News

One-third of dev professionals unfamiliar with secure coding practices

code, News, OpenSSF, report, software, software development, survey, The Linux Foundation, training /

One-third of dev professionals unfamiliar with secure coding practices 2024-07-19 at 07:01 By Help Net Security Attackers consistently discover and exploit software vulnerabilities, highlighting the increasing importance of robust software security, according to OpenSSF and the Linux Foundation. Despite this, many developers lack the essential knowledge and skills to effectively implement secure software development. Lack […]

One-third of dev professionals unfamiliar with secure coding practices Read More »

CISOs must shift from tactical defense to strategic leadership

CISO, cybersecurity, Ivanti, News, report, strategy, survey, threats, vulnerability management /

CISOs must shift from tactical defense to strategic leadership 2024-07-19 at 06:31 By Help Net Security Cyber threats are advancing quickly in size and sophistication, largely because of the rapid evolution of technology, increasing sophistication of cyber attackers, and the expansion of attack surfaces through interconnected systems and devices, according to Ivanti. Ivanti’s research shows […]

CISOs must shift from tactical defense to strategic leadership Read More »

New infosec products of the week: July 19, 2024

AuditBoard, BlueVoyant, Druva, Invicti Security, News, Rezonate /

New infosec products of the week: July 19, 2024 2024-07-19 at 06:01 By Help Net Security Here’s a look at the most interesting products from the past week, featuring releases from AuditBoard, BlueVoyant, Druva, Invicti Security, and Rezonate. AuditBoard’s self-assessment tools allow audit teams to maintain focus on their critical work AuditBoard launched out-of-the-box (OOTB) […]

New infosec products of the week: July 19, 2024 Read More »

Critical Splunk flaw can be exploited to grab passwords (CVE-2024-36991)

CVE, data analytics, Don't miss, enterprise, Hot stuff, News, security update, SonicWall, Splunk, vulnerability /

Critical Splunk flaw can be exploited to grab passwords (CVE-2024-36991) 2024-07-18 at 18:01 By Zeljka Zorz A recently fixed vulnerability (CVE-2024-36991) affecting Splunk Enterprise on Windows “is more severe than it initially appeared,” according to SonicWall’s threat researchers. Several PoC exploits have been published, including one by IT consultant Mohamed Nabil Ali that performs bulk […]

Critical Splunk flaw can be exploited to grab passwords (CVE-2024-36991) Read More »

eBook: How CISSP turns career goals into reality

Don't miss, ISC2, News, Whitepapers and webinars /

eBook: How CISSP turns career goals into reality 2024-07-18 at 16:01 By Help Net Security CISSP carries clout. As the world’s leading cybersecurity certification, it opens many professional opportunities worldwide. Find out what led 14 successful CISSPs around the globe to a career in cybersecurity. They open up about how certification has helped them realize […]

eBook: How CISSP turns career goals into reality Read More »

FIN7 sells improved EDR killer tool

attack tools, backdoor, cybercrime, cybercriminals, Don't miss, Hot stuff, Malware, News, Ransomware, SentinelOne /

FIN7 sells improved EDR killer tool 2024-07-18 at 15:46 By Zeljka Zorz The cybercrime-focused enterprise known as FIN7 (aka the Carbanak group) has come up with yet another trick to assure the effectiveness of its “EDR killer” tool, dubbed AvNeutralizer (i.e., AuKill) by researchers. By leveraging Windows’ built-in driver TTD Monitor Driver (ProcLaunchMon.sys), in conjunction […]

FIN7 sells improved EDR killer tool Read More »

Cisco fixes critical flaws in Secure Email Gateway and SSM On-Prem (CVE-2024-20401, CVE-2024-20419)

Cisco, Don't miss, email security, Hot stuff, News, security update, vulnerability /

Cisco fixes critical flaws in Secure Email Gateway and SSM On-Prem (CVE-2024-20401, CVE-2024-20419) 2024-07-18 at 12:16 By Zeljka Zorz Cisco has fixed two critical vulnerabilities that may allow attackers to overwrite files on its Secure Email Gateways (CVE-2024-20401) and change the password of any user on its Smart Software Manager On-Prem license servers (CVE-2024-20419). Neither […]

Cisco fixes critical flaws in Secure Email Gateway and SSM On-Prem (CVE-2024-20401, CVE-2024-20419) Read More »

NDAY Security ATTACKN identifies critical exploitable security vulnerabilities

NDAY Security, News /

NDAY Security ATTACKN identifies critical exploitable security vulnerabilities 2024-07-18 at 11:31 By Industry News NDAY Security unveiled the latest release to its automated offensive security platform, ATTACKN. This all-in-one platform enables organizations to deploy, monitor, and manage critical offensive security measures, including: Point-in-time Penetration Testing. Penetration Testing as a Service (PTaaS). Continuous Penetration Testing. Cyber […]

NDAY Security ATTACKN identifies critical exploitable security vulnerabilities Read More »

Fighting AI-powered synthetic ID fraud with AI

Artificial Intelligence, authentication, AuthenticID, biometrics, Compliance, cybersecurity, Don't miss, Expert analysis, Expert corner, fraud, Hot stuff, identity, identity verification, News, opinion /

Fighting AI-powered synthetic ID fraud with AI 2024-07-18 at 07:31 By Help Net Security Aided by the emergence of generative artificial intelligence models, synthetic identity fraud has skyrocketed, and now accounts for a staggering 85% of all identity fraud cases. For security professionals, the challenge lies in staying one step ahead of these evolving threats. […]

Fighting AI-powered synthetic ID fraud with AI Read More »

Laying the groundwork for zero trust in the military

Artificial Intelligence, Core4ce, cybersecurity, Department of Defense, Don't miss, Features, Hot stuff, machine learning, network, News, opinion, policy, training, zero trust /

Laying the groundwork for zero trust in the military 2024-07-18 at 07:01 By Mirko Zorz In this Help Net Security interview, Curtis Arnold, VP and Chief Scientist at Core4ce, discusses the starting points for military training in zero trust principles, emphasizing foundational technologies and a unified taxonomy. Arnold provides insights into the DoD’s Zero Trust […]

Laying the groundwork for zero trust in the military Read More »

Grype: Open-source vulnerability scanner for container images, filesystems

cybersecurity, Don't miss, GitHub, Hot stuff, News, open source, penetration testing, scanning, software /

Grype: Open-source vulnerability scanner for container images, filesystems 2024-07-18 at 06:31 By Help Net Security Grype is an open-source vulnerability scanner designed for container images and filesystems that seamlessly integrates with Syft, a powerful Software Bill of Materials (SBOM) tool. Find vulnerabilities for major operating system packages Alpine Amazon Linux BusyBox CentOS CBL-Mariner Debian Distroless […]

Grype: Open-source vulnerability scanner for container images, filesystems Read More »

Red Hat OpenShift enhancements help organizations connect their disparate, diverse workloads

News, Red Hat /

Red Hat OpenShift enhancements help organizations connect their disparate, diverse workloads 2024-07-17 at 11:01 By Industry News Red Hat introduced new capabilities and enhancements for Red Hat OpenShift, a hybrid cloud application platform powered by Kubernetes, as well as the general availability of Red Hat Advanced Cluster Security Cloud Service. The new features, delivered with […]

Red Hat OpenShift enhancements help organizations connect their disparate, diverse workloads Read More »

Overlooked essentials: API security best practices

access control, Akto, API security, authentication, cybersecurity, Don't miss, Encryption, Features, Hot stuff, News, opinion, policy /

Overlooked essentials: API security best practices 2024-07-17 at 07:31 By Mirko Zorz In this Help Net Security, Ankita Gupta, CEO at Akto, discusses API security best practices, advocating for authentication protocols like OAuth 2.0 and OpenID Connect, strict HTTPS encryption, and the use of JWTs for stateless authentication. Gupta recommends role-based access control (RBAC) and […]

Overlooked essentials: API security best practices Read More »

SubSnipe: Open-source tool for finding subdomains vulnerable to takeover

cybersecurity, Don't miss, GitHub, Hot stuff, News, open source, penetration testing, software /

SubSnipe: Open-source tool for finding subdomains vulnerable to takeover 2024-07-17 at 07:01 By Mirko Zorz SubSnipe is an open-source, multi-threaded tool to help find subdomains vulnerable to takeover. It’s simpler, produces better output, and has more fingerprints than other subdomain takeover tools. “SubSnipe does some additional verification after the fingerprinting to find candidates more likely […]

SubSnipe: Open-source tool for finding subdomains vulnerable to takeover Read More »

Cybersecurity jobs available right now: July 17, 2024

cybersecurity jobs, News /

Cybersecurity jobs available right now: July 17, 2024 2024-07-17 at 06:31 By Anamarija Pogorelec Adversary Emulation Team Member Australian Federal Police | Australia | On-site – View job details As an Adversary Emulation Team Member you will participate in testing and assessment activities in both domestic and international settings. You will gain exposure to a […]

Cybersecurity jobs available right now: July 17, 2024 Read More »

Most GitHub Actions workflows are insecure in some way

cyber risk, cybersecurity, GitHub, Legit Security, News, report, survey /

Most GitHub Actions workflows are insecure in some way 2024-07-17 at 06:01 By Help Net Security Most GitHub Actions are susceptible to exploitation; they are overly privileged or have risky dependencies, according to Legit Security. GitHub Actions security flaws pose major risks The report found the GitHub Actions marketplace’s security posture to be especially concerning, […]

Most GitHub Actions workflows are insecure in some way Read More »

Void Banshee APT exploited “lingering Windows relic” in zero-day attacks

APT, Check Point, CVE, Don't miss, Hot stuff, Internet Explorer, News, spear-phishing, Trend Micro, Windows /

Void Banshee APT exploited “lingering Windows relic” in zero-day attacks 2024-07-16 at 16:46 By Zeljka Zorz The zero-day exploit used to leverage CVE-2024-38112, a recently patched Windows MSHTML vulnerability, was wielded by an APT group dubbed Void Banshee to deliver malware to targets in North America, Europe, and Southeast Asia, threat hunters with Trend Micro’s […]

Void Banshee APT exploited “lingering Windows relic” in zero-day attacks Read More »

ChatGPTriage: How can CISOs see and control employees’ AI use?

Artificial Intelligence, ChatGPT, CISO, Compliance, cybersecurity, Don't miss, Expert analysis, Expert corner, generative AI, Hot stuff, News, opinion, Privacy, WitnessAI /

ChatGPTriage: How can CISOs see and control employees’ AI use? 2024-07-16 at 08:01 By Help Net Security It’s been less than 18 months since the public introduction of ChatGPT, which gained 100 million users in less than two months. Given the hype, you would expect enterprise adoption of generative AI to be significant, but it’s […]

ChatGPTriage: How can CISOs see and control employees’ AI use? Read More »

Managing exam pressure: Tips for certification preparation

Artificial Intelligence, certification, cybersecurity, Don't miss, Features, Hot stuff, News, opinion, skill development, Udemy /

Managing exam pressure: Tips for certification preparation 2024-07-16 at 07:32 By Mirko Zorz In this Help Net Security interview, Seth Hodgson, SVP of Engineering at Udemy, discusses effective study techniques for cybersecurity certification exams. Hodgson discusses the role of study groups, online forums, and professional networks in certification preparation and shares strategies for maintaining motivation […]

Managing exam pressure: Tips for certification preparation Read More »

Scroll to Top