Security Boulevard

In today’s complex cyber landscape, managing risks effectively isn’t just about identifying threats—it’s about understanding their impact and knowing how to prioritize vulnerabilities. With constant changes in the vulnerability landscape, security teams need tools that not only quantify risks but also enable them to act swiftly. This is where KnightVision, a core feature within CyberSaint’s CyberStrong platform, plays a pivotal role. By focusing on cyber risk quantification and vulnerability prioritization, KnightVision helps security leaders make data-driven decisions that strengthen their cybersecurity posture.

The post Transforming Cyber Risk Quantification and Vulnerability Prioritization with KnightVision appeared first on Security Boulevard.

Online brand impersonation is an insidious threat compared to more straightforward attacks. Ransomware, for example, is simply extortion. A cybercriminal encrypts your data, holds it hostage, and demands payment in exchange for encryption keys. The consequences of the attack are either the loss of data or the cost of the ransom (and associated downtime). Online […]

The post Cost of Online Brand Impersonation: Customer Acquisition and Loyalty first appeared on alluresecurity.

The post Cost of Online Brand Impersonation: Customer Acquisition and Loyalty appeared first on Security Boulevard.

This year’s Cyber Security Awareness Month theme is “Generation Cyber Safe: Because online security knows no age”, but what does that mean? The annual theme of

The post Generational security: The meaning behind this year’s Cyber Security Awareness Month theme appeared first on Security Boulevard.

 

The InCyber Forum Canada 2024 conference is an outstanding event, packed with multiple stages, many thought-leadership panels, and an expansive array of vendors showcasing their latest innovation.

Come join me in Montreal Canada, Oct 29th-30th, and check out our panel Protect your Data, Thrive in Business: Strike a Balance on the Trust & Safety stage (Oct 30th, from 2:40pm to 3:40pm).

Registration is open now and here is a bonus: an exclusive 50% discount code on registration, so you can enjoy all the sessions!

Registration link: https://2024.northamerica.forum-incyber.com/en/pe1/pe1-home.htm

Discount code is: ININ59XU2CF3

Panel Abstract: Protecting data while thriving in business is a delicate but much needed balance in today’s digital landscape. Companies are faced with the need to ensure the privacy and security of their customers’ data while continuing to innovate and grow. What are the best practices for striking the right balance?

Esteemed Panel:

• Luc Gagnon — Chief Technology Officer of the Canada Treasury Board
• Sandra Estok — Founder & CEO of Way2Protect
• Brandon Pugh — Director of Cybersecurity and Emerging Threats Policy at R Street Institute
• Tania Tanic — Founder & CEO of Brainstorm CyberRisque
• Matthew Rosenquist — CISO and Cybersecurity Strategist at Mercury Risk
• Nataliya Khylenko (moderator) — President & Founder of KhylenCo Consulting and AdaptAble Academy

The post InCyber Forum Canada 2024 appeared first on Security Boulevard.

In July, I wrote about my new book project on AI and democracy, to be published by MIT Press in fall 2025. My co-author and collaborator Nathan Sanders and I are hard at work writing.

At this point, we would like feedback on titles. Here are four possibilities:

1. Rewiring the Republic: How AI Will Transform our Politics, Government, and Citizenship
2. The Thinking State: How AI Can Improve Democracy
3. Better Run: How AI Can Make our Politics, Government, Citizenship More Efficient, Effective and Fair
4. AI and the New Future of Democracy: Changes in Politics, Government, and Citizenship...

The post More on My AI and Democracy Book appeared first on Security Boulevard.

Authors/Presenters:Lixin Liu, Yuanjie Li, Hewu Li, Jiabo Yang, Wei Liu, Jingyi Lan, Yufeng Wang, Jiarui Li, Jianping Wu, Qian Wu, Jun Liu, Zeqi Lai

Recipient: Outstanding Paper Award

Our sincere thanks to USENIX, and the Presenters & Authors for publishing their superb 21st USENIX Symposium on Networked Systems Design and Implementation (NSDI '24) content, placing the organizations enduring commitment to Open Access front and center. Originating from the conference’s events situated at the Hyatt Regency Santa Clara; and via the organizations YouTube channel.

Permalink

The post USENIX NSDI ’24 – Democratizing Direct-to-Cell Low Earth Orbit Satellite Networks appeared first on Security Boulevard.

Gary Perkins, Chief Information Security Officer, CISO Global While the scale of this data breach is alarming – with 277 gigabytes of data reportedly stolen – it’s important not to panic. Instead, focus on taking concrete steps to protect yourself. Stay informed, be proactive in safeguarding your personal information, and remainvigilant for any signs of […]

The post Identity Under Siege: Responding to the National Public Data Breach appeared first on CISO Global.

The post Identity Under Siege: Responding to the National Public Data Breach appeared first on Security Boulevard.

via the comic humor & dry wit of Randall Munroe, creator of XKCD

Permalink

The post Randall Munroe’s XKCD ‘Solar Protons’ appeared first on Security Boulevard.

The software development lifecycle (SDLC) looks different for every team, but standard methodologies have emerged and evolved to help teams plan, test, and maintain projects with consistency and accuracy. These methodologies offer a clear approach to software development, ensuring each phase of development—from initial design to post-deployment maintenance—executes effectively.

The post SDLC Methodologies: The 7 Most Common appeared first on Security Boulevard.

The goal of any software development lifecycle (SDLC) is to create a great product. And that requires flexibility, customer-centricity, and a philosophy of constant improvement—all attributes of the Agile SDLC. 

The post What Is the Agile SDLC? Benefits, Stages And Implementation appeared first on Security Boulevard.

Earlier this week, on October 9, during the second day of the fall CA/Browser Forum Face-to-Face meeting, Apple revealed that it had published a draft ballot for commentary to GitHub. This proposal, which is sponsored by Sectigo, offers to incrementally phase maximum term for public SSL/TLS certificates down to 45 days between now and 2027. The draft also phases down the DCV reuse period over time, until it reaches 10 days in 2027.

The post Apple Releases Draft Ballot to Shorten Certificate Lifespan to 45 Days appeared first on Security Boulevard.

The Contrast Security Runtime Security Platform — the engine driving Contrast’s Application Detection and Response (ADR) technology — blocked approximately 55.8K cybersecurity attacks during the month of September 2024. 

The post Prevent Path Traversal Attacks with ADR | Contrast Security appeared first on Security Boulevard.

FMR FAIL: Huge investment firm won’t say how it was hacked.

The post (In)Fidelity Admits Data Breach 8 Weeks Ago — 77K PII Lost appeared first on Security Boulevard.

Information and digital security frameworks like FedRAMP, CMMC, and ISO 27001 are not static documents. They provide a static framework for your business to comply with and achieve, but that framework is only valid for so long. Several different forces are in play to ensure that the stipulations and security measures outlined in these frameworks […]

The post ISO 27001 – 2013 vs 2022: Changes, Transition & More appeared first on Security Boulevard.

Managing resource requests and limits in Kubernetes can be challenging, especially for teams that are new to container orchestration or scaling complex workloads. But without proper configuration, your cluster can become unstable, experience resource contention (we call that the noisy neighbor effect), or drive up cloud costs unnecessarily. This is why we created Goldilocks, an open-source tool that helps you get your resource requests and limits just right.

The post Exploring Goldilocks: ‘Just Right’ Resource Management appeared first on Security Boulevard.

Organizations say generative AI is fueling a surge of more sophisticated cyberattacks and that they feel unprepared for the onslaught, but a Keeper Security survey found they are investing more in such foundational protections as data encryption and employee awareness training.

The post Generative AI Fueling More Sophisticated Cyberattacks: Survey appeared first on Security Boulevard.

The .io domain has been a favorite for tech startups, but its potential disappearance is sending ripples through the industry. Discover the reasons behind this change and how it might affect your favorite tech companies and the future of online businesses.

The post The Ripple Effect: .io Domain Disappearance and Its Impact on the Tech Industry appeared first on Security Boulevard.

At CornCon 2024, experts debunk myths, explore SaaS vulnerabilities, and highlight how human connections shape the future of cybersecurity innovation.

The post CornCon X: Powering Cybersecurity Innovation Through Human Connection appeared first on Security Boulevard.

Passwordless Authentication without Secrets!
divya
Fri, 10/11/2024 - 08:54

As user expectations for secure and seamless access continue to grow, the 2024 Thales Consumer Digital Trust Index (DTI) research revealed that 65% of users feel frustrated with frequent password resets. This highlights an increasing demand for advanced authentication methods like passkeys and multi-factor authentication (MFA), which provide robust security for most use cases. However, industries reliant on shared devices—such as healthcare, retail, and manufacturing—face unique challenges. These fast-paced environments need a more flexible approach to balance security, speed, and user privacy.

The Challenges of Shared Devices

In industries where shared devices are the norm, such as healthcare workers accessing patient records or retail employees operating point-of-sale systems, security must remain a priority without sacrificing efficiency. Traditional methods, like password resets or multi-factor prompts, slow down workflows and create friction for users who need quick transitions between devices.

For example, in healthcare, constant authentication interruptions can impact both patient care and productivity. Similarly, in retail and manufacturing, delays caused by authentication procedures reduce overall efficiency. These sectors require an authentication solution that delivers fluidity and security without compromising user experience.

Integrating Thales’s User Journey Orchestration with Badge’s Passwordless Authentication without secrets

The Thales OneWelcome Identity Platform offers advanced user journey orchestration, seamless integration, and robust compliance with data privacy regulations like GDPR and CCPA. Its ability to manage complex identity requirements on validation, consent, and progressive profiling for large infrastructures across diverse industries and use cases makes it the ideal to integrate Badge Inc.’s unique "identity without secrets" approach that uses fuzzy extraction, a cryptographic method that consistently derives a secure key from biometric data, eliminating the need to store passwords or personal information. The Thales Consumer Digital Trust Index (DTI) research, reveals that more than four in five (87%) expect some level of privacy rights from the companies they interact with online.

The Growing Demand for Scalable, Secure Shared Device Solutions

The need for scalable, secure solutions for shared device access is skyrocketing as shared devices are the new normal across multiple industry verticals such as healthcare, manufacturing, or retail. CISO and Operation Managers are increasingly attentive to the security and efficiency returns of frictionless onboarding and authentication for professionals working in dynamic, multi-user environments.

This integration improves user experience by allowing for frictionless transitions across devices, reducing costs related to device loss, while ensuring privacy compliance by eliminating the need to store personal data.

• Streamline user experience: seamless onboarding and access management, with passwordless authentication allows users to move across devices without interruptions, cutting costs by eliminating lost-device issues.
• Enhanced privacy and security: eliminate the need to store personal information, reducing risk and meeting global privacy standards.
• Cost savings: Avoid productivity loss and device-related issues with a passwordless approach that eliminates costly credential resets and lost device management.

The industry has key gaps and areas for improvement. At $9.5 trillion, cybercrime is the world's third largest economy1 , with 70% of organizations experiencing significant disruption to their business resulting from a breach. According to the IBM 2024 Cost of a Data Breach Report, "Breaches involving stolen or compromised credentials took the longest to identify and contain (292 days) of any attack vector," and are among the most prevalent and costliest attack type. By eliminating stored credentials and biometrics, Badge ensures there is nothing to breach.

Account recovery is traditionally highly vulnerable—a weak spot for the industry and a common vector for credential theft. With Badge, there is no credential recovery because there is no credential. Thales is augmenting its identity offering by adding Badge to the integrated solution, authenticating that you are you all along the identity lifecycle.

Thales serves customers around the world with a variety of needs, and therefore optionality is critical. Badge's technology allows organizations to use face, fingerprint, PIN, device characteristics, contextual, and other factors for authentication. A standout feature of Badge is that it maintains high accuracy in recognizing users without increasing errors, and organizations can adjust how strict or lenient the system is, ensuring both security and user convenience.

Improving Shared Device Management with Badge Inc.’s Passwordless Authentication

The integration of Badge Inc.’s unique passwordless authentication enhances identity management for shared devices. The integration allows multiple users to authenticate efficiently, without the delays caused by password resets or complex credential management, ensuring secure, uninterrupted access to shared devices.

In healthcare the integration provides comprehensive IAM capabilities that ensures secure patient and clinician authentication to leading healthcare systems on shared devices without centrally storing biometric templates. In finance and payments, the integration offers robust authentication to secure bank teller, back office, and customer data without requiring added friction and liability such as push notifications to trusted devices. Retail and manufacturing sectors benefit from streamlined operations and improved user experiences across shared devices such as kiosks.

Stay tuned for more updates on how our partnership will drive innovation in IAM. To learn more about how Thales OneWelcome and Badge, Inc. can support your organization, visit us at the Thales booth at Authenticate 2024 Conference, October 14-16, in Carlsbad, CA.

Access Control Identity & Access Management Cloud Security Compliance

Marco Venuti | IAM Enablement & Acceleration Director
More About This Author > Schema {
"@context": "https://schema.org",
"@type": "BlogPosting",
"headline": "Passwordless Authentication without Secrets",
"description": "Explore how Thales integrates Badge Inc.'s passwordless authentication technology for shared devices, improving security and user experience in industries like healthcare and retail.",
"author": {
"@type": "Person",
"name": "Marco Venuti",
"url": "https://cpl.thalesgroup.com/blog/author/mvenuti"
},
"publisher": {
"@type": "Organization",
"name": "Thales Group",
"description": "The world relies on Thales to protect and secure access to your most sensitive data and software wherever it is created, shared, or stored. Whether building an encryption strategy, licensing software, providing trusted access to the cloud, or meeting compliance mandates, you can rely on Thales to secure your digital transformation.",
"url": "https://cpl.thalesgroup.com",
"logo": "https://cpl.thalesgroup.com/sites/default/files/content/footer/thaleslogo-white.png",
"sameAs": [
"https://www.facebook.com/ThalesCloudSec",
"https://www.twitter.com/ThalesCloudSec",
"https://www.linkedin.com/company/thalescloudsec",
"https://www.youtube.com/ThalesCloudSec"
]
},
"mainEntityOfPage": {
"@type": "WebPage",
"@id": "https://cpl.thalesgroup.com/blog/access-management/passwordless-authentication-without-secrets"
},
"datePublished": "2024-10-11",
"dateModified": "2024-10-11"
}

basic

The post Passwordless Authentication without Secrets! appeared first on Security Boulevard.

Microsoft has recently identified a threat actor known as Storm-0501 targeting government, manufacturing, transportation, and law enforcement sectors in the United States (US) in a cloud ransomware attack campaign. In this article, we’ll dive into the details of the campaign and determine how such attacks are carried out. Let’s begin!  Cloud Ransomware Attack Campaign Hacker […]

The post Cloud Ransomware Attack: Microsoft Sees Storm-0501 As Threat appeared first on TuxCare.

The post Cloud Ransomware Attack: Microsoft Sees Storm-0501 As Threat appeared first on Security Boulevard.