As much as some people dislike it, the world is interconnected, and to operate a business successfully, you will have to use the products or services produced by other businesses. Under normal circumstances, this is fine. However, when you’re a contractor looking to work with a department of the federal government, you have to adhere […]
The post How to Vet SaaS Apps Using FedRAMP Equivalency appeared first on Security Boulevard.
If it feels like your entire cybersecurity program is once again operating on a geopolitical fault line, you're not imagining things.
The intersection of global politics and cybersecurity has grown a whole lot messier — and more consequential — in recent weeks. With the current U.S. Administration turning up the heat on China through aggressive tariffs and foreign policy pressure, the ripple effects on cybersecurity are no longer hypothetical. They’re here. And they’re accelerating.
Trade wars mean cyber warsLet’s start with the obvious: the U.S.-China trade war. After the administration slapped 145% tariffs on key Chinese imports, Beijing didn’t just fume — they likely leveraged their extensive access to our infrastructure. Literally. According to a recent Wall Street Journal report, Chinese officials quietly acknowledged involvement in attacks on U.S. critical infrastructure. The message? Cyber is the battlefield.
Cybersecurity advisor and author Tom Kellermann has said that attacks by the Chinese state-backed Salt Typhoon and Volt Typhoon operations have enabled infiltration of U.S. critical infrastructure. These intrusions could be leveraged today for intelligence in these times of escalating tensions as well as tomorrow for more destructive attacks if relations truly deteriorate.
And increases in cyber activity exploiting U.S. tariff policies have been noted by BforeAI CEO Luigi Lenguito in the last few weeks, with criminals already engaging in invoice fraud and other scams involving shipping company impersonation.
This isn’t just state-on-state stuff. The private sector is feeling the pressure. A growing number of threat analysts are flagging a rise in industrial espionage and IP theft attempts, particularly targeting sectors tied to strategic national interests — energy, tech and semiconductors.
The private sector is carrying more of the cyber defense loadWith the federal government currently reevaluating roles, budgets and security clearances across key cybersecurity agencies, more of the frontline burden is shifting to the private sector. This transition is happening just as geopolitical tensions are driving up the volume and sophistication of attacks.
Critical industries — like energy, finance, healthcare and manufacturing — are increasingly being targeted by state-aligned threat actors. These organizations are expected to maintain operational readiness, detect threats, and respond quickly.
For cybersecurity professionals, this shift means greater responsibility, higher stakes and a growing need for clarity around real risk. Now more than ever, visibility and proactive defense strategies are essential. Preventing an attack is so much more important, and actually cheaper, than cleaning up in the aftermath.
Your vendors are feeling it, tooThe entire security ecosystem is absorbing the shockwaves from rapidly changing economic policy. Tariffs on Chinese-made chips and components are complicating hardware supply chains and raising costs across the board. Some cybersecurity vendors are bracing for delays and price hikes, which could mean you’re waiting longer (and paying more) for upgrades to critical infrastructure.
And yet — despite all of this — some U.S. companies are doubling down on their ties with China. A recent survey conducted by the U.S. Chamber of Commerce found that 70% of firms who responded plan to maintain or even increase engagement.
What you should be watching (and doing)So, what does this mean for those of us on the front lines of cyber defense? Here are some recommendations for moving forward in these conflicted times:
Cybersecurity efforts are often reactive — teams scramble to respond to new cyber threats as they arise. In today’s world, reactive security is not only inadequate; it’s irresponsible, and it puts national security at risk. A proactive approach is what’s needed in these turbulent times. One in which organizations use accurate assessment of real-world risks to address the most critical vulnerabilities, misconfigurations and overprivileged identities before they can be used in an attack. The more unstable the geopolitical climate, the more essential it is to proactively reduce your organization’s exposure and bolster its proactive defenses.
The post Geopolitics Just Cranked Up Your Threat Model, Again. Here’s What Cyber Pros Need to Know appeared first on Security Boulevard.
Achieving CMMC (Cybersecurity Maturity Model Certification) compliance is essential for organizations aiming to secure contracts with the Department of Defense (DoD). Navigating the complexities of CMMC can be challenging, making the role of CMMC consultants invaluable. While you can do this process yourself, if you don’t have the time or expertise, you can also work […]
The post The Top CMMC Consultants: How to Choose the Right One for Your Business appeared first on PreVeil.
The post The Top CMMC Consultants: How to Choose the Right One for Your Business appeared first on Security Boulevard.
Microsoft a year ago was about to launch Recall, a Windows feature for Copilot+ PCs that takes regular screenshots of users' systems and stores them so they can be searched for later. Privacy and security concerns forced the company to pull it back and rework it. Now it is in preview with Windows Insiders.
The post Microsoft Moves Forward With Controversial Recall Feature appeared first on Security Boulevard.
A high severity vulnerability in DICOM, the healthcare industry’s standard file protocol for medical imaging, has remained exploitable years after its initial disclosure. The flaw enables attackers to embed malicious code within legitimate medical image files. While previous research demonstrated this vulnerability’s impact on Windows-based medical systems, Praetorian’s new proof of concept, ELFDICOM, extends the […]
The post ELFDICOM: PoC Malware Polyglot Exploiting Linux-Based Medical Devices appeared first on Praetorian.
The post ELFDICOM: PoC Malware Polyglot Exploiting Linux-Based Medical Devices appeared first on Security Boulevard.
Cyber-Physical Systems (CPS) are no longer the stuff of science fiction; they are woven into the fabric of our daily lives, organizations, and critical infrastructure. From smart grids managing our power to the connected cars we drive and the automated systems in our factories, CPS offers incredible benefits. But with great power comes great responsibility […]
The post Navigating New Cyber-Physical System Security Regulations appeared first on Viakoo, Inc.
The post Navigating New Cyber-Physical System Security Regulations appeared first on Security Boulevard.
Authors/Presenters: Oreen Livni Shein, Elad Pticha
Our sincere appreciation to BSidesLV, and the Presenters/Authors for publishing their erudite Security BSidesLV24 content. Originating from the conference’s events located at the Tuscany Suites & Casino; and via the organizations YouTube channel.
The post BSidesLV24 – Breaking Ground – Redis Or Not: Argo CD & GitOps From An Attacker’s Perspective appeared first on Security Boulevard.
Redundancy in secrets management introduces risks, as well as operational complexity, ultimately undermining overall security maturity.
The post A Security Leader’s Perspective on The Real Business Risks of Secrets Managers Redundancy appeared first on Security Boulevard.
At the start of this year, IRONSCALES launched an integration with CrowdStrike Falcon® Next-Gen SIEM, delivering enhanced threat visibility, detection, and correlation to help organizations combat phishing and account takeover (ATO) threats. This integration reflects our shared commitment to simplifying and strengthening cross-domain security—including email security—as a critical part of modern cyber defense.
The post Seeing the Big Picture in Phishing Defense: IRONSCALES & CrowdStrike appeared first on Security Boulevard.
Imagine that all of us—all of society—have landed on some alien planet and need to form a government: clean slate. We do not have any legacy systems from the United States or any other country. We do not have any special or unique interests to perturb our thinking. How would we govern ourselves? It is unlikely that we would use the systems we have today. Modern representative democracy was the best form of government that eighteenth-century technology could invent. The twenty-first century is very different: scientifically, technically, and philosophically. For example, eighteenth-century democracy was designed under the assumption that travel and communications were both hard...
The post Reimagining Democracy appeared first on Security Boulevard.
The post Agentic AI & Cybersecurity: A Powerful Partnership appeared first on AI Security Automation.
The post Agentic AI & Cybersecurity: A Powerful Partnership appeared first on Security Boulevard.
President Trump stripped former CISA head Chris Krebs of his security clearances, accusing him of disloyalty for claiming the 2020 election was safe and disagreeing with him regarding the pandemic. SentinelOne, where Krebs is an executive, also was targeted by Trump, who further ordered investigations of Krebs and CISA.
The post Trump Strips Security Clearances of Ex-CISA Head Krebs, SentinelOne appeared first on Security Boulevard.
Are You Overlooking an Essential Part of Your Cybersecurity Strategy? When it comes to solidifying your organization’s cybersecurity strategies, an often-overlooked aspect is Non-Human Identities (NHIs). Given the increasing reliance on the cloud for business operations across a multitude of industries and departments, managing NHIs effectively is crucial for stable and secure operations. The Indispensable […]
The post Ensuring Stability in Your NHI Security Strategy appeared first on Entro.
The post Ensuring Stability in Your NHI Security Strategy appeared first on Security Boulevard.
What Makes Secrets Vaulting Essential for Modern Business Security? Non-human identities (NHIs) and secrets management play a critical role in safeguarding sensitive data. NHIs, or machine identities, are created by combining a unique encrypted password, key, or token (the “Secret”) with permissions granted by a destination server. But why is managing these NHIs and their […]
The post Smart Secrets Vaulting Solutions for Modern Businesses appeared first on Entro.
The post Smart Secrets Vaulting Solutions for Modern Businesses appeared first on Security Boulevard.
The emergence of Model Context Protocol for AI is gaining significant interest due to its standardization of connecting external data sources to large language models (LLMs). While these updates are good news for AI developers, they raise some security concerns. In this blog we address FAQs about MCP.
BackgroundTenable Research has compiled this blog to answer Frequently Asked Questions (FAQ) regarding Model Context Protocol (MCP).
FAQWhat is Model Context Protocol (MCP)?
Model Context Protocol (MCP) is an open-source standard created by Anthropic that provides a universal method to connect external data and actions to large language models (LLMs). It provides the methods to allow an LLM to detect what resources it has at its disposal, and understand when and why it would use those resources to answer or enhance the task it is working on.
Examples of external data that an AI could access include local file systems, databases, APIs, SaaS applications and more.
In a way, the MCP allows an LLM to provide a deterministic request of data or actions to assist in answering questions with data outside of its training.
MCP is quickly becoming a standard that many AI companies are implementing.
Why is there so much interest in MCP?
MCP is gaining significant interest due to its standardization of connecting external data sources to LLMs. A developer can now write an integration for an LLM once and use it across a variety of tools and LLMs that utilize MCP. "App stores" and "marketplaces" of MCP servers are available for quick integration into your environment. Services to help create custom MCP servers specifically for you are available.
Is this the first time LLMs could interact with external data and sources?
Agentic AI, which has the capacity to act autonomously, can take actions and work with external sources, but implementation is unique to each tool. Solutions like LangFlow help by standardizing some of the tooling and can interact with multiple LLMs within its specific framework. However, the MCP specification takes this standardization to the next level, where an integration can be created and used across multiple solutions.
How do I get started working with MCP?
MCP requires a host application, colloquially called a client and a server. The host application orchestrates communication between an LLM and the interfaces that communicate with the MCP servers.
The foundational example is using Claude Desktop to add a filesystem MCP server, as outlined at Quickstart for Claude Desktop Users. This example shows what it takes to add a filesystem server to Claude Desktop to provide local filesystem information to Claude.ai. While Claude Desktop is the proving ground for MCP servers, many other clients exist that improve the user experience.
Online directories of MCP clients and servers are becoming available, such as MCP Clients | Glama and Open-Source MCP Servers | Glama.
How does MCP work?
MCP uses a client/server architecture to allow LLMs to interact with external data. This is accomplished using three primary components; host, client and server.
Source: Tenable, April 2025
While these components are discussed as separate components, they can be a part of a single application or separate applications. The most common configuration seen at time of publishing this FAQ consists of the client integrated into the host application and communicating to the server over secure transports using JSON-RPC.
What type of capabilities do MCP servers offer?
MCP servers offer different capabilities to clients to support the retrieval of data along with actions taken on data. The following capabilities are available:
Currently, "tools" are the most impactful capability offered by MCP and what garners much of the media's attention.
Is it safe for me to use MCP servers?
MCP relies heavily on trust.
Users should seek out MCP servers from reputable sources. However, always remember to "trust but verify," and do not install unknown software in your environment.
How does the MCP host implement security?
The host application should implement controls that allow the user of the application to approve tools prior to using them. Many of the mainstream applications already have methods to verify that the tool usage is acceptable. For example, on the first time attempting to call the tool, Claude Desktop provides a choice of "use once" or "use for the entire chat session." Other applications, like Cline, may have a method to "auto approve" different tools or applications. The amount of information provided to the user in these verification dialogs can vary.
What controls are available for transport security?
There are two primary transports; STDIO and Server Sent Events (SSE).
Ok, so what are the biggest risks to using MCP?
The biggest risk to using MCP is the injection of malicious servers. Since all registered servers have a single point of reference in the host application and LLM, malicious servers can poison the LLM or abuse the tools of other legitimate servers. As the MCP ecosystem matures we expect to see formalization of concepts like MCP security certification, server integrity monitoring and standardization of logging for monitoring. We will begin to see MCP “App Stores” where collections of MCP servers can be easily pulled into existing tools from a central repository.
The specification for MCP highly recommends authentication and authorization for remote servers, but it is not required. However, developers of MCP servers may not consider the network security of the MCP servers and not implement these recommendations.
Any MCP servers that are remotely accessible can be susceptible to man in the middle attacks or remote attacks. Make sure any MCP servers that use a network based transport have implemented strong authentication and authorization.
What can I do to protect my information while using MCP?
As the technical solutions and capabilities for securing MCP solutions evolve the current recommendations are to use solid cybersecurity best practices. Some of the top things that you can do include the following:
Is Tenable looking into safety and security concerns surrounding MCP implementations?
Yes, Tenable Research is actively researching MCPs and will be sharing more of our findings in future publications on the Tenable blog.
Get more informationThe post Frequently Asked Questions About Model Context Protocol (MCP) and Integrating with AI for Agentic Applications appeared first on Security Boulevard.
In the current economic environment, IT and security leaders face significant challenges. Budget optimization and prioritizing initiatives that provide real business value are crucial, particularly amidst a growingly complex and threatening threat landscape. This pressure is especially pronounced when it comes to securing the APIs essential for modern applications and linking vital data.
APIs serve as the foundation of digital innovation, yet their swift expansion results in an extensive attack surface. Development teams often operate rapidly, occasionally sidestepping standard security evaluations, leading to undocumented shadow APIs and outdated zombie APIs hiding within your environment. The task of manually identifying these APIs, ensuring compliance, and defending against sophisticated attacks can seem daunting, especially with limited resources. How can you improve security and manage costs simultaneously?
Bridging the Gap: Security and Efficiency Can CoexistWhat if compromise was unnecessary? Imagine having complete visibility into your entire API ecosystem, proactively tackling threats, and streamlining security operations without increasing operational expenses.
That’s where Salt Security steps in. We recognize your challenges, and our platform is crafted to assist security and development teams in maximizing efficiency while achieving solid API security without incurring additional operational costs.
How Salt Security Empowers Your Teams:Are you concerned about complicated procurement cycles or identifying new budget lines? We've simplified that process too. Salt Security is available directly through AWS, Azure, and GCP Marketplaces, enabling you to use your existing cloud budgets and streamline purchasing. It’s about optimizing your previous investments.
Don't Compromise on API SecurityIn an era that demands fiscal wisdom, skimping on API security is not an option—the risks are simply too great. With Salt Security, you can safeguard your APIs, reduce costs, and empower your teams to concentrate on innovation, even with tight resources. Secure your essential projects and uphold robust API security without straining your finances.
Ready to discover how you can decrease costs while enhancing your API security and compliance posture?
If you want to learn more about Salt and how we can help you on your API Security journey through discovery, posture governance, and run-time threat protection, please contact us, schedule a demo, or check out our website.
The post Unlock Total API Visibility and Control, Cost-Effectively appeared first on Security Boulevard.
Learn how to stop enumeration fraud before Visa’s new thresholds take effect. Protect your business with DataDome’s Cyberfraud Protection Platform.
The post How to Decrease Your Enumeration Fraud Before Visa’s New Rules Take Effect appeared first on Security Boulevard.
Introduction A critical security vulnerability, identified as CVE-2025-31161 (previously tracked as CVE-2025-2825), has been discovered in CrushFTP versions 10.0.0 through 10.8.3 and 11.0.0 through 11.3.0. This flaw allows unauthenticated remote attackers to access unpatched CrushFTP servers if they’re publicly exposed over HTTP(S). The vulnerability has been actively exploited since March 2025, underscoring the urgency for […]
The post Imperva Customers Are Protected Against CVE-2025-31161 in CrushFTP appeared first on Blog.
The post Imperva Customers Are Protected Against CVE-2025-31161 in CrushFTP appeared first on Security Boulevard.
Authors/Presenters: Jay Chen, Ravid Mazon
Our sincere appreciation to BSidesLV, and the Presenters/Authors for publishing their erudite Security BSidesLV24 content. Originating from the conference’s events located at the Tuscany Suites & Casino; and via the organizations YouTube channel.
The post BSidesLV24 – Breaking Ground – BOLABuster: Harnessing LLMs For Automating BOLA Detection appeared first on Security Boulevard.
Grip helped companies reduce exposure from the Oracle Cloud breach before it was acknowledged, detecting shadow tenants and enabling fast, targeted response.
The post How We Knew the Oracle Breach Was Real | Grip Security appeared first on Security Boulevard.
