Security Boulevard

Contributors to this post: Mickey Shkatov, Alex Bazhaniuk So What Happened? Last week, Sophos released a bombshell report on what they’re calling “Pacific Rim”—and no, we’re not talking about giant robots fighting sea monsters. Sophos chronicles a five-year ordeal involving nation-state threat actors targeting network appliances, particularly Sophos firewalls. The discovery has been documented in […]

The post Pacific Rim: Chronicling a 5-year Hacking Escapade appeared first on Eclypsium | Supply Chain Security for the Modern Enterprise.

The post Pacific Rim: Chronicling a 5-year Hacking Escapade appeared first on Security Boulevard.

I’ve been writing about the possibility of AIs automatically discovering code vulnerabilities since at least 2018. This is an ongoing area of research: AIs doing source code scanning, AIs finding zero-days in the wild, and everything in between. The AIs aren’t very good at it yet, but they’re getting better.

Here’s some anecdotal data from this summer:

Since July 2024, ZeroPath is taking a novel approach combining deep program analysis with adversarial AI agents for validation. Our methodology has uncovered numerous critical vulnerabilities in production systems, including several that traditional Static Application Security Testing (SAST) tools were ill-equipped to find. This post provides a technical deep-dive into our research methodology and a living summary of the bugs found in popular open-source tools...

The post AIs Discovering Vulnerabilities appeared first on Security Boulevard.

The reality is, that despite our best efforts, breaches happen. And there’s a lot less information on how to respond versus how to prevent.  

The post Recovering From a Breach: 4 Steps Every Organization Should Take  appeared first on Security Boulevard.

Security and development teams often face a tough challenge: delivering a secure, quality product quickly without bogging down the pipeline. Security testing is traditionally squeezed in late, sometimes even right...

The post How PTaaS Supports Shift-Left Security Practices? appeared first on Strobes Security.

The post How PTaaS Supports Shift-Left Security Practices? appeared first on Security Boulevard.

As security teams level up to support the cloud-native transition, three major issues keep impeding detection and response in the cloud.

The post Three ‘Must Solve” Challenges Hindering Cloud-Native Detection and Response appeared first on Security Boulevard.

We have entered a new era of cyberthreats, and employees must be equipped to defend the company from more cunning and effective attacks than ever.

The post How Cybersecurity Training Must Adapt to a New Era of Threats appeared first on Security Boulevard.

Cybercriminals are exploiting DocuSign’s APIs to send highly authentic-looking fake invoices, while DocuSign’s forums have reported a rise in such fraudulent campaigns in recent months. Unlike typical phishing scams that rely on spoofed emails and malicious links, these attacks use legitimate DocuSign accounts and templates to mimic reputable companies, according to a Wallarm report. By..

The post Hackers Exploit DocuSign APIs for Phishing Campaign appeared first on Security Boulevard.

The Role of Secrets Management in Securing Financial Services
madhav
Tue, 11/05/2024 - 04:30

Secrets management is one of the top DevOps challenges. According to 2024 Thales Global Data Threat Report: Financial Services, FinServ organizations face greater security challenges in securing cloud infrastructure and focus on locking down secrets in development operations. This is a sobering fact. Among respondents who cited cloud/DevSecOps as a top source of emerging security concern, 61% identified secrets management as a top DevSecOps challenge. Let’s look at the role of secrets management for financial services.

The safe handling of private data, including passwords, and other credentials, is known as secrets management. Ensuring the integrity and confidentiality of data is crucial for every firm, but it's especially critical for financial services.

Financial firms manage enormous volumes of sensitive data, such as financial records, transaction details, and customer information. Maintaining compliance with strict regulatory standards and safeguarding this data from unwanted access depend on effective secrets management.

What is secrets management?

Secrets management for any business entails the safe handling, retrieval, and use of confidential data. It includes a range of procedures and instruments intended to safeguard login credentials and guarantee that only approved individuals and systems can access this data.

Access control methods, encryption, and secure storage solutions are important components. These components work together ensuring that secrets are managed securely throughout their lifecycle.

Why is secrets management crucial for financial services?

Financial institutions must safeguard sensitive data preventing breaches and unauthorized access. Effective secrets management helps to protect data both at rest and in transit, reducing the risk of data leaks and fraud. Because secrets management offers safe ways to handle and safeguard sensitive data, it is essential to fulfilling these compliance obligations.

Making sure that only authorized individuals have access to sensitive information is one way that good secrets management lowers the risk of insider threats and cyberattacks. Additionally, it aids in preventing security incidents brought on by credential exposure or poor management.

Financial services must consider the difficulties managing secrets. They often operate in intricate IT environments that include a variety of legacy infrastructure, systems, and apps. Maintaining confidentiality in these various contexts can be difficult and calls for a well-thought-out plan.

Organizations must manage an increasing number of secrets as they expand. It can be challenging to scale secrets management systems to ensure efficiency and security during this expansion.

It's never easy to ensure that secrets are only accessible to authorized people and systems. Incorrectly configured access controls may result in compliance problems and security flaws.

Summary

One essential part of cybersecurity in financial services is secret management. Financial organizations may safeguard confidential information, maintain regulatory compliance, and reduce the danger of unwanted access by managing secrets well. Establishing strong secrets management procedures should be a top priority for financial organizations to protect their operations and improve their overall security posture.

Thales is a trusted brand in the finance industry. Visit our financial services page for information on managing secrets. Keep a lookout for an upcoming article where we'll examine some tactics and industry best practices for putting efficient secrets management into practice for financial services.

Data Security Compliance Insider Threat Access Control Regulation and compliance

Randy Hildebrandt | Product Marketing, Data Protection
More About This Author > Schema {
"@context": "https://schema.org",
"@type": "BlogPosting",
"headline": "The Role of Secrets Management in Securing Financial Services",
"description": "Explore the importance of secrets management for financial services, including how it helps secure sensitive data, reduce risks, and maintain compliance in complex IT environments.",
"datePublished": "2024-11-05",
"author": {
"@type": "Person",
"name": "Randy Hildebrandt",
"url": "https://cpl.thalesgroup.com/blog/author/rhildebrandt",
"sameAs": "https://www.linkedin.com/in/randyhildebrandt/"
},
"publisher": {
"@type": "Organization",
"name": "Thales Group",
"description": "The world relies on Thales to protect and secure access to your most sensitive data and software wherever it is created, shared, or stored. Whether building an encryption strategy, licensing software, providing trusted access to the cloud, or meeting compliance mandates, you can rely on Thales to secure your digital transformation.",
"url": "https://cpl.thalesgroup.com",
"logo": "https://cpl.thalesgroup.com/sites/default/files/content/footer/thaleslogo-white.png",
"sameAs": [
"https://www.facebook.com/ThalesCloudSec",
"https://www.twitter.com/ThalesCloudSec",
"https://www.linkedin.com/company/thalescloudsec",
"https://www.youtube.com/ThalesCloudSec"
]
},
"mainEntityOfPage": "https://cpl.thalesgroup.com/blog/data-security/role-secrets-management-securing-financial-services"
}

basic

The post The Role of Secrets Management in Securing Financial Services appeared first on Security Boulevard.

Today, we’re diving into the fascinating world of cyber ranges—a critical component in the ever-evolving landscape of cybersecurity. But what exactly is a cyber range? Let’s break it down. What is a Cyber Range? A cyber range is a sophisticated environment that leverages technologies such as virtualization, hybrid reality, security orchestration, behavior and traffic simulation, […]

The post What is a Cyber Range? appeared first on NSFOCUS, Inc., a global network and cyber security leader, protects enterprises and carriers from advanced cyber attacks..

The post What is a Cyber Range? appeared first on Security Boulevard.

The FIDO Alliance found in a survey that as consumers become more familiar with passkeys, they are adopting the technology as a more secure alternative to passwords to authenticate their identities online.

The post FIDO: Consumers are Adopting Passkeys for Authentication appeared first on Security Boulevard.

In Part 2 of this blog series, we uncover the details of SLSA provenance from end to end. Previously in Part 1, we started by reviewing in-toto attestations, which are the underlying technology of SLSA provenance. Now, we dive into the internals of SLSA provenance, understand its content, and how you can leverage SLSA provenance to improve the security of your software supply chain and gain more visibility into it. In the next post, we will go further into the requirements of SLSA level 3, including how to implement it and why it is useful.

The post SLSA Framework: What is It and How to Gain Visibility appeared first on Security Boulevard.

Understand the key differences between MDR and MSSP and choose the right cybersecurity service to protect your business.

The post MDR vs. MSSP: Making the Right Choice for Your Business appeared first on D3 Security.

The post MDR vs. MSSP: Making the Right Choice for Your Business appeared first on Security Boulevard.

Authors/Presenters: Aviad Hahami

Our sincere appreciation to DEF CON, and the Presenters/Authors for publishing their erudite DEF CON 32 content. Originating from the conference’s events located at the Las Vegas Convention Center; and via the organizations YouTube channel.

Permalink

The post DEF CON 32 – OH MY DC Abusing OIDC All The Way To Your Cloud appeared first on Security Boulevard.

With new and increasing cyber threats abound, navigating global software regulations and staying informed and compliant can seem like an unending task. To help mitigate risks within the software applications organizations use every day, many are increasingly looking to the strategic adoption of software bills of materials (SBOMs) as an effective way to maintain compliance and better secure their software supply chain. An SBOM lists all packages and libraries in an application, including all components' dependencies. This enhanced visibility into what's in a piece of software makes it easier to identify vulnerabilities and license issues, as well as manage risk from open source components.

The post Securing your software supply chain with CISA’s new SBOM guidance appeared first on Security Boulevard.

via the comic humor & dry wit of Randall Munroe, creator of XKCD

Permalink

The post Randall Munroe’s XKCD ‘Disposal’ appeared first on Security Boulevard.

Refine your cybersecurity strategies to navigate the challenges of a VUCA (volatility, uncertainty, complexity, and ambiguity) environment.

The post Gartner Report: How to Respond to the Threat Landscape in a Volatile, Complex and Ambiguous World appeared first on Security Boulevard.

The deadline to comply with the latest version of the Payment Card Industry Data Security Standard (PCI DSS), v4.0.1, is rapidly approaching: March 31, 2025. Are you prepared?

The post PCI DSS v4.0.1 Changes | Application Security PCI Compliance Requirements | Contrast Security appeared first on Security Boulevard.

MEDIA ADVISORY Strata Identity, Saviynt, and Oxford Computer Group to Present Strategies for Identity Continuity at the Tactical Edge BOULDER, Colo., Nov. 5, 2024 — Strata Identity, the Identity Orchestration company, today announced Carahsoft will host a free webinar on November 12th that explores strategies to ensure Identity, Credentialing, and Access Management (ICAM) survivability for...

The post Carahsoft to Host Webinar on Ensuring ICAM Survivability for Access in Disconnected, Degraded, Intermittent, and Low-Bandwidth (DDIL) Environments appeared first on Strata.io.

The post Carahsoft to Host Webinar on Ensuring ICAM Survivability for Access in Disconnected, Degraded, Intermittent, and Low-Bandwidth (DDIL) Environments appeared first on Security Boulevard.

Authors/Presenters: Chanin Kim, Myounghun Pak

Our sincere appreciation to DEF CON, and the Presenters/Authors for publishing their erudite DEF CON 32 content. Originating from the conference’s events located at the Las Vegas Convention Center; and via the organizations YouTube channel.

Permalink

The post DEF CON 32 – The Edges Of Surveillance System And Its Supply Chain appeared first on Security Boulevard.

Explore the technical realities of passwordless authentication in this comprehensive analysis. We debunk common myths, examine security implications, and provide evidence-based insights into how this technology transforms digital security while enhancing user experience.

The post Busting Common Passwordless Authentication Myths: A Technical Analysis appeared first on Security Boulevard.