CISA - Security Ticks

CISA Releases New Identity and Access Management Guidance

CISA, Government, IAM, identity, Identity & Access, Security Architecture / SecurityTicks

CISA Releases New Identity and Access Management Guidance 18/09/2023 at 15:03 By Ionut Arghire CISA has released new guidance on how federal agencies can integrate identity and access management into their ICAM architecture. The post CISA Releases New Identity and Access Management Guidance appeared first on SecurityWeek. This article is an excerpt from SecurityWeek RSS […]

React to this headline:

CISA Releases New Identity and Access Management Guidance Read More »

US Agencies Publish Cybersecurity Report on Deepfake Threats

CISA, deepfake, Fraud & Identity Theft, guidance, Management & Strategy / SecurityTicks

US Agencies Publish Cybersecurity Report on Deepfake Threats 13/09/2023 at 18:49 By Eduard Kovacs CISA, FBI and NSA have published a cybersecurity report on deepfakes and recommendations for identifying and responding to such threats. The post US Agencies Publish Cybersecurity Report on Deepfake Threats appeared first on SecurityWeek. This article is an excerpt from SecurityWeek

React to this headline:

US Agencies Publish Cybersecurity Report on Deepfake Threats Read More »

US Aeronautical Organization Hacked via Zoho, Fortinet Vulnerabilities

CISA, Cyberwarfare, Malware & Threats / SecurityTicks

US Aeronautical Organization Hacked via Zoho, Fortinet Vulnerabilities 08/09/2023 at 13:33 By Ionut Arghire APTs exploited vulnerabilities in Zoho ManageEngine and Fortinet VPNs to hack an aerospace organization in early January 2023. The post US Aeronautical Organization Hacked via Zoho, Fortinet Vulnerabilities appeared first on SecurityWeek. This article is an excerpt from SecurityWeek RSS Feed

React to this headline:

US Aeronautical Organization Hacked via Zoho, Fortinet Vulnerabilities Read More »

CISA Releases Guidance on Adopting DDoS Mitigations

CISA, DDoS, Government, guidance / SecurityTicks

CISA Releases Guidance on Adopting DDoS Mitigations 07/09/2023 at 17:48 By Ionut Arghire CISA has released new guidance to help federal agencies decide upon and prioritize DDoS mitigations based on mission and reputational impact. The post CISA Releases Guidance on Adopting DDoS Mitigations appeared first on SecurityWeek. This article is an excerpt from SecurityWeek RSS

React to this headline:

CISA Releases Guidance on Adopting DDoS Mitigations Read More »

MITRE Caldera for OT now available as extension to open-source platform

CISA, critical infrastructure, DHS, GitHub, HSSEDI, MITRE, News, open source, USA / SecurityTicks

MITRE Caldera for OT now available as extension to open-source platform 06/09/2023 at 09:32 By Help Net Security MITRE Caldera for OT is now publicly available as an extension to the open-source Caldera platform, allowing security teams to run automated adversary emulation exercises that are specifically focused on threats to operational technology (OT). The first

React to this headline:

MITRE Caldera for OT now available as extension to open-source platform Read More »

CISA Hires ‘Mudge’ to Work on Security-by-Design Principles

CISA, CISO Strategy, Government, Mudge, National Cybersecurity Strategy, Security Architecture, Twitter / SecurityTicks

CISA Hires ‘Mudge’ to Work on Security-by-Design Principles 05/09/2023 at 21:47 By Ryan Naraine Peiter ‘Mudge’ Zatko joins the US government’s cybersecurity agency to preach the gospel of security-by-design and secure-by-default development principles. The post CISA Hires ‘Mudge’ to Work on Security-by-Design Principles appeared first on SecurityWeek. This article is an excerpt from SecurityWeek RSS

React to this headline:

CISA Hires ‘Mudge’ to Work on Security-by-Design Principles Read More »

MITRE and CISA Release Open Source Tool for OT Attack Emulation

CISA, ICS, ICS/OT, MITRE, OT / SecurityTicks

MITRE and CISA Release Open Source Tool for OT Attack Emulation 05/09/2023 at 18:18 By Ionut Arghire MITRE and CISA introduce Caldera for OT, a new extension to help security teams emulate attacks targeting operational technology systems. The post MITRE and CISA Release Open Source Tool for OT Attack Emulation appeared first on SecurityWeek. This

React to this headline:

MITRE and CISA Release Open Source Tool for OT Attack Emulation Read More »

Exploit Code Published for Critical-Severity VMware Security Defect

Aria Operations for Networks, CISA, CVE-2023-34039, ICS/OT, Network Security, VMWare, Vulnerabilities / SecurityTicks

Exploit Code Published for Critical-Severity VMware Security Defect 02/09/2023 at 02:22 By Ryan Naraine Exploit code and root-cause analysis released by SinSinology documents the problem as a case where VMWare “forgot to regenerate” SSH keys. The post Exploit Code Published for Critical-Severity VMware Security Defect appeared first on SecurityWeek. This article is an excerpt from

React to this headline:

Exploit Code Published for Critical-Severity VMware Security Defect Read More »

CISA Releases Cyber Defense Plan to Reduce RMM Software Risks

CISA, Government, Identity & Access, Management & Strategy / SecurityTicks

CISA Releases Cyber Defense Plan to Reduce RMM Software Risks 17/08/2023 at 14:32 By Ionut Arghire CISA has published a cyber defense plan outlining strategies to help critical infrastructure organizations reduce the risks associated with RMM software. The post CISA Releases Cyber Defense Plan to Reduce RMM Software Risks appeared first on SecurityWeek. This article

React to this headline:

CISA Releases Cyber Defense Plan to Reduce RMM Software Risks Read More »

Black Hat USA 2023 video walkthrough

1Password, Aqua Security, Black Hat, Black Hat USA 2023, CISA, Cisco, conferences, CyberFOX, Darktrace, Dasera, Don't miss, Fortanix, Fortinet, Fortra, Hot stuff, HUMAN Security, Illumio, ManageEngine, Mimecast, NetSPI, Palo Alto Networks, Proofpoint, SentinelOne, Sophos, Tenable, Trellix, Uptycs, Video, VMWare, Wiz, Zimperium / SecurityTicks

Black Hat USA 2023 video walkthrough 11/08/2023 at 15:04 By Help Net Security Help Net Security is in Las Vegas this week for Black Hat USA 2023, and this video provides a closer look at the event. The exhibitors featured in this video are: 1Password, Aqua Security, CISA, Cisco, CyberFOX, Darktrace, Dasera, Fortanix, Fortinet, Fortra,

React to this headline:

Black Hat USA 2023 video walkthrough Read More »

CISA Warns Organizations of Exploited Vulnerability Affecting .NET, Visual Studio

.NET, CISA, Featured, Microsoft, Vulnerabilities, Zero-Day / SecurityTicks

CISA Warns Organizations of Exploited Vulnerability Affecting .NET, Visual Studio 10/08/2023 at 12:33 By Eduard Kovacs CISA has added CVE-2023-38180, a zero-day vulnerability affecting .NET and Visual Studio, to its Known Exploited Vulnerabilities Catalog. The post CISA Warns Organizations of Exploited Vulnerability Affecting .NET, Visual Studio appeared first on SecurityWeek. This article is an excerpt

React to this headline:

CISA Warns Organizations of Exploited Vulnerability Affecting .NET, Visual Studio Read More »

Learning from past healthcare breaches to fortify future cybersecurity strategies

Centura Health, CISA, cybercrime, cybersecurity, data, data breach, Don't miss, Features, Health3PT, healthcare, HITRUST, Hot stuff, legacy technology, News, opinion / SecurityTicks

Learning from past healthcare breaches to fortify future cybersecurity strategies 10/08/2023 at 07:02 By Help Net Security In the face of rising cyber threats, the healthcare sector has become a hotbed for cyberattacks. Given the gravity of this situation, we sat down with Shenny Sheth, Deputy CISO at Centura Health, who sheds light on the

React to this headline:

Learning from past healthcare breaches to fortify future cybersecurity strategies Read More »

CISA Unveils Cybersecurity Strategic Plan for Next 3 Years

CISA, Government, Management & Strategy / SecurityTicks

CISA Unveils Cybersecurity Strategic Plan for Next 3 Years 07/08/2023 at 16:20 By Eduard Kovacs CISA has unveiled its Cybersecurity Strategic Plan for the next 3 years, focusing on addressing immediate threats, hardening the terrain, and driving security. The post CISA Unveils Cybersecurity Strategic Plan for Next 3 Years appeared first on SecurityWeek. This article

React to this headline:

CISA Unveils Cybersecurity Strategic Plan for Next 3 Years Read More »

Top 12 vulnerabilities routinely exploited in 2022

ACSC, CISA, Don't miss, exploit, FBI, Hot stuff, NCSC, News, trends, vulnerability / SecurityTicks

Top 12 vulnerabilities routinely exploited in 2022 04/08/2023 at 16:31 By Helga Labus Cybersecurity agencies from member countries of the Five Eyes intelligence alliance have released a list of the top 12 vulnerabilities routinely exploited in 2022, plus 30 additional ones also “popular” with attackers. The top 12 “In 2022, malicious cyber actors exploited older

React to this headline:

Top 12 vulnerabilities routinely exploited in 2022 Read More »

August 2023 Patch Tuesday forecast: Software security improvements

Adobe, apple, CISA, Don't miss, Expert analysis, FIRST, Hot stuff, Ivanti, Microsoft, Mozilla, News, Patch Tuesday / SecurityTicks

August 2023 Patch Tuesday forecast: Software security improvements 04/08/2023 at 12:17 By Help Net Security The continued onslaught of phishing attacks, ransomware deployment, and other exploitation is forcing the community to pay closer attention to early identification, as well as fast response, to vulnerabilities in their software. In July alone Microsoft addressed 84 CVEs in

React to this headline:

August 2023 Patch Tuesday forecast: Software security improvements Read More »

New persistent backdoor used in attacks on Barracuda ESG appliances

backdoor, Barracuda Networks, CISA, Don't miss, exploit, Hot stuff, News, vulnerability / SecurityTicks

New persistent backdoor used in attacks on Barracuda ESG appliances 31/07/2023 at 13:32 By Helga Labus The Cybersecurity and Infrastructure Agency (CISA) has published an analysis report on the backdoors dropped by attackers exploiting CVE-2023-2868, a remote command injection vulnerability in Barracuda Email Security Gateway (ESG) appliances. Barracuda ESG zero-day exploit and backdoors In late

React to this headline:

New persistent backdoor used in attacks on Barracuda ESG appliances Read More »

Head of US Cybersecurity Agency Sees Progress on Election Security, With More Work Needed for 2024

CISA, Election, Government / SecurityTicks

Head of US Cybersecurity Agency Sees Progress on Election Security, With More Work Needed for 2024 27/07/2023 at 19:16 By Associated Press CISA Director Jen Easterly says more is needed to defend the integrity and resiliency of the election process ahead of the 2024 election. The post Head of US Cybersecurity Agency Sees Progress on

React to this headline:

Head of US Cybersecurity Agency Sees Progress on Election Security, With More Work Needed for 2024 Read More »

Citrix ADC zero-day exploitatation: CISA releases details about attack on CI organization (CVE-2023-3519)

0-day, CISA, Citrix, critical infrastructure, Don't miss, GreyNoise, Hot stuff, Incident Response, News / SecurityTicks

Citrix ADC zero-day exploitatation: CISA releases details about attack on CI organization (CVE-2023-3519) 21/07/2023 at 14:19 By Zeljka Zorz The exploitation of the Citrix NetScaler ADC zero-day vulnerability (CVE-2023-3519) was first spotted by a critical infrastructure organization, who reported it to the Cybersecurity and Infrastructure Security Agency (CISA). “In June 2023, threat actors exploited this

React to this headline:

Citrix ADC zero-day exploitatation: CISA releases details about attack on CI organization (CVE-2023-3519) Read More »

Thanks Storm-0558! Microsoft to expand default access to cloud logs

APT, CISA, cloud security, Don't miss, enterprise, Government, government-backed attacks, Hot stuff, logging, Microsoft, Microsoft 365, News / SecurityTicks

Thanks Storm-0558! Microsoft to expand default access to cloud logs 20/07/2023 at 13:31 By Zeljka Zorz Starting in September 2023, more federal government and commercial Microsoft customers will have access to expanded cloud logging capabilities at no additional charge, Microsoft and the Cybersecurity and Infrastructure Security Agency (CISA) have announced on Wednesday. The announcements come

React to this headline:

Thanks Storm-0558! Microsoft to expand default access to cloud logs Read More »

Microsoft Bows to Pressure to Free Up Cloud Security Logs

China APT, CISA, cloud security, Data Breaches, Government, M365, Microsoft / SecurityTicks

Microsoft Bows to Pressure to Free Up Cloud Security Logs 19/07/2023 at 19:49 By Ryan Naraine Facing intense pressure after Chinese APT hack, Microsoft plans to expand logging defaults for lower-tier M365 customers. The post Microsoft Bows to Pressure to Free Up Cloud Security Logs appeared first on SecurityWeek. This article is an excerpt from

React to this headline:

Microsoft Bows to Pressure to Free Up Cloud Security Logs Read More »