. Email attacks skyrocket 293% Acronis | Acronis H1 2024 Cyberthreats Report | August 2024 Email attacks have surged by 293% in the … More →

The post Security measures fail to keep up with rising email attacks appeared first on Help Net Security.

Organizations are grappling with their current NHI (non-human identities) security strategies, according to Cloud Security Alliance and Astrix Security. The high volume of NHIs significantly amplifies the security challenges organizations face. Each NHI can potentially access sensitive data and critical systems, increasing the attack surface exponentially. Without adequate visibility and control over these NHIs, the risk of security incidents rises. Organizations’ lack of confidence suggests their current NHI security methods are lagging behind their human … More →

The post Organizations still don’t know how to handle non-human identities appeared first on Help Net Security.