Security is enhanced with the introduction of dynamic zero-trust security, a method that continuously assesses the security posture of devices and users on the network.
The post Beyond Zero-Trust: The Impact of Adaptive Micro-Segmentation on Network Security appeared first on Security Boulevard.
Currently accessing the free legacy DNS Blocklists (DNSBLs) via the Public Mirrors, and using GoDaddy's network? You'll need to make some minor changes to your email infrastructure. The changes are simple to implement, but if you fail to do so, you could find that at some point post-September 26th 2024, all or none of your email is blocked!
The post If you query the legacy DNSBLs via GoDaddy move to Spamhaus Technology’s free Data Query Service appeared first on Security Boulevard.
Stewart and Trey join us to talk about driving cybersecurity policies for the nation, what makes a good policy, what makes a bad policy, supply chain research and policies, and overall how we shape policies that benefit cybersecurity. Show Notes
The post BTS #36 - Supply Chain Policies - Stewart Scott, Trey Herr appeared first on Eclypsium | Supply Chain Security for the Modern Enterprise.
The post BTS #36 – Supply Chain Policies – Stewart Scott, Trey Herr appeared first on Security Boulevard.
The search landscape is undergoing a seismic shift. Traditional search engines are being challenged by AI-powered platforms like Perplexity and SearchGPT. This new era promises more personalized, intuitive, and efficient information retrieval. Are you ready for the future of search?
The post The Future of Search: AI-Powered Transformation appeared first on Security Boulevard.
Authors/Presenters:uhong Nan, Sun Yat-sen University; Xueqiang Wang, University of Central Florida; Luyi Xing and Xiaojing Liao, Indiana University Bloomington; Ruoyu Wu and Jianliang Wu, Purdue University; Yifan Zhang and XiaoFeng Wang, Indiana University Bloomington
Many thanks to USENIX for publishing their outstanding USENIX Security ’23 Presenter’s content, and the organizations strong commitment to Open Access. Originating from the conference’s events situated at the Anaheim Marriott; and via the organizations YouTube channel.
The post USENIX Security ’23 – Are You Spying on Me? Large-Scale Analysis on IoT Data Exposure through Companion Apps appeared first on Security Boulevard.
The post 8 Must-Ask Questions for AI Security Vendors appeared first on AI-enhanced Security Automation.
The post 8 Must-Ask Questions for AI Security Vendors appeared first on Security Boulevard.
Analyst firms play an important role in the tech vendor landscape. Their reports help buyers and would-be buyers learn about vendors and their offerings. In cybersecurity, in particular, buyers use analysts’ outputs to build shortlists prior to thee kick-offs of their individual deep dive evaluations — in some categories of tools, the field is simply […]
The post Five Gartner Reports. Four Categories. What Does OX Security Do Anyway? appeared first on OX Security.
The post Five Gartner Reports. Four Categories. What Does OX Security Do Anyway? appeared first on Security Boulevard.
See These CVEs: Patch Tuesday—ten zero-days, seven Critical vulns, zero time to waste.
The post August Patch Pileup: Microsoft’s Zero-Day Doozy Dump appeared first on Security Boulevard.
Your home or small office (SOHO router) is likely being targeted by cybercriminals, malware, and nation-state actors alike. Though this targeting often has nothing to do with wanting to spy on you, your SOHO router can be a valuable resource for threat actors looking to conceal their malicious traffic and activity.
Unfortunately, targeting of SOHO routers is growing primarily due a multifaceted problem - which includes vendors selling routers with poor security and many users not understanding the importance of updating their devices.
TABLE OF CONTENTS
Malware, cybercriminals, and state-backed threat actors target SOHO routers. They've done so increasingly over the last few years.
To backtrack a little , it's important to understand that a lot of threat actors target routers - which can include modems and gateways - alongside internet-of-things (IoT devices). Here I will focus on "routers" as general term, as this can include gateways (which are router/modem combinations and extremely popular for home/small offices users).
For simplicity's sake, I'll also focus on malware, cybercriminals, and state-backed threat actors. (Yes, state-backed APTs or hackers have and do target SOHO routers in pursuing their own goals.)
To be fair, malware, botnets and cybercriminals often go together; botnets are often used by cybercriminals to carry out their goals, whether that is overloading servers to keep a service offline or launching distributed credential stuffing attacks. However, botnets regularly use malware like Mirai variants - which are considered a self-replicating worm - to "automatically" launch attacks and recruit devices into the botnet, so it felt important enough to make the distinction.
The poor state of SOHO router securityBefore diving into why threat actors find "regular" consumer routers interesting enough to bother "hacking" them, it's important to understand the security landscape of the SOHO router market. Admittedly, this topic itself could be an entire post (or website - check out routersecurity.org, but put simply - it's not good.
Without even considering the technical ability of the end user, SOHO routers are routinely plagued with issues - top of the list are security vulnerabilities. While it is not reasonable or feasible to expect firmware and software to be completely free of security issues, perhaps in the modern age some shouldn't be as prevalent as they are (ex: failing to sanitize input or straight up broken security controls). There are many reasons security vulnerabilities can crop up in SOHO routers, but I am willing to bet many are due to lack of security-oriented review and/or just insecure design.
Security vulnerabilities in router firmware is too large of a topic to cover in just a section of this post. Fortunately, there are many examples where consumer routers had some pretty nasty vulnerabilities I can point you to:
The problem has not gone unnoticed by agencies in the US - and some other government agencies from other governments.
In light of the nation-state actor Volt Typhoon exploiting security vulnerabilities in SOHO routers (there's more information on that later in this post), the US Cybersecurity and Infrastructure Security Agency (CISA) has urged vendors to incorporate "Secure by Design" principles into their firmware/software. The Federal Communications Commission (FCC) has proposed the "US Cyber Trust Mark" for smart devices - though it could (and should) include SOHO routers.
Misconfigurations, poor updating practices, and use of EOL devicesThis section primarily pertains to end user behavior, which when combined with router manufacturer blunders, makes quite the interesting (and compounded) issue.
While misconfigurations can certainly be default values, users may misconfigure their routers by enabling or disabling features. For example, some SOHO routers may support remote management. Some users may enable this despite not truly needing it while not understanding the risk of exposing the administrator login panel of their router to the public internet.
In fact, even CISA has described the risks of exposing administrative interfaces of devices like routers to the public internet. While their guidance is directed towards more sophisticated organizations, the basics do apply here.
Many people do not know or understand that router firmware should be updated regularly, as updated firmware can include security fixes for vulnerabilities. As such, millions of SOHO routers either do not have the most recent updates installed or updates are installed after a considerable amount of time has passed - enough time for possible exploitation by attackers. As I've noted in other posts, this is important as the time between vulnerability disclosure and exploitation attempts continues to shorten.
Automatic updates can fix this, but the availability of automatic updates (and whether they are even enabled by default) depends on manufacturer, model, and submodel. Of course, users should realize (automatically) updating is not without slight risk of introducing new bugs or inconveniences, but it's certainly better than the alternative in most situations - on the receiving end of n-day vulnerability exploitation.
Just like with any other device, router models eventually become "old" or "legacy" after a number of years. Eventually, manufacturer support - including updates for the firmware - for some models ceases, reaching end of life (EOL). Since devices may not be "broken" or "dead" when the EOL period arrives, many people fail to replace their devices. As such, vulnerabilities discovered in these EOL models often do not get updates, leaving them open for exploitation by attackers:
The post Your SOHO Router is a Juicy Target for Hackers appeared first on Security Boulevard.
This article provides a comprehensive overview of threat intelligence services, highlighting the importance, methodology, benefits, etc.
The post What is Threat Intelligence? appeared first on Security Boulevard.
via the respected Software Engineering expertise of Mikkel Noe-Nygaard and the lauded Software Engineering / Enterprise Agile Coaching work of Luxshan Ratnaravi at Comic Agilé!
The post Comic Agilé – Mikkel Noe-Nygaard, Luxshan Ratnaravi – #303 — The Scrum Master To-Do List appeared first on Security Boulevard.
Software bill of materials (SBOMs) are essential elements for managing software security and compliance, especially in light of increasing open source risks.
The post How to audit SBOMs for enhanced software security appeared first on Security Boulevard.
As businesses enhance their risk management techniques, the importance of efficient audit procedures and robust internal controls cannot be overstated. Audit procedures are used by audit teams to identify and assess risks. Auditors can also recommend mitigation, such as a control effectiveness deficiency that could impact an organization’s operations and financial health. But how do...
The post How Audit Procedures and Internal Controls Improve Your Compliance Posture appeared first on Hyperproof.
The post How Audit Procedures and Internal Controls Improve Your Compliance Posture appeared first on Security Boulevard.
As we move through 2024, three events are causing significant disruption in the Public Key Infrastructure (PKI) landscape – the Entrust CA distrust incident, Google’s proposal for 90-day TLS certificate validity, and post-quantum cryptography (PQC) standardization. These events come with unique challenges and opportunities and are compelling organizations to rethink their approach to PKI and […]
The post Top Trends in 2024 Reshaping the PKI Landscape appeared first on Security Boulevard.
DigiCert today announced it is acquiring Vercara, a provider of Domain Name System (DNS) and distributed denial-of-service (DDoS) security services delivered via the cloud.
The post DigiCert Acquires Vercara to Extend Cybersecurity Services appeared first on Security Boulevard.
In the fast-paced world of cybersecurity, every second counts. When an API attack occurs, the speed at which your security team can detect, understand, and respond to the threat can mean the difference between a minor incident and a major data breach. This is where Mean Time to Resolve (MTTR) comes into play. MTTR is a key performance indicator (KPI) that measures the average time it takes to resolve a security incident, from the moment it's detected to the point where it's fully mitigated.
The Importance of MTTR in API SecurityAPIs are vital for modern applications as they enable smooth communication and data exchange. However, they also pose a significant security risk. API attacks can result in data breaches, service disruptions, and financial losses. The longer an attack remains undetected and unresolved, the more severe the potential damage.
A high MTTR indicates that your security team is struggling to keep up with the pace of attacks. This may be due to a variety of factors, including:
The Salt Security Platform is designed to help organizations minimize MTTR and improve their API security incident response capabilities. The platform achieves this through several key features.
By reducing MTTR, Salt Security helps organizations:
In the context of API security, time is of the essence. Salt Security's AI-infused platform, focuses on reducing MTTR by providing high-quality alerts, faster investigation capabilities, automated responses, and insights into attackers powered by AI. This allows organizations to promptly and effectively deal with threats. By doing so, not only is the impact of attacks minimized, but it also enhances their overall security posture, ensuring the protection of their valuable APIs.
If you want to learn more about Salt and how we can help you on your API Security journey through discovery, posture management, and run-time threat protection, please contact us, schedule a demo, or check out our website.
The post Time is of the Essence: Shrinking MTTR in API Security appeared first on Security Boulevard.
As software development reaches new heights, ensuring the security and management of your code is more crucial than ever. Seeing the need of the hour, Strobes CTEM is now integrated...
The post Strobes Integrates with Azure Repos: Enhancing Code Security appeared first on Strobes Security.
The post Strobes Integrates with Azure Repos: Enhancing Code Security appeared first on Security Boulevard.
The National Institute of Standards and Technology (NIST) released its first three post-quantum cryptography (PQC) standards, a world-first designed to meet the threat of powerful quantum computers as well as the increasing encryption vulnerability to AI-based attacks.
The post NIST Releases Post Quantum Cryptography Standards appeared first on Security Boulevard.
By pushing past the hurdles that can make threat modeling challenging, business leaders can take full advantage of threat models to give their organizations a leg up in the battle against cyberattacks.
The post Putting Threat Modeling Into Practice: A Guide for Business Leaders appeared first on Security Boulevard.
Authors: Rui Ataide, Hermes Bojaxhi GuidePoint’s DFIR team is frequently called upon to respond to Ransomware incidents. While many such […]
The post Update from the Ransomware Trenches appeared first on Security Boulevard.
