News - Security Ticks

Katie Boswell on AI security and women’s rise in cybersecurity

Artificial Intelligence, CISO, Cybellum, cybersecurity, KPMG, News, NIST, podcast, strategy, tips / SecurityTicks

Katie Boswell on AI security and women’s rise in cybersecurity 05/06/2023 at 05:45 By Help Net Security Katie Boswell spent years on the front lines securing the most critical national infrastructure in energy and life sciences. Yet, earlier in her career, she was told that senior leadership was not for her if she planned on […]

React to this headline:

Katie Boswell on AI security and women’s rise in cybersecurity Read More »

Week in review: MOVEit Transfer critical zero-day vulnerability, Kali Linux 2023.2 released

News, Week in review / SecurityTicks

Week in review: MOVEit Transfer critical zero-day vulnerability, Kali Linux 2023.2 released 04/06/2023 at 11:03 By Help Net Security Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: MOVEit Transfer zero-day attacks: The latest info Progress Software has updated the security advisory and confirmed that the vulnerability (still without

React to this headline:

Week in review: MOVEit Transfer critical zero-day vulnerability, Kali Linux 2023.2 released Read More »

Google triples reward for Chrome full chain exploits

bug bounty, Chrome, Don't miss, exploit, Google, Hot stuff, News, sandbox / SecurityTicks

Google triples reward for Chrome full chain exploits 02/06/2023 at 15:57 By Helga Labus Google has tripled the full reward amount for the first security bug report that includes a functional full chain exploit of its popular Chrome browser. Six months of higher rewards for a Chrome full chain exploit The Chrome Vulnerability Rewards Program,

React to this headline:

Google triples reward for Chrome full chain exploits Read More »

MOVEit Transfer zero-day attacks: The latest info

0-day, attack, data theft, Don't miss, enterprise, file-sharing, Hot stuff, Huntress, News, Progress, Rapid7, TrustedSec, vulnerability / SecurityTicks

MOVEit Transfer zero-day attacks: The latest info 02/06/2023 at 12:41 By Zeljka Zorz There’s new information about the zero-day vulnerability in Progress Software’s MOVEit Transfer solution exploited by attackers and – more importantly – patches and helpful instructions for customers. The MOVEit Transfer zero-day and updated mitigation and remediation advice Progress Software has updated the

React to this headline:

MOVEit Transfer zero-day attacks: The latest info Read More »

Qakbot: The trojan that just won’t go away

Don't miss, Hot stuff, Lumen, Malware, Microsoft, News, phishing, Ransomware, trojan, Windows / SecurityTicks

Qakbot: The trojan that just won’t go away 02/06/2023 at 11:33 By Helga Labus Qakbot (aka Qbot) – banking malware-turned-malware/ransomware distribution network – has been first observed in 2007 and is active to this day. The neverending adaptability of this threat is key to its long-term survival and success. “Qakbot operators tend to reduce or

React to this headline:

Qakbot: The trojan that just won’t go away Read More »

New infosec products of the week: June 2, 2023

Bitdefender, ConnectSecure, Cytracom, News, Permit.io, PingSafe / SecurityTicks

New infosec products of the week: June 2, 2023 02/06/2023 at 08:05 By Help Net Security Here’s a look at the most interesting products from the past week, featuring releases from Bitdefender, ConnectSecure, CYTRACOM, Permit.io, and PingSafe. Permit.io launches FoAz to give frontend developers the keys to security Short for frontend-only authorization, FoAz is a

React to this headline:

New infosec products of the week: June 2, 2023 Read More »

How defense contractors can move from cybersecurity to cyber resilience

attacks, Compliance, Conquest Cyber, cybercrime, cybersecurity, Don't miss, Expert analysis, Expert corner, Government, News, opinion, strategy / SecurityTicks

How defense contractors can move from cybersecurity to cyber resilience 02/06/2023 at 07:42 By Help Net Security As the world’s most powerful military and economic power, the United States also holds another, less impressive distinction: Cyber threat actors target the US more than any other country in the world. In 2022 alone, the FBI received

React to this headline:

How defense contractors can move from cybersecurity to cyber resilience Read More »

Cybercriminals use legitimate websites to obfuscate malicious payloads

cybercrime, Egress, email security, Malware, News, phishing, report, scams, social engineering, threat, threats / SecurityTicks

Cybercriminals use legitimate websites to obfuscate malicious payloads 02/06/2023 at 06:33 By Help Net Security According to Egress, the evolving attack methodologies currently used by cybercriminals are designed to get through traditional perimeter security. “The evolution of phishing emails continues to pose a major threat to organizations, emphasizing the need to enhance defenses to prevent

React to this headline:

Cybercriminals use legitimate websites to obfuscate malicious payloads Read More »

Despite cutbacks, IT salaries expected to rise

Artificial Intelligence, ChatGPT, digital transformation, InformationWeek, money, News / SecurityTicks

Despite cutbacks, IT salaries expected to rise 02/06/2023 at 06:01 By Help Net Security Despite rising labor costs, economic inflation, and companies making an effort to cut back, the salary outlook for IT professionals is positive, according to InformationWeek. Work-life balance and base pay top the list as what matters most to IT professionals regarding

React to this headline:

Despite cutbacks, IT salaries expected to rise Read More »

Critical zero-day vulnerability in MOVEit Transfer exploited by attackers!

0-day, attack, Don't miss, enterprise, file-sharing, Hot stuff, News, Progress, threat, vulnerability / SecurityTicks

Critical zero-day vulnerability in MOVEit Transfer exploited by attackers! 01/06/2023 at 18:18 By Zeljka Zorz A critical zero-day vulnerability in Progress Software’s enterprise managed file transfer solution MOVEit Transfer is being exploited by attackers to grab corporate data. “[The vulnerability] could lead to escalated privileges and potential unauthorized access to the environment,” the company warned

React to this headline:

Critical zero-day vulnerability in MOVEit Transfer exploited by attackers! Read More »

Threat actors can exfiltrate data from Google Drive without leaving a trace

digital forensics, Don't miss, enterprise, Google, Google Drive, Google Workspace, Hot stuff, Incident Response, Mitiga, News, SMBs, threat hunting / SecurityTicks

Threat actors can exfiltrate data from Google Drive without leaving a trace 01/06/2023 at 15:43 By Zeljka Zorz Google Workspace (formerly G Suite) has a weak spot that can prevent the discovery of data exfiltration from Google Drive by a malicious outsider or insider, Mitiga researchers say. A problem for digital forensic analysts and incident

React to this headline:

Threat actors can exfiltrate data from Google Drive without leaving a trace Read More »

Zyxel firewalls under attack by Mirai-like botnet

botnet, Censys, Don't miss, Europe, exploit, firewall, Hot stuff, News, PoC, Rapid7, Shadowserver, vulnerability, Zyxel / SecurityTicks

Zyxel firewalls under attack by Mirai-like botnet 01/06/2023 at 11:52 By Zeljka Zorz CVE-2023-28771, the critical command injection vulnerability affecting many Zyxel firewalls, is being actively exploited by a Mirai-like botnet, and has been added to CISA’s Known Exploited Vulnerabilities (KEV) catalog. About CVE-2023-28771 CVE-2023-28771 is a vulnerability that allows unauthenticated attackers to execute OS

React to this headline:

Zyxel firewalls under attack by Mirai-like botnet Read More »

Why organizations should adopt a cloud cybersecurity framework

Cloud, Don't miss, Expert analysis, Expert corner, framework, Information Security Forum, News, opinion, Risk Management / SecurityTicks

Why organizations should adopt a cloud cybersecurity framework 01/06/2023 at 08:16 By Help Net Security The cloud is the future of enterprise architecture. It’s economical (to a degree), it’s scalable, it’s flexible and – best of all – it’s someone else’s responsibility. Again, to a point. That’s because the cloud comes with its own set

React to this headline:

Why organizations should adopt a cloud cybersecurity framework Read More »

Navigating cybersecurity in the age of remote work

BYOD, CISO, cybersecurity, Don't miss, Features, Hot stuff, News, opinion, remote working, VPN, zero trust, Zscaler / SecurityTicks

Navigating cybersecurity in the age of remote work 01/06/2023 at 07:34 By Mirko Zorz In this Help Net Security interview, Jay Chaudhry, CEO at Zscaler, talks about connecting and securing remote employees and their devices to access organizational resources from any location. He discusses the potential risks of remote VPN access, the increasing reliance on

React to this headline:

Navigating cybersecurity in the age of remote work Read More »

Phishing campaigns thrive as evasive tactics outsmart conventional detection

cybercrime, cybercriminals, data, Email, Group-IB, News, phishing, report, scams / SecurityTicks

Phishing campaigns thrive as evasive tactics outsmart conventional detection 01/06/2023 at 06:21 By Help Net Security A 25% increase in the use of phishing kits has been recorded in 2022, according to Group-IB. The key phishing trends observed are the increasing use of access control and advanced detection evasion techniques. The rise in evasive tactics,

React to this headline:

Phishing campaigns thrive as evasive tactics outsmart conventional detection Read More »

Infosec products of the month: May 2023

Aqua Security, Axiado, Bitwarden, Cloudflare, ComplyAdvantage, Dashlane, Delinea, Enzoic, Feedzai, Immersive Labs, Intruder, Nebulon, Netscout, Neurotechnology, News, Nozomi Networks, OpenVPN, Private AI, Radware, Satori, Trua, Vanta, Veriff, Veza / SecurityTicks

Infosec products of the month: May 2023 01/06/2023 at 05:32 By Industry News Here’s a look at the most interesting products from the past month, featuring releases from: Aqua Security, Axiado, Bitwarden, Cloudflare, ComplyAdvantage, Dashlane, Delinea, Enzoic, Feedzai, Immersive Labs, Intruder, Nebulon, NETSCOUT, Neurotechnology, Nozomi Networks, OpenVPN, Private AI, Radware, Satori, Trua, Vanta, Veriff, and

React to this headline:

Infosec products of the month: May 2023 Read More »

Someone is roping Apache NiFi servers into a cryptomining botnet

Apache Nifi, cryptojacking, Don't miss, Hot stuff, News, SANS ISC / SecurityTicks

Someone is roping Apache NiFi servers into a cryptomining botnet 31/05/2023 at 16:51 By Zeljka Zorz If you’re running an Apache NiFi instance exposed on the internet and you have not secured access to it, the underlying host may already be covertly cryptomining on someone else’s behalf. The attack Indicators of the ongoing campaign were

React to this headline:

Someone is roping Apache NiFi servers into a cryptomining botnet Read More »

Zyxel patches vulnerability in NAS devices (CVE-2023-27988)

Don't miss, Hot stuff, NAS, News, security update, vulnerability, Zyxel / SecurityTicks

Zyxel patches vulnerability in NAS devices (CVE-2023-27988) 31/05/2023 at 14:51 By Helga Labus Zyxel has patched a high-severity authenticated command injection vulnerability (CVE-2023-27988) in some of its network attached storage (NAS) devices aimed at home users. About the vulnerability (CVE-2023-27988) The vulnerability was discovered in the devices’ web management interface. “An authenticated attacker with administrator

React to this headline:

Zyxel patches vulnerability in NAS devices (CVE-2023-27988) Read More »

How APTs target SMBs

APT, Don't miss, Hot stuff, MSP, News, phishing, Proofpoint, SMBs, supply chain attacks, trends / SecurityTicks

How APTs target SMBs 31/05/2023 at 13:47 By Helga Labus Small and medium businesses (SMBs) are not exempt from being targeted by advanced persistent threat (APT) actors, according to Proofpoint researchers. By analyzing a year’s worth of APT campaign data they collected from the 200,000+ SMBs that have their security solution deployed, they pinpointed three

React to this headline:

How APTs target SMBs Read More »

Kali Linux 2023.2 released: New tools, a pre-built Hyper-V image, a new audio stack, and more!

Don't miss, Hot stuff, Kali Linux, Linux, News, Offensive Security, open source, penetration testing / SecurityTicks

Kali Linux 2023.2 released: New tools, a pre-built Hyper-V image, a new audio stack, and more! 31/05/2023 at 10:29 By Zeljka Zorz Offensive Security has released Kali Linux 2023.2, the latest version of its popular penetration testing and digital forensics platform. New tools in Kali Linux 2023.2 Aside from updates for existing tools, a new

React to this headline:

Kali Linux 2023.2 released: New tools, a pre-built Hyper-V image, a new audio stack, and more! Read More »