Help Net Security

November 2024 Patch Tuesday is here, and Microsoft has dropped fixes for 89 new security issues in its various products, two of which – CVE-2024-43451 and CVE-2024-49039 – are actively exploited by attackers. The exploited vulnerabilities (CVE-2024-43451, CVE-2024-49039) CVE-2024-43451 is yet another vulnerability that allows attackers to elevate their privileges on targeted Windows and Windows Server machines by disclosing the user’s NTLMv2 hash, which contains their authentication credentials. The hash can then be used by … More →

The post Microsoft fixes actively exploited zero-days (CVE-2024-43451, CVE-2024-49039) appeared first on Help Net Security.

BlackFog launched its next generation enterprise platform to deliver even more powerful ransomware and insider threat prevention. BlackFog’s pioneering platform focuses specifically on anti data exfiltration to prevent unauthorized data from leaving a device, ensuring that an organization’s most sensitive information is protected. The latest product enhancements in Version 5 are designed to provide enhanced data loss prevention without the need for data classification. This comes at a time when ransomware attacks continue to evolve … More →

The post BlackFog platform enhancements boost data loss prevention appeared first on Help Net Security.

Akamai announced the Akamai App Platform, a ready-to-run solution that makes it easy to deploy, manage, and scale highly distributed applications. The Akamai App Platform is built on top of the cloud native Kubernetes technology Otomi, which Akamai acquired from Red Kubes earlier this year. The application platform provides ready-to-run templates that address common challenges in deploying, managing, and scaling Kubernetes clusters at scale. Instead of relying on multiple departments and spending months sourcing, connecting, … More →

The post Akamai App Platform reduces the complexity associated with managing Kubernetes clusters appeared first on Help Net Security.

Druva announced support for Microsoft Dynamics 365 to help enterprises secure mission-critical data across Dynamics 365 Sales and Customer Service CRM modules. With support for Dynamics 365, Druva ensures customers can keep business-critical CRM data secure and maintain business operations in the event of an incident. Druva is also announcing support for Microsoft 365 Backup Storage to increase customer choice with Microsoft 365 protection. With core CRM capabilities, Dynamics 365 is the heartbeat of many … More →

The post Druva empowers businesses to secure data throughout Microsoft environments appeared first on Help Net Security.

F5 announced early access of F5 AI Gateway to streamline interactions between applications, APIs, and large language models (LLMs) driving enterprise AI adoption. This powerful containerized solution optimizes performance, observability, and protection capabilities—all leading to reduced costs. Integrated with F5’s portfolio, AI Gateway gives security and operations teams a seamless path to adopting AI services through significantly improved data output quality and a superior user experience. According to F5’s State of AI Application Strategy Report, … More →

The post F5 AI Gateway secures and optimizes access to AI applications appeared first on Help Net Security.

If you’re wondering whether your personal and financial data has been compromised in the massive Hot Topic breach, you can use two separate online tools to check: Have I Been Pwned? or DataBreach.com. Which data was compromised? News of a potential data breach affecting customers of popular US retailers Hot Topic, Torrid, and Box Lunch – all three owned by private equity firm Sycamore Partners – was first reported by Hudson Rock researchers on October … More →

The post Hot Topic breach: Has your credit card info been compromised? appeared first on Help Net Security.

Zscaler announced a Zero Trust Segmentation solution to provide a more secure, agile and cost-effective means to connect users, devices, and workloads across and within globally distributed branches, factories, campuses, data centers, and public clouds. While traditional networks, including SD-WAN and site-to-site VPN, have extended enterprise connectivity to branches and clouds, they have also inadvertently accelerated the spread of ransomware. Although firewalls are used to do segmentation on networks, they add complexity, increase costs, and … More →

The post Zscaler Zero Trust Segmentation prevents lateral movement from ransomware attacks appeared first on Help Net Security.

Immersive Labs introduced AI Scenario Generator. This new capability enables organizations to generate threat scenarios for crisis simulations to ensure their workforces are ready for the latest threats. By inputting a few short prompts, customers can use the AI Scenario Generator to rapidly generate and launch customized cyber exercises to prove and improve individual and team cyber skills against various attack types, such as ransomware and supply chain threats. Organizations can automatically tailor content by … More →

The post Immersive Labs AI Scenario Generator improves cyber skills against various attack types appeared first on Help Net Security.

Eurotech launches ReliaGATE 15A-14, a cybersecure modular edge gateway designed to meet the growing demand for secure, flexible, and globally deployable IoT solutions. Built to support a wide range of applications, the ReliaGATE 15A-14 accelerates IoT projects by simplifying compliance with regional and carrier certifications, providing native support for field asset integration, and meeting stringent security standards. The ReliaGATE 15A-14 combines flexible feature expansion to adapt to diverse customer requirements with multiple compact form factors … More →

The post Eurotech ReliaGATE 15A-14 enables organizations to meet regulatory standards appeared first on Help Net Security.

A threat actor who goes by the online moniker “Nam3L3ss” has leaked employee data belonging to a number of corporations – including Amazon, 3M, HSBC and HP – ostensibly compromised during the May 2023 MOVEit hack by the Cl0p ransomware gang, which affected British Airways, the BBC, Aer Lingus, Boots. Zellis, and others. Nam3L3ss’ post leaking Amazon employee data (Source: Hudson Rock) More data leaks announced “The stolen data, which dates back to May 2023, … More →

The post Massive troves of Amazon, HSBC employee data leaked appeared first on Help Net Security.

It’s easy to see why identity security is often synonymous with user security. Social engineering tactics are the mainstay of the threat actor’s arsenal, and it’s rare to find an attack that doesn’t feature them to some degree. Getting hold of privileged user credentials is often the goal of attackers, granting the perpetrator the keys to the kingdom and enabling them to pull off all malicious activity. There’s also the fact that identity security is … More →

The post The changing face of identity security appeared first on Help Net Security.

Microsoft followed their October precedent set with Windows 11 24H2 and announced Microsoft Server 2025 on the first of November. We were expecting the official announcement at Microsoft Ignite near the end of the month, but with the early release, early users and Ignite attendees can have more in-depth discussions due to product familiarity. Before we dig into some of the security enhancements and features in the new server, let’s take a quick look at … More →

The post November 2024 Patch Tuesday forecast: New servers arrive early appeared first on Help Net Security.

Through their past military service, veterans are trained to think like adversaries, often share that mission-driven spirit and excel when working with a team to achieve a larger goal. They develop and champion the unique traits that cybersecurity companies need in prospective talent. These organizations must take note, as tapping veterans for cybersecurity roles can mutually benefit their business and the individuals they hire. Below, I’ll explain four reasons veterans make excellent cybersecurity company employees. … More →

The post 4 reasons why veterans thrive as cybersecurity professionals appeared first on Help Net Security.

In this Help Net Security interview, Alex Freedland, CEO at Mirantis, discusses the cloud security challenges that CISOs need to tackle as multi-cloud and hybrid environments become the norm. He points out the expanded attack surfaces, the importance of consistent security policies, and the need for automated compliance solutions. What are the most pressing cloud security challenges that CISOs should prioritize, especially as multi-cloud and hybrid environments grow more complex? With the increasing adoption of … More →

The post Strategies for CISOs navigating hybrid and multi-cloud security appeared first on Help Net Security.

Vulnerability management has been the standard approach to fending off cyber threats for years. Still, it falls short by focusing on a limited number of vulnerabilities, often resolving only 1% to 20% of issues. In 2024, with the average data breach cost rising to $4.88 million, businesses can no longer rely on outdated, reactive practices. Instead, a shift to exposure management is crucial. In this Help Net Security video, Rob Gurzeev, CEO of CyCognito, discusses … More →

The post Setting a security standard: From vulnerability to exposure management appeared first on Help Net Security.

10% of security researchers now specialize in AI technology as 48% of security leaders consider AI to be one of the greatest risks to their organizations, according to HackerOne. HackerOne’s report combines perspectives from the researcher community, customers, and security leaders. It explores how security-focused organizations integrate human expertise with technology and AI for a defense-in-depth strategy. AI is a threat and an opportunity 67% of security professionals said an external and unbiased review of … More →

The post How human ingenuity continues to outpace automated security tools appeared first on Help Net Security.

Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: Millions of Synology NAS devices vulnerable to zero-click attacks (CVE-2024-10443) Synology has released fixes for an unauthenticated “zero-click” remote code execution flaw (CVE-2024-10443, aka RISK:STATION) affecting its popular DiskStation and BeeStation network attached storage (NAS) devices. Google patches actively exploited Android vulnerability (CVE-2024-43093) Google has delivered fixes for two vulnerabilities endangering Android users that “may be under limited, targeted exploitation”: … More →

The post Week in review: Zero-click flaw in Synology NAS devices, Google fixes exploited Android vulnerability appeared first on Help Net Security.

A vulnerability (CVE-2024-5910) in Palo Alto Networks Expedition, a firewall configuration migration tool, is being exploited by attackers in the wild, the Cybersecurity and Infrastructure Security Agency (CISA) confirmed on Thursday. About CVE-2024-5910 Unearthed and reported by Brian Hysell of Synopsys Cybersecurity Research Center (CyRC), CVE-2024-5910 stems from missing authentication for a critical function, which can lead to an Expedition admin account takeover for attackers with network access to the installation. A security update fixing … More →

The post Critical Palo Alto Networks Expedition bug exploited (CVE-2024-5910) appeared first on Help Net Security.

Mirantis launched Mirantis Harbor Registry Support and Mirantis KubeVirt Support offerings, providing support for managing container image registries and virtual machine workloads within any Kubernetes environment, irrespective of the underlying infrastructure or Kubernetes distribution. “For organizations seeking pure open-source deployments, Mirantis is committed to empowering them with the support they need to manage their Kubernetes environments effectively,” said Randy Bias, VP – open source strategy and technology, Mirantis. “Our new Harbor and KubeVirt support offerings … More →

The post Mirantis provides support offerings for Harbor Registry and KubeVirt appeared first on Help Net Security.

AppOmni announced a significant partnership that combines the company’s Zero Trust Posture Management (ZTPM) solution with Cisco’s Security Service Edge (SSE) technology suite to enable zero trust principles at the application layer in Security-as-a-Service (SaaS) applications. The combined solution provides organizations with end-to-end zero trust from the endpoint to the application and greatly improves security in complex SaaS installations, with enhanced visibility and monitoring into everything from configurations to user behaviors. With a secure environment … More →

The post AppOmni partners with Cisco to extend zero trust to SaaS appeared first on Help Net Security.