Security researcher Alexander Popov has discovered and fixed five similar issues in the virtual socket implementation of the Linux kernel. The vulnerabilities could be exploited for local privilege escalation, as confirmed in experiments on Fedora 33 S…
Read More Now-fixed Linux kernel vulnerabilities enabled local privilege escalation (CVE-2021-26708)Many people’s first exposure to bots came from so-called sneakerbots. Sneakerbots are used to scan websites for inventory and automatically complete the checkout process. Combined with proxy services that provide IP addresses and user agents to make th…
Read More Proliferation of sneakerbots across industries: The long tail of DIY bot operatorsAs the challenges of smaller security teams are certainly different than with larger teams, these IT professionals must be more creative and pragmatic than their large enterprise counterparts, according to Cynet. In the past several years we have seen …
Read More 10 strategies small security teams can use for effective cybersecurity managementTanium released a report to evaluate the primary IT operations and security challenges organizations have faced amid the large-scale shift to remote work in the COVID-19 era, and how businesses plan to adapt moving forward. The report was conducted by …
Read More Enterprises observing uptick in risky behaviors since shift to remote workAccording to recent estimates, there will be roughly 10 billion people to feed in 2050. Agricultural production will need to increase by almost 56% to guarantee food security globally, without converting more land for agriculture (in line with environm…
Read More How to tackle modern agriculture security challengesThe number of cities with 5G networks is now 1,336 globally, a 350 percent increase during the past year despite an ongoing global pandemic, Viavi Solutions reveals. As of January 2021, more than 30 percent of the world’s countries now have 5G av…
Read More More than 30% of the world’s countries now have 5G availabilityFor the Defense Industrial Base (DIB), the Department of Defense (DoD) Cybersecurity Maturity Model Certification (CMMC) compliance requirement is the hot news topic of 2021. In fact, across the DIB market, CMMC compliance will probably stay a focus th…
Read More Preparing for the Cybersecurity Maturity Model Certification onslaughtThe delivery method for the six-year-old Gootkit financial malware has been developed into a complex and stealthy delivery system for a wide range of malware, including ransomware. Sophos researchers have named the platform Gootloader. It is actively d…
Read More Multi-payload Gootloader platform stealthily delivers malware and ransomwareWith the voice commands “Alexa Skills,” users can load numerous extra functions onto their Amazon voice assistant. Amazon screens special voice assistant functions for security. However, scammers can circumvent this check. These Skills can often have s…
Read More Alexa Skills: Security gaps and data protection problemsThe majority of all malware is now delivered via cloud applications, underscoring how attackers increasingly abuse popular cloud services to evade legacy security defenses putting enterprise data increasingly at risk, a Netskope research reveals. “Cybe…
Read More Cybercriminals continue to target trusted cloud appsThere is ample opportunity for financial institutions to harness the power of AI to build more meaningful connections and experiences with customers — vastly improving both retention and acquisition, according to research findings released by NTT DATA….
Read More Customers willing to share personal data in exchange for personalized servicesCOVID-19 propelled the world of IT years into the future. Organizations considering long-term digital transformation plans were abruptly forced to accelerate their timeline, so employees could work remotely amid shelter-in-place orders. While this shif…
Read More Protecting the digital workplace with an integrated security strategy78% of senior IT and IT security leaders believe their organizations lack sufficient protection against cyberattacks despite increased IT security investments made in 2020 to deal with distributed IT and work-from-home challenges, according to an IDG R…
Read More Most IT security leaders lack confidence in their company’s security postureIn a recent report, Trend Micro announced it detected 119,000 cyber threats per minute in 2020 as home workers and infrastructure came under new pressure from attacks. Attacks on homes surged The report also shows that home networks were a major draw l…
Read More Insights for navigating a drastically changing threat landscapeAppDynamics released its global research study, exploring the impact of the rapid acceleration of digital transformation created in response to the COVID-19 pandemic and the repercussions for global technologists. The findings reveal a dramatic increas…
Read More Full-stack observability: The only way technologists can deal with IT complexity95% of IT leaders say that client and company data is at risk on email, an Egress report reveals. Additionally, an overwhelming 83% of organizations have suffered data breaches via this channel in the last 12 months. Human error was at the root of near…
Read More Data is most at risk on email, with 83% of organizations experiencing email data breachesHere’s an overview of some of last week’s most interesting news and articles: Attackers are looking to exploit critical VMware vCenter Server RCE flaw, patch ASAP! The day after VMware released fixes for a critical RCE flaw (CVE-2021-21972)…
Read More Week in review: Kali Linux 2021.1, CNAME-based tracking, VMware vCenter Servers under attackBalancing data privacy within an organization is no easy task, particularly for data scientists who need quick access to data, and security and governance teams whose job it is to protect it. Too many of our customers have told us they are being inunda…
Read More Closing the data divide: How to create harmony among data scientists and privacy advocatesBusiness email compromise (BEC) threats are one of the many tried-and-tested tactics cybercriminals use to target their victims. These tend to be brief messages with only a few lines of text but no URLs, attached files or other elements that can be sca…
Read More The rise of non-English language spear phishing emailsThere was a massive increase in cyber threats globally year-over-year fueled by both the pandemic and expanding attack surfaces, Skybox Security reveals. Expanding attack surfaces New malware samples nearly doubled: New ransomware samples increased 106…
Read More Massive rise in threats across expanding attack surfacesEmployees working from home on a company-provided computer are demonstrating a clear lack of cybersecurity knowledge through high-risk behavior, according to a report released by Ivanti. Using work passwords for consumer websites The report found that …
Read More One in four people use work passwords for consumer websitesThe application container market is expected to register a CAGR of 29% over the forecast period 2021 to 2026, according to ResearchAndMarkets. Increasing deployments of application container across industries Organizations in the retail and e-commerce …
Read More Application container market to grow steadily by 2026Dragos releases annual analysis of ICS/OT focused cyber threats, vulnerabilities, assessments, and incident response insights. “In 2020, the industrial community performed amazing feats to keep civilization running under challenging circumstances throu…
Read More ICS threat landscape highlightsThe debate within business organizations of whether to use consumer devices or to invest in rugged devices for the operations side of their business is as old as personal computing itself. And with the pandemic having shown that endpoint management is …
Read More Why enterprises need rugged devices with integrated endpoint management systemsFor billions of individuals around the world, digital identity became critical in 2020. As a result, the global identity verification market, which was already growing rapidly to support the digitization of a whole host of industries, is now booming. W…
Read More Five factors driving investment in IDVCyberattacks evolved in 2020 as threat actors sought to profit from the unprecedented socioeconomic, business and political challenges brought on by the COVID-19 pandemic, IBM Security reveals. In 2020 attackers were observed pivoting their attacks to …
Read More Attackers disrupting COVID-19 efforts and critical supply chainsOut with the old, in with MACH. That’s what a poll of global IT leaders found regarding their plans to revamp, or retain, their enterprise architectures. The research, conducted by DJS Research, polled senior level technology decision makers (CIO…
Read More C-level executives driving the adoption of MACH across their organizationsHow much personal information can our phone apps gather through location tracking? To answer this question, two researchers – Mirco Musolesi (University of Bologna, Italy) and Benjamin Baron (University College London, UK) – carried out a f…
Read More Users largely unaware of the privacy implications of location trackingIn 2020, the pandemic was a radical turning point in the way we work. Office workers were forced to give up their commute and work from home. People from a whole range of industry sectors had to embrace technology, video conferencing and new communicat…
Read More 2021 will be the year of hybrid working: How can CTOs keep staff secure and productive?Enterprise third-party risk management (TPRM) programs have been around for a half-decade or longer, and at this point most large organizations run one. However, many of these TPRM programs only provide a thin veneer of cybersecurity assurance. Recent …
Read More Third-party risk management programs still largely a checkbox exerciseOn Feb 5th, 2021, a hacker gained remote access to a water treatment plant in Oldsmar, Florida, and was able to adjust the amount of sodium hydroxide in the water from 100 parts per million to 11,100. Thanks to the physical fail-safes and alarm systems…
Read More U.S. municipalities are the perfect target for cybercriminals in 2021A majority of businesses surveyed for a study by the Economist Intelligence Unit (EIU) and the Cybersecurity Tech Accord, see state-led and sponsored cyberattacks as a major threat. They are concerned about catastrophic reputational and financial conse…
Read More Most businesses see state-sponsored cyberattacks as a major threatFor public health officials, contact tracing remains critical to managing the spread of the coronavirus — particularly as it appears that variants of the virus could be more transmissible. The need for widespread contact tracing at the start of t…
Read More Researchers propose more secure and private mobile contact tracingThe digitalization of services and expansion of remote working has heightened the number of off-premises users accessing cloud-based resources from their mobile device. In this configuration, each mobile device represents a point of entry for hackers, …
Read More Whitepaper – EDR to secure mobile devices: Coverage, limits & recommendationsMany organizations have maintained heavy investment in cybersecurity over the last year, even in an unpredictable time when other spending has faltered. Gartner estimates that IT security and risk management spending still grew 2.6 percent even as IT s…
Read More Physical cyber threats: What do criminals leave when they break in?Supply chain attacks, ransomware, data extortion and nation-state threats prove to be more prolific than ever, a CrowdStrike report suggests. eCrime attacks made up 79% of all intrusions (via hands-on-keyboard activity). Among a popular vector for cybe…
Read More Adversaries exploit supply chains, double down on COVID-19 and ransomwareThere’s an increased adoption of managed infrastructure services and the emergence of new cloud watering hole attacks, Accurics reveals. Of all violations identified, 23 percent correspond to poorly configured managed service offerings – largely …
Read More Top cloud infrastructure risks faced by real-world organizationsThe global zero trust security market size is projected to grow from $19.6 billion in 2020 to $51.6 billion by 2026, recording a compound annual growth rate (CAGR) of 17.4% from 2020 to 2026, according to MarketsandMarkets. The major growth drivers for…
Read More Worldwide zero trust security market size to reach $51.6 billion by 2026The PCI Security Standards Council (PCI SSC) has published version 1.1 of the PCI Secure Software Lifecycle (SLC) Standard and its supporting program documentation. The PCI Secure SLC Standard is one of two standards that are part of the PCI Software S…
Read More PCI SSC releases PCI Secure Software Lifecycle (SLC) Standard 1.1Databases are the lifeblood store of information for every organization. Without them, the organization’s efficiency, productivity and scope to prosper would be curtailed severely. Protecting the company crown jewels is something that most organization…
Read More Database encryption: Protecting the crown jewelsIn 2020, we experienced wave after wave of COVID-19 surges and watched failure after failure at practicing what we knew were effective preventative measures. Similarly, in December 2020, the Russia-backed SolarWinds malware attack resulted in the compr…
Read More 10 COVID-19-related lessons for future-ready cybersecurityRedgate has released a report which shows some dramatic changes in IT as a direct result of the current pandemic. Nearly three quarters of organizations have now adopted DevOps in some form, cross-platform database use has risen markedly and, significa…
Read More Exploring DevOps adoption among database prosTurbonomic announced findings from the survey of over 800 global IT professionals that examines the current state of multicloud adoption, its drivers, and the technologies enabling it, including containers, public cloud, and edge computing. The analysi…
Read More The state of multicloud adoption, its drivers, and the technologies enabling itMalwarebytes announced the findings of its report which explores how the global pandemic forced many employees to quickly become a remote workforce and confined consumers to their homes. In the wake of this change, cybercriminals ditched many of their …
Read More Criminals leveraging shift to remote work to develop targeted attacksHere’s an overview of some of last week’s most interesting news and articles: Nearly 40% of consumers lost money to phone scams in 2020 Businesses and consumers are relying on the voice call more than ever during the pandemic with voice tra…
Read More Week in review: Most used MITRE ATT&CK tactics, boosting the “Sec” in DevSecOpsThe “castle and moat” approach to protecting one’s domain was effective for centuries. At the start of the internet age, when a company’s greatest assets were physically located on-premises and when employees were accessing them in a predictable way (u…
Read More What behavioral experts can teach us about improving securityAn organization’s web application firewall (WAF) is a critical line of defense in protecting proprietary and customer data, but the concern is that some organizations are spending an outsized allotment of resources on modifying these mission-critical e…
Read More Most security pros think a WAF is high maintenanceMore than 70% of CXOs of global companies consider mainframe or legacy modernization a strategic business priority for the next three years, a Tata Consultancy Services survey reveals. The study surveyed 211 CXOs and senior decision makers from compani…
Read More CXOs consider mainframe and legacy modernization a business priorityThe 5G security market size is projected to grow from $580 million in 2020 to $5.226 billion by 2026, at a compound annual growth rate (CAGR) of 44.3% during the forecast period, according to MarketsandMarkets. The major drivers for the 5G security mar…
Read More 5G security market to reach 5.226 billion by 2026Bottomline and Strategic Treasurer released the results of a survey that gathered details about corporate and banking experiences, actions and plans regarding fraud. Results show that the pandemic accelerated both the threat of fraud and the response t…
Read More Business email compromise is a top concern for banksOne of the challenges with the current pace of innovation is deciphering what is real and what is vaporware. Most of us are understandably skeptical when we hear of technical advances that sound too good to be true – our skepticism is rooted in our exp…
Read More Homomorphic encryption: Myths and misconceptionsThe increasing importance of emotional intelligence and other skills required to work with different stakeholders are placing new demands on CISOs. However, it’s also creating opportunities for CISOs to become leaders of their organizations, according …
Read More Emotional intelligence playing an increasingly important role for CISOsIn 2020, there were 599 healthcare breaches that collectively affected over 26 million individuals. Bitglass’ report takes an in-depth look at the breaches that healthcare organizations faced, comparing them to previous years and revealing key trends a…
Read More Healthcare breaches increased over 50% in 2020The internet has revolutionized our lives – whether in terms of working, finding information or entertainment, connecting with others, or shopping. The online world has made many things easier and opened up previously unimaginable opportunities. …
Read More How can we protect ourselves against fake news and manipulation?Continued high levels of technology deployment worldwide will result in a proliferation of data created, driving the need for data processing and storage capacity, Frost & Sullivan’s analysis finds. The result will be the construction of lar…
Read More $432.14 billion to be invested in the data center market by 2025What is CIEM? Among the many changes of 2020, Gartner added a new category: cloud infrastructure entitlement management (CIEM). While CIEM may sound similar to SIEM (security information and event management), the two security solutions are not the sam…
Read More Why do enterprise SOC teams need CIEM now?Even the best-laid plans can go astray, but you can get your certification goals back on track for success. Every (ISC)² member started out by committing to and passing one of our certification exams. No matter which certification you choose, you’ll fi…
Read More Free certification Exam Action Plan from (ISC)²Wading through waves of alert noise to find real threats and manually connecting the dots to find context in real-time attacks are essential capabilities in today’s cyberthreat detection and response battleground. While it sounds impossible, the same t…
Read More Knowledge graphs: The secret of Google Search and now XDRNIST logged more than 18,000 vulnerabilities in 2020, over 10,000 of which were critical or high severity – an all-time high. Redscan’s analysis looks beyond severity scores, detailing the rise of low complexity vulnerabilities as well as those which r…
Read More 57% of vulnerabilities in 2020 were classified as critical or high severitySecurity analysts are becoming less productive due to widespread “alert fatigue” resulting in ignored alerts, increased stress, and fear of missing incidents, according to an IDC survey of 350 internal and MSSP security analysts and managers. To improv…
Read More Analysts need advanced automation tools to reduce fear of missing incidentsBy removing the most common cause of traffic accidents – the human driver – autonomous vehicles are expected to reduce traffic accidents and fatalities. However, they may pose a completely different type of risk to drivers, passengers and pedestrians. …
Read More Cybersecurity risks connected to AI in autonomous vehiclesA research study conducted by Deep Instinct reports on the hundreds of millions of attempted cyberattacks that occurred every day throughout 2020 showing malware increased by 358% overall and ransomware increased by 435% as compared with 2019. Report h…
Read More Malware increased by 358% in 2020Roughly 12 months ago, when the world shifted seemingly overnight to work-from-home, few companies were well-positioned to seamlessly scale their remote work solutions. Legacy remote desktop solutions, like Virtual Desktop Infrastructure (VDI) and Desk…
Read More Enable secure remote workspaces without trashing your entire IT infrastructureEmail data breaches are on the rise. Our recent research found that 93% of organizations have experienced an email data breach in the last 12 months, at an average rate of one incident every 12 working hours. The vast majority of these incidents are ca…
Read More Why contextual machine learning is the fix that zero-trust email security needsSeismic monitoring devices linked to the internet are vulnerable to cyberattacks that could disrupt data collection and processing, say researchers who have probed the devices for weak points. Common security issues such as non-encrypted data, insecure…
Read More The cybersecurity issues of seismic monitoring devicesStartpage announced results of its survey exploring the attitudes of Americans towards protecting their own privacy online. The results found a gap between the high levels of online privacy awareness and concern respondents report, and the low levels o…
Read More Consumers not protecting data online despite having privacy concernsCybersecurity spending in critical infrastructure has been little impacted by the COVID-19 pandemic, save for some reshuffling on where that spend is most needed. The effect has been mostly in increased demand for secure remote connectivity. Most of th…
Read More Cybersecurity spending for critical infrastructure to reach $105.99 billion in 2021The Cyber Underground General Intelligence Requirements Handbook (CU-GIRH) is a baseline tool to assist in organizing, prioritizing, producing and measuring production of cyber underground intelligence. Central to this handbook are General Intelligence…
Read More Cyber Underground General Intelligence Requirements HandbookRecently, much of the cybersecurity commentary and blogs have talked about new approaches for protecting the network, especially beyond the perimeter. For the past few years, the industry has focused on conditional access (i.e., identity as the new per…
Read More Have we put too much emphasis on protecting the network?Businesses and consumers are relying on the voice call more than ever during the pandemic with voice traffic up 184% in 2020 compared to 2019, according to a Hiya report. Phone scams However, this increase in voice calls is being exploited by scammers …
Read More Nearly 40% of consumers lost money to phone scams in 2020Cryptography is a vital part of cybersecurity. Security properties like confidentiality, integrity, authentication, non-repudiation rely on strong cryptographic mechanisms, especially in an always connected, always online world. Quantum computing and e…
Read More Quantum computing and encryption: Key to achieving resilience, technological sovereignty and leadership25.9 million business account credentials and over 543 million breach assets tied to employees in the Fortune 1000 are readily available on the criminal underground, SpyCloud reveals. Password reuse risk “Year after year, studies show that the us…
Read More Rampant password reuse puts companies and customers at riskAs the pandemic continues to challenge organizations worldwide, the role of chief financial officers (CFOs) has moved further beyond “economic guardians” of the enterprise to “architects of business value” and “catalysts of digital strategies,” with 72…
Read More CFOs are becoming catalysts of digital strategyHere’s an overview of some of last week’s most interesting news and articles: Vulnerabilities in widely used TCP/IP stacks open IoT, OT devices to attack Forescout researchers have discovered nine vulnerabilities affecting nine different TC…
Read More Week in review: Improving vulnerability triage, RDP attacks soaring, hackers in high demandTools for analytics and automation are providing today’s SOC teams with enhanced visibility, improved productivity, and unlimited scalability—and it couldn’t come at a better time. In the wake of the COVID-19 pandemic, security has become a top priorit…
Read More For SOC teams, the analytics and automation hype is real2020 was chock full of surprises and twists that no analyst could have predicted and came with a massive shift to remote working and tools that facilitate it. The good news is that managed service providers (MSPs) saw tremendous growth both due to the …
Read More 5 cybersecurity trends MSPs must address in 2021The number of phishing attacks grew through 2020, fully doubling over the course of the year. Attacks peaked in October 2020, with a high of 225,304 new phishing sites appearing in that month alone, breaking all previous monthly records, according to A…
Read More Successful BEC attacks become 56% more costlyAll of the 30 popular mHealth apps that were tested are vulnerable to API attacks that can allow unauthorized access to full patient records including protected health information (PHI) and personally identifiable information (PII), Approov reveals. Th…
Read More mHealth apps consistently expose PII and PHI through APIs2020 vulnerability disclosures are on track to exceed 2019 despite a sharp decrease of 19.2% observed earlier in the year, according to Risk Based Security. The team aggregated 23,269 vulnerabilities disclosed during 2020. Despite the initial disruptio…
Read More 2020 vulnerability disclosures on track to exceed those from 2019The COVID-19 pandemic continued to influence the cybercrime landscape in 2020, ESET reveals. Most notably, the new attack surface created by the shift to work from home brought further growth of Remote Desktop Protocol (RDP) attacks, albeit at a slower…
Read More Researchers spot massive increase in RDP attack attemptsOver the past decade, the firms that make up the so-called Big Tech have captured enough of the global economy to resemble industrial cartels from a bygone era. Amazon, Apple, Google, Facebook, and Microsoft form behemoths within their respective marke…
Read More Big Tech will try to pre-empt harsh privacy laws by writing their ownDuring the past year, business leaders have seen first-hand the benefits of adopting an everywhere enterprise model of working and are now carefully considering its role in the future of work. A study by Mercer revealed 94% of employers agreed that pro…
Read More Protecting productivity within the disappearing perimeterThe number of annual credential spill incidents nearly doubled from 2016 to 2020, according to F5 research. There was a 46% downturn in the number of spilled credentials during the same period. The average spill size also declined, falling from 63 mill…
Read More Credential spill incidents nearly doubled since 2016Thanks to cyberattacks making regular headlines in the news, it’s no secret that massive data breaches are a significant threat to organizations. However, a report from F-Secure highlights the rarely-discussed impact these attacks can have on people an…
Read More People are often the collateral damage of attacks on corporationsSpirent Communications released its 5G outlook report, based on analysis and takeaways from over 600 global 5G engagements in 2020. The report provides insights from across the 5G eco-system on the current status of 5G, illustrating the accelerated tim…
Read More 5G experimentation and security grows in govt, military sectorsGuardicore released IPCDump, a new open source tool for tracing interprocess communication on Linux. The tool covers most interprocess communication (IPC) mechanisms, including pipes, fifos, signals, Unix sockets, loopback-based networking, and pseudot…
Read More IPCDump: Open-source tool for tracing interprocess communication on Linux