Help Net Security

Open source has become the foundation of modern application development, with up to 98% of applications incorporating open-source components and open-source code accounting for 70% or more of the typical application. In this Help Net Security video, Donald Fischer, CEO at Tidelift, discusses the 2024 State of the Open Source Maintainer report, which provides insights into the work and mindset of open source maintainers. The study showed that paid maintainers are 55% more likely than … More →

The post Open source maintainers: Key to software health and security appeared first on Help Net Security.

In this Help Net Security interview, Joe Baguley, CTO EMEA at Broadcom, shares insights on private AI and its significance in data security. He explains how it helps organizations maintain control over sensitive information while addressing the complexities of compliance and data privacy. Baguley also discusses the sectors leading the way in private AI adoption and the risks that come with it. What are the key technological components that make AI “private”? Which industries or … More →

The post Businesses turn to private AI for enhanced security and data management appeared first on Help Net Security.

Despite the rise in cyber threats, many people do not have a holistic view of security, according to Yubico. The results of the survey uncovered concerning patterns and behaviors when it comes to personal and workplace cybersecurity, including the extensive underutilization of multi-factor authentication (MFA) and a generally reactive approach to addressing cyber threats. While organizations often try their best to implement stringent security protocols at work, employees are falling behind in maintaining their own … More →

The post The most common authentication method is also the least secure appeared first on Help Net Security.

Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: Windows Server 2025 gets hotpatching option, without reboots Organizations that plan to upgrade to Windows Server 2025 once it becomes generally available will be able to implement some security updates by hotpatching running processes. PoC for critical SolarWinds Web Help Desk vulnerability released (CVE-2024-28987) Details about and proof-of-concept (PoC) exploit code for CVE-2024-28987, a recently patched SolarWinds Web Help Desk … More →

The post Week in review: Windows Server 2025 gets hotpatching option, PoC for SolarWinds WHD flaw released appeared first on Help Net Security.

After much hyping and following prematurely leaked information by a third party, security researcher Simone Margaritelli has released details about four zero-day vulnerabilities in the Common UNIX Printing System (CUPS) that can be abused by remote, unauthenticated attackers to achieve code execution on vulnerable Linux and Unix-like sistems. The CUPS vulnerabilities CUPS is an open-source printing system that allows a computer on which is installed to act as a print server. It is developed by … More →

The post CUPS vulnerabilities affecting Linux, Unix systems can lead to RCE appeared first on Help Net Security.

SpyCloud released new hosted automation solution, SpyCloud Connect, which delivers custom-built automation workflows to Information Security (InfoSec) and Security Operations (SecOps) teams. The solution enables rapid automation of SpyCloud’s suite of identity threat protection products with a vast array of security tools and systems they currently use to protect their business and users from cyber threats – saving them valuable time and alleviating overburdened resources. With this new solution, SpyCloud will build, maintain, and support … More →

The post SpyCloud Connect delivers automated remediation of compromised identities appeared first on Help Net Security.

AuditBoard announced extensions to its modern connected risk platform to help teams improve efficiency, foster collaboration, and increase the rigor and intentionality of their GRC management programs. Available immediately, these functionalities include: AuditBoard analytics enhancements include nine new out-of-the-box workflows to automate testing and analysis to help Audit and Internal Controls teams uncover risks faster, minimize routine tasks, and enable focus on higher-value initiatives. Risk appetite provides risk management teams with precise analysis against set … More →

The post AuditBoard’s risk platform enhancements empower teams to boost efficiency appeared first on Help Net Security.

IoT devices have become integral to how many organizations operate. From Smart TVs in conference rooms to connected sensors and wireless security cameras, these connected devices are now a fixture in the modern workplace. They also, however, present a real and often overlooked cybersecurity threat. An effective, comprehensive approach to IoT security requires organizations to have complete visibility into all connected devices within their network, addressing common vulnerabilities such as built-in backdoors and outdated firmware, … More →

The post 3 tips for securing IoT devices in a connected world appeared first on Help Net Security.

Tosint is an open-source Telegram OSINT tool that extracts useful information from Telegram bots and channels. It’s suited for security researchers, investigators, and others who want to gather insights from Telegram sources. Several law enforcement agencies utilize Tosint to gather intelligence and monitor cybercriminal activities. “I created Tosint to analyze and track cybercriminals, particularly those involved in phishing attacks. As head of threat intelligence at D3Lab, I counter phishing for various Italian and international banks … More →

The post Tosint: Open-source Telegram OSINT tool appeared first on Help Net Security.

In this Help Net Security interview, Nadir Izrael, CTO at Armis, discusses how AI has transformed cyberwarfare by amplifying attacks’ scale and sophistication. Izrael emphasizes the need for AI-powered defenses and proactive cybersecurity strategies to combat these evolving threats. How has adopting AI transformed the nature of cyberwarfare, and what specific capabilities does it offer to threat actors? AI has transformed the nature of cyberwarfare. Threat actors can amplify the scale and sophistication of attacks … More →

The post Developing an effective cyberwarfare response plan appeared first on Help Net Security.

Here’s a look at the most interesting products from the past week, featuring releases from Absolute, ArmorCode, Bitdefender, Guardsquare, Malwarebytes, NETGEAR, and Nudge Security. Bitdefender debuts GravityZone PHASR, enhancing security through user behavior analysis GravityZone PHASR enables security teams to anticipate and quickly mitigate emerging risks before they escalate and seamlessly adapts as threats and user roles evolve to ensure security measures always remain aligned with business objectives. For example, if a user’s responsibilities change … More →

The post New infosec products of the week: September 27, 2024 appeared first on Help Net Security.

iOS 18 allows you to lock and hide apps to protect the information within them by requiring Face ID, Touch ID, or your passcode for access, while also concealing the content from searches, notifications, and various areas throughout the system. If someone is using your iPhone, they won’t be able to open locked apps and will be notified that they can only access them by using Face ID. Not all apps can be locked, as … More →

The post How to lock and hide iPhone apps in iOS 18 appeared first on Help Net Security.

Active Directory (AD), Microsoft’s on-premises directory service for Windows domain networks, is so widely used for enterprise identity and access management that compromising it has become almost a standard step in cyber intrusions. “Active Directory is susceptible to compromise due to its permissive default settings, its complex relationships, and permissions; support for legacy protocols and a lack of tooling for diagnosing Active Directory security issues,” Five Eyes cybersecurity agencies have clarified in a recently released … More →

The post Active Directory compromise: Cybersecurity agencies provide guidance appeared first on Help Net Security.

Zilla Security launched AI-powered modern IGA platform, which includes Zilla AI Profiles and significantly enhanced provisioning capabilities. These innovations tackle the long-standing challenge of managing hundreds of roles or group membership rules to give users job-appropriate access. The cloud has broken traditional IGA, leading to cumbersome processes and escalating costs. Now, the team that pioneered IGA twenty years ago at Aveksa is revolutionizing the space once again. Zilla’s CEO, Deepak Taneja, has been defining the … More →

The post Zilla Security simplifies identity governance and administration for organizations appeared first on Help Net Security.

DoControl released a security product suite for Google Workspace, designed to protect data, identities, configurations, and third-party connected apps. DoControl’s SSPM provides Google Workspace customers with security capabilities that are not offered by Google’s built-in security ecosystem. Adopted by top Google Workspace customers, DoControl is the SSPM of choice for securing enterprise Google Workspace environments. DoControl’s Google Workspace Posture Management mitigates admin misconfigurations, preventing them from becoming an organization’s Achilles’ heel. DoControl continuously monitors Google … More →

The post DoControl introduces security product suite for Google Workspace appeared first on Help Net Security.

Google’s decision to write new code into Android’s codebase in Rust, a memory-safe programming language, has resulted in a significant drop in memory safety vulnerabilities, despite old code (written in C/C++) not having been rewritten. The number of memory safety vulnerabilities found in the Android codebase per year (Source: Google) Android evolves, and has fewer memory safety vulnerabilities “The Android team began prioritizing transitioning new development to memory-safe languages around 2019. This decision was driven … More →

The post The number of Android memory safety vulnerabilities has tumbled, and here’s why appeared first on Help Net Security.

Salt Security announced its integration with Google Cloud‘s Apigee API Management platform. With this technical collaboration, customers can discover all of their APIs, including shadow and deprecated APIs, apply posture rules, uncover areas of non-compliance, and stop API-based attacks at their root. The security landscape is witnessing an unprecedented reliance on APIs. Now more than ever, organizations need comprehensive API security mechanisms that proactively detect and prevent threats. Salt Security, a pioneer in API security, … More →

The post Salt Security provides improved API protection with Google Cloud appeared first on Help Net Security.

Deep-learning models have found applications across various industries, from healthcare diagnostics to financial forecasting. However, their high computational demands often require powerful cloud-based servers. This dependency on cloud computing raises notable security concerns, particularly in sensitive sectors like healthcare. Hospitals, for instance, may be reluctant to adopt AI tools for analyzing confidential patient data due to potential privacy risks. To tackle this pressing issue, MIT researchers have developed a security protocol that leverages the quantum … More →

The post New MIT protocol protects sensitive data during cloud-based computation appeared first on Help Net Security.

In July, Wall Street experienced its worst day since 2022, with the tech-focused Nasdaq falling by 3.6%. The downturn was largely triggered by what commentators suggest is the result of underwhelming earnings from some major tech companies. What’s notable is that the companies hit the hardest by this decline were those heavily invested in AI. While AI has driven significant investment and optimism, there is growing concern that its capabilities may have been overhyped. This … More →

The post AI use: 3 essential questions every CISO must ask appeared first on Help Net Security.

In this Help Net Security interview, Andrius Buinovskis, Head of Product at NordLayer, discusses how organizations can assess their compliance management and ensure they meet regulatory requirements. Buinovskis also addresses the challenges of managing multiple frameworks and offers strategies for building a strong security compliance program. To start things off, how can organizations assess their current compliance management level, and what steps should they take to determine whether they are meeting all regulatory requirements? Assessing … More →

The post Compliance management strategies for protecting data in complex regulatory environments appeared first on Help Net Security.