CISA - Security Ticks

CISA Warns Organizations of Exploited Vulnerability Affecting .NET, Visual Studio

.NET, CISA, Featured, Microsoft, Vulnerabilities, Zero-Day / SecurityTicks

CISA Warns Organizations of Exploited Vulnerability Affecting .NET, Visual Studio 10/08/2023 at 12:33 By Eduard Kovacs CISA has added CVE-2023-38180, a zero-day vulnerability affecting .NET and Visual Studio, to its Known Exploited Vulnerabilities Catalog. The post CISA Warns Organizations of Exploited Vulnerability Affecting .NET, Visual Studio appeared first on SecurityWeek. This article is an excerpt […]

React to this headline:

CISA Warns Organizations of Exploited Vulnerability Affecting .NET, Visual Studio Read More »

Learning from past healthcare breaches to fortify future cybersecurity strategies

Centura Health, CISA, cybercrime, cybersecurity, data, data breach, Don't miss, Features, Health3PT, healthcare, HITRUST, Hot stuff, legacy technology, News, opinion / SecurityTicks

Learning from past healthcare breaches to fortify future cybersecurity strategies 10/08/2023 at 07:02 By Help Net Security In the face of rising cyber threats, the healthcare sector has become a hotbed for cyberattacks. Given the gravity of this situation, we sat down with Shenny Sheth, Deputy CISO at Centura Health, who sheds light on the

React to this headline:

Learning from past healthcare breaches to fortify future cybersecurity strategies Read More »

CISA Unveils Cybersecurity Strategic Plan for Next 3 Years

CISA, Government, Management & Strategy / SecurityTicks

CISA Unveils Cybersecurity Strategic Plan for Next 3 Years 07/08/2023 at 16:20 By Eduard Kovacs CISA has unveiled its Cybersecurity Strategic Plan for the next 3 years, focusing on addressing immediate threats, hardening the terrain, and driving security. The post CISA Unveils Cybersecurity Strategic Plan for Next 3 Years appeared first on SecurityWeek. This article

React to this headline:

CISA Unveils Cybersecurity Strategic Plan for Next 3 Years Read More »

Top 12 vulnerabilities routinely exploited in 2022

ACSC, CISA, Don't miss, exploit, FBI, Hot stuff, NCSC, News, trends, vulnerability / SecurityTicks

Top 12 vulnerabilities routinely exploited in 2022 04/08/2023 at 16:31 By Helga Labus Cybersecurity agencies from member countries of the Five Eyes intelligence alliance have released a list of the top 12 vulnerabilities routinely exploited in 2022, plus 30 additional ones also “popular” with attackers. The top 12 “In 2022, malicious cyber actors exploited older

React to this headline:

Top 12 vulnerabilities routinely exploited in 2022 Read More »

August 2023 Patch Tuesday forecast: Software security improvements

Adobe, apple, CISA, Don't miss, Expert analysis, FIRST, Hot stuff, Ivanti, Microsoft, Mozilla, News, Patch Tuesday / SecurityTicks

August 2023 Patch Tuesday forecast: Software security improvements 04/08/2023 at 12:17 By Help Net Security The continued onslaught of phishing attacks, ransomware deployment, and other exploitation is forcing the community to pay closer attention to early identification, as well as fast response, to vulnerabilities in their software. In July alone Microsoft addressed 84 CVEs in

React to this headline:

August 2023 Patch Tuesday forecast: Software security improvements Read More »

New persistent backdoor used in attacks on Barracuda ESG appliances

backdoor, Barracuda Networks, CISA, Don't miss, exploit, Hot stuff, News, vulnerability / SecurityTicks

New persistent backdoor used in attacks on Barracuda ESG appliances 31/07/2023 at 13:32 By Helga Labus The Cybersecurity and Infrastructure Agency (CISA) has published an analysis report on the backdoors dropped by attackers exploiting CVE-2023-2868, a remote command injection vulnerability in Barracuda Email Security Gateway (ESG) appliances. Barracuda ESG zero-day exploit and backdoors In late

React to this headline:

New persistent backdoor used in attacks on Barracuda ESG appliances Read More »

Head of US Cybersecurity Agency Sees Progress on Election Security, With More Work Needed for 2024

CISA, Election, Government / SecurityTicks

Head of US Cybersecurity Agency Sees Progress on Election Security, With More Work Needed for 2024 27/07/2023 at 19:16 By Associated Press CISA Director Jen Easterly says more is needed to defend the integrity and resiliency of the election process ahead of the 2024 election. The post Head of US Cybersecurity Agency Sees Progress on

React to this headline:

Head of US Cybersecurity Agency Sees Progress on Election Security, With More Work Needed for 2024 Read More »

Citrix ADC zero-day exploitatation: CISA releases details about attack on CI organization (CVE-2023-3519)

0-day, CISA, Citrix, critical infrastructure, Don't miss, GreyNoise, Hot stuff, Incident Response, News / SecurityTicks

Citrix ADC zero-day exploitatation: CISA releases details about attack on CI organization (CVE-2023-3519) 21/07/2023 at 14:19 By Zeljka Zorz The exploitation of the Citrix NetScaler ADC zero-day vulnerability (CVE-2023-3519) was first spotted by a critical infrastructure organization, who reported it to the Cybersecurity and Infrastructure Security Agency (CISA). “In June 2023, threat actors exploited this

React to this headline:

Citrix ADC zero-day exploitatation: CISA releases details about attack on CI organization (CVE-2023-3519) Read More »

Thanks Storm-0558! Microsoft to expand default access to cloud logs

APT, CISA, cloud security, Don't miss, enterprise, Government, government-backed attacks, Hot stuff, logging, Microsoft, Microsoft 365, News / SecurityTicks

Thanks Storm-0558! Microsoft to expand default access to cloud logs 20/07/2023 at 13:31 By Zeljka Zorz Starting in September 2023, more federal government and commercial Microsoft customers will have access to expanded cloud logging capabilities at no additional charge, Microsoft and the Cybersecurity and Infrastructure Security Agency (CISA) have announced on Wednesday. The announcements come

React to this headline:

Thanks Storm-0558! Microsoft to expand default access to cloud logs Read More »

Microsoft Bows to Pressure to Free Up Cloud Security Logs

China APT, CISA, cloud security, Data Breaches, Government, M365, Microsoft / SecurityTicks

Microsoft Bows to Pressure to Free Up Cloud Security Logs 19/07/2023 at 19:49 By Ryan Naraine Facing intense pressure after Chinese APT hack, Microsoft plans to expand logging defaults for lower-tier M365 customers. The post Microsoft Bows to Pressure to Free Up Cloud Security Logs appeared first on SecurityWeek. This article is an excerpt from

React to this headline:

Microsoft Bows to Pressure to Free Up Cloud Security Logs Read More »

U.S. Cyber Trust Mark labeling program raises the bar for smart devices’ cybersecurity

certification, CISA, Closed Door Security, cybersecurity, Government, hardware, News, NIST, Privacy, regulation, USA / SecurityTicks

U.S. Cyber Trust Mark labeling program raises the bar for smart devices’ cybersecurity 19/07/2023 at 13:33 By Help Net Security The Biden-Harris Administration has announced a cybersecurity certification and labeling program to help Americans more easily choose smart devices that are safer and less vulnerable to cyberattacks. The new “U.S. Cyber Trust Mark” program proposed

React to this headline:

U.S. Cyber Trust Mark labeling program raises the bar for smart devices’ cybersecurity Read More »

Exploit Code Published for Remote Root Flaw in VMware Logging Software

Application Security, CISA, CVE-2023-20864, Network Security, VMWare, VMware aria Operations for Logs, vrealize, Vulnerabilities / SecurityTicks

Exploit Code Published for Remote Root Flaw in VMware Logging Software 10/07/2023 at 23:02 By Ryan Naraine VMware confirmed that exploit code for CVE-2023-20864 has been published, underscoring the urgency for enterprise network admins to apply available patches. The post Exploit Code Published for Remote Root Flaw in VMware Logging Software appeared first on SecurityWeek.

React to this headline:

Exploit Code Published for Remote Root Flaw in VMware Logging Software Read More »

Samsung Phone Flaws Added to CISA ‘Must Patch’ List Likely Exploited by Spyware Vendor

CISA, exploited, Mobile & Wireless, Samsung, Vulnerabilities / SecurityTicks

Samsung Phone Flaws Added to CISA ‘Must Patch’ List Likely Exploited by Spyware Vendor 30/06/2023 at 16:18 By Eduard Kovacs CISA adds 6 Samsung mobile device flaws to its known exploited vulnerabilities catalog and they have likely been exploited by a spyware vendor. The post Samsung Phone Flaws Added to CISA ‘Must Patch’ List Likely

React to this headline:

Samsung Phone Flaws Added to CISA ‘Must Patch’ List Likely Exploited by Spyware Vendor Read More »

Hundreds of Devices With Internet-Exposed Management Interface Found in US Agencies

BOD, CISA, Risk Management / SecurityTicks

Hundreds of Devices With Internet-Exposed Management Interface Found in US Agencies 27/06/2023 at 17:03 By Ionut Arghire Censys identified hundreds of devices within US federal agencies’ networks that expose their management interface to the internet. The post Hundreds of Devices With Internet-Exposed Management Interface Found in US Agencies appeared first on SecurityWeek. This article is

React to this headline:

Hundreds of Devices With Internet-Exposed Management Interface Found in US Agencies Read More »

CISA Tells US Agencies to Patch Exploited Roundcube, VMware Flaws

and CVE-2021-44026, CISA, CVE-2020-12641, CVE-2020-35730, Government, Incident Response, KEV catalog, Vulnerabilities / SecurityTicks

CISA Tells US Agencies to Patch Exploited Roundcube, VMware Flaws 23/06/2023 at 18:43 By Ionut Arghire The US government’s cybersecurity agency adds VMware and Roundcube server flaws to its Known Exploited Vulnerabilities (KEV) catalog. The post CISA Tells US Agencies to Patch Exploited Roundcube, VMware Flaws appeared first on SecurityWeek. This article is an excerpt

React to this headline:

CISA Tells US Agencies to Patch Exploited Roundcube, VMware Flaws Read More »

Enphase Ignores CISA Request to Fix Remotely Exploitable Flaws

CISA, Enphase, ICS/OT, IoT Security, Vulnerabilities / SecurityTicks

Enphase Ignores CISA Request to Fix Remotely Exploitable Flaws 21/06/2023 at 19:14 By Ionut Arghire Enphase Energy has ignored CISA requests to fix remotely exploitable vulnerabilities in Enphase products. The post Enphase Ignores CISA Request to Fix Remotely Exploitable Flaws appeared first on SecurityWeek. This article is an excerpt from SecurityWeek RSS Feed View Original

React to this headline:

Enphase Ignores CISA Request to Fix Remotely Exploitable Flaws Read More »

CISA Instructs Federal Agencies to Secure Internet-Exposed Devices

CISA, Government, Government Policy, Identity & Access / SecurityTicks

CISA Instructs Federal Agencies to Secure Internet-Exposed Devices 14/06/2023 at 17:58 By Ionut Arghire CISA’s Binding Operational Directive 23-02 requires federal agencies to secure the network management interfaces of certain classes of devices. The post CISA Instructs Federal Agencies to Secure Internet-Exposed Devices appeared first on SecurityWeek. This article is an excerpt from SecurityWeek RSS

React to this headline:

CISA Instructs Federal Agencies to Secure Internet-Exposed Devices Read More »

Beyond MFA: 3 steps to improve security and reduce customer authentication friction

authentication, CISA, Don't miss, Expert analysis, Expert corner, F5 Networks, GDPR, Hot stuff, identity, identity verification, MFA, opinion, PCI DSS / SecurityTicks

Beyond MFA: 3 steps to improve security and reduce customer authentication friction 14/06/2023 at 07:42 By Help Net Security For many people, life’s fundamental activities are now conducted online. We do our banking and shopping online, turn to the digital realm for entertainment and to access medical records, and pursue our romantic interests via dating

React to this headline:

Beyond MFA: 3 steps to improve security and reduce customer authentication friction Read More »

20 cybersecurity projects on GitHub you should check out

ARMO, CISA, cybersecurity, Don't miss, Faraday Technology Corporation, GitHub, Google, Hot stuff, Metasploit, MISP, MITRE ATT&CK, News, open source, software / SecurityTicks

20 cybersecurity projects on GitHub you should check out 08/06/2023 at 07:47 By Helga Labus Open-source GitHub cybersecurity projects, developed and maintained by dedicated contributors, provide valuable tools, frameworks, and resources to enhance security practices. From vulnerability scanning and network monitoring to encryption and incident response, the following collection encompasses a diverse range of projects

React to this headline:

20 cybersecurity projects on GitHub you should check out Read More »

ON2IT adds CISA Zero Trust Maturity Model to AUXO cloud platform

CISA, Industry news, ON2IT / SecurityTicks

ON2IT adds CISA Zero Trust Maturity Model to AUXO cloud platform 02/06/2023 at 16:54 By Industry News ON2IT announces the addition of the CISA Zero Trust Maturity Model into its Zero Trust as a Service platform, AUXO. Organizations can use ON2IT’s Zero Trust as a Service platform to strengthen cyber defenses and easily embrace Zero

React to this headline:

ON2IT adds CISA Zero Trust Maturity Model to AUXO cloud platform Read More »