F5 Labs

January threat actor activity focused heavily on exploiting a ThinkPHP remote code execution vulnerability and infecting vulnerable Oracle WebLogic systems with a Mirai variant.

F5 Labs' Preston Hogue writes for Security Week, explaining how to manage the personal data you have spread across the internet in an assume breach world.

Key lessons from martial arts translate to cyber-defense, including preparation, taking falls, proper stance, diligent practice, sparring, and continuous growth.

F5 Labs' David Warburton writes for Professional Security, discussing how your stereotypical perception of cybercrime is all wrong - and what to do about it.

More lessons learned from CISOs about “fire and forget,” physical security, the human factor, and audit logging.

How certificate transparency can help you spot fraudulently registered TLS certificates that exploit your domain or brand name.

Gozi “banking” trojan continues to shift its targets beyond banking as it employs client-side and server-side evasion techniques via time-tested web injection.

Don’t just check a box - done right, security awareness training can turn your users into your greatest asset.

F5 Lab's Ray Pompon writes for Help Net Security, discussing how many of our security "solutions" actually just create more work and shift the burden for actually addressing the problem farther down the line.

Using existing protocols and tools to begin building a robust phishing and fraud mitigation strategy.

Learn from CISOs who describe how they would “do it over” again in some of their early security program deployments.

Patching is a tedious and relentless task, but like brushing your teeth to prevent cavities, it keeps holes from forming in your infrastructure.

Large, high-profile data breaches have eroded public trust in data processors. We must adapt our practices in turn.

F5 Labs' Preston Hogue writes for SecurityWeek, tracing the full extent of your digital footprint in the era of big data breaches.

F5 Labs' David Warburton writes for Venafi, explaining one of the key strategies for improving the use of OCSP for certificate revocation.

We surveyed infosec professionals from organizations with at least 5,000 employees to investigate the qualitative differences in running a security program at scale. We also distill 5 principles you can use to have a better chance at success.

F5 Labs' David Warburton writes for Venafi, discussing the different methods for checking a certificate's status, and their relative benefits.

Expect a breach If you have basic, vendor default SSH credentials active on any system.

Threat actors wasted no time jumping on this new exploit to launch new campaigns for reconnaissance, uploading back doors, and deploying variants of the Mirai botnet.

First detected in May 2018, DanaBot is a fraud trojan that has since shifted its targets from banks in Australia to banks in Europe, as well as global email providers such as Google, Microsoft and Yahoo for the holiday phishing season.