Security Boulevard

Authors/Presenters:Yong Feng, Zhikang Chen, Haoyu Song, Yinchao Zhang, Hanyi Zhou, Ruoyu Sun, Wenkuo Dong, Peng Lu, Shuxin Liu, Chuwen Zhang, Yang Xu, Bin Liu

Our sincere thanks to USENIX, and the Presenters & Authors for publishing their superb 21st USENIX Symposium on Networked Systems Design and Implementation (NSDI '24) content, placing the organizations enduring commitment to Open Access front and center. Originating from the conference’s events situated at the Hyatt Regency Santa Clara; and via the organizations YouTube channel.

Permalink

The post USENIX NSDI ’24 – Empower Programmable Pipeline for Advanced Stateful Packet Processing appeared first on Security Boulevard.

InfoSec World 2024 was a meeting ground for forward-thinking discussions on the future of cybersecurity, marked by the rise of AI and the growing complexity of security environments. With evolving threats and expanding infrastructures, the event provided the perfect platform to dive deeper into pressing industry issues and explore cutting-edge solutions.  The Evolving Role of AI in Cybersecurity  AI was ... Read More

The post Nuspire at InfoSec World 2024: Navigating AI and Cybersecurity Challenges appeared first on Nuspire.

The post Nuspire at InfoSec World 2024: Navigating AI and Cybersecurity Challenges appeared first on Security Boulevard.

via the comic humor & dry wit of Randall Munroe, creator of XKCD

Permalink

The post Randall Munroe’s XKCD ‘UK Coal’ appeared first on Security Boulevard.

Silver Spring, MD, Oct. 2, 2024, CyberNewswire — Aembit, the non-human IAM company, today announced the appointment of Mario Duarte as chief information security officer (CISO). Duarte, formerly head of security at Snowflake, joins Aembit with a deep commitment … (more…)

The post News alert: Aembit appoints former Snowflake security director Mario Duarte as its new CISO first appeared on The Last Watchdog.

The post News alert: Aembit appoints former Snowflake security director Mario Duarte as its new CISO appeared first on Security Boulevard.

Exponential growth in code, an unmanageable attack surface as a result of Cloud + DevOps, accelerated development cycles...

The post Why ASPM Requires an Independent Approach: Exploring the Role of ASPM vs. CNAPP | Part 1 appeared first on Cycode.

The post Why ASPM Requires an Independent Approach: Exploring the Role of ASPM vs. CNAPP | Part 1 appeared first on Security Boulevard.

Authors/Presenters:Jiaqi Gao, Jiamin Cao, Yifan Li, Mengqi Liu, Ming Tang, Dennis Cai, Ennan Zhai

Our sincere thanks to USENIX, and the Presenters & Authors for publishing their superb 21st USENIX Symposium on Networked Systems Design and Implementation (NSDI '24) content, placing the organizations enduring commitment to Open Access front and center. Originating from the conference’s events situated at the Hyatt Regency Santa Clara; and via the organizations YouTube channel.

The post USENIX NSDI ’24 – Sirius: Composing Network Function Chains into P4-Capable Edge Gateways appeared first on Security Boulevard.

In conversation: Pete McKernan & Luke Luckett

As organizations seek to wrap their arms around potential cybersecurity exposures, CIOs and CISOs are increasingly pushing their vulnerability management teams to widen scope. With such a focus, the growing concept of continuous threat exposure management (CTEM) aims to prioritize whatever most threatens the enterprise, whether or not such threats come with a known CVE or are even an unclassified vector for a ransomware attack.

Wherever an organization ranks on the path to CTEM and vulnerability management maturity, IT and cyber leaders are rapidly reducing business risk by adding attack path management (APM) to their programs. The following is a condensed version of a conversation on the topic between Luke Luckett, Director of Product Marketing, and Pete McKernan, Strategic Partner Engineer, who collaborate on Attack Path Management education at SpecterOps.

Luke Luckett: Good morning, Pete. Great to be with you today. In a recent conversation with one of our enterprise customers, you mentioned that Attack Path Management should be a critical part of every organization’s vulnerability management process. That got me curious and I wanted to learn more. So let’s start from the top: what are the key elements of a robust vulnerability management program?

Pete McKernan: Sure. The key elements of any security program start with having a security operations center (SOC) that’s responsible for both maintaining the security baseline of systems and monitoring the environment for any security events. Vulnerability management falls under that umbrella, and it’s about ensuring that systems run as they should. This ties in directly with Attack Path Management, which aligns with vulnerability management in terms of maintaining security over time.

Then, you have SOC analysts using various event monitoring tools to correlate different events and identify risks before things go haywire. Essentially, vulnerability management and Attack Path Management are like twin pillars of a defensive operation — each one is critical to ensuring that systems remain secure.

Luke Luckett: That makes sense. How does Attack Path Management (or APM, as it’s commonly known) fit into that structure?

Pete McKernan: APM complements vulnerability management. Think of vulnerability management as handling patching and configuration of the organization’s software and networks, but it only covers a portion of the environment. APM, particularly with tools like Bloodhound Enterprise, goes deeper by focusing on identity-related risks that traditional vulnerability management tools don’t handle. For example, vulnerability management is great for securing software and checking network configurations, but it doesn’t address how an attacker could exploit an identity system like Active Directory or Entra ID to move laterally across the network.

APM fills this gap by identifying hidden relationships within the environment — using graph theory, for instance — to find weak spots that aren’t immediately visible. This approach supports a “better together” strategy, where traditional vulnerability management tools work hand-in-hand with APM to provide a more complete security picture.

Identity Attack Path Management is a critical part of a robust CTEM and Vulnerability Management strategy. APM helps solve the problem of attack paths, which are often attackers’ quickest path to lateral movement, unauthorized escalations and domain takeovers.

Luke Luckett: That’s really interesting. So how are you seeing security leaders go about integrating Attack Path Management into an existing CTEM or vulnerability management process?

Pete McKernan: The first step is education. The CISO needs to understand what Attack Path Management is and how it fits within the organization’s broader security landscape. Once they grasp the basics, they should engage their vulnerability management team to start a conversation about identity security. Many organizations already have tools (and even separate identity teams) that monitor identity-related risks, but they may not be leveraging them effectively.

I recommend starting with BloodHound’s Community Edition, running it in their environment, and letting the data speak for itself. BloodHound helps blue teams and red teams better understand privileged relationships (attack paths) in Active Directory, Entra, and hybrid environments — so they can eliminate those attack paths. Once teams see the results and the risks highlighted, they can take the next steps to engage further with tools like BloodHound Enterprise. From there, it’s about fusing the data from APM and vulnerability management to get a full picture of the organization’s security posture. You don’t need to build an entirely new program — just empower your current team to see the other half of the picture.

Luke Luckett: It sounds like Attack Path Management provides that extra layer of visibility.

Pete McKernan: Exactly. Vulnerability management typically focuses on the software and network side of things, ensuring that patches are applied, configurations are secure, and no known vulnerabilities are present. But APM looks at how attackers could exploit identities within the organization. For example, if an attacker exploits a vulnerable application on the perimeter, they can use the application’s identity in Active Directory to move laterally and escalate privileges. This is why securing identity is so crucial — it’s often the preferred method of attack in today’s environment.

Luke Luckett: So, how does APM help in real-world scenarios?

Pete McKernan: With APM platforms like Bloodhound Enterprise, we see everything that traditional vulnerability management tools don’t. For example, vulnerability management tools don’t track identities or monitor how they interact across the network. Attackers often weave in and out of both identity and technology silos, meaning they’ll exploit a vulnerable technology and then leverage compromised identities to move through the network.

APM can map out these hidden pathways that attackers might use to gain access to sensitive areas, providing a level of visibility that’s just not available through traditional means. It helps organizations take proactive measures by identifying the vulnerabilities in their identity infrastructure — like dormant accounts with excessive permissions or forgotten groups nested deep within the network.

Luke Luckett: That brings us to the integration process. It sounds like the SOC and vulnerability management teams can easily add APM into their existing workflows.

Pete McKernan: Absolutely. APM integrates almost seamlessly with vulnerability management workflows. Both processes involve scanning systems, analyzing data and taking action based on the findings. Where APM really shines is in the fusion of identity data with the results of vulnerability scans. Once you have that complete picture, you can make far more informed decisions about the security of your environment. Integrating APM data becomes very simple for organizations utilizing data lakes and SIEMs to orchestrate action.

The key is to enable the teams you already have. They’re likely trained and capable of doing this work, but they need the right tools to see both the technological and identity-related risks. Once they have that, you don’t need to build a new program — just add the data and leverage the expertise you already have in place.

Luke Luckett: That makes a lot of sense. Really appreciate your time and expertise on this important topic, Pete! Thank you.

Closing the Gaps: How Attack Path Management Improves Vulnerability Management Programs was originally published in Posts By SpecterOps Team Members on Medium, where people are continuing the conversation by highlighting and responding to this story.

The post Closing the Gaps: How Attack Path Management Improves Vulnerability Management Programs appeared first on Security Boulevard.

Virtual CISO services can help managed service providers (MSPs) harden their attack surface management strategy and unlock growth. Read on to learn how.

The post Leverage vCISO Services to Unlock Managed Service Provider (MSP) Success appeared first on Security Boulevard.

In the world of managed service providers (MSPs), staying ahead of the curve requires constant innovation, particularly in data management and operational efficiency. I recently had the opportunity to interview Callen Sapien, President and acting Chief Security Officer (CSO) of MSPBots on the show floor of the Build IT event in Orlando, FL, to explore

The post Unlocking New Potential with MSPBots: A Conversation with Callen Sapien appeared first on Seceon Inc.

The post Unlocking New Potential with MSPBots: A Conversation with Callen Sapien appeared first on Security Boulevard.

4 min read Just when I thought I was out, they (non-human identities and a young startup named Aembit) pulled me back in.

The post Why I Came Out of (Pseudo) Retirement to Help Solve the Non-Human Identity Challenge as Aembit’s CISO appeared first on Aembit.

The post Why I Came Out of (Pseudo) Retirement to Help Solve the Non-Human Identity Challenge as Aembit’s CISO appeared first on Security Boulevard.

Despite slower hiring trends and tighter budgets, chief information security officer (CISO) compensation continues to rise, with the average U.S.-based CISO earning $565K, and top earners exceeding $1 million.

The post Average CISO Compensation Tops $500K appeared first on Security Boulevard.

MEDIA ADVISORY Leading experts to share insights on using orchestration to protect legacy identity systems with modern cloud identity platforms without code rewriting  BOULDER, Colo., Oct. 2, 2024 – Strata Identity, the Identity Orchestration company, today announced it will host a free webinar on October 3rd with CyberArk on how to eliminate the costly, time-consuming...

The post Strata Identity and CyberArk to Host Webinar on Transforming Legacy Identity by Embracing Modern IAM appeared first on Strata.io.

The post Strata Identity and CyberArk to Host Webinar on Transforming Legacy Identity by Embracing Modern IAM appeared first on Security Boulevard.

Silver Spring, Maryland, 2nd October 2024, CyberNewsWire

The post Mario Duarte, Former Snowflake Cybersecurity Leader, Joins Aembit as CISO to Tackle Non-Human Identities appeared first on Security Boulevard.

Canonical has released security updates for Ubuntu 16.04 ESM and Ubuntu 18.04 ESM to address multiple vulnerabilities in Git, a powerful and widely-used distributed version control system. These vulnerabilities may allow malicious attackers to overwrite files outside the repository, inject arbitrary configuration, or even execute arbitrary code. In this article, we’ll explore the details of […]

The post Addressing Git Vulnerabilities in Ubuntu 18.04 and 16.04 appeared first on TuxCare.

The post Addressing Git Vulnerabilities in Ubuntu 18.04 and 16.04 appeared first on Security Boulevard.

Reaching p=reject does not mean your DMARC management ...

The post What Happens After p=Reject: Beyond the DMARC Golden Standard  appeared first on EasyDMARC.

The post What Happens After p=Reject: Beyond the DMARC Golden Standard  appeared first on Security Boulevard.

As of June 30, 2024, the CentOS Project ceased all updates and releases for CentOS Linux. CentOS Stream serves as the upstream development platform for future RHEL releases. CentOS Stream 9 will continue to receive regular updates, providing users with the latest features and security patches. In December 2020, Red Hat announced a significant shift […]

The post Future of CentOS Stream 9: The Road Ahead appeared first on TuxCare.

The post Future of CentOS Stream 9: The Road Ahead appeared first on Security Boulevard.

Cybersecurity professionals are facing increasing levels of stress, with 66% reporting that their roles have become more demanding over the past five years, according to a report from ISACA.

The post Cybersecurity Professionals Operate Under Increased Stress Levels appeared first on Security Boulevard.

As per a recent Microsoft alert, a threat actor with malicious financial motives has been observed leveraging a new INC ransomware strain to target the health sector in the United States (US). In this article, we’ll dive into the details and determine who the threat actor is and how such attacks are carried out. Let’s […]

The post Microsoft Alert: New INC Ransomware Targets US Healthcare appeared first on TuxCare.

The post Microsoft Alert: New INC Ransomware Targets US Healthcare appeared first on Security Boulevard.

Simplify SOAR playbook development with an artifact-based approach. Learn to integrate tools, categorize commands, map key artifacts, and build effective playbook stages.

The post How to Build a SOAR Playbook: Start with the Artifacts appeared first on D3 Security.

The post How to Build a SOAR Playbook: Start with the Artifacts appeared first on Security Boulevard.

Authors/Presenters:Nirav Atre, Hugo Sadok, Justine Sherry

Our sincere thanks to USENIX, and the Presenters & Authors for publishing their superb 21st USENIX Symposium on Networked Systems Design and Implementation (NSDI '24) content, placing the organizations enduring commitment to Open Access front and center. Originating from the conference’s events situated at the Hyatt Regency Santa Clara; and via the organizations YouTube channel.

Permalink

The post USENIX NSDI ’24 – BBQ: A Fast and Scalable Integer Priority Queue for Hardware Packet Scheduling appeared first on Security Boulevard.