Security Boulevard

How Can Organizations Securely Manage Non-Human Identities? Have you ever considered how important it is to manage machine identities within your organization’s cybersecurity framework? Non-Human Identities (NHIs) are becoming increasingly crucial with digital evolves, particularly in industries like financial services, healthcare, and cloud-based services. With the surge in cloud computing, the gap between security teams […]

The post What makes Agentic AI capable in secrets scanning appeared first on Entro.

The post What makes Agentic AI capable in secrets scanning appeared first on Security Boulevard.

Are Current Secrets Vaulting Solutions Meeting Enterprise Expectations? What drives enterprise satisfaction with secrets vaulting systems, and are current solutions living up to the expectations? When organizations increasingly move towards cloud-based environments, managing Non-Human Identities (NHIs) and secrets security becomes a critical component of an effective cybersecurity strategy. NHIs are essentially machine identities, and managing […]

The post Are enterprises satisfied with current secrets vaulting solutions appeared first on Entro.

The post Are enterprises satisfied with current secrets vaulting solutions appeared first on Security Boulevard.

What Is the Role of Agentic AI in Managing Machine Identities? How can organizations enhance their security measures where teeming with sophisticated cybersecurity threats? The answer may be in evolving role of Agentic AI, particularly in managing machine identities. With the rise of cloud technologies and automated systems, machine identities—often seen as Non-Human Identities (NHIs)—play […]

The post Can Agentic AI operate independently in managing machine identities appeared first on Entro.

The post Can Agentic AI operate independently in managing machine identities appeared first on Security Boulevard.

Is Your Organization Prepared for the Surge of Non-Human Identities in Cloud Security? When businesses increasingly shift their operations to the cloud, the complexities of cybersecurity also grow. A little-discussed aspect of this transition is the management of Non-Human Identities (NHIs). These are essentially the machine identities that navigate secure environments, operating through encrypted secrets […]

The post How are cloud security teams supported by Agentic AI appeared first on Entro.

The post How are cloud security teams supported by Agentic AI appeared first on Security Boulevard.

Claude Code Security marks a shift in AI code review.

The post Why Anthropic’s Claude Code Security matters and what it means for Mend.io customers appeared first on Security Boulevard.

OpenClaw is a hot topic at the moment. But what is it and how can you use the 24/7 AI assistant in a safe way?

The post OpenClaw: What is it and can you use it safely? appeared first on Security Boulevard.

Session 13B: API Security

Authors, Creators & Presenters: Miaoqian Lin (Institute of Information Engineering, Chinese Academy of Sciences, Beijing, China; School of Cyber Security, University of Chinese Academy of Sciences, China), Kai Chen (Institute of Information Engineering, Chinese Academy of Sciences, Beijing, China; School of Cyber Security, University of Chinese Academy of Sciences, China), Yi Yang (Institute of Information Engineering, Chinese Academy of Sciences, Beijing, China; School of Cyber Security, University of Chinese Academy of Sciences, China), Jinghua Liu (Institute of Information Engineering, Chinese Academy of Sciences, Beijing, China; School of Cyber Security, University of Chinese Academy of Sciences, China)

PAPER
Uncovering The Iceberg From The Tip: Generating API Specifications For Bug Detection Via Specification Propagation Analysis

Modern software often provides diverse APIs to facilitate development. Certain APIs, when used, can affect variables and require post-handling, such as error checks and resource releases. Developers should adhere to their usage specifications when using these APIs. Failure to do so can cause serious security threats, such as memory corruption and system crashes. Detecting such misuse depends on comprehensive API specifications, as violations of these specifications indicate API misuse. Previous studies have proposed extracting API specifications from various artifacts, including API documentation, usage patterns, and bug patches. However, these artifacts are frequently incomplete or unavailable for many APIs. As a result, the lack of specifications for uncovered APIs causes many false negatives in bug detection. In this paper, we introduce the idea of API Specification Propagation, which suggests that API specifications propagate through hierarchical API call chains. In particular, modern software often adopts a hierarchical API design, where high-level APIs build on low-level ones. When high-level APIs wrap low-level ones, they may inherit the corresponding specifications. Based on this idea, we present APISpecGen, which uses known specifications as seeds and performs bidirectional propagation analysis to generate specifications for new APIs. Specifically, given the seed specifications, APISpecGen infers which APIs the specifications might propagate to or originate from. To further generate specifications for the inferred APIs, APISpecGen combines API usage and validates them using data-flow analysis based on the seed specifications. Besides, APISpecGen iteratively uses the generated specifications as new seeds to cover more APIs. For efficient and accurate analysis, APISpecGen focuses only on code relevant to the specifications, ignoring irrelevant semantics. We implemented APISpecGen and evaluated it for specification generation and API misuse detection. With 6 specifications as seeds, APISpecGen generated 7332 specifications. Most of the generated specifications could not be covered by state-of-the-art work due to the quality of their sources. With the generated specifications, APISpecGen detected 186 new bugs in the Linux kernel, 113 of them have been confirmed by the developers, with 8 CVEs assigned.

ABOUT NDSS
The Network and Distributed System Security Symposium (NDSS) fosters information exchange among researchers and practitioners of network and distributed system security. The target audience includes those interested in practical aspects of network and distributed system security, with a focus on actual system design and implementation. A major goal is to encourage and enable the Internet community to apply, deploy, and advance the state of available security technologies.

Our thanks to the Network and Distributed System Security (NDSS) Symposium for publishing their Creators, Authors and Presenter’s superb NDSS Symposium 2025 Conference content on the Organizations' YouTube Channel.

Permalink

The post NDSS 2025 – Generating API Specifications For Bug Detection Via Specification Propagation Analysis appeared first on Security Boulevard.

Learn how Menlo Security identified a massive Sneaky 2FA phishing campaign using 3.4K domains to bypass Microsoft 365 MFA and steal session cookies.

The post Inside Attacker’s Defensive Funnel: How Sneaky 2FA Cloaks Itself from Security Scanners – Blog | Menlo Security appeared first on Security Boulevard.

via the comic artistry and dry wit of Randall Munroe, creator of XKCD

Permalink

The post Randall Munroe’s XKCD ‘Early Arthropods’ appeared first on Security Boulevard.

This blog post aims to explain what Claude Code Security is (recognizing few details are currently available), and how enterprises and developers should think about its role in their cybersecurity toolchain.

The post Thoughts on Claude Code Security appeared first on Security Boulevard.

Session 13B: API Security

Authors, Creators & Presenters: Jinghua Liu (Institute of Information Engineering, Chinese Academy of Sciences, Beijing, China; School of Cyber Security, University of Chinese Academy of Sciences, China), Yi Yang (Institute of Information Engineering, Chinese Academy of Sciences, Beijing, China; School of Cyber Security, University of Chinese Academy of Sciences, China), Kai Chen (Institute of Information Engineering, Chinese Academy of Sciences, Beijing, China; School of Cyber Security, University of Chinese Academy of Sciences, China), Miaoqian Lin (Institute of Information Engineering, Chinese Academy of Sciences, Beijing, China; School of Cyber Security, University of Chinese Academy of Sciences, China)

PAPER
Generating API Parameter Security Rules with LLM for API Misuse Detection

When utilizing library APIs, developers should follow the API security rules to mitigate the risk of API misuse. API Parameter Security Rule (APSR) is a common type of security rule that specifies how API parameters should be safely used and places constraints on their values. Failure to comply with the APSRs can lead to severe security issues, including null pointer dereference and memory corruption. Manually analyzing numerous APIs and their parameters to construct APSRs is labor-intensive and needs to be automated. Existing studies generate APSRs from documentation and code, but the missing information and limited analysis heuristics result in missing APSRs. Due to the superior Large Language Model's (LLM) capability in code analysis and text generation without predefined heuristics, we attempt to utilize it to address the challenge encountered in API misuse detection. However, directly utilizing LLMs leads to incorrect APSRs which may lead to false bugs in detection, and overly general APSRs that could not generate applicable detection code resulting in many security bugs undiscovered. In this paper, we present a new framework, named GPTAid, for automatic APSRs generation by analyzing API source code with LLM and detecting API misuse caused by incorrect parameter use. To validate the correctness of the LLM-generated APSRs, we propose an execution feedback-checking approach based on the observation that security-critical API misuse is often caused by APSRs violations, and most of them result in runtime errors. Specifically, GPTAid first uses LLM to generate raw APSRs and the Right calling code, and then generates Violation code for each raw APSR by modifying the Right calling code using LLM. Subsequently, GPTAid performs dynamic execution on each piece of Violation code and further filters out the incorrect APSRs based on runtime errors. To further generate concrete APSRs, GPTAid employs a code differential analysis to refine the filtered ones. Particularly, as the programming language is more precise than natural language, GPTAid identifies the key operations within Violation code by differential analysis, and then generates the corresponding concrete APSR based on the aforementioned operations. These concrete APSRs could be precisely interpreted into applicable detection code, which proven to be effective in API misuse detection. Implementing on the dataset containing 200 randomly selected APIs from eight popular libraries, GPTAid achieves a precision of 92.3%. Moreover, it generates 6 times more APSRs than state-of-the-art detectors on a comparison dataset of previously reported bugs and APSRs. We further evaluated GPTAid on 47 applications, 210 unknown security bugs were found potentially resulting in severe security issues (e.g., system crashes), 150 of which have been confirmed by developers after our reports.

ABOUT NDSS
The Network and Distributed System Security Symposium (NDSS) fosters information exchange among researchers and practitioners of network and distributed system security. The target audience includes those interested in practical aspects of network and distributed system security, with a focus on actual system design and implementation. A major goal is to encourage and enable the Internet community to apply, deploy, and advance the state of available security technologies.

Our thanks to the Network and Distributed System Security (NDSS) Symposium for publishing their Creators, Authors and Presenter’s superb NDSS Symposium 2025 Conference content on the Organizations' YouTube Channel.

Permalink

The post NDSS 2025 – Generating API Parameter Security Rules With LLM For API Misuse Detection appeared first on Security Boulevard.

Apple chose Google's Gemini over ChatGPT for Siri's AI upgrade. This $1B/year deal reveals who's actually winning the AI race—and it's not who you think.

The post The Apple-Google AI Deal: What $1 Billion Says About Who’s Really Winning the AI Race appeared first on Security Boulevard.

Vault sprawl means duplicated secrets, fragmented access, and unclear ownership. Learn how GitGuardian's NHI Governance restores control across the enterprise.

The post Confronting Vault Sprawl And The Risks It Brings appeared first on Security Boulevard.

Introduction Following the release of Amazon Bedrock Powered by AWS Mantle, I discovered a mechanism to bypass Service Control Policy (SCP) statements limiting the use of bedrock-mantle IAM permissions. By leveraging long-lived API keys backed by Service Specific Credentials, I was able to successfully leverage bedrock-mantle:CreateInference despite an SCP statement denying that action. SCPs are […]

The post Cracks in the Bedrock: Bypassing SCP Enforcement with Long-Lived API Keys appeared first on Security Boulevard.

Originally published at How SmugMug Strengthened Email Authentication and Deliverability with EasyDMARC by Sona Mirzoyan.

About the Customer Company: SmugMug Industry: Image Hosting ...

The post How SmugMug Strengthened Email Authentication and Deliverability with EasyDMARC appeared first on EasyDMARC.

The post How SmugMug Strengthened Email Authentication and Deliverability with EasyDMARC appeared first on Security Boulevard.

The "Engineering" Trap

In many organizations, there is a dangerous unspoken rule: The SOC handles endpoints and networks; Engineering handles APIs.

This silo creates a massive blind spot. We recently spoke with the Senior Manager of Security Engineering at a major insurance provider, who described this exact pain point. Before bringing in Salt Security, their API security was effectively an "engineering function."

The SecOps team had world-class visibility into their laptops and servers via CrowdStrike, but their API traffic, the very lifeblood of their digital business, was a black box. They relied on a traditional WAF, logs, and SIEM.

The problem? As the customer noted, "These weren't volumetric attacks or malformed requests... but behavioral attacks operating inside legitimate API usage patterns."

The Visibility Gap: You Can't Protect What You Can't See

Before you can secure your APIs, you have to know they exist. This customer faced a common challenge: they lacked a "living view" of their API fabric.

Like many enterprises, they relied on their API Gateway for inventory. But gateways only see what is routed through them. They are blind to "shadow" endpoints, legacy versions, and direct-to-origin connections that bypass the gateway entirely.

The customer noted that while they could perform manual investigations via the gateway, they "lacked a complete, continuously updated inventory" required to spot drift or anomalies. By integrating Salt, they automatically generated a granular, real-time inventory of every API endpoint, including the ones the gateway missed, giving the SOC the map they needed to defend the territory.

The Limits of WAF + SIEM

The customer’s experience highlights a critical industry reality: Traditional stacks cannot catch modern API threats.

• WAFs look for bad signatures (SQLi, XSS).
• SIEMs aggregate logs.
• Business Logic Abuse (BOLA/IDOR) appears to be valid traffic to both.

The customer found that without a dedicated, AI-powered behavioral engine for API security, they couldn't distinguish between a user aggressively using the platform and an attacker slowly enumerating IDs to scrape sensitive data.

Breaking the Silo with CrowdStrike + Salt

The turning point came when the customer stopped treating API security as a standalone problem.

By integrating Salt Security with CrowdStrike Falcon, they didn't just buy a new tool; they expanded their existing ecosystem.

1. Context, Not Just Alerts: Salt identifies the intent behind API traffic (the "who" and "why").
2. Unified Workflow: These insights are pushed into the CrowdStrike Falcon console.
3. Actionable Response: Analysts can now detect API attacks in real time alongside endpoint signals, enabling faster, more confident remediation.

Future-Proofing: The AI Agent & MCP Wave

While this customer’s immediate goal was stopping human attackers, their architectural shift has prepared them for a much larger threat: Agentic AI.

The "logic abuse" patterns they detected, low-and-slow enumeration, unauthorized data scraping, are the exact behaviors AI Agents will automate at scale using the Model Context Protocol (MCP). By deploying Salt’s behavioral engine today, they haven’t just solved a current gap; they’ve inoculated their environment against the coming surge of machine-to-machine traffic that traditional WAFs will be completely blind to.

The Result: Operationalized Security

The customer's feedback was clear: "We maximized our existing platform investment and simplified operations by avoiding yet another point tool."

This is the future of API security. It isn't about buying more dashboards for your team to ignore. It's about feeding high-fidelity behavioral intelligence into the platforms you already trust. It’s about taking API security out of the "Engineering" silo and putting it right where it belongs: in the SOC.

If you want to learn more about Salt and how we can help you, please contact us, schedule a demo, or visit our website. You can also get a free API Attack Surface Assessment from Salt Security's research team and learn what attackers already know.

The post Why Your SOC is Blind to Your Biggest Attack Surface (And How to Fix It) appeared first on Security Boulevard.

Explore how Windows CardSpace’s 'Identity Agent' architecture paved the way for modern Passkeys and secure password management in 2026.

The post Using CardSpace as a Secure Password Manager appeared first on Security Boulevard.

Simplify access with Enterprise SSO for WordPress portals. Secure, seamless single sign-on integration for your enterprise users.

The post Enterprise SSO for WordPress Portals appeared first on Security Boulevard.

Researchers investigated the zero-knowledge claims of password managers—and found some possible attack scenarios.

The post Password managers keep your passwords safe, unless… appeared first on Security Boulevard.

The Problem with the Traditional Idea of a Site For a long time, the concept of a “site” in networking and security was synonymous with a physical office. This included: a headquarters building a branch office a campus connected to the corporate network This traditional model was built on several assumptions: employees primarily worked from...

The post Modern Workplaces Demand a New Meaning for “Site” in Network Security appeared first on Aryaka.

The post Modern Workplaces Demand a New Meaning for “Site” in Network Security appeared first on Security Boulevard.