Help Net Security

Google has announced that, by the end of 2025, multi-factor authentication (MFA) – aka 2-step verification – will become mandatory for all Google Cloud accounts. “Given the sensitive nature of cloud deployments — and with phishing and stolen credentials remaining a top attack vector observed by our Mandiant Threat Intelligence team — we believe it’s time to require [2-step verification] for all users of Google Cloud,” said Mayank Upadhyay, VP of Engineering and Distinguished Engineer, … More →

The post All Google Cloud users will have to enable MFA by 2025 appeared first on Help Net Security.

Atakama announced the latest expansion of its Managed Browser Security Platform, introducing DNS filtering explicitly designed for Managed Service Providers (MSPs). This new feature enables comprehensive in-browser and network-level filtering, providing a full-spectrum DNS solution that secures browsers and entire network environments. Atakama’s Managed Browser Security Platform transforms the browser into a secure foundation, empowering MSPs with enhanced visibility and control over client web activity. The platform now includes advanced capabilities such as category-based filtering … More →

The post Atakama introduces DNS filtering designed for MSPs appeared first on Help Net Security.

A new ransomware dubbed GoZone is being leveraged by attackers that don’t seem to be very greedy: they are asking the victims to pay just $1,000 in Bitcoin if they want their files decrypted. The GoZone HTML ransom note (Source: SonicWall) The ransom notes shown by the malware lay out another incentive for paying up: they claim that child sexual abuse material has been found on the targeted computer and urge the victim to pay … More →

The post GoZone ransomware accuses and threatens victims appeared first on Help Net Security.

Authlete launched Authlete 3.0, offering support for OpenID for Verifiable Credential Issuance (OID4VCI). This new capability empowers organizations—including governments, financial institutions, and educational establishments—to revolutionize how they issue and manage user credentials. With the introduction of Authlete 3.0, Authlete now offers a simple API solution for quickly issuing interoperable verifiable credentials (VCs) conformant with OID4VCI. Built on OAuth and OIDC—proven and widely used global standards for authentication and authorization—OID4VCI supports various credential formats, including SD-JWT … More →

The post Authlete 3.0 empowers organizations to improve how they issue and manage user credentials appeared first on Help Net Security.

Symbiotic Security launched a real-time security for software development that combines detection and remediation with just-in-time training – incorporating security testing and training directly into the development process without breaking developers’ workflows. Backed with $3 million of seed funding from investors including Lerer Hippeau, Axeleo Capital, Factorial Capital, and others, the company has introduced its software-as-a-service that works with the developer’s Integrated Development Environment (IDE) and enables them to develop software more securely. A Ponemon … More →

The post Symbiotic provides developers with real-time feedback on potential security vulnerabilities appeared first on Help Net Security.

In this Help Net Security interview, Julie Madhusoodanan, Head of CyberSecurity at LinkedIn, discusses how closing the gender gap could enhance cybersecurity’s effectiveness in combating emerging threats. With women still underrepresented in cybersecurity roles, she emphasizes how diverse teams bring essential skills and innovative perspectives. Madhusoodanan outlines strategies like inclusive hiring, mentorship, and flexible work policies as essential steps to foster gender balance in the field. What impact would closing the gender gap in cybersecurity … More →

The post The cybersecurity gender gap: How diverse teams improve threat response appeared first on Help Net Security.

Osmedeus is an open-source workflow engine designed for offensive security. It serves as a versatile foundation, enabling users to easily create customized reconnaissance systems and scale them across extensive target lists. Osmedeus key features Speed up your recon process Organize your scan results Customize and optimize your recon process Integrate with new public and private tools Scale across a large number of targets Synchronize the results across many places Osmedeus is available for free on … More →

The post Osmedeus: Open-source workflow engine for offensive security appeared first on Help Net Security.

In this Help Net Security video, Chris Gibson, CEO at FIRST, discusses the evolving threat landscape and provides a unique take on where data breaches and cyber attacks will be in 2025.

The post Key cybersecurity predictions for 2025 appeared first on Help Net Security.

Identity-related data breaches are more severe and costly than run-of-the-mill incidents, according to RSA. 40% of respondents reported an identity-related security breach. Of those, 66% reported it as a severe event that affected their organization. 44% estimated that the total costs of identity-related data breaches exceeded the cost of a typical data breach. These findings underscore why organizations should prioritize investing in security capabilities that can mitigate the high costs of identity-related breaches. AI seen … More →

The post Identity-related data breaches cost more than average incidents appeared first on Help Net Security.

Lumifi announces the acquisition of Critical Insight, marking its third acquisition in 13 months. This strategic move expands Lumifi’s service offerings and strengthens its presence in the healthcare and critical infrastructure cybersecurity sector. The acquisition adds to Lumifi’s existing offerings, including its 24/7 Security Operations Center (SOC), managed detection and response, and ShieldVision platform. Critical Insight’s incident response capabilities complement Lumifi’s real-time threat monitoring, while its professional services expand the ability to provide tailored cybersecurity … More →

The post Lumifi acquires Critical Insight to boost incident response capabilities appeared first on Help Net Security.

Unknown attackers are trying to trick Windows users into spinning up a custom Linux virtual machine (VM) with a pre-configured backdoor, Securonix researchers have discovered. The campaign The attack began with a phishing email, they believe, but they weren’t able to pinpoint the intendend victims. The email included a link pointing to an unusually big ZIP file (285 MB), and its name – OneAmerica Survey.zip – points to the likely lure: a survey by OneAmerica … More →

The post Beware of phishing emails delivering backdoored Linux VMs! appeared first on Help Net Security.

Google has delivered fixes for two vulnerabilities endangering Android users that “may be under limited, targeted exploitation”: CVE-2024-43047, a flaw affecting Qualcomm chipsets, and CVE-2024-43093, a vulnerability in the Google Play framework. The exploited vulnerabilities (CVE-2024-43047, CVE-2024-43093) Qualcomm patched CVE-2024-43047 – a use-after-free vulnerability in the Digital Signal Processor (DSP) service that could be exploited to escalate privileges on targeted devices – in October 2024, and urged original equipment manufacturers (OEMs) to deploy the patches … More →

The post Google patches actively exploited Android vulnerability (CVE-2024-43093) appeared first on Help Net Security.

In this study, GitGuardian and CyberArk reveal the stark reality of secrets management across 1,000 organizations. With 79% experiencing secrets leaks and an average remediation time of 27 days, the findings expose critical gaps between security confidence and reality. Learn how leading organizations tackle the secrets sprawl crisis and what sets successful security programs apart from the rest. Get actionable insights into modernizing your secrets security strategy for today’s cloud-native world. Download the Voice of … More →

The post Report: Voice of Practitioners 2024 – The True State of Secrets Security appeared first on Help Net Security.

BigID launched Data Security Posture Management (DSPM) Starter App, built natively in Snowflake and using the Snowflake Native App Framework. BigID’s DSPM Starter App will be available via Snowflake Marketplace and provide rapid data discovery and classification assessment natively in the Snowflake AI Data Cloud. As data environments grow more complex, with fragmented sources, rising breaches, and increasing demands for AI governance, organizations are under greater pressure to safeguard their sensitive data. BigID DSPM Starter … More →

The post BigID DSPM Starter App enhances data security posture for Snowflake customers appeared first on Help Net Security.

The open-source software (OSS) industry is developing the core software for the global infrastructure, to the point that even some proprietary software giants adopt Linux servers for their cloud services. Still, it has never been able to get organized by creating representative bodies capable of giving an organic response to issues such as those raised at the European level by the Cyber Resilience Act. I have been advocating for years the need to transform a … More →

The post Open-source software: A first attempt at organization after CRA appeared first on Help Net Security.

In this Help Net Security interview, Barry Mainz, CEO at Forescout, discusses the obstacles organizations encounter in attaining security visibility, particularly within cloud and hybrid environments. He explains why asset intelligence—going beyond basic visibility to understand device behavior and risk—is essential. Mainz also discusses how AI and machine learning can help organizations stay proactive as the attack surface continues to grow. What are the primary challenges organizations face when trying to achieve security visibility, particularly … More →

The post Maximizing security visibility on a budget appeared first on Help Net Security.

Application Security Engineer MassMutual | USA | Hybrid – View job details As an Application Security Engineer, you will conduct in-depth security assessments, including vulnerability scanning, and code reviews. Ensure secure coding practices are followed, and security controls are incorporated into software designs. Conduct detailed threat modeling to identify attack vectors and potential weaknesses. Ensure compliance with security regulations, frameworks, and industry standards such as OWASP. Cybersecurity Engineer, Resilience Electrolux Group | Italy | On-site … More →

The post Cybersecurity jobs available right now: November 5, 2024 appeared first on Help Net Security.

The proliferation of non-human identities and the complexity of modern application architectures have created significant security challenges, particularly in managing sensitive credentials, according to GitGuardian and CyberArk. Based on a survey of 1,000 IT decision-makers in organizations with over 500 employees across the US, UK, Germany, and France, the report reveals a significant rise in awareness and concern regarding the risks associated with secrets sprawl. Secrets leaks are on the rise 79% of respondents reported … More →

The post AI learning mechanisms may lead to increase in codebase leaks appeared first on Help Net Security.

Synology has released fixes for an unauthenticated “zero-click” remote code execution flaw (CVE-2024-10443, aka RISK:STATION) affecting its popular DiskStation and BeeStation network attached storage (NAS) devices. About CVE-2024-10443 CVE-2024-10443 was discovered by Rick de Jager, a security researcher at Midnight Blue, and has been exploited at the Pwn2Own Ireland 2024 hacking competition ten days ago. The specifics of CVE-2024-10443 are under wraps for the moment, but we know that it may allow unauthenticated attackers to … More →

The post Millions of Synology NAS devices vulnerable to zero-click attacks (CVE-2024-10443) appeared first on Help Net Security.

The IRISSCERT Cyber Crime Conference (IRISSCON) returns on November 6th at the Aviva Stadium, where global cybersecurity leaders will explore AI’s revolutionary role in defending against and contributing to cyber threats. As Ireland’s longest-standing cybersecurity conference, IRISSCON 2024 will dive into AI’s impact on how it both enhances security and enables cybercriminals to scale and automate attacks. With generous support from diamond sponsors ESET, Symantec, and BH Consulting, the event will highlight cutting-edge AI strategies … More →

The post IRISSCON 2024 to address AI’s dual impact on cybersecurity appeared first on Help Net Security.