Over the past decade, the world of open source software has undergone a seismic transformation, both in terms of its scale and challenges.
The post The transformation of open source: Lessons from the past decade appeared first on Security Boulevard.
Like most businesses, banks are facing a highly competitive future built on digital services. To succeed, they must modernize their IT infrastructure to deliver the experiences that customers now demand, without incurring the wrath of regulators. Yet the wealth of sensitive information managed by financial services firms ensures the sector remains a popular target for state-backed and criminally motivated threat actors.
The post Celebrating Excellence in Financial Services appeared first on Security Boulevard.
The U.S. Army is developing a cloud environment called N-CODE that will give smaller businesses access to the security technologies they need to meet stringent DoD cybersecurity requirements and compete for defense contracts.
The post Army Cloud Program to Help SMBs Meet DoD Cyber Requirements appeared first on Security Boulevard.
Check out invaluable cloud security insights and recommendations from the “Tenable Cloud Risk Report 2024.” Plus, a PwC study says increased collaboration between CISOs and fellow CxOs boosts cyber resilience. Meanwhile, a report finds the top cyber skills gaps are in cloud security and AI. And get the latest on SBOMs; CIS Benchmarks; and cyber pros’ stress triggers.
Dive into six things that are top of mind for the week ending Oct. 18.
1 - Tenable: Riskiest cloud workloads present in 38% of orgsAlmost 40% of global organizations have cloud workloads that put them at the highest risk of attack — an alarmingly high percentage. That’s according to the new “Tenable Cloud Risk Report 2024,” which is based on an analysis of billions of cloud resources scanned through the Tenable Cloud Security platform.
Specifically, 38% of organizations have at least one cloud workload that suffers from the “toxic triad” of cloud risks: publicly exposed; critically vulnerable; and highly privileged. Those are the three major vectors that organizations must take into account in order to properly assess a cloud workload’s risk level and potential vulnerability impact.
“Securing cloud workloads is about much more than scanning for vulnerabilities,” reads the report, whose telemetry data was collected during the first six months of 2024.
(Source: “Tenable Cloud Risk Report 2024,” October 2024)
Cloud workloads with the “toxic triad” represent “a perfect storm of exposure for cyberattackers to target,” according to a Tenable statement.
“When bad actors exploit these exposures, incidents commonly include application disruptions, full system takeovers, and DDoS attacks that are often associated with ransomware,” the statement reads.
Other key findings include:
The 28-page report also offers mitigation guidance aimed at helping organizations limit their cloud exposures.
To get more details, check out:
2 - PwC: C-suite disconnect hurting cyber resilience
For global enterprises to boost their cyber resilience, CISOs and their C-suite peers need to collaborate more closely, and CISOs should be more looped into their organizations’ business strategy, according to PwC’s “2025 Global Digital Trust Insights” global survey, which polled about 4,000 business and tech executives.
“To safeguard their organisations, executives should treat cybersecurity as a standing item on the business agenda, embedding it into every strategic decision and demanding C-suite collaboration,” reads a report summary.
Among the barriers to cyber resilience identified in the report are:
“All of this points to the need for better C-suite collaboration and strategic investment to strengthen cyber resilience,” reads the report summary.
For their part, CISOs can contribute by providing “tech-enabled insights” and by explaining cybersecurity priorities using business metrics, such as costs, opportunities and risk.
For more information about CISO trends:
When it comes to hiring cybersecurity professionals, it’s particularly difficult to find qualified candidates skilled in securing cloud environments and in mitigating risks introduced by AI usage.
That’s one major finding in O’Reilly’s “2024 State of Security Survey,” which polled about 1,300 tech professionals, including 419 members of security teams, in August of this year.
As companies ramped up their cloud adoption, many downplayed the need to beef up their cloud security expertise. “That’s finally changed, and as a result, we’re seeing a serious shortage of experts in cloud security,” the report reads.
A similar thing has happened with AI, except more abruptly, after the release of OpenAI’s ChatGPT in late 2022. “Everyone, including the security community, was blindsided — both by the possibilities and by the risks,” the report reads.
“Our global survey underscores a security landscape in flux, with critical skills gaps emerging in AI and cloud security,” said Laura Baldwin, president of O’Reilly, in a statement.
Given this reality, organizations must amp up “continuous, high-quality training,” seeing it as essential, not optional. “Organizations must prioritize ongoing upskilling to stay ahead of evolving risks and build robust defenses,” Baldwin said.
Top security skills shortages (as cited by percentage of security team members)
(Source: O’Reilly’s “2024 State of Security Survey,” October 2024)
Other findings from the 36-page report include:
To get more details, read:
For more information about recruiting cybersecurity professionals:
Cybersecurity professionals are collectively getting older and feeling heightened pressure at work, as they grapple with an increase in the number and sophistication of cyberattacks, according to ISACA’s “State of Cybersecurity 2024” report, based on a survey of about 1,800 cybersecurity professionals.
Specifically, this is the first time in the report’s 10-year history that the majority of respondents (34%) are between the ages of 45 and 54. The percentage of respondents under the age of 34 stayed the same as last year.
“The current cybersecurity practitioners are aging, and the efforts to increase staffing with younger professionals are making little progress. Left unchecked, this situation will create business continuity issues in the future,” the report reads.
Meanwhile, 66% of respondents said they’re more stressed out at work today than they were five years ago. They attributed the growing work aggravation to various factors, including:
Regarding attack frequency, 55% of surveyed organizations reported suffering more attacks than a year prior, a jump of 7 percentage points over last year’s report. The most common types of attacks were social engineering; malware; denial of service; and compromise of unpatched systems.
Year-over-Year Comparison of Cybersecurity Attack Reporting
(Source: ISACA’s “State of Cybersecurity 2024” report, October 2024)
When asked to list the security skills their organizations need the most, these ranked as the top five:
To get more details, check out:
For more information about helping cybersecurity pros manage work-related stress:
If you’re looking to learn more about software bills of materials (SBOMs), CISA has just updated a document that offers foundational guidance about these software inventories, such as what they are and how to implement them.
The document, titled “Framing Software Component Transparency,” was last updated in 2021. This new version revises and expands the topic of SBOM attributes, which are used to identify SBOM components.
In theory, SBOMs help boost your software supply chain security by listing all ingredients in a software product, such as an application. Their purpose is to provide granular visibility into all software components in your environment. Thus, an SBOM should help you locate all instances of a component with a newly disclosed flaw, such as a critical vulnerability — as happened with the Log4j utility in late 2021.
However, the software industry is still working through complex SBOM-related challenges in areas including standards, data comprehensiveness, and interoperability.
The new edition of “Framing Software Component Transparency” zeroes in on the challenge of “universally identifying and defining certain aspects of software components.”
Specifically, the CISA guidance states the need to:
“This document establishes a minimum expectation for creating a baseline SBOM that outlines the minimum amount of information required to support basic and essential features,” the guidance reads.
For more information about SBOMs:
VIDEOS
Building and Scaling SBOM Programs: Navigating the Challenges for Effective Risk Management (SANS)
An SBOM Primer (The Linux Foundation)
6 - CIS updates Benchmarks for AWS, Google and Microsoft productsAWS Foundations. Google Kubernetes Engine. Microsoft Azure Foundations. Those are some of the CIS Benchmarks updated in September by the Center for Internet Security.
Specifically, these CIS Benchmarks were updated:
In addition, CIS added a new Benchmark for IBM AIX 7.
The CIS Benchmarks’ secure-configuration guidelines are intended to help you harden products against attacks. Currently, CIS offers more than 100 Benchmarks for 25-plus vendor product families. There are CIS Benchmarks for cloud platforms; databases; desktop and server software; mobile devices; operating systems; and more.
To get more details, read the CIS blog “CIS Benchmarks October 2024 Update.” For more information about the CIS Benchmarks list, check out its home page, as well as:
The post Cybersecurity Snapshot: Tenable Report Warns About Toxic Cloud Exposures, as PwC Study Urges C-Suite Collaboration for Stronger Cyber Resilience appeared first on Security Boulevard.
According to IBM’s latest Cost of a Data Breach report, data breach costs have risen 39.4% over the past decade and are now at almost $5 million per breach. We should make sure our cybersecurity insurance falls in line with these numbers.
Insight #2: Ditto for open-source nasties in repos
According to a new report, the number of malicious packages uploaded to open-source repositories has increased 150% in the last year. Security of the supply chain is still a major problem, and the malicious actors are now trying to take advantage of this even more. What are you doing to secure your supply chain?
Insight #3: Stressed-out security leaders are turning to drugs & boozeThe pressures of the modern workplace are driving an alarming number of security leaders to turn to substance abuse as a coping mechanism. Long hours, constant demands and the struggle to maintain work-life bala+nce are taking a significant toll. Prioritizing well-being is crucial. Incorporate stress-reducing activities into your day, such as exercise or mindfulness practices, and ensure you take adequate time off to prevent burnout.
The post Cybersecurity Insights with Contrast CISO David Lindner | 10/18/24 appeared first on Security Boulevard.
There are growing concerns among chief information security officers (CISOs) about the evolving demands of their role, with 84% advocating for a split into separate technical and business-focused positions. The Trellix and Vanson Bourne survey of 5,000 CISOs and IT security leaders found that as cybersecurity threats grow more complex and regulatory frameworks expand, there..
The post CISOs Concerned Over Growing Demands of Role appeared first on Security Boulevard.
Passwordless authentication for end users is taking the world by storm, offering organizations and individuals alike unprecedented security, user experience, and efficiency benefits. By all indications, the next generation of authentication for end users has finally arrived, sending the password the way of the dodo. Although they don’t get anywhere near the same hype, advanced [...]
The post Beyond Passwords: Advanced API Authentication Strategies for Enhanced Security appeared first on Wallarm.
The post Beyond Passwords: Advanced API Authentication Strategies for Enhanced Security appeared first on Security Boulevard.
Protecting digital identities is essential for individuals and organizations in a world where cyberattacks are becoming more sophisticated and frequent. If anything has proven to boost security massively, it has to be the proper utilization of Multi-Factor Authentication (MFA). While traditional password protection can easily be attacked through phishing, credential stuffing, and brute force, MFA […]
The post Understanding the Importance of MFA: A Comprehensive Guide first appeared on StrongBox IT.
The post Understanding the Importance of MFA: A Comprehensive Guide appeared first on Security Boulevard.
Mastering CentOS commands can help you effectively manage CentOS systems, perform common tasks, and troubleshoot issues. Process management is streamlined using commands like ps and top, which help monitor and troubleshoot system performance in real time. Each command is described with clear explanations, making it easy to understand their purpose and usage. CentOS, a popular […]
The post How to Master CentOS Commands: The Ultimate Cheat Sheet appeared first on TuxCare.
The post How to Master CentOS Commands: The Ultimate Cheat Sheet appeared first on Security Boulevard.
In the most recent US crackdown with Microsoft a total of 107 Russian domains have been seized. Reports claim that these domains were mainly used by state sponsored threat actors for malicious purposes. In this article, we’ll dive into the details of the US crackdown, the threat actor behind the malicious initiatives, and more. Let’s […]
The post US Crackdown With Microsoft: Over 100 Russian Domains Seized appeared first on TuxCare.
The post US Crackdown With Microsoft: Over 100 Russian Domains Seized appeared first on Security Boulevard.
Automated browser detection has changed dramatically throughout the years as bot developers seek easier ways to bypass detection, and bot protection vendors find new ways to identify and stop bots.
The post The Evolution of Automated Browser Detection: A Cat & Mouse Game appeared first on Security Boulevard.
A critical vulnerability (CVE-2024-9381) in Ivanti’s Cloud Services Appliance allows attackers to bypass security measures and execute arbitrary code. Affected Platform CVE-2024-9381 impacts Ivanti’s Cloud Services Appliance (CSA), a critical component used in secure remote access for enterprise environments, affecting CSA versions prior to the latest patch. Ivanti CSA provides a secure bridge for cloud...
The post CVE-2024-9381 – Ivanti CSA Security Vulnerability – October 2024 appeared first on TrueFort.
The post CVE-2024-9381 – Ivanti CSA Security Vulnerability – October 2024 appeared first on Security Boulevard.
The post Life in the Swimlane with Abby Shapiro, Customer Success Manager appeared first on AI-enhanced Security Automation.
The post Life in the Swimlane with Abby Shapiro, Customer Success Manager appeared first on Security Boulevard.
Remember when we were bracing ourselves for 90-day certificates? That shift felt like a game-changer, yet here we are, with a new curveball: 45-day certificates are making their way into the mix. It wasn’t too long ago that speculation around Apple’s influence hinted at the possibility of even shorter cert lifespans. Fast forward, and the […]
The post 45-Day Certs? You’ve Got No Time to Lose! first appeared on Accutive Security.
The post 45-Day Certs? You’ve Got No Time to Lose! appeared first on Security Boulevard.
Dive into the world of product-led onboarding for B2B SaaS. This guide explores key strategies and best practices to create an engaging and effective onboarding experience that turns new users into power users. Learn how to optimize user journeys, reduce churn, and drive product adoption.
The post Mastering Product-led Onboarding in B2B SaaS: A Comprehensive Guide appeared first on Security Boulevard.
Good cyber defense involves more than blocking and tackling. Without visibility into what’s happening, where and by whom, enterprises are hard-pressed to maintain solid protection of systems, networks and data. One area where visibility falls short of what you need is the application layer. This obscurity has given rise to a groundbreaking new breed of must-have detection and response solutions: Application Detection and Response (ADR).
The post ADR Provides Application Visibility for CISOs | Closing Application Layer Gap | Contrast Security appeared first on Security Boulevard.
The World Economic Forum is advocating a shift in security thinking from secure by design to resilience by design in the face of the rapid development and expanding connectivity of emerging technologies like AI, quantum computing, and the Internet of Things.
The post World Economic Forum: AI, Quantum Require ‘Paradigm Shift’ in Security appeared first on Security Boulevard.
Authors/Presenters:Chenyang Zhao, Yuebin Guo, Jingyu Wang, Qi Qi, Zirui Zhuang, Haifeng Sun, Lingqi Guo, Yuming Xie, Jianxin Liao
Our sincere thanks to USENIX, and the Presenters & Authors for publishing their superb 21st USENIX Symposium on Networked Systems Design and Implementation (NSDI '24) content, placing the organizations enduring commitment to Open Access front and center. Originating from the conference’s events situated at the Hyatt Regency Santa Clara; and via the organizations YouTube channel.
The post USENIX NSDI ’24 – EPVerifier: Accelerating Update Storms Verification with Edge-Predicate appeared first on Security Boulevard.
Using the same email address everywhere isn't helping you be more private. But short of creating a multiple new mailboxes and subsequently managing them - what can you do?
TABLE OF CONTENTS
Your personal email address is a unique - and reliable - identifier. This is regardless of what email provider you may use - whether a typical one or an encrypted, privacy-friendly email provider.
Think about it... many users likely use the same email everywhere, for everything like:
... and everything in between.
This same email address may even be involved in data breaches and data leaks. Data breaches generally occur when a service/provider suffers a cyberattack and user/employee/personal information is stolen or otherwise compromised; data leaks are similar, but don't necessarily result from a cyberattack - an organization could inadvertently directly expose sensitive/personal data from their systems, often available publicly.
In either case, given the ubiquity of collecting email addresses, using them for account creation, and as general purpose identifiers, they are often exposed (alongside other data) in these breaches and leaks. Keep in mind data breaches/leaks are just one way your email address could be exposed - many services may share your information, which can include your email address - with data brokers, partners, affiliates, and contractors
Thus, by "following the email address" you can be relatively easy to track and target for marketing, general spam, scam attempts, or phishing attempts alike.
However, creating and then subsequently managing a bunch of different inboxes for different uses or use cases can be difficult and frustrating. Enter the email alias (or forwarder)!
Note: Some email providers may provide aliasing capabilities, though these capabilities may vary.
What is email aliasing?Generally speaking, an email alias is a forwarding email address. Emails sent to the alias are automatically forwarded to another email address. You do need an email account (an inbox) to use forwarders/aliases.
There are different forms of email aliasing: plus addressing (+aliases) and unique/custom aliasing. Plus addressing is also called subaddressing. Though, to be fair, when "email aliasing" is mentioned, generally it is in reference to unique aliasing - a unique address forwarding to an email inbox.
Plus addressing doesn't do much for privacyWhile useful for organization, plus addressing isn't that great for privacy. This is because plus addressing still uses the email's "root," which is easily discernible. Take for example this list of plus addresses:
For each plus address, the actual email is easy to figure out for just about anyone: [email address is javascript encrypted].
As a result, you may still find this email address on marketing lists, spam lists, combolists (where the email is commonly paired with leaked/cracked passwords), among others. Naturally, the more places it is used (especially for important accounts), the more it is tied to your identity online and off.
Custom/unique aliasing is more beneficial for privacy... and it has non-privacy benefits too. The privacy benefits of custom aliasing primarily stems from the fact that third parties won't know your actual email address.
Reduce spamPhishing and spam often go hand-in-hand, though some "legitimate" or otherwise non-malicious entities certainly engage in spam or spam-like tactics.
The primary benefit of using email aliases is reducing spam and phishing attempts. As mentioned previously - think about what your personal or "primary" email address is tied to. By extension, your email address may be sold, exposed (ex: data breaches or data leaks), or leaked to other parties outside of the party you shared your email with.
It's difficult to prevent spam - which may include cold-outreach emails and some marketing tactics - when your email address is, well, known. This can happen a variety of ways (as described in the previous paragraph) With an alias, once you begin receiving spam, you can simply disable that alias, rendering it inactive; you won't receive the spam.
Likewise, if you begin receiving phishing emails - especially in the aftermath of a data breach - you can disable the alias, thus eliminating delivery of phishing emails to your inbox. This can reduce the possibility you fall for a phishing attack; email remains a common and effective phishing vector. Phishing attempts often come as spam but can also be more targeted, leveraging publicly available information or information leaked in data breaches to make the lure more believable.
De-couple identity from a single email addressAs mentioned earlier, users can be easily tracked by their email address. Many people have the same email for years - which is fine - but this same email address has probably been used across many different accounts, services, ecommerce purchases, newsletters, personal correspondence, etc. In some cases, "people search websites" - often owned by data brokers - may even list this email!
Long-term and widespread use of a single email address likely means it has been disclosed to many entities and may have been disclosed even further, without your expressed knowledge. For example, you may make a purchase from an ecommerce store and be automatically opted in to receiving emails from them. In an effort to (re)target users via advertising to drive more sales, they may take their email list and share it with other marketers or advertisers. This is not a hypothetical example; BetterHelp was exposed for doing almost exactly this and more.
How does using an email alias help here? By using aliases across different accounts, you begin breaking the association of your identity with a single email address. This can make it harder to track your activity across different platforms.
Of course, if other collected/provider identifiers are consistent (such as an address or a phone number), correlations can be drawn. But this doesn't necessarily negate the effectiveness of decoupling your identity from a single email address.
Similarly, if a service/provider manages to compromise your email address, you can disable the alias.
Email aliasing toolsSimpleLogin, addy.io, and DuckDuckGo Email Protection are email aliasing tools designed to make generating and using email aliases easier.
SimpleLoginSimpleLogin is an open source email aliasing service. Users can both receive and send emails with aliases created using SimpleLogin. It has support for custom domains.
SimpleLogin was acquired by Proton in April 2022. Users can still sign up to SimpleLogin separately...
The post Email Aliasing is a Great Privacy Tool appeared first on Security Boulevard.
Axio CEO, Scott Kannry recently sat down with Michelle Faylo, US Cyber & Technology Leader of Lockton in our executive perspectives podcast. In each episode, we interview the world’s top
Read MoreThe post Executive Perspectives, Episode 2, Michelle Faylo appeared first on Axio.
The post Executive Perspectives, Episode 2, Michelle Faylo appeared first on Security Boulevard.
