Security Boulevard

Register now: 2024 MITRE ATT&CK Enterprise Evaluation Result Breakdown Webinar.

Back in the summer I wrote a blog around capability versus usability, in which I highlighted that typically industry testing focuses on capability, despite one of the key challenges in the industry being skills. EDR by its nature, is a technical capability and as such the skills gap in this space is even greater. I will always remember a good friend sharing in his keynote, a number of years ago, that there is little point in buying a best of breed solution if you don’t have the people powers to actually use it.

In our recent SoC optimizationresearch we saw that on average only 50-80% of alerts are processed the same day, false positives being a significant challenge and distraction for SoC analysts.

The post “Out-of-the-Box” Detection Coverage: A Critical Metric for Endpoint Security appeared first on Security Boulevard.

via Photographer Marjory Collins in New York City, NY, USA, January 1943, Blowing Horns on Bleeker Street, New Year's Day

The post A Happy, Prosperous & Safe New Year Wish For All appeared first on Security Boulevard.

In 2025, the cybersecurity landscape will continue to evolve rapidly, driven by increasing cyber threats and technological advancements. As governments and regulatory bodies implement stricter cybersecurity regulations, businesses will face pressure to ensure compliance. Failing to meet these standards could result in severe penalties, financial losses, and reputational damage. This blog will explore the key […]

The post Why ISMS Policies Are Crucial for Compliance in Cybersecurity? first appeared on StrongBox IT.

The post Why ISMS Policies Are Crucial for Compliance in Cybersecurity? appeared first on Security Boulevard.

OAuth Identity Attack — Are your Extensions Affected?

A malicious variant of Cyberhaven’s browser extension (v24.10.4) was uploaded to the Chrome Store on Christmas Day. According to Cyberhaven, this compromised version can allow “sensitive information, including authenticated sessions and cookies , to be exfiltrated to the attacker’s domain”. The extension remained available for download on the Chrome Store for over 30 hours before the issue was identified and removed. Cyberhaven manages data loss for enterprises via its browser extension, with at least 400,000 users on its platform based on Chrome Store.

This attack was part of a widespread campaign targeting Chrome extension developers. Just one week before the Cyberhaven breach, SquareX’s researchers disclosed the very same attack on social media, including a video revealing the phishing email and bogus app used to trick developers into giving attackers access to their Chrome Store account. This breach is likely part of a large-scale phishing campaign targeted at popular extension providers, including security vendors. Thus, we urge enterprises and individuals alike to be especially cautious when installing or updating any Chrome extensions published after December 2024.

This article will detail the attack mechanism for this particular exploit, examine several variants to the attack from the past and discuss some best practices enterprises can use to safeguard against supply chain attacks.

Cyberhaven OAuth Attack Mechanism — What Happened?

In short, the breach occurred when a Cyberhaven employee unknowingly provided the attacker with access to the company’s Chrome Store account. This allowed the attacker to upload a malicious version of the extension to Cyberhaven’s official account. Aimed at security-trained professionals from reputable cyber companies, this attack was highly sophisticated, employing several clever tactics to deceive the user. Here’s a step-by-step breakdown of how the breach unfolded:

Step 1 — Email Address Collection

First, the attacker had to gather a list of targets. Lucky for them, Chrome Store publicly displays contact information of the extension’s developer. This allows them to easily create a hit list of cybersecurity extensions with a given number of downloads and ratings. Moreover, as these contact details are typically used for bug reporting, emails are often automatically routed to developers who may lack the security awareness to detect sophisticated attacks.

Step 2 — Phishing Email

The attacker then sends an email to the hit list, impersonating the Chrome Store. The email contains an urgent message claiming that the developer’s extension is “at risk of being removed from the Chrome Web Store” due to a violation of the store’s policy. There is then an urgent call to action for the user to accept these policies to continue publishing on Chrome Store.

This email looks very similar to any SaaS policy update notification, and details the relevant extension name, ID and policy violation. Thus, this email may not raise suspicion among employees unfamiliar with the attack.

Step 3 — Gaining Access to Extension via OAuth

Once the employee clicks on the “Go To Policy” button, they are redirected to a Google OAuth page for a “Privacy Policy Extension”. If one clicks on the name, a developer info pop-up will actually indicate that the creator is [email protected] and that choosing an account will redirect them to https://app.checkpolicy.site. These are all clear signs that should raise suspicion. Unfortunately, most employees are unlikely to click into the developer info box in the first place, especially as they are under the belief that the email came from a trusted source.

Note: Even if the employee did run a quick check on the URL, no popular threat feeds would have flagged this site as malicious due to its novelness. This is a classic example of a zero day attack.

Step 4 — Uploading a Malicious Extension Update

Once the attacker gains access to the developer’s Chrome Store account, they have the necessary permissions to edit, update and publish any extensions associated with the account. This is an extremely effective way to distribute malware as it allows attackers to leverage a trusted brand and disguise the attack as a regular software update. In this case, the malware contained cookie session stealers that allowed the attacker to exfiltrate data from multiple SaaS applications used by Cyberhaven end users.

A Blast from the Past — Attack Variations

This is not the first time an attack exploiting extension developers occurred. Many of these extensions have up to millions of users that have no reason to doubt patches pushed by their software vendors, creating a hugely asymmetric and attractive opportunity for attackers. Similar OAuth-based attacks have been used to hijack employee emails by mimicking a GoogleDocs file sharing notification.

Image Source: Ron Amadeo, ArsTechnica

Other attackers have also used a similar methodology to steal cloud data from file storage sites like GoogleDrive and OneDrive. These attacks, classed as consent phishing, host their applications on legitimate providers like Microsoft to deceive users into allowing permissions for the app to read and access confidential company data. Once granted, these permissions are extremely challenging to track and reverse, especially if it involves shadow SaaS applications that the security team are not even aware of.

Source: Microsoft Preventing Extension OAuth Based Attacks — Best Practices

The first step to mitigating supply chain vulnerabilities is to recognize that supply chain risks are a shared responsibility between vendors and customers. Enterprises often depend on the vendor to mitigate security risks from an expanded attack surface when adopting new software. Sophisticated attacks like these can happen to anyone, including those at the forefront of security technology. Unfortunately, all it takes is for one unknowing employee to fall prey to an attacker’s trickery and as we have seen, these attacks are only getting more difficult to spot.

Thus, where humans are unreliable, it is critical to use the right technologies to safeguard against these attacks. Due to the complexity of the OAuth exploit, only a browser native solution will have the full context on user interaction and extension permissions required to stop the attack in its tracks. Re-emphasizing the theme of shared responsibility, below are the ways in which SquareX’s Browser Detection and Response (BDR) could have prevented the attack both at the vendor and customer level.

For the Vendor

The Policy Privacy Extension involved in this attack is an example of a shadow SaaS app. It is not uncommon for employees to breeze through SSO and OAuth authorization screens without truly understanding the permissions they are granting these third party apps. SquareX’s BDR can block or warn the use of unauthorized apps that request risky OAuth permissions — in this case the ability to edit, update and publish extensions on the developer’s Chrome Store account. This way, employees can still experience the user experience and productivity benefits of applications leveraging OAuth, as long as it does not involve risky permissions that could lead to security breaches.

For the Customer

Ideally, software vendors should have the right browser security tools in place to prevent their extensions from being compromised. However, it is critical for end customers to also have the right solutions in place to detect any abnormalities from their vendor’s extensions should they fall prey to an attack. SquareX’s BDR is able to monitor all active extensions across the organization, automatically blocking any suspicious extensions. This includes extensions that are already whitelisted by the organization, but may have a malicious update containing a new, risky extension. Similarly, extensions with a sudden surge in negative reviews, are sideloaded or unpopular can also be blocked. This approach not only prevents installation of risky extensions in the first place, but can also identify initially extensions that turn malicious due to intent or compromise.

Introducing the BDR

SquareX’s Browser Detection and Response solution extends beyond managing browser extensions and identities. SquareX’s industry-first BDR solution detects, mitigates and threat-hunt client-side web attacks targeting employees in real time. The solution comes in the form of a lightweight browser extension that can be deployed to existing browsers via a simple group policy.

We believe that there are three key components required when it comes to securing the browser:

• Web Threat Detection & Mitigation including identity attacks, malicious sites & scripts, malicious browser extensions and malicious files
• Browser DLP including genAI DLP, clipboard DLP, file DLP and insider attacks
• Private App Access to provide secure access to web applications and private apps via the browser, including for BYOD/unmanaged devices

How could SquareX’s BDR have blocked this attack? For the Vendor — Cyberhaven

In this scenario, Cyberhaven could have prevented their employee from granting Privacy Policy Extension the OAuth authorization to update Cyberhaven’s extension on Chrome store with three simple steps:

1. Import or create a list of authorized SaaS applications on SquareX’s platform
2. Create a policy that blocks OAuth for any applications outside the authorized list
3. Apply policy to all employees or select user groups (e.g. developers) as required

The video below contains a live demonstration of the OAuth extension attack, as well as how SquareX’s BDR can be used to block the attack.

https://medium.com/media/41d847da520dc1aa5706a8eeea11212f/href

For the Customers

Assuming extension vendors are compromised, end customers can protect themselves by implementing the following policy:

• Block extensions containing risky permissions

Additionally, other example policies that could be added to safeguard against other suspicious extensions include:

• Block sideloaded extensions
• Block extensions with over 30% negative reviews on Chrome store
• Block unpopular extensions with less than 100,000 users
• Block extensions containing “ChatGPT” in the title or description

A wider range of extension based policies, including video demos, can be viewed on our website.

OAuth Identity Attack — Are your Extensions Affected? was originally published in SquareX Labs on Medium, where people are continuing the conversation by highlighting and responding to this story.

The post OAuth Identity Attack — Are your Extensions Affected? appeared first on Security Boulevard.

Nisos
Safeguarding Executives in the Digital World

It takes a combination of people and technology to attribute and solve executive protection problems and drive real-world consequences...

The post Safeguarding Executives in the Digital World appeared first on Nisos by Nisos

The post Safeguarding Executives in the Digital World appeared first on Security Boulevard.

2024 has been a year of bold moves and big wins at Strobes Security. From launching game-changing innovations to expanding globally, we’ve made strides to reshape cybersecurity for the better....

The post Strobes Security 2024: Year in Review appeared first on Strobes Security.

The post Strobes Security 2024: Year in Review appeared first on Security Boulevard.

When it comes to cybersecurity, it’s not just the technology that evolves, it’s the threats too. Every month brings its own set of challenges, and December 2024 has been no...

The post Top CVEs & Vulnerabilities of December 2024 appeared first on Strobes Security.

The post Top CVEs & Vulnerabilities of December 2024 appeared first on Security Boulevard.

December 2024 wrapped up the year with a chilling reminder of how vulnerable we all are to data breaches. From personal information to corporate secrets, it seemed like no one...

The post Top Data Breaches in December 2024 appeared first on Strobes Security.

The post Top Data Breaches in December 2024 appeared first on Security Boulevard.

Spend more on security! Car and truck dealers fall back on pen and paper as huge SaaS provider gets hacked (again).

The post Best of 2024: 30,000 Dealerships Down — ‘Ransomware’ Outage Outrage no. 2 at CDK Global appeared first on Security Boulevard.

California has passed revolutionary legislation to regulate artificial intelligence, requiring companies to disclose training data and label AI-generated content. Starting 2026, these laws will transform how AI companies operate and how consumers interact with AI-generated materials.

The post California’s Pioneering AI Legislation: Shaping the Future of Artificial Intelligence appeared first on Security Boulevard.

Palo Alto, Calif., Dec. 30, 2024, CyberNewswire — SquareX, an industry-first Browser Detection and Response (BDR) solution, leads the way in browser security. About a week ago, SquareX reported large-scale attacks targeting Chrome Extension developers aimed at taking over … (more…)

The post News alert: SquareX exposes OAuth attack on Chrome extensions — days before a major breach first appeared on The Last Watchdog.

The post News alert: SquareX exposes OAuth attack on Chrome extensions — days before a major breach appeared first on Security Boulevard.

Authors/Presenters: Matt Thomassen, Sean McKeever

Our sincere appreciation to DEF CON, and the Authors/Presenters for publishing their erudite DEF CON 32 content. Originating from the conference’s events located at the Las Vegas Convention Center; and via the organizations YouTube channel.

Permalink

The post DEF CON 32 – Warflying in a Cessna appeared first on Security Boulevard.

via the comic humor & dry wit of Randall Munroe, creator of XKCD

Permalink

The post Randall Munroe’s XKCD ‘Sun Avoidance’ appeared first on Security Boulevard.

Cariad, VW Group’s software arm, made this classic error.

The post VW Cars Leak Private Data of 800,000 — ‘Volksdaten’ appeared first on Security Boulevard.

Authors/Presenters: Brandon Colley

Our sincere appreciation to DEF CON, and the Authors/Presenters for publishing their erudite DEF CON 32 content. Originating from the conference’s events located at the Las Vegas Convention Center; and via the organizations YouTube channel.

Permalink

The post EF CON 32 – Winning the Game of Active Directory appeared first on Security Boulevard.

Palo Alto, Calif., USA, 30th December 2024, CyberNewsWire

The post SquareX Researchers Expose OAuth Attack on Chrome Extensions Days Before Major Breach appeared first on Security Boulevard.

Reading Time: 5 min Have you received a microsoft account security alert email? Learn how to identify legitimate alerts and avoid phishing scams targeting your Microsoft account.

The post Best of 2024: Microsoft Account Security Alert Email: Recognize the Scam appeared first on Security Boulevard.

In December 2023, as cyberattacks surged, the U.S. Securities and Exchange Commission (SEC)began enforcing new cybersecurity disclosure rules. This pushed C-level executives and boards to adopt measures for compliance and transparency. In this post, we look at the enforcement actions the SEC has taken and what public company CISOs should do to stay in compliance.

Cyberattacks surge, the SEC takes action and boards pay attention

In recent years, cyberattacks have become more sophisticated, affecting public and private organizations alike. Recognizing the critical need for transparency and robust cybersecurity measures, the U.S. Securities and Exchange Commission adopted new cybersecurity disclosure rules in July 2023, which took effect in September 2023, with compliance required by December 2023.

These rules, which mandate that all public companies disclose material cybersecurity incidents within four business days and detail their risk management strategies, highlight that cybersecurity is a board-level risk management concern.

As part of their fiduciary duties, boards play a key role in the oversight of risks from cybersecurity threats. In partnership with senior executives, they need to pay close attention to the risks their companies face and the strategies those companies put in place to comply.

As the rules were authorized in late 2023, we shared what we see as the implications for infosec leaders. This post explores the impact of these regulations after one year. We also look at recent enforcement actions and measures that companies should consider adopting to promote compliance and bolster their cybersecurity posture.

An important note: In 2025, there will be changes in SEC leadership, which could affect these rules. But they’re just one example of the additional attention governments around the world are giving to cyber risk.

The EU recently issued the network and information systems (NIS)2 Directive, aimed at improving cybersecurity across member states. It requires the reporting of “significant” incidents within 24 hours, a more detailed report within 72 hours and a final report within a month. Other more focused rules, such as the General Data Protection Regulation (GDPR) in Europe, although it doesn’t have incident disclosure provisions, have driven significant change for companies that want to do business in that region.

It comes down to trust. Tenable CEO Amit Yoran had a clear point of view when he wrote about the rules as they took effect.

“The SEC’s rule will force what companies should have been implementing all along; informed cyber risk management practices,” he said. “Requiring companies to provide annual updates of their cybersecurity risk management strategy and governance and report material breaches within four business days will force leadership to pay attention and keep customers and investors better informed as to who they trust with their business.”

Key requirements of the SEC’s cybersecurity disclosure rules

With that as a backdrop, CISOs looking to support stakeholders like legal, finance, investor relations and boards in these efforts should understand a few things about the SEC rules.

The SEC requires public companies to disclose material cybersecurity incidents within four business days of determining their materiality using an 8-K form. This requirement aims to give investors timely and relevant information about potential risks that could impact business operations and financial performance.

At a conference held by the American Institute of Certified Public Accountants (AICPA) and the Chartered Institute of Management Accountants (CIMA) in December, Sebastian Gomez Abero, Associate Director of the Division of Corporate Finance (DCF) Disclosure Review Program emphasized that materiality, rather than the discovery of a breach, is the trigger for disclosing a cybersecurity incident. According to an EY summary of his remarks provided by the conference organizations, Gomez Abero also reminded registrants that both quantitative and qualitative factors should be considered in their materiality assessment of a cybersecurity incident.

In addition, companies must include descriptions of their cybersecurity risk management and governance practices annually in their 10-K or 20-F reports. The rules essentially validate cybersecurity as an important component of risk management, within a robust corporate governance program. Recent 10-Ks from a number of companies incorporated these new requirements.

According to the EY conference summary, Gomez Abero reminded registrants to provide sufficient detail in their annual cybersecurity disclosures for a reasonable investor to understand the organization’s processes to assess, identify and manage material risks from cybersecurity threats, rather than just stating that a process exists. In addition, registrants that have a management group to assess material cybersecurity risk need to disclose each member’s individual expertise.

Big fines and penalties from enforcement actions

Since the introduction of the cybersecurity rules, the SEC has taken significant enforcement actions to ensure compliance, including issuing fines and negotiating settlements with various companies.

For example, in October 2024, the SEC fined Unisys Corp., Avaya Holdings Corp., Check Point Software Technologies Ltd. and Mimecast Limited a combined total of almost $7 million for allegedly misleading disclosures related to their exposure to the SolarWinds cyberattack.

In the same order, the SEC alleged that these firms downplayed their involvement, which led to misleading investors about potential impacts. Each company settled without admitting or denying the allegations.

In another notable enforcement action by the SEC, R.R. Donnelley & Sons Company (RRD) agreed in June 2024 to pay more than $2.1 million for inadequate disclosure and poor management of significant cybersecurity incidents from 2021. The SEC found that RRD’s internal processes failed to properly elevate and disclose these incidents to senior management in a timely manner, underscoring the importance of having robust incident management frameworks in place.

Lessons learned

There are three key lessons to keep in mind as you work to help your organization meet the SEC cybersecurity requirements:

1. Be transparent. Your organization’s incident management and disclosure practices are being scrutinized. It’s not just the board and senior executives paying attention — your company’s investors want to understand your organization’s cyber risk. Choose a forthright and straightforward approach to meet the 8-K disclosure requirements, such as establishing a cybersecurity disclosure committee and a materiality framework for regularly assessing cyber incidents. Doing so could help your organization avoid fines.
2. View cyber risk as business risk. Your cybersecurity risk management and governance practices are of strategic importance to your organization. The 10-K and 20-F requirements codify the importance of having a robust strategy for cybersecurity. Rather than seeing it as a compliance chore, consider it an opportunity to educate the board and investors about all the ways your organization is reducing cyber risk.
3. Be proactive. Don’t treat your cybersecurity strategy as merely a once-a-year compliance task. Make sure the cybersecurity systems and processes you have in place provide continuous visibility into the entirety of your attack surface, so that you’re always ready to answer the questions “how secure are we?” and “where are we at risk?”

Exposure management can help meet the SEC requirements

So what can a CISO do about this? It starts with a comprehensive cybersecurity program, including exposure management, which gives CISOs the information they need to communicate with legal, finance, investor relations, boards and other internal stakeholders about vulnerabilities and cyber incidents so that those can be appropriately captured in the company’s cyber risk management and public reporting.

Exposure management equips an organization with the tools needed to meet the SEC’s cybersecurity disclosure requirements by aligning cybersecurity efforts with business risk management.

Exposure management provides comprehensive visibility into the organization’s attack surface, prioritizes vulnerabilities based on their potential business impact and delivers actionable insights that inform the preparation of risk management filings. Moreover, exposure management is part of a cyber program that can identify cyber risks and incidents that may need to be reported in filings. With easily understood, dynamically updated dashboards that a CISO can use to gain visibility into companywide exposures, exposure management is critical for ensuring compliance and demonstrating a strong security posture.

Plus, an exposure management strategy that integrates asset visibility, risk prioritization and incident response — along with strong partnerships between the CISO, legal, IR and finance — ensures that organizations can accurately report their practices and responses at any point in time because of the continuous monitoring built into exposure management.

By focusing on vulnerabilities that pose the greatest threat to business operations, companies can allocate resources effectively and build a cybersecurity program that supports regulatory compliance.

What the C-suite should consider

For CISOs, adopting an exposure management program ensures they can provide legal, finance, investor relations, boards and other executives with clear, actionable insights into the organization’s cybersecurity risks.

Exposure management helps inform decision-making and supports the development of comprehensive risk management frameworks, enabling companies to address threats proactively and build confidence among investors and stakeholders.

The entire C-suite should approach the SEC’s new rules with an eye toward integrated and forward-looking cybersecurity strategies. As part of that effort, it’s crucial to develop and maintain comprehensive incident response plans that can be deployed swiftly to meet the four-day disclosure mandate.

Preventative measures for compliance

To meet the SEC’s cybersecurity disclosure rules and reduce the risk of breaches that could lead to significant regulatory and financial consequences, organizations must adopt proactive strategies that strengthen their defenses. The following preventative measures outline key steps companies should take to enhance their cybersecurity posture and ensure compliance.

• Vulnerability management: Effective vulnerability management is essential for maintaining a strong cybersecurity posture. Automated vulnerability assessment tools can regularly inspect infrastructure and promptly identify security gaps.
• Zero trust architecture: A zero trust security model operates on the principle that no user or device, whether inside or outside the organization’s network, should be trusted by default. Implementing zero trust means continuously verifying each user and device that attempts to access company resources, ensuring strict authentication, authorization and validation throughout the user session.

Takeaways

The SEC’s cybersecurity disclosure rules underscore the critical importance of transparency and proactive risk management in today’s digital landscape.

Although compliance requires effort and resources, it also presents an opportunity for companies to build trust with investors and stakeholders.

By prioritizing robust cybersecurity practices that focus on prevention, enterprises can better align with regulatory expectations and be prepared for critical reporting requirements. They can close exposures and become resilient, responsible leaders in an increasingly risky world.

Learn more

• Visit the web page: How to reduce SEC cybersecurity rule compliance challenges
• Read the blog: FAQ: What the new SEC Cybersecurity Rules Mean for Infosec Leaders
• View the on-demand webinar Preparing for the new SEC cybersecurity disclosures
• Download the Gartner report How to Grow Vulnerability Management into Exposure Management

The post Navigating the SEC’s Cybersecurity Disclosure Rules: One Year On appeared first on Security Boulevard.

Cybersecurity Resolutions for 2025: Prepare Your Business for What’s Ahead Cybersecurity Resolutions for 2025: Prepare Your Business for What’s Ahead As we approach the new year, it’s time to reflect on the cybersecurity challenges of 2024 and prepare for what lies ahead. The digital landscape continues to evolve, with cyber threats becoming more sophisticated and […]

The post Cybersecurity Resolutions for 2025: Prepare Your Business for What’s Ahead appeared first on Cyber security services provider, data privacy consultant | Secureflo.

The post Cybersecurity Resolutions for 2025: Prepare Your Business for What’s Ahead appeared first on Security Boulevard.

SANTA CLARA, Calif., December 30, 2024 – We are thrilled to announce that NSFOCUS was selected as the notable vendor of Forrester The Security Analytics Platform Landscape, Q4 by its ISOP (Intelligent Security Operations Platform) with built-in NSFGPT AI assistant and AI-empowered security operation scenarios. “The security analytics platform is the core of the security […]

The post NSFOCUS ISOP Listed in The Security Analytics Platform Landscape Report by Forrester appeared first on NSFOCUS, Inc., a global network and cyber security leader, protects enterprises and carriers from advanced cyber attacks..

The post NSFOCUS ISOP Listed in The Security Analytics Platform Landscape Report by Forrester appeared first on Security Boulevard.