At long last, there’s a spotlight — Application Detection and Response (ADR) — that shines the light into what’s been a blindspot: namely, the application layer.
The post Application Layer Security: ADR Brings the Application Layer into Cybersecurity Monitoring and Response | Contrast Security appeared first on Security Boulevard.
Frequently asked questions about a zero-day vulnerability in Fortinet’s FortiManager that has reportedly been exploited in the wild.
BackgroundThe Tenable Security Response Team (SRT) has compiled this blog to answer Frequently Asked Questions (FAQ) regarding a zero-day vulnerability in Fortinet’s FortiManager.
FAQWhat is FortiJump?
FortiJump is a name given to a zero-day vulnerability in the FortiGate-FortiManager (FGFM) protocol in Fortinet’s FortiManager and FortiManager Cloud. It was named by security researcher Kevin Beaumont in a blog post on October 22. Beaumont also created a logo for FortiJump.
What are the vulnerabilities associated with FortiJump?
On October 23, Fortinet published an advisory (FG-IR-24-423) for FortiJump, assigning a CVE identifier for the flaw.
CVE Description CVSSv3 CVE-2024-47575 FortiManager Missing authentication in fgfmsd Vulnerability 9.8What is CVE-2024-47575?
CVE-2024-47575 is a missing authentication vulnerability in the FortiGate to FortiManager (FGFM) daemon (fgfmsd) in FortiManager and FortiManager Cloud.
How severe is CVE-2024-47575?
Exploitation of FortiJump could allow an unauthenticated, remote attacker using a valid FortiGate certificate to register unauthorized devices in FortiManager. Successful exploitation would grant the attacker the ability to view and modify files, such as configuration files, to obtain sensitive information, as well as the ability to manage other devices.
Obtaining a certificate from a FortiGate device is relatively easy:/pblockquote class=reddit-embed-bq data-embed-height=377pa href=https://www.reddit.com/r/fortinet/comments/1g9bxfk/comment/lt72xjd/Comment/abrby from discussionbrina href=https://www.reddit.com/r/fortinet/fortinet/a/p/blockquotepnbsp;/ppAccording to a href=https://www.shodan.io/search?query=port%3A541+xaburesults from Shodan/u/a, there are nearly 60,000 FortiManager devices that are internet-facing, including over 13,000 in the United States, over 5,800 in China, nearly 3,000 in Brazil and 2,300 in India:/pimg src=https://www.tenable.com/sites/default/files/images/blog/2009fd1c-5bc4-42a6-9839-3decd7b4c7b1.png alt=Shodan search results for Fortinet FortiManager devices that are internet-facing. width=449 height=666 referrerpolicy=no-referrer loading=lazypstrongWhen was FortiJump first disclosed?/strong/ppThere were reports on Reddit that Fortinet proactively notified customers using FortiManager about the flaw ahead of the release of patches, though some customers say they never received any notifications. Beaumont a href=https://cyberplace.social/@GossiTheDog/113299762582288860uposted a warning to Mastodon on October 13/u/a:/pblockquote class=mastodon-embed data-embed-url=https://cyberplace.social/@GossiTheDog/113299762582288860/embeda href=https://cyberplace.social/@GossiTheDog/113299762582288860 target=_blank/adiva href=https://cyberplace.social/@GossiTheDog/113299762582288860 target=_blankPost by @[email protected]/a/divdiva href=https://cyberplace.social/@GossiTheDog/113299762582288860 target=_blankView on Mastodon/a/div/blockquotepnbsp;/ppstrongWas this exploited as a zero-day?/strong/ppYes, according to both Beaumont and Fortinet, FortiJump has been exploited in the wild as a zero-day./ppstrongWhich threat actors are exploiting FortiJump?/strong/ppNo specific threat actors have been attributed to the exploitation of FortiJump, though reports suggest the flaw has been exploited by nation-state groups as part of cyber espionage activity./ppstrongIs there a proof-of-concept (PoC) available for this vulnerability/these vulnerabilities?/strong/ppAs of October 23, there are no public proof-of-concept exploits available for FortiJump./ppstrongAre patches or mitigations available for FortiJump?/strong/ppThe following table contains a list of affected products, versions and fixed versions./pdiv class=table-responsivetable class=tabletheadtrthstrongAffected Product/strong/ththstrongAffected Versions/strong/ththstrongFixed Version/strong/th/tr/theadtbodytrtdFortiManager 6.2/tdtd6.2.0 through 6.2.12/tdtdUpgrade to 6.2.13 or above/td/trtrtdFortiManager 6.4/tdtd6.4.0 through 6.4.14/tdtdUpgrade to 6.4.15 or above/td/trtrtdFortiManager 7.0/tdtd7.0.0 through 7.0.12/tdtdUpgrade to 7.0.13 or above/td/trtrtdFortiManager 7.2/tdtd7.2.0 through 7.2.7/tdtdUpgrade to 7.2.8 or above/td/trtrtdFortiManager 7.4/tdtd7.4.0 through 7.4.4/tdtdUpgrade to 7.4.5 or above/td/trtrtdFortiManager 7.6/tdtd7.6.0/tdtdUpgrade to 7.6.1 or above/td/trtrtdFortiManager Cloud 6.4/tdtd6.4 all versions/tdtdMigrate to a fixed release/td/trtrtdFortiManager Cloud 7.0/tdtd7.0.1 through 7.0.12/tdtdUpgrade to 7.0.13 or above/td/trtrtdFortiManager Cloud 7.2/tdtd7.2.1 through 7.2.7/tdtdUpgrade to 7.2.8 or above/td/trtrtdFortiManager Cloud 7.4/tdtd7.4.1 through 7.4.4/tdtdUpgrade to 7.4.5 or above/td/trtrtdFortiManager Cloud 7.6/tdtdNot affected/tdtdNot Applicable/td/tr/tbody/table/divpFortinet’s advisory provides workarounds for specific impacted versions if patching is not feasible. These include blocking unknown devices from attempting to register to FortiManager, creating IP allow lists of approved FortiGate devices that can connect to FortiManager and the creation of custom certificates. Generally speaking, it is advised to ensure FGFM is not internet-facing./ppstrongHas Tenable released any product coverage for these vulnerabilities?/strong/ppA list of Tenable plugins for this vulnerability can be found on the individual CVE page for a href=https://www.tenable.com/cve/CVE-2024-47575/pluginsuCVE-2024-47575/u/a as they’re released. This link will display all available plugins for this vulnerability, including upcoming plugins in our a href=https://www.tenable.com/plugins/pipelineuPlugins Pipeline/u/a./ph3Get more information/h3ullia href=https://doublepulsar.com/burning-zero-days-fortijump-fortimanager-vulnerability-used-by-nation-state-in-espionage-via-msps-c79abec59773uBurning Zero Days: FortiJump FortiManager vulnerability used by nation state in espionage via MSPs/u/a/lilia href=https://www.fortiguard.com/psirt/FG-IR-24-423uFortiGuard Labs PSIRT FG-IR-24-423 Advisory/u/a/li/ulpemstrongJoin /strong/ema href=https://community.tenable.com/s/group/0F9f2000000fyxyCAA/cyber-exposure-alertsemstronguTenable's Security Response Team/u/strong/em/aemstrong on the Tenable Community./strong/embremstrongLearn more about /strong/ema href=https://www.tenable.com/products/tenable-oneemstronguTenable One/u/strong/em/aemstrong, the Exposure Management Platform for the modern attack surface./strong/em/p
img src=https://www.tenable.com/sites/default/files/images/articles/blog-tenable-research-advisory-high-FAQ_7.jpg /
The post CVE-2024-47575: Frequently Asked Questions About FortiJump Zero-Day in FortiManager and FortiManager Cloud appeared first on Security Boulevard.
In recent years, the adoption and growth of open source software (OSS) have soared, with 2024 set to break records, projecting over 6.6 trillion downloads by year-end. The vast influence of open source now underpins nearly every aspect of software development.
The post The scale of open source: Growth, challenges, and key insights appeared first on Security Boulevard.
Authors/Presenters:Paulo Silva, David Sopas
Our sincere appreciation to DEF CON, and the Presenters/Authors for publishing their timely DEF CON 32 erudite content. Originating from the conference’s events located at the Las Vegas Convention Center; and via the organizations YouTube channel.
The post DEF CON 32 – AppSec Village – Speed Bumps and Speed HacksP: Adventures in Car Mfg Security appeared first on Security Boulevard.
Discover how a one-week SOAR migration is possible. Learn the key steps to seamlessly transition from your legacy SOAR platform to D3.
The post One-Week SOAR Migration: It’s a Fact appeared first on D3 Security.
The post One-Week SOAR Migration: It’s a Fact appeared first on Security Boulevard.
via the respected Software Engineering expertise of Mikkel Noe-Nygaard and the lauded Software Engineering / Enterprise Agile Coaching work of Luxshan Ratnaravi at Comic Agilé!
The post Comic Agilé – Mikkel Noe-Nygaard, Luxshan Ratnaravi – #310 – The Day After PI Planning appeared first on Security Boulevard.
Keeping up with the world of cybercrime is important but can often feel overwhelming for security practitioners. Leaky Weekly is a podcast hosted by security researcher Nick Ascoli as he dives into the most pressing stories on data leaks, cybercrime, and the dark web in the last week or so. On this episode of Leaky […]
The post Dark Web Forum Arrests, Columbus Ransomware Attack Updates, and American Background Info Data Leak appeared first on Flare | Cyber Threat Intel | Digital Risk Protection.
The post Dark Web Forum Arrests, Columbus Ransomware Attack Updates, and American Background Info Data Leak appeared first on Security Boulevard.
Application programming interface (API) vulnerabilities surged 21% in the third quarter, with cloud-native infrastructure increasingly targeted by cybercriminals, according to Wallarm’s Q3 2024 API ThreatStats report.
The post API Vulnerabilities Jump 21% in Third Quarter appeared first on Security Boulevard.
The SEC has fined four major companies for materially misleading investors regarding cyberattacks.
Tech in TroubleRegulatory actions have been brought against Unisys, Avaya, Check Point, and Mimecast for their purposeful decisions to not clearly inform customers and shareholders of the attacks and breaches they suffered as part of the SolarWinds cyberattack.
The SEC concluded that these companies were purposely vague by framing their cybersecurity risk factors hypothetically or discussing them in generic terms, even after knowing the issues were present and material.
Reporting material issues to shareholders is a requirement for public companies, so investors will have the same information to make decisions as the insiders of the company.
Jorge G. Tenreiro, acting chief of the Crypto Assets and Cyber Unit, warned that “downplaying the extent of a material cybersecurity breach is a bad strategy”.
The result of this investigation is that Unisys Corporation is fined $4 million as a civil penalty for misleading disclosures and a failure to maintain proper controls over its public statements. Check Point, Avaya, and Mimecast were fined close to $1 million each for similar reasons.
Message to CISOsThe message to boards, C-suites, and especially Chief Information Security Officers (CISOs) is clear — report material breaches as required by the governing regulations. Misleading or false statements are not acceptable.
Sanjay Wadhwa, Acting Director of the SEC’s Division of Enforcement, stated “…while public companies may become targets of cyberattacks, it is incumbent upon them to not further victimize their shareholders or other members of the investing public by providing misleading disclosures about the cybersecurity incidents they have encountered”
Security must be seen as a center of trust. Ethical representations of risks and impacts are the foundation. This includes messages and formal notifications to shareholders and customers. CISOs must recognize their new responsibilities and actively navigate conflicts of interest they experience, and honor their duties.
SEC Press Release: https://www.sec.gov/newsroom/press-releases/2024-174
The post SEC is Not Accepting Half-Truths appeared first on Security Boulevard.
In this episode, Paul Asadoorian and Matt Johansen discuss the recent targeted attacks by Chinese threat actors, particularly focusing on the Volt Typhoon group. They explore the implications of back doors in cybersecurity, the role of ISPs, and the ongoing tension between privacy and security. The conversation delves into historical contexts, the evolution of threat […]
The post BTS #40 - Backdoors in Backdoors - Matt Johansen appeared first on Eclypsium | Supply Chain Security for the Modern Enterprise.
The post BTS #40 – Backdoors in Backdoors – Matt Johansen appeared first on Security Boulevard.
FortiFAIL: Remote code execution vulnerability still not acknowledged by Fortinet after 10+ days’ exploitation.
The post FortiJump: Yet Another Critical Fortinet 0-Day RCE appeared first on Security Boulevard.
Authors/Presenters:Jerry Gamblin
Our sincere appreciation to DEF CON, and the Presenters/Authors for publishing their timely DEF CON 32 erudite content. Originating from the conference’s events located at the Las Vegas Convention Center; and via the organizations YouTube channel.
The post DEF CON 32 – AppSec Village – Using EPSS for Better Management Vulnerability Management appeared first on Security Boulevard.
Proactive strategies to protect your critical data, strengthen your SaaS security and equip your security team for success.
The post The Definitive Guide to SaaS Security eBook appeared first on AppOmni.
The post The Definitive Guide to SaaS Security eBook appeared first on Security Boulevard.
Cary, NC, Oct. 22, 2024, CyberNewswire — INE Security offers essential advice to protect digital assets and enhance security.
As small businesses increasingly depend on digital technologies to operate and grow, the risks associated with cyber threats also escalate. INE … (more…)
The post News alert: INE Security shares cyber hygiene guidance for small- and medium-sized businesses first appeared on The Last Watchdog.
The post News alert: INE Security shares cyber hygiene guidance for small- and medium-sized businesses appeared first on Security Boulevard.
Adds new competency through demonstration of deep technical expertise in security and proven customer success.
The post Kasada Achieves AWS Security Competency Status appeared first on Security Boulevard.
An OT security program can lead to better resource use, improved security operations, and tangible gains for the security posture of an OT operator. The benefits of running an OT security program include: At a fundamental level, an OT security program provides a strong foundation for an enterprise to adopt and scale up security measures. What is OT security program maturity? Based on various factors, an OT security program can be graded into the following tiers: Parameter Mature OT Security Program Evolutionary/Evolving OT Security Program Early stage OT Security Program Score Clear delineation of roles and responsibilities All personnel across functions are clear about their roles and responsibilities. All employees are in alignment with the assigned roles for managing security collectively. Every team has a employee responsible for security. This delineation is clear within the security operations teams. The larger organization does not subscribe to the program or subscribes in parts driven by a compliance mandate or any other factor that originates from outside the organization. Security teams are solely responsible for security. In the event of an incident, the security team is held responsible. Security measures are driven by a well-drafted security policy and a governance framework that is binding for all employees Yes. All teams and employees are governed through and are required to adhere to a security policy that may derive elements from standards such as IEC 62443 yet projects a distinct security mandate while incorporating cultural elements from the organization and its operational imperatives. The policy clearly articulates the security requirements at all operational and asset levels. The policy is generic in nature without paying any attention to the unique institutional character of the organization. Compliance to the policy is also partial and episodic. There is no policy in place Management and senior leadership are engaged in the security program and are active contributors Fully engaged and security-sensitive management Management is partially engaged and does not track the program Management is not connected with the program in any way Evolved incident response and disaster recovery mechanisms Followed in letter and spirit with clear protocols A mix of proactive and reactive measures are in place. Assets and data are at risk due to a potential for delay in intervention after an incident No measures in place Risk assessment and gap analysis audit frequency Once every 180 days Once every 365 days Infrequent or performed in an adhoc manner Institutional action on OT security audit findings Key audit findings are addressed within a pre-agreed time frame. OT security policy is modified to reflect major suggestions Audit findings are addressed but not in a time bound manner If an audit is done, then the findings are ignored or filed without any action being taken Program coverage 100 percent across assets, infrastructure, services, process, sites and networks Partial Less or none Security Operations coverage – asset visibility, vulnerability and patch management, secure remote access, SOC, hard segmentation of OT and IT networks Complete/100 percent Partial Less or none Improvement in key security operations metrics such as MTTD, MTTR, number of events closed, percentage of false positives over the last 11 months 30 percent 15 but less than 30 < 10 percent improvement Has the program been evaluated by a qualified third party? Yes No No How frequently OT security awareness programs run? Once a quarter Once every 9 months Only in October Are crown jewels and legacy systems residing behind a DMZ? Yes Yes No Strong anomaly and breach detection capabilities Yes Approaching strong but not yet there Weak or non-existent Countermeasures in place around access controls and insider activity Yes Partial measures in place No Cybersecurity risk in ICS environment is managed through strategic security planning and controls Yes Partial measures in place No OT security assurance is arrived through risk minimization and management of risk exposure Yes Partial measures in place No Lifecycle measures in place for each aspect mentioned above Yes Partial measures in place No ICS controls derived from last OT security audit cycle implemented Yes Partially No Secure design architecture and engineering compliance in place Yes Initial/rudimentary No Microsegmentation implemented Yes No No Calculating the score of your OT Security program To derive your OT security program effectiveness score, assign 40 points for each mature program parameter met, 20 for each evolving program parameter met and 5 or 0 (for each No) for every early stage program parameter met. For example for the parameter “Microsegmentation Implemented”, the following score will apply: Yes: 40 points No: 0No: 0 For the “Secure design architecture and engineering compliance in place” parameter you can follow the below points scheme: Yes: 40 pointsInitial/rudimentary: 20 pointsNo: 0 points If your total score is above 650 points, then you are running a mature OT security program. Congratulations. If your total score is above 350 but less than 650, then you are running an evolving security program. Let’s ramp up. If your total score is below 350 points, then you have a lot of catching up to do. No matter where your OT security program is on the above scale, Sectrio can help you run a model and relevant security program that is also high on RoI. Talk to our OT security program expert now through a free consultation to figure out your next steps. 62443, NIST CSF, and NIST SP 800, talk to a Sectrio OT governance expert. Book a consultation with our ICS security experts now. Contact Us Thinking of an ICS security training program for your employees? Talk to us for a custom package.
The post How to evaluate OT security program maturity appeared first on Security Boulevard.
IBM is rolling out Guardian Data Security Center, a framework designed to give enterprises the tools they need to address the emerging cyberthreats that come the ongoing development of generative AI and quantum computing.
The post IBM Addresses AI, Quantum Security Risks with New Platform appeared first on Security Boulevard.
Many organizations have experienced significant data breaches after inadvertently exposing secrets such as tokens, API keys, digital certificates, and user credentials that attackers gained access to. Many factors have made it harder to avoid secrets exposure, including the adoption of cloud services and DevOps practices, the increase in distributed work environments, the rise of automated workflows, and the use of unmonitored tools and external services.
The post Keep your secrets secret: 5 core tips — and a call to action on modernizing appeared first on Security Boulevard.
October 2024 marked an exciting time for SquareX as we returned to our home ground, Singapore, for two significant back-to-back events: Cyber Security World Asia (part of Singapore Tech Week) from October 9–10 and GovWare 2024 from October 15–17.
Both prominent cybersecurity events were held at the Sands Expo and Convention Centre and featured leading voices in digital security, policymakers, and professionals across industries. With a combined attendance of over 30,000 people, these events are known for driving innovation and collaboration in cybersecurity.
At both events, SquareX was proud to showcase our industry-first Browser Detection and Response (BDR) solution, which has evolved significantly since our last appearance at GovWare 2023. We engaged with attendees, answered questions about the various use cases across industries, and demonstrated how our browser-native security solution protects employees from modern client-side threats — in a way no other solution has done before.
In addition to thought-provoking discussions, we also distributed exclusive SquareX merchandise to booth visitors, including limited-edition T-shirts, stickers, and copies of Hackers: Superheroes of the Digital Age.
Our Experience at Cyber Security World Asia & GovWare 2024The SquareX booth was buzzing with activity throughout both events. Visitors were eager to learn more about the practical applications of our industry-first BDR solution, especially as the browser becomes an increasingly large attack surface across sectors. We received insightful questions about how SquareX can be tailored to different organizational needs, from protecting employees from malicious websites, to preventing data leakage and enabling secure browsing for distributed workforces.
Our swag was also a hit, with many attendees complimenting the robot-themed artwork and creative designs we had on display. The interaction with cybersecurity professionals, thought leaders, and industry friends made these two weeks even more fulfilling.
Another highlight was how our Chief Architect Jeswin Mathai, also delivered an insightful talk titled “The Silver Bullet in Your Enterprise Defense Strategy: Browser Security Solutions” at Cyber Security World Asia 2024. Attended by different professionals, students, and security researchers, the session explored how SMEs and non-profits can benefit from a browser security solution, as opposed to relying solely on traditional measures like Secure Web Gateways.
Jeswin highlighted the unique advantages of adopting browser-native security, emphasizing how it addresses the gaps in current security infrastructure, especially for resource-constrained organizations. The audience’s engagement demonstrated a growing interest in practical, cutting-edge solutions that go beyond legacy systems.
We were also thrilled to have press coverage, including live interviews with from our Product Evangelist Dakshitaa Babu, by Cyber Security World Asia, and Martin from AOPG (Asia Online Publishing Group) interviewing our Chief Architect Jeswin. Stay tuned for the full episodes!
Reflections on Two Weeks of SuccessExhibiting at two major events in consecutive weeks was intense, but the energy and interest from attendees made it all worthwhile. The growing awareness and understanding of browser-native security — and the role SquareX plays as a pioneer in this space — was evident from the feedback we received.
For us, these events were not just an opportunity to showcase our solutions but also a chance to learn more about our customers’ needs. Engaging directly with the community gave us valuable insights to refine our approach and further align our messaging.
We wrapped up both conferences with a deep sense of fulfillment, knowing we had spread the word, sparked meaningful conversations and strengthened our ties to the Singaporean cybersecurity community.
https://medium.com/media/7749be14c570daaa2d74354aa778da32/href
We hope everyone who visited our booth at Cyber Security World Asia and GovWare 2024 enjoyed the experience as much as we did. If you’d like to learn more about SquareX and how our Browser Detection and Response solution can protect your organization, contact us today to schedule an obligation-free pilot!
Showcasing our Industry-First BDR Solution in Singapore was originally published in SquareX Labs on Medium, where people are continuing the conversation by highlighting and responding to this story.
The post Showcasing our Industry-First BDR Solution in Singapore appeared first on Security Boulevard.
Authors/Presenters:Javan Rasokat
Our sincere appreciation to DEF CON, and the Presenters/Authors for publishing their timely DEF CON 32 erudite content. Originating from the conference’s events located at the Las Vegas Convention Center; and via the organizations YouTube channel.
The post DEF CON 32 – AppSec Village – Lessons Learned from Building and Defending LLM Applications appeared first on Security Boulevard.
