Security Boulevard

It’s been a little over a year since we first introduced security levels into Spectra Assure™ with the goal of reducing the remediation burden on developers. It automatically generates a plan for addressing prioritized software risks, recommending manageable projects to continually improve the software’s level of supply chain security in the same way that developers continually improve software capabilities.

The post Gauging the Safety Level of Your Software with Spectra Assure appeared first on Security Boulevard.

New guidance for organizations seeking to protect the generative AI tools they're running has been released by the OWASP Top 10 LLM Applications Security Project.

The post OWASP Top 10 for LLM and new tooling guidance targets GenAl security appeared first on Security Boulevard.

Discover the 5 best vendor risk management solutions, designed to help you mitigate third-party risks while ensuring compliance.

The post 5 Best Vendor Risk Management Solutions appeared first on Scytale.

The post 5 Best Vendor Risk Management Solutions appeared first on Security Boulevard.

Augmented reality use cases have become prevalent in our society.

The technology, which first emerged primarily in the world of gaming and entertainment, now promises to reshape our reality with interactive information and immersive experiences. In short, AR is undoubtedly … (more…)

The post GUEST ESSAY: The promise and pitfalls of using augmented reality– ‘AR’ — in cybersecurity first appeared on The Last Watchdog.

The post GUEST ESSAY: The promise and pitfalls of using augmented reality– ‘AR’ — in cybersecurity appeared first on Security Boulevard.

I didn’t see much visibility on this DocuSign hack. This is a situation where the product features were not vetted to understand if they could be misused by malicious fraudsters. There is not a technical vulnerability, it comes down to a design weakness in the product.

According to the security team at Wallarm, “An attacker creates a legitimate, paid DocuSign account that allows them to change templates and use the API directly.” They then employ a special template that masquerades as a well-known brand to send the billing invoice. Because the fraudulent invoice is directly sent from the DocuSign platform, it appears legitimate and won’t be stopped by email filters.

The entire process can be automated and sent out on a massive scale, spraying large numbers of unsuspecting victims.

It is the old story of well-intentioned developers asking if they “can” develop something without questioning if they “should” develop something.

It often takes security-minded experts, savvy in the ways of how attackers think, to evaluate such situations. These are often missed by even experienced developers because there is no technical vulnerability per se. But that does not mean a creative adversary can’t use it in destructive ways. Often, additional controls, oversight, or accountability must be included to dissuade, prevent, or quickly alert of misuse.

The sustainable solution for all software and service vendors is to have cybersecurity experts, not just security-minded developers, as part of the initial feature design teams, keep them in the loop during development, and make sure they vet the final capabilities before going live.

The post Fraudsters Abuse DocuSign API for Legit-Looking Invoices appeared first on Security Boulevard.

Flare recently hosted our first Threat Intel Workshop with Senior Threat Intelligence Researcher Tammy Harper. Below are some of the questions Tammy covered in improving threat intelligence collection practices. 1. How does the disruption to Telegram affect threat actors? After the arrest of Telegram CEO in August 2024, the messaging platform that has been popular […]

The post 6 Things to Know About Improving Threat Intelligence Collection appeared first on Flare | Cyber Threat Intel | Digital Risk Protection.

The post 6 Things to Know About Improving Threat Intelligence Collection appeared first on Security Boulevard.

Authors/Presenters: Michael Gorelik, Arnold Osipov

Our sincere appreciation to DEF CON, and the Presenters/Authors for publishing their erudite DEF CON 32 content. Originating from the conference’s events located at the Las Vegas Convention Center; and via the organizations YouTube channel.

Permalink

The post DEF CON 32 – Outlook Unleashing RCE Chaos CVE 2024 30103 appeared first on Security Boulevard.

TEL AVIV, Israel, 11th November 2024, CyberNewsWire

The post Sweet Security Announces Availability of its Cloud Native Detection & Response Platform on the AWS Marketplace appeared first on Security Boulevard.

With Deep Respect, We Honor Our Canadian Allies, Family And Friends On This Remembrance Day 2024 / Avec un profond respect, nous honorons nos alliés, notre famille et nos amis canadiens en ce jour du Souvenir 2024 (Image Courtesy of Veterans Affairs Canada / Affaires des Anciens Combattants Canada)

Permalink

The post Canada Remembrance Day 2024 / Jour du Souvenir du Canada 2024 appeared first on Security Boulevard.

As software supply chain risks rise, regulatory authorities are increasingly requiring organizations to adopt software bills of materials (SBOMs) for security and compliance.

The post Gartner report: How SBOMs improve security and compliance in the software supply chain appeared first on Security Boulevard.

Tel Aviv, Israel, Nov. 11, 2024, CyberNewswire — Sweet Security today announced the availability of its cloud-native detection and response platform on the Amazon Web Services (AWS) marketplace.

Sweet’s solution unifies threat detection across cloud infrastructure, network, workloads, and applications. … (more…)

The post News alert: Sweet Security rolls out its advanced runtime detection and response platform for AWS first appeared on The Last Watchdog.

The post News alert: Sweet Security rolls out its advanced runtime detection and response platform for AWS appeared first on Security Boulevard.

Organizations today face a surge of vulnerabilities and exposures. With data on assets and exposures scattered across platforms, complexity hinders timely action. Security teams are left to manually sift through fragmented data to identify, prioritize, and mitigate the exposures that pose the highest risk to the organization. But imagine if all vulnerabilities and exposures were …

Read More

The post Four New Balbix Capabilities You’ll Love! appeared first on Security Boulevard.

Open Source AI Definition 1.0 marks a milestone in transparent and ethical AI development by providing clear guidelines for truly open source AI, bringing the proven benefits of open-source to AI technology.

The post The Open Source AI : Understanding the New Standard appeared first on Security Boulevard.

As we observe Veterans Day in the United States and Remembrance Day in the United Kingdom on Monday, November 11th, Team Cymru is proud...

The post Team Cymru Honored with Third Consecutive Gold HIRE Vets Medallion Award from U.S. Department of Labor appeared first on Security Boulevard.

Authors/Presenters: Wesley McGrew

Our sincere appreciation to DEF CON, and the Presenters/Authors for publishing their erudite DEF CON 32 content. Originating from the conference’s events located at the Las Vegas Convention Center; and via the organizations YouTube channel.

Permalink

The post DEF CON 32 – Reverse Engineering MicroPython Frozen Modules appeared first on Security Boulevard.

In our latest webinar, we explored real-world cybersecurity and online safety incidents, focusing on strategies that K-12 techs can use to prepare for hidden digital threats. Guest speakers Sal Franco, IT Director at Buckeye Elementary, and Fran Watkins, Technology Manager at Centennial School District, shared first-hand stories of ransomware and data loss incidents that tested ...

The post The Urgent Call: How a Phishing Email Pushed Buckeye Elementary to Strengthen Cyber Defenses  appeared first on ManagedMethods Cybersecurity, Safety & Compliance for K-12.

The post The Urgent Call: How a Phishing Email Pushed Buckeye Elementary to Strengthen Cyber Defenses  appeared first on Security Boulevard.

Articles related to cyber risk quantification, cyber risk management, and cyber resilience.

The post The Top 9 Cyber Risk Management Trends in 2025 | Kovrr appeared first on Security Boulevard.

The Internet of Things is growing apace.

Related: The Top 12 IoT protocols

Deployment of 5G and AI-enhanced IoT systems is accelerating. This, in turn, is driving up the number of IoT-connected devices in our homes, cities, transportation systems and … (more…)

The post MY TAKE: Technology breakthroughs, emerging standards are coalescing to assure IoT integrity first appeared on The Last Watchdog.

The post MY TAKE: Technology breakthroughs, emerging standards are coalescing to assure IoT integrity appeared first on Security Boulevard.

In episode 354, we discuss the emergence of the term ‘Advanced Persistent Teenagers’ (APT) as a “new” cybersecurity threat. Recorded just before the election, the hosts humorously predict election outcomes while exploring the rise of teenage hackers responsible for major breaches. The episode also covers a notable Okta vulnerability that allowed someone to login without […]

The post Advanced Persistent Teenagers, Okta Bug Allowed Logins Without a Correct Password appeared first on Shared Security Podcast.

The post Advanced Persistent Teenagers, Okta Bug Allowed Logins Without a Correct Password appeared first on Security Boulevard.

Your internet account passwords are probably among the most guarded pieces of information you retain in your brain. With everything that has recently migrated to the digital realm, a secure password functions as the deadbolt to your private data.. Hackers understand how valuable this personal data is, and so Account Takeover Attacks—where malicious actors gain …

The post NIST Updated Standards for a Secure Password appeared first on Security Boulevard.