If you’re part of the defense industrial base and you’re seeking CMMC certification, there’s a very good chance you’re aiming for Level 2. Level 1 is mostly meant for businesses with a focus on federal contract information but not CUI, while Level 3 is meant for businesses handling the most sensitive kinds of CUI; since […]
The post CMMC Level 2 Documentation: What Auditors Want to See appeared first on Security Boulevard.
Microsoft’s approach offers a compelling opportunity to secure AI, leverage AI-driven security tools and establish a self-reinforcing ecosystem where AI agents effectively collaborate within defined organizational boundaries
The post AI Security Got Complicated Fast. Here’s How Microsoft is Simplifying It appeared first on Security Boulevard.
Classic “wordplay:” Larry’s PR angels desperately dance on the head of a pin.
The post Oracle Hack: From ‘Deny-Deny-Deny’ to ‘Oops-Oops-Oops’ appeared first on Security Boulevard.
Security teams can now define application protection policies declaratively in Impart — with Cursor's agent executing them safely and autonomously, eliminating the need for tedious clickops.
Why This MattersApplication protection has traditionally been a necessary burden. Security engineers find themselves trapped in a cycle of managing brittle regex rules, wrestling with unwieldy WAF interfaces, and constantly troubleshooting policy misconfigurations that disrupt production.
This manual toil isn't just frustrating — it's a significant business risk that drains resources and creates vulnerabilities.
Our integration with Cursor transforms this landscape by offering declarative security policies that are autonomously executed at runtime, freeing your team to focus on strategic security initiatives rather than repetitive maintenance.
Why Now Is the TimeSecurity teams are increasingly strained, trying to secure complex, rapidly evolving application stacks while facing:
Impart + Cursor Agent delivers the solution these teams desperately need.
What Sets This Integration ApartIn a market saturated with automated and agentic detection tools, Impart stands alone as a comprehensive solution for automated and agentic application protection.
Impart + Cursor provides:
This isn't just detection and visibility — it's real time protection that operates independently in production environments.
What We've ReleasedWith this integration, you can now:
Security engineers now have the power to move quickly, maintain robust security, and escape the chaos of manual WAF operations once and for all.
Get Started TodayReady to experience what truly agentic application protection looks like?
Say goodbye to clickops. Say hello to autonomous protection.
The post Design, implement, and deploy application protection policies with Cursor Agent | Impart Security appeared first on Security Boulevard.
CISA, the FBI, and NSA issued an advisory about the national security threat posed by "fast flux," a technique used by threat actors to evade detection of their C2 infrastructures that has been around for two decades but has seen a resurgence in use by ransomware gangs and nation-state bad actors.
The post Longtime ‘Fast Flux’ Evasion Technique Now a National Security Threat appeared first on Security Boulevard.
Check out the security controls that SANS Institute says are essential for protecting your AI systems. Plus, the U.K. NCSC urges organizations to adopt newer API security techniques. In addition, CISA and other cyber agencies warn that attackers are using “fast flux” techniques to conceal their actions. And much more!
Dive into five things that are top of mind for the week ending April 4.
1 - SANS: Six critical controls for securing AI systemsHow do you protect the growing number of artificial intelligence (AI) systems your organization is gleefully deploying to improve business operations?
That’s a critical question cybersecurity teams grapple with every day. In an effort to help bring clarity to this issue, SANS Institute this week published draft guidelines for AI system security.
The “SANS Draft Critical AI Security Guidelines v1.1” document outlines these six key security control categories for mitigating AI systems' cyber risks.
“By prioritizing security and compliance, organizations can ensure their AI-driven innovations remain effective and safe in this complex, ever-evolving landscape,” the document reads.
In addition to the six critical security controls, SANS also offers advice for deploying AI models, recommending that organizations do it gradually and incrementally, starting with non-critical systems; that they establish a central AI governance board; and that they draft an AI incident response plan.
For more information about securing AI systems against cyberattacks, check out these Tenable resources:
Organizations must update their methods for securing their application programming interfaces (APIs), including by using stronger authentication.
So said the U.K. National Cyber Security Centre (NCSC) this week in a new guidance document titled “Securing HTTP-based APIs,” published in the wake of several high-profile API breaches.
“Strengthening API security should not simply be seen as a protective measure; it can also enable organisations to enhance agility, simplicity and productivity,” reads a companion NCSC blog titled “New guidance on securing HTTP-based APIs.”
Unfortunately, many organizations rely on outdated API-security practices, including:
NCSC offers detailed recommendations to boost the security of your HTTP-based APIs in areas including:
For example, NCSC recommends adopting strong authentication frameworks like OAuth 2.0 or token-based authentication. It also suggests doing a threat modeling analysis of your API design.
Another recommendation is to develop APIs’ applications in a secure development and delivery environment; and to use secure standards, such as JSON for data exchange and TLS cryptography for in-transit data.
For more information about API security:
Cyber attackers are leveraging a technique called “fast flux” to evade detection and conceal their actions, so critical infrastructure organizations, internet service providers and governments must prioritize addressing this critical threat.
The warning comes via a joint cybersecurity advisory issued this week by the governments of Australia, Canada, New Zealand and the U.S.
“Fast flux represents a persistent threat to network security, leveraging rapidly changing infrastructure to obfuscate malicious activity,” reads the advisory, titled “Fast Flux: A National Security Threat.”
“By implementing robust detection and mitigation strategies, organizations can significantly reduce their risk of compromise by fast flux-enabled threats,” the document adds.
A type of dynamic resolution technique, “fast flux” allows cyber criminals, nation-state actors and other cyber attackers to:
Governments, critical infrastructure organizations, ISPs, cybersecurity service providers and protective DNS service providers should take “a multi-layered approach to detection and mitigation to reduce risk of compromise by fast flux-enabled threats,” reads an alert from the U.S. Cybersecurity and Infrastructure Security Agency (CISA).
“Fast flux” mitigation recommendations include:
Agencies that co-authored this advisory include CISA, the U.S. Federal Bureau of Investigation (FBI), the Australian Cyber Security Centre, the Canadian Centre for Cyber Security and New Zealand’s Nation Cyber Security Centre.
For more information about the “fast flux” technique:
During a recent webinar about our Tenable Web Application Scanning product, we polled attendees about their API security practices, including API discovery and protection. Check out what they said.
(41 webinar attendees polled by Tenable, April 2025)
(38 webinar attendees polled by Tenable, April 2025)
To learn more about API security and about what’s new in Tenable Web Application Scanning, watch the webinar on demand.
5 - U.S. House looks at cybersecurity of local, state governmentsA U.S. House of Representatives subcommittee held a hearing this week about the ability of U.S. state, local, tribal and territorial (SLTT) governments to address rapidly-changing cyber threats.
Also discussed: The future of the “State and Local Cybersecurity Grant Program” (SLCGP), which was established in 2021 to help boost SLTT governments’ cybersecurity preparedness and which is set to expire in September.
“Cybersecurity is a whole-of-society challenge, meaning the Federal government must continue to support and strengthen cybersecurity at the state and local levels to protect our nation’s networks and critical infrastructure,” said Rep. Andrew Garbarino (R-NY), Chairman of the House Subcommittee on Cybersecurity and Infrastructure Protection.
Tenable Chief Security Officer Robert Huber was one of four experts who testified during the hearing, titled “Cybersecurity is Local, Too: Assessing the State and Local Cybersecurity Grant Program.”
Huber, who is also Tenable’s Head of Research and President of Tenable Public Sector, emphasized the importance of the SLCGP in strengthening cybersecurity and critical infrastructure, while recommending grant process improvements to increase participation.
Check out a few minutes of Huber’s participation in the hearing:
For more information about cybersecurity challenges of state and local governments:
The post Cybersecurity Snapshot: SANS Recommends Six Controls To Secure AI Systems, While NCSC Warns About Outdated API Security Methods appeared first on Security Boulevard.
Vulnerability assessment is a process that identifies security weaknesses of any IT system, network, application, or cloud environment. It is a proactive approach to detect and fix security gaps before...
The post The Ultimate Guide to Vulnerability Assessment appeared first on Strobes Security.
The post The Ultimate Guide to Vulnerability Assessment appeared first on Security Boulevard.
Q1 Goals to Gaps in Security: The Rise of HR-Themed Phishing
The post Q1 Goals to Gaps in Security: The Rise of HR-Themed Phishing appeared first on Security Boulevard.
Artificial Intelligence (AI) has quickly become an integral part of modern workflows, with AI-powered applications like copilots, chatbots, and large-scale language models streamlining automation, decision-making, and data processing. However, these same tools introduce significant security risks—often in ways organizations fail to anticipate.
The post The Fast Flux DNS Threat: A Call to Action Against a Geopolitical and Hacktivist Nightmare appeared first on Security Boulevard.
The post 5 Reasons to Secure Firmware in Financial Services Organizations appeared first on Eclypsium | Supply Chain Security for the Modern Enterprise.
The post 5 Reasons to Secure Firmware in Financial Services Organizations appeared first on Security Boulevard.
Are You Truly Equipped to Tame Secrets Sprawl? Managing secrets sprawl is no trifling matter. A significant challenge lying in the labyrinth of cloud security, secrets sprawl could pose a hefty risk to your organization’s data security. So, are you fully geared to combat this beast? Decoding Secrets Sprawl: An Invisible Threat Secrets sprawl refers […]
The post Are You Capable of Handling Secrets Sprawl? appeared first on Entro.
The post Are You Capable of Handling Secrets Sprawl? appeared first on Security Boulevard.
Why Should You Be Excited About Innovations in Identity and Access Management (IAM)? If you’re a Cybersecurity professional or CISO, you understand the value of Non-Human Identities (NHI) and Secrets Management. The burning question, then, is “Why should you be excited about innovations in IAM?” IAM, or Identity and Access Management, is a critical piece […]
The post Get Excited About Innovations in IAM appeared first on Entro.
The post Get Excited About Innovations in IAM appeared first on Security Boulevard.
Strengthened Cloud Compliance: Why Machine Identities Hold the Key? The importance of robust cybersecurity practices and tools cannot be overstressed. One area that demands particular attention is the management of Non-Human Identities (NHIs) and secret security, which is critical for ensuring the highest level of compliance assurance. Unraveling the Concept of Non-Human Identities and Secrets […]
The post Feel Assured with Enhanced Cloud Compliance appeared first on Entro.
The post Feel Assured with Enhanced Cloud Compliance appeared first on Security Boulevard.
See how a top retailer protected revenue and customer trust during a major spring sale — with faster checkouts and zero downtime.
The post How to Protect Your Spring Sale from Bots appeared first on Security Boulevard.
DataDome stopped a 28M-request Flash DDoS in real time—no downtime or disruption for the $3B e-commerce platform under attack.
The post How DataDome Instantly Blocked a 28M-Request Flash DDoS Attack For a $3B E-Commerce Leader appeared first on Security Boulevard.
Author/Presenter: Anthony Hendricks
Our sincere appreciation to BSidesLV, and the Presenters/Authors for publishing their erudite Security BSidesLV24 content. Originating from the conference’s events located at the Tuscany Suites & Casino; and via the organizations YouTube channel.
The post BSidesLV24 – HireGround – You Need a Jay-z and a Beyoncé: How Sponsors and Mentors Can Supercharge Your Career in Cybersecurity appeared first on Security Boulevard.
Discover how Kaseya 365 User enhances end-user protection and prevents threats before they cause damage.
The post Protecting Users: Prevent and Stop Cyberthreats Before They Start With Kaseya 365 User appeared first on Kaseya.
The post Protecting Users: Prevent and Stop Cyberthreats Before They Start With Kaseya 365 User appeared first on Security Boulevard.
via the comic humor & dry wit of Randall Munroe, creator of XKCD
The post Randall Munroe’s XKCD ‘Rock Identification’ appeared first on Security Boulevard.
CISO mind maps are helpful, but they reinforce a tactical view of security. Learn why modern CISOs need a new mental model focused on strategy, value, and board-level impact.
The post CISO Transformation: It’s Time for a New Mental Model first appeared on Identient.
The post CISO Transformation: It’s Time for a New Mental Model appeared first on Security Boulevard.
MFA Fatigue Attacks on the Rise Yet another challenge is undermining the effectiveness of MFA: MFA fatigue attacks. In an MFA fatigue attack (sometimes also referred to as an “MFA bombing” or “push bombing” attack), a hacker who already possesses a valid username and password bombards the rightful user with repeated MFA login approval requests […]
The post Stopping MFA Fatigue Attacks Before They Start: Securing Your Entry Points appeared first on Security Boulevard.
