6 min readFrom DNA to data, explore the unanswered questions of identity and the challenges of securing a non-human world.
The post What Makes You… You? A Philosophical Take on Non-Human Identity appeared first on Aembit.
The post What Makes You… You? A Philosophical Take on Non-Human Identity appeared first on Security Boulevard.
Author/Presenter: Dr. Muhsinah Morris
Our sincere appreciation to DEF CON, and the Authors/Presenters for publishing their erudite DEF CON 32 content. Originating from the conference’s events located at the Las Vegas Convention Center; and via the organizations YouTube channel.
The post DEF CON 32 – Student Engagement Doesn’t Have to Suck appeared first on Security Boulevard.
The data of more than 8,500 customers were exposed during an attack on the Green Bay Packers online retail website in which the hackers were able to bypass security measure and install malicious code, steal customers' names, addresses, and credit card information.
The post Green Bay Packers Retail Site Hacked, Data of 8,500 Customers Exposed appeared first on Security Boulevard.
Ivanti disclosed two vulnerabilities in its Connect Secure, Policy Secure and Neurons for ZTA gateway devices, including one flaw that was exploited in the wild as a zero-day.
BackgroundOn January 8, Ivanti published a security advisory for two vulnerabilities affecting multiple products including Ivanti Connect Secure, Ivanti Policy Secure and Ivanti Neurons for Zero Trust Access (ZTA) gateways:
CVE Description CVSSv3 CVE-2025-0282 Ivanti Connect Secure, Ivanti Policy Secure and Ivanti Neurons for ZTA gateways Stack-based Buffer Overflow Vulnerability 9.0 CVE-2025-0283 Ivanti Connect Secure, Ivanti Policy Secure and Ivanti Neurons for ZTA gateways Stack-based Buffer Overflow Vulnerability 7.0 AnalysisCVE-2025-0282 is a stack-based buffer overflow vulnerability in Ivanti Connect Secure, Ivanti Policy Secure and Ivanti Neurons for ZTA gateways. An unauthenticated, remote attacker that successfully exploits this flaw would obtain remote code execution on a vulnerable device.
CVE-2025-0283 is also a stack-based buffer overflow in Ivanti Connect Secure, Ivanti Policy Secure and Ivanti Neurons for ZTA gateways. Unlike CVE-2025-0282, a local, authenticated attacker that successfully exploits this flaw would be able to elevate privileges on a vulnerable device.
In-the-wild exploitation observed for CVE-2025-0282
In a blog post, Ivanti confirmed that they have observed in-the-wild exploitation of CVE-2025-0282 in “a limited number of customers” of Ivanti Connect Secure devices. They reiterate that they have not observed exploitation against Ivanti Policy Secure or Neurons for ZTA gateways.
Historical exploitation of Ivanti Connect Secure
Ivanti Connect Secure, formerly known as Pulse Connect Secure, has been frequently targeted by attackers of all types, including advanced persistent threat (APT) groups as well as ransomware affiliates and opportunistic cybercriminals.
CVE Description Tenable Publications Year CVE-2019-11510 Ivanti Pulse Connect Secure Arbitrary File Read Vulnerability 1, 2, 3, 4, 5 2019 CVE-2019-11539 Ivanti Pulse Connect Secure and Policy Secure Command Injection Vulnerability 1, 2, 3, 4 2019 CVE-2020-8218 Ivanti Pulse Connect Secure Code Injection Vulnerability Tenable 2020 Threat Landscape Retrospective 2020 CVE-2020-8243 Ivanti Pulse Connect Secure Code Injection Vulnerability 1, 2 2020 CVE-2020-8260 Ivanti Pulse Connect Secure Unrestricted File Upload Vulnerability 1, 2 2020 CVE-2021-22893 Ivanti Pulse Connect Secure Authentication Bypass Vulnerability 1, 2 2021 CVE-2021-22894 Ivanti Pulse Connect Secure Buffer Overflow Vulnerability CVE-2021-22893: Zero-Day Vulnerability in Pulse Connect Secure Exploited in the Wild 2021 CVE-2021-22899 Ivanti Pulse Connect Secure Command Injection Vulnerability CVE-2021-22893: Zero-Day Vulnerability in Pulse Connect Secure Exploited in the Wild 2021 CVE-2021-22900 Ivanti Pulse Connect Secure Multiple Unrestricted Uploads Vulnerability CVE-2021-22893: Zero-Day Vulnerability in Pulse Connect Secure Exploited in the Wild 2021 CVE-2023-46805 Ivanti Connect Secure and Ivanti Policy Secure Authentication Bypass Vulnerability 1, 2 2024 CVE-2024-21887 Ivanti Connect Secure and Ivanti Policy Secure Command Injection Vulnerability 1, 2 2024 CVE-2024-21893 Ivanti Connect Secure, Policy Secure, and Neurons Server-Side Request Forgery (SSRF) Vulnerability CVE-2023-46805, CVE-2024-21887, CVE-2024-21888 and CVE-2024-21893: Frequently Asked Questions for Vulnerabilities in Ivanti Connect Secure and Policy Secure Gateways 2024Because of the historical exploitation of these devices, customers are strongly advised to apply the available patch for these flaws as soon as possible.
Proof of conceptAt the time this blog post was published, there were no public proof-of-concept exploits for CVE-2025-0282 or CVE-2025-0283.
SolutionIvanti has released the following patches for Connect Secure, Policy Secure and Neurons for ZTA Gateways.
Affected Product Affected Versions (CVE-2025-0282) Affected Versions (CVE-2025-0283) Fixed Version Ivanti Connect Secure 22.7R2 through 22.7R2.4 22.7R2.4 and belowIvanti customers can utilize its Integrity Checker Tool (ICT) to identify exploitation of CVE-2025-0282.
For Connect Secure customers, Ivanti recommends performing a factory reset of devices prior to upgrading to version 22.7R2.5 “out of an abundance of caution” for those with clean ICT scan results and to “ensure any malware is removed” where ICT results “show signs of compromise.”
Identifying affected systemsA list of Tenable plugins for these vulnerabilities can be found on the individual CVE pages for CVE-2025-0282 and CVE-2025-0283 as they’re released. These links will display all available plugins for these vulnerabilities, including upcoming plugins in our Plugins Pipeline.
Tenable Attack Surface Management customers are able to quickly identify these assets by leveraging the built in subscription labeled Ivanti Connect Secure (ICS) - v1.
Get more informationJoin Tenable's Security Response Team on the Tenable Community.
Learn more about Tenable One, the Exposure Management Platform for the modern attack surface.
The post CVE-2025-0282: Ivanti Connect Secure Zero-Day Vulnerability Exploited In The Wild appeared first on Security Boulevard.
IEI-IEI, Oh: Running an obsolete OS, on obsolete hardware, configured with obsolete settings.
The post Insecure Medical Devices — Illumina DNA Sequencer Illuminates Risks appeared first on Security Boulevard.
This post will clarify what SSF is, describe its approach, explain the roles of the CAEP and RISC, and outline the ways to work together.
The post The OpenID Shared Signals Framework appeared first on Security Boulevard.
via the comic humor & dry wit of Randall Munroe, creator of XKCD
The post Randall Munroe’s XKCD ‘Origami Black Hole’ appeared first on Security Boulevard.
Navigating the job market can feel like a final boss battle in a video game—thrilling, challenging, and filled with traps. Unfortunately, work-from-home scams are some of the trickiest villains you’ll encounter on this quest. They disguise themselves as legitimate opportunities, preying on jobseekers eager to land their dream roles.
The post Time for a new job—9 work-from-home scams and how to spot them appeared first on Security Boulevard.
Authors/Presenters: Panel
Our sincere appreciation to DEF CON, and the Authors/Presenters for publishing their erudite DEF CON 32 content. Originating from the conference’s events located at the Las Vegas Convention Center; and via the organizations YouTube channel.
The post DEF CON 32 – Preparing for the Future: A Discussion of Our Rapidly Evolving Threat Landscape appeared first on Security Boulevard.
I recently caught up with Karissa Breen, the founder of KBI.Media, and we got straight into our topic: What is breach readiness and business continuity planning in complex environments? Everyone talks about having a plan, but actually putting it into action, especially when you’re under attack, is a completely different story. Realities of Breach Readiness […]
The post Breach Readiness and Business Continuity Planning appeared first on ColorTokens.
The post Breach Readiness and Business Continuity Planning appeared first on Security Boulevard.
Web applications and APIs are critical parts of your attack surface, but managing WAFs has never been easy. False positives, rule tuning, risks of production outages, and log analysis - all of this work has made WAF historically difficult to operationalize.
Well, that time is over. Meet Impart’s WAF Squad - a five-member squad of AI assistants superheroes dedicated to making web application security not just manageable, but downright fun!
In this blog post, you’ll see why these Assistants aren’t just toys —they’re here to revolutionize how you protect your apps and data - IN PRODUCTION.
WAF his a hard space to play
WAF has always been a historically challenging space to work in because of the intersection of multiple personas within a organization. Unlike other appsec tools like DAST, which are primarily controlled and managed by the application security team with very few other stakeholders, WAF has many stakeholders with different focus areas and priorities. WAF historically has impacted SRE teams, software engineers, architects, SOC teams, as well as application security teams. One tiny mistake by any of these teams can have a huge impact on all of them, which carries significant risk. That’s why so many organizations get so little value out of their WAF, with most of their rules turned off or in non-blocking mode.
At Impart, we have decades of operational experience working with all of these types of teams across hundreds of customers, along a wide range of production environments. Over the years we’ve been able to identify most of the common operational and implementation pitfalls associated with each persona and have developed playbooks and tactics to still be successful.
Team of Assistants approach
Many companies in the information security space have different types of assistants and chatbots bolted onto their SaaS offerings. These assistants have largely been gimmicks, not trusted enough to do anything in production. The most egregious I’ve encountered are AI chatbots which summarize developer documentation for security teams, which is a solution in search of a problem and doesn’t consider the different personas involved in a typical security team.
Our core insight from working in the WAF space for so long is that security is a team sport. It’s not enough to have a general purpose security assistants working on a security problem - there needs to be multiple security assistants, each with a different focus area and different expertise, which work together seamlessly in the same manner that an effective security team works together with other stakeholders in their organization.
How We Built Our WAF Assistants
Building out a suite of AI-driven WAF Assistants wasn’t just about slapping some algorithms onto a firewall—it was about solving real-world security problems experienced by the people in the trenches. We started by mapping out the key personas in a typical WAF deployment: the SRE responsible for rolling out and monitoring performance, the AppSec engineer tasked with analyzing behavior and spotting threats, the Detection and Response engineer creating effective security policies, the Product Security specialist ensuring alignment with business goals, and the SOC analyst managing day-to-day operations and investigations.
Once we had these roles pinned down, we identified their most critical “jobs to be done,” such as monitoring resource usage, discovering risky endpoints, crafting targeted detection rules, refining policies to meet product objectives, and triaging potential incidents. By translating each job into a set of repeatable tasks, we saw a clear path for AI agents that could automate or assist these responsibilities.
From there, we built out five specialized WAF Assistants, each tailored to a core persona. Finally, we integrated them into the Impart data fabric natively so they could seamlessly share findings and data with each other: threat findings from one Assistant inform detection rules in another, and policy changes are instantly visible to the entire stack. The end result is a coordinated security “dream team” that unburdens human experts and ensures your WAF remains agile and effective—no matter how quickly your environment changes.
Meet the Dream TeamAlone, each Assistant shines. Together, they’re an all-star team capable of thwarting zero-day threats, locking down new APIs, and ensuring your security strategy doesn’t crumble under the next wave of attacks.
How They Work Together on ImpartImagine a platform where all five heroes hang out, share intel, and tackle threats the moment they appear. That’s Impart. Instead of bouncing between separate dashboards, you get a single command center. Inspector flags a suspicious endpoint? Great—Rule Writer can generate the necessary protection. Architect tests, approves, and deploys the policy, and SOC Analyst keeps watch for any follow-up threats. It’s the definition of teamwork, only you’re not wrangling five different tools or stakeholders manually to make it happen.
Conclusion & Call to ActionThe WAF Assistants represent a new era of web security—smarter, faster, and infinitely more collaborative. By offloading repetitive tasks and maintaining real-time communication across the Impart platform, they free your human experts to focus on strategy, innovation, and high-level risk management.
Ready to see them in action? Click here to sign up for an upcoming deep-dive or book a live demo. Your security posture is about to get a serious upgrade—let the WAF Assistants show you what true teamwork can achieve.
The post Meet the WAF Squad | Impart Security appeared first on Security Boulevard.
Six Tech Trends Shaping the Future of Brand Experiences
madhav
Wed, 01/08/2025 - 12:38
Business success relies on balancing positive brand experiences and maintaining consumer trust. Consumers want efficiency—2024 research from Thales found that 22% of consumers will give up after less than a minute if they're having a frustrating customer experience—but they are suspicious of the technologies that provide that efficiency. 57% are nervous that brands' use of generative AI will put their personal data at risk.
Businesses must take advantage of emerging technologies to gain and maintain customers. But it's equally important to take a considered, responsible approach to those technologies to maintain customer trust. Here are a few technologies that can help improve your organization's brand experience and some advice on how to get your customers to trust them.
Generative AI has dominated news, corporate, and social media headlines for nearly two years. Speculation about its potential ranges from mundane to hysterical. But if used correctly, it could genuinely transform brand experiences.
Consumers are split on AI. While 51% said they would be happy for companies to use the technology to improve their brand experiences, 43% said they would not trust any interactions powered by it.
Generative AI can improve the brand experience in many ways. For example, technology enables businesses to tailor product recommendations, FAQs, and marketing materials to specific customers. Similarly, using generative AI, organizations can quickly and efficiently analyze customer feedback to gauge public sentiment towards their brand and adjust their services and marketing accordingly.
Convincing consumers to trust your use of AI relies on transparency. It's essential to demonstrate your commitment to data privacy by publishing an AI policy that clarifies how you intend to use customer data. Often, it's the fear of the unknown that scares people, meaning that simply explaining your AI policy can significantly improve customer trust.
Augmented Reality (AR) and Virtual Reality (VR) are revolutionizing how brands interact with consumers. While they differ slightly – AR overlays digital information onto the real world, while VR creates entirely simulated environments – both technologies create immersive consumer experiences. For example, brands may use AR and VR technologies for virtual try-ons, interactive product demonstrations, and immersive storytelling.
While these technologies undoubtedly enhance customer engagement and drive sales, they also bring about significant, novel privacy considerations. For example, unlike the other technologies covered in this article, AR can see exactly what users see. If a threat actor were to gain access to an AR device, they could record the user in potentially embarrassing or compromising situations and demand a ransom from them. Similarly, VR devices often record and track a user’s fingers – if they type a password or code in their VR device, cybercriminals could steal this data and, hence, their data. It’s crucial to be open with users about the data you collect and take special measures to protect that data.
Love them or hate them, IoT devices are the future. If used correctly, they can significantly improve consumers' experiences and interactions with your brand. Moreover, consumers are remarkably bullish on smart home devices, with 30% saying the technology will improve their interactions with brands over the next 12 months.
Consider smart energy meters, for example. These devices not only provide users greater insight into their energy uses and associated costs but also communicate with them directly, alerting them to planned or impromptu outages and restorations.
Similarly, by integrating with voice assistants like Amazon Alexa or Google Assistant, users can interact directly with your brand by speaking. Although your customers know they're not talking to a human, your brand's voice will shine through and improve the overall brand experience. What’s more, voice assistants such as these collect vast amounts of data on consumer behavior, preferences, and usage patterns that you can use to personalize product offerings, improve customer experiences, and develop new products and services that meet evolving consumer needs.
However, IoT devices have substantial privacy implications. Remember, these devices are always listening, which can be a disconcerting reality for consumers. To set your customers' minds at ease, you should emphasize the security features of these devices and clearly outline your privacy policies.
Progressive profiling is a great way to collect consumer data without demanding too much at once. This caveat is especially important considering that 29% of users reported leaving a brand in the past 12 months because it demanded too much information. It allows brands to build detailed customer profiles organically, enhancing personalization, improving customer experience, increasing engagement, boosting data quality, and strengthening customer relationships.
However, brands must remember that although they’re not collecting an overwhelming amount of data all at once, they are still collecting data. Just because consumers are more willing to accept this kind of data collection, that doesn’t give brands the right to disregard data privacy considerations like minimization and security.
Good customer service is essential. Research suggests that 73% of customers will switch to a competitor after multiple bad experiences. But good customer service is extremely difficult—and expensive—to provide. Unless you're a tiny business with only a handful of high-value customers, hiring enough staff to effectively deal with customer queries and complaints simply is not feasible. This is where chatbots come in. Chatbots have played a role in customer service for some time, but generative AI has supercharged their abilities. Consumers know this fact, with 25% believing they will contribute to positive brand interactions in the next 12 months.
With generative AI, chatbots provide responses tailored to consumers' history, preferences, and behavior. They can even predict customer needs based on past interactions and offer proactive assistance, making for a bespoke and positive brand experience. Similarly, as generative AI has improved, chatbots respond to customer queries rather than just redirecting them to FAQ pages or a customer service email address.
But, again, this technology can seriously damage customer trust. Chatbots are especially risky as they not only present data privacy concerns—you can remediate these with a transparent data privacy policy, as above—but they can also be unreliable. In 2024, Air Canada's customer service chatbot wrongly offered a customer a bereavement discount. The airline refused to honor the discount, and the customer sued, winning over $800 in damages. To avoid a similar situation, it's essential to audit AI-powered chatbots regularly.
The rollout of 5G networks in recent years has sped up data speeds and lowered latency, granting new possibilities for enhancing brand experiences. For example, brands could create high-quality, interactive content, live-stream events, and deliver personalized experiences in real-time, further blurring the lines between the physical and digital worlds.
But again, brands need to consider the data they collect when delivering these experiences. 5G networks inherently collect more data than less powerful networks, so brands need to take extra measures to protect it.
In conclusion, it's crucial to recognize that customers want to both trust a brand and have a positive, streamlined experience with it. While these wants are often difficult to reconcile, they are not mutually exclusive or unreasonable. To succeed as a modern business, take advantage of technology trends that can improve brand experiences, but be sure to take a considered, responsible, and transparent approach to these technologies with customer privacy at its core.
Identity & Access Management Cloud Computing Ammar Faheem | Product Marketing Manager
More About This Author >
Schema
{
"@context": "https://schema.org",
"@type": "BlogPosting",
"mainEntityOfPage": {
"@type": "WebPage",
"@id": "https://cpl.thalesgroup.com/blog/access-management/six-tech-trends-shaping-brand-experiences"
},
"headline": "Six Tech Trends Shaping the Future of Brand Experiences",
"description": "Explore six technology trends including AI, AR/VR, IoT, and 5G that are shaping brand experiences while addressing consumer trust concerns.",
"image": "https://cpl.thalesgroup.com//sites/default/files/content/blog/social/six-tech-trends-shaping-the-future-of-brand-experiences-sc.jpg",
"author": {
"@type": "Person",
"name": "Ammar Faheem",
"url": "https://cpl.thalesgroup.com/blog/author/afaheem"
},
"publisher": {
"@type": "Organization",
"name": "Thales Group",
"description": "The world relies on Thales to protect and secure access to your most sensitive data and software wherever it is created, shared, or stored. Whether building an encryption strategy, licensing software, providing trusted access to the cloud, or meeting compliance mandates, you can rely on Thales to secure your digital transformation.",
"url": "https://cpl.thalesgroup.com",
"logo": "https://cpl.thalesgroup.com/sites/default/files/content/footer/thaleslogo-white.png",
"sameAs": [
"https://www.facebook.com/ThalesCloudSec",
"https://www.twitter.com/ThalesCloudSec",
"https://www.linkedin.com/company/thalescloudsec",
"https://www.youtube.com/ThalesCloudSec"
]
},
"datePublished": "2025-01-08",
"dateModified": "2025-01-08"
}
The post Six Tech Trends Shaping the Future of Brand Experiences appeared first on Security Boulevard.
Victim organizations need more effective tools and strategies to streamline incident response and mitigate financial fallout.
The post Rethinking Incident Response: How Organizations Can Avoid Budget Overruns and Delays appeared first on Security Boulevard.
The numbers are staggering—2024 has seen over 200,000 layoffs across 1,200 companies, with 82% coming from the tech industry. Welcome to the Top Tech Talent Reemployment Project! I’m Peter, and this initiative is all about supporting those affected by layoffs and helping them find fulfilling roles. In our first episode, I’m joined by my friend […]
The post Reemployment Project: Meet Alex Ryan appeared first on Security Boulevard.
After being let go from F5 in May 2023, I started thinking about how to support job seekers during tough times. That’s when I came up with the Top Tech Talent Reemployment Project—a video series featuring professionals who have been impacted by layoffs. The idea is simple: I host 5-7 minute interviews where we discuss […]
The post Top Tech Talent Reemployment Project: Helping Job Seekers Shine! appeared first on Security Boulevard.
Explore the invisible war being fought in cyberspace, where nations battle without traditional weapons. This comprehensive guide explains modern cyberattacks, their impact on global security, and how countries defend their digital borders in an increasingly connected world.
The post The Digital Battlefield: Understanding Modern Cyberattacks and Global Security appeared first on Security Boulevard.
Are Organizations Fully Grasping the Importance of API Security? It is surprising how often businesses underestimate the importance of Application Programming Interface (API) security while navigating the digital landscape. This concern arises due to the significant rise in API-centric applications. While APIs offer countless benefits, they also pose substantial cybersecurity challenges. So, how well are […]
The post Challenges and Solutions in API Security appeared first on Entro.
The post Challenges and Solutions in API Security appeared first on Security Boulevard.
Why Is Identity Access Management (IAM) Crucial in Cloud Security? Have you ever thought about how crucial Identity Access Management (IAM) is when it comes to cloud security? IAM is not just about managing human identities but also about dealing with non-human identities (NHIs) and their secret security management. As a data management specialist and […]
The post The Role of IAM in Securing Cloud Transactions appeared first on Entro.
The post The Role of IAM in Securing Cloud Transactions appeared first on Security Boulevard.
Author/Presenter: Joshua Herman
Our sincere appreciation to DEF CON, and the Authors/Presenters for publishing their erudite DEF CON 32 content. Originating from the conference’s events located at the Las Vegas Convention Center; and via the organizations YouTube channel.
The post DEF CON 32 – Psychic Paper: Making E-Ink Access Badges Accessible For Anyone appeared first on Security Boulevard.
Philadelphia, Pa., Jan. 7, 2025, CyberNewswire — Security Risk Advisors today announced it has become a member of the Microsoft Intelligent Security Association (MISA), an ecosystem of independent software vendors (ISVs) and managed security service providers (MSSPs) that have integrated … (more…)
The post News Alert: Security Risk Advisors joins Microsoft Intelligent Security Association (MISA) first appeared on The Last Watchdog.
The post News Alert: Security Risk Advisors joins Microsoft Intelligent Security Association (MISA) appeared first on Security Boulevard.
