Help Net Security

Human-led penetration testing is an essential practice for any organization seeking to proactively address potential attack vectors. However, this indispensable pentesting method is often limited by several factors: high resource demands, project time constraints, dispersed communication, and lack of continuous visibility into evolving vulnerabilities. Plainsea‘s innovative all-in-one platform addresses these challenges through an augmented penetration testing approach that results in a continuous, streamlined, and collaborative service. Designed for MSSPs and security teams, the platform enables … More →

The post Product showcase: Augmenting penetration testing with Plainsea appeared first on Help Net Security.

The CWE list of the 25 most dangerous software weaknesses demonstrates the currently most common and impactful software flaws. Identifying the root causes of these vulnerabilities provides insights to shape investments, policies, and practices that proactively prevent their occurrence. The CWE top 25 most dangerous software weaknesses list was calculated by analyzing public vulnerability information in Common Vulnerabilities and Exposures (CVE) Records for CWE root cause mappings. This year’s dataset included 31,770 CVE Records for … More →

The post CWE top 25 most dangerous software weaknesses appeared first on Help Net Security.

In this Help Net Security interview, Brooke Motta, CEO of RAD Security, talks about how cloud-specific threats have evolved and what companies should be watching out for. She discusses the growing complexity of cloud environments and the importance of real-time detection to protect against increasingly sophisticated attacks. Motta also shares practical advice for SMBs and organizations navigating compliance and cloud security challenges. How have cloud-specific threats evolved over the past few years, and what new … More →

The post Enhancing visibility for better security in multi-cloud and hybrid environments appeared first on Help Net Security.

In this Help Net Security video, Tina Srivastava, MIT Lecturer and CEO of Badge, discusses a 20-year cryptography problem – using biometrics for authentication without storing a face/finger/voice print. This has massive implications for corporate and personal security/privacy because there is nothing for an attacker to steal.

The post Preventing credential theft in the age of AI appeared first on Help Net Security.

In 2024, businesses reported taking an average of 7.3 months to recover from cybersecurity breaches – 25% longer than expected and over a month past the anticipated timeline of 5.9 months, according to Fastly. Cybersecurity leaders feel unprepared for future threats Recovery times were even worse for companies that planned on cutting back cybersecurity spending. They faced an average of 68 incidents each – 70% above the average – and their recovery times stretched to … More →

The post Full recovery from breaches takes longer than expected appeared first on Help Net Security.

GitHub is calling on maintainers of open source projects to apply for the newly opened Secure Open Source Fund, to get funding and knowledge to improve the security and sustainability of their software. The program is funded by companies (AmEx Chainguard, Microsoft, 1Password, Shopify, Stripe, etc.), venture funds (e.g., Mayfield Fund) and nonprofits (e.g., the Alfred P. Sloan Foundation). About the program Applicants that get chosen will receive, among other things: $10,000 per project (delivered … More →

The post GitHub Secure Open Source Fund: Project maintainers, apply now! appeared first on Help Net Security.

Oracle Linux offers a secure, streamlined platform for deploying and managing applications across on-premises, cloud, and edge environments. Designed for demanding workloads, it includes tools for automation, virtualization, high availability, cloud-native development, Kubernetes, and more. Oracle Linux, 9 Update 5 for the 64-bit Intel and AMD (x86_64) and 64-bit Arm (aarch64) platforms is now generally available. This release is packaged with the following kernel options: Unbreakable Enterprise Kernel (UEK) Release 7 Update 3, 5.15.0-302.167.6 for … More →

The post Oracle Linux 9 Update 5 brings security updates, OpenJDK 17, .NET 9.0 appeared first on Help Net Security.

Quantum announces the DXi9200, the latest generation of its flagship DXi9000 Series hybrid (flash + dense disk) data protection appliances, designed for scalable, efficient backup and recovery services for large organizations. With the continuing threat of ransomware attacks, organizations need to take a comprehensive and proactive approach to secure their data and data copies, continuously validate recovery operations, and quickly recover in case of attack. As the industry’s most scalable, feature-rich, and efficient data protection … More →

The post Quantum DXi9200 helps organizations manage and reduce cybersecurity risks appeared first on Help Net Security.

Apple has released emergency security updates for macOS Sequoia that fix two zero-day vulnerabilities (CVE-2024-44309, CVE-2024-44308) that “may have been actively exploited on Intel-based Mac systems”. About CVE-2024-44309 and CVE-2024-44308 CVE-2024-44309 affects WebKit, the browser engine used in the Safari web browser and all iOS and iPadOS web browsers, and can be triggered when it’s made to process maliciously crafted web content. It can enable a cross site scripting (XSS) attack. CVE-2024-44308 affects JavaScriptCore – … More →

The post Apple fixes 2 zero-days exploited to breach macOS systems (CVE-2024-44309, CVE-2024-44308) appeared first on Help Net Security.

ArmorCode announced the growth of its ASPM Platform with the ability to unify AppSec and infrastructure vulnerability management. The continued innovation of Risk-Based Vulnerability Management (RBVM) in ArmorCode empowers security teams to address vulnerabilities across infrastructure, cloud, and applications with enhanced prioritization, automation, asset and remediation workflows, offering organizations a comprehensive approach to manage risk. ArmorCode delivers an independent governance layer that integrates findings from multiple scanning tools, including infrastructure and application security scanners into … More →

The post ArmorCode unifies application security with infrastructure vulnerability management appeared first on Help Net Security.

Tanium announced Tanium Cloud Workloads, providing real-time visibility and protection for containerized environments. Through image vulnerability scanning, container run-time inventory, rogue container identification, and Kubernetes policy enforcement, teams across security, IT operations, and DevOps can reduce their attack surface and improve the security posture of containerized workloads whether on premises or in the cloud. As the adoption of containerized workloads increases across organizations, so does the attack surface available to bad actors exploiting their vulnerabilities. … More →

The post Tanium Cloud Workloads provides visibility and protection for containerized environments appeared first on Help Net Security.

OpenText unveiled Cloud Editions (CE) 24.4, presenting a suite of transformative advancements in Business Cloud, AI, and Technology to empower the future of AI-driven knowledge work. This release delivers secure, AI-integrated solutions that strengthen data connectivity, streamlines workflows, and enhances human potential—addressing the needs of forward-thinking CIOs and business leaders navigating multi-cloud environments. As multi-cloud strategies become standard practice, enterprises are now leveraging them to enhance flexibility, reduce vendor lock-in, and improve resilience. Seamless data … More →

The post OpenText Cloud Editions 24.4 blends AI with secure data connectivity appeared first on Help Net Security.

Exabeam coolaborates with with Wiz to provide organizations with improved threat detection, investigation, and response (TDIR) capabilities, ensuring a more secure and resilient cloud environment. With its open architecture the Exabeam New-Scale Security Operations Platform supports a best-of-breed ecosystem that includes hundreds of product integrations to accelerate time-to-value and strengthen on-premises and cloud security. “As organizations embrace cloud environments, the surge in cyberattacks is unprecedented, and visibility alone is not enough. Exabeam and Wiz are … More →

The post Exabeam and Wiz join forces to improve cloud security appeared first on Help Net Security.

Arkose Labs launched Arkose Device ID, a device identification solution that raises the bar in fraud detection by combining precise device tracking with session-based risk signals and anti-spoofing technology. Arkose Device ID is designed to address the growing sophistication of cyber threats, which are impacting businesses globally with increasing frequency and intensity. In a new research report, Arkose Labs found that more than 70% of enterprises cite identity-based attacks—including fake account creation and account takeovers … More →

The post Arkose Device ID detects suspicious activity patterns appeared first on Help Net Security.

Yubico announced Yubico Enrollment Suite for Microsoft users, including Yubico FIDO Pre-reg and the new YubiEnroll. These solutions integrate with Microsoft’s Entra ID, helping organizations create stronger cyber resilience and provide support to further advance strategies with a zero trust model. The Yubico Enrollment Suite enables organizations to strengthen security standards and go passwordless with phishing-resistant multi-factor authentication (MFA) to safeguard Microsoft ecosystems. Microsoft’s recently announced Secure Future Initiative (SFI) aims to deliver strong phishing-resistant … More →

The post Yubico Enrollment Suite boosts security for Microsoft users appeared first on Help Net Security.

The ransomware attack on UnitedHealth earlier this year is quickly becoming the healthcare industry’s version of Colonial Pipeline, prompting congressional testimony, lawmaker scrutiny and potential legislation.  Over the past few months, there have been two congressional hearings on the attack — one in the Senate, followed by one in the House — as well as calls from multiple senators for investigations into how the government responded to the incident, not to mention the criticism against UnitedHealth’s CISO, Steven Martin, … More →

The post Five backup lessons learned from the UnitedHealth ransomware attack appeared first on Help Net Security.

In this Help Net Security interview, Stephanie Domas, CISO at Canonical, discusses common misconceptions about open-source security and how the community can work to dispel them. She explains how open-source solutions, contrary to myths, offer enterprise-grade maturity, reliability, and transparency. Domas also shares key factors organizations should prioritize in open-source adoption to enhance security and balance innovation with stability. What are the biggest misconceptions about open-source security, and how can community members and professionals work … More →

The post Debunking myths about open-source security appeared first on Help Net Security.

The integrity of our online ecosystem heavily relies on domain registries, which serve as the foundation for secure and trusted digital experiences. However, threats like Domain Name System (DNS) abuse– manifesting as phishing, malware, and botnets – jeopardize this security. Such abuses harm individuals and undermine the overall trust in the internet. In this Help Net Security video, Ram Mohan, Chief Strategy Officer at Identity Digital, discusses the role registries play in safeguarding the DNS … More →

The post Safeguarding the DNS through registries appeared first on Help Net Security.

Application Security Engineer ENOC | UAE | On-site – View job details As an Application Security Engineer, you will establish and maintain DLP policies to prevent unauthorized access, transmission, or disclosure of sensitive data, focusing on both on-premises and cloud environments. Design, implement, and manage CASB solutions to control and monitor access to cloud applications and safeguard data across cloud services. Application Security Engineer Intellias | Poland | Remote – View job details As an … More →

The post Cybersecurity jobs available right now: November 20, 2024 appeared first on Help Net Security.

GenAI is quickly changing the software development process by automating tasks that once took developers hours, if not days, to complete, bolstering efficiency and productivity, according to Legit Security. “As GenAI transforms software development and becomes increasingly embedded in the development lifecycle, there are some real security concerns among developers and security teams,” said Liav Caspi, CTO at Legit. “Our research found that teams are challenged with balancing the innovations of GenAI and the risks … More →

The post Overreliance on GenAI to develop software compromises security appeared first on Help Net Security.