Security Boulevard

Thank You Chicago! Earlier this week we had the pleasure of hosting a regional API Security Summit in Chicago (well, actually in Lombard). These summits bring together the local cybersecurity community for  half-day of API Security-focused content, including expert speakers and panelists. While this isn’t the first time we’ve organized an event like this, it [...]

The post Chicago API Security Summit 2024 appeared first on Wallarm.

The post Chicago API Security Summit 2024 appeared first on Security Boulevard.

Insight #1: Don't shrug off this internet plague! Cross-site scripting (XSS) is the overlooked vulnerability plaguing the web. As Contrast’s
recent attack data show, it's everywhere, yet it’s often dismissed as “'low risk.” The truth? This prevalence makes XSS more of a threat, and it's easily exploited. Fortunately,
Application Detection and Response (ADR) is here to help you stop it!   Insight #2: Finding root cause doesn't always solve the problem 

Root cause analysis is not just about figuring out the technical problems that may have occurred, as Forbes describes. Technical problems rarely exist in isolation. They often occur within the context of a larger process or workflow. If that process is inefficient, it can create conditions that make technical problems more likely to occur, or harder to detect and fix.

  Insight #3: Fixing culture helps fix security  So many interesting interactions with peers over the last few months are making me realize that there is still a major disconnect between finding and fixing vulnerabilities and the culture that drives it. Too many security leaders don't care about culture and care more about resolving risk. But I would argue that creating a positive security culture will naturally help to address vulnerabilities faster (
mean time to respond/remediate [MTTR]) and create less vulnerabilities as time goes on (
vulnerability escape rate [VER]). Why can't we get over this hump?

The post Cybersecurity Insights with Contrast CISO David Lindner | 09/20/24 appeared first on Security Boulevard.

More than 2.1 million stolen VPN passwords have been compromised by malware in the past year, highlighting a growing risk for unauthorized access to secure networks, according to a Specops Software report.

The post More Than Two Million Stolen VPN Passwords Discovered appeared first on Security Boulevard.

Security issues stemming from the integration of information technology (IT) and operational technology (OT), could be addressed through artificial intelligence (AI), although the technology could also be leveraged by malicious actors, according to a Cisco study.

The post AI Could Help Resolve IT/OT Integration Security Challenges appeared first on Security Boulevard.

Nearly a third of companies hit by ransomware attacks paid ransoms four or more times in the past year, according to the Semperis 2024 Ransomware Risk report.

The post Companies Often Pay Ransomware Attackers Multiple Times appeared first on Security Boulevard.

The healthcare industry’s swift embrace of digital technologies is revolutionizing care delivery, but it also introduces new and potentially harmful cyber threats that could disrupt operations and jeopardize patient safety. As a result, cyber security in healthcare has become essential, playing a crucial role in protecting sensitive patient information and ensuring that healthcare services remain […]

The post Key Role of Cyber Security in Healthcare appeared first on Kratikal Blogs.

The post Key Role of Cyber Security in Healthcare appeared first on Security Boulevard.

On September 17 and 18, a series of devastating explosions rocked Lebanon, resulting in 37 fatalities and nearly 3,000 injuries, according to the Lebanese Minister of Public Health. Initial investigations suggest these attacks were not mere accidents but rather the result of a sophisticated cyber operation targeting communication devices. Understanding the Attack Experts indicate that […]

The post The Supply Chain Conspiracy: Cyber Attacks Behind the Lebanon Explosions appeared first on NSFOCUS, Inc., a global network and cyber security leader, protects enterprises and carriers from advanced cyber attacks..

The post The Supply Chain Conspiracy: Cyber Attacks Behind the Lebanon Explosions appeared first on Security Boulevard.

Attacks on critical infrastructure  The explosion of the Soviet gas pipeline in 1982 was one of the first well-known instances of critical infrastructure being targeted through a software modification that contained a hidden malfunction. In this instance, the Soviets were stealing Western technology and the CIA slipped the flawed software to them without their knowledge. While the explosion itself didn’t cause any fatalities, it did cause some damage to the Soviet economy as per Washinton Post.      With the intensification of hybrid warfare, we have seen multiple attacks on ICS-based critical infrastructure in Europe and the Middle East. These attacks were designed not just to destabilize the systems but also to cause a major kinetic impact. No systems or assets are out of bounds today. State-backed actors from countries like North Korea are not just after technology and revenue but also act as conduits for other countries to infiltrate the critical infrastructure of their adversary nations.   Read more: Buyers guide to OT/ICS cybersecurity solutions A case study   In a recent instance, Sectrio’s Asset Research Team uncovered an anomaly in hardware supplied to a critical infrastructure operator. In this instance, same OEM supplied was supposed to supply the same hardware to two divisions of the same business. However, the hardware supplied to one entity, when examined, showed a deviation that was found to enable a backdoor communication with an obscure server using a now obsolete protocol that was sparingly used in the 90s.   The OEM in this case claimed that the anomaly was a generational remnant from an old version. How it made its way to only one piece of hardware and not the other is a question that was not answered to our satisfaction. The hardware belonged to the same batch and even had sequential serial numbers adding to the mystery.    This could be a genuine error but it is an error that could potentially be exploited by a bad actor.   Supply chain challenges As the Lebanon episode clearly showed, OEMs now have to ensure the integrity of their hardware well beyond their shop floors. ICS/OT operators should also watch out for anomalous behaviors and risky interactions that could jeopardize operations and plant safety levels. One way of offsetting these challenges is to ensure the systems undergo Security Acceptance Tests (SAT) along with Factory Acceptance Tests (FAT). This will ensure the integrity of the assets and call out any security issues before they are added to the infrastructure.   A ‘maker-checker’ approach is the way to go.   Recommended cybersecurity measures to risk-proof ICS assets  While IEC 62443 and NIST CSF-based risk assessment and gap analysis is a good place to start, the outcomes of such an assessment can and should be used across the enterprise to improve security posture. Here are some of the other steps that can be taken to secure ICS and OT assets and infrastructure:  Talk to us to learn how your crown jewels and assets can be protected through a custom-built ICS/OT cybersecurity plan. Contact us now! Book a consultation with our OT/ICS cybersecurity experts now. Contact Us  Thinking of an ICS security training program for your employees? Talk to us for a custom package.   

The post Exploding pagers and the new face of asset-centric warfare   appeared first on Security Boulevard.

Recent Cybersecurity regulations in the EU impact providers of digital products by setting down new requirements along the software supply chain. Our Cyber Resilience Act (CRA) checklist covers key elements of CRA and how the Sonatype platform enables compliance for your organization.

The post Tackle Cyber Resilience Act requirements with our CRA checklist appeared first on Security Boulevard.

The post What is Network Security Automation? appeared first on AI-enhanced Security Automation.

The post What is Network Security Automation? appeared first on Security Boulevard.

Providers of digital products and services to the EU are being impacted by a suite of new cybersecurity regulations coming into force. Among them is the Digital Operations Resilience Act (DORA), and we've developed a checklist to help you manage key components on your journey to compliance.

The post Sonatype can help you navigate DORA compliance appeared first on Security Boulevard.

Authors/Presenters:Wenxin Li, Xin He, Yuan Liu, Keqiu Li, Kai Chen, Zhao Ge and Zewei Guan, Heng Qi, Song Zhang, Guyue Liu

Our sincere thanks to USENIX, and the Presenters & Authors for publishing their superb 21st USENIX Symposium on Networked Systems Design and Implementation (NSDI '24) content, placing the organizations enduring commitment to Open Access front and center. Originating from the conference’s events situated at the Hyatt Regency Santa Clara; and via the organizations YouTube channel.

Permalink

The post USENIX NSDI ’24 – Flow Scheduling With Imprecise Knowledge appeared first on Security Boulevard.

If your organization is not already preparing to comply with the Cyber Resilience Act (CRA), now's the time to begin. This is a European-wide regulation, which means it will be implemented in the same way across all European Union (EU) member states. However, its practical application will impact anyone placing digital products or products with digital elements into the European market.

The post Compliance webinar series: Understanding the Cyber Resilience Act appeared first on Security Boulevard.

We’re thrilled to introduce Escape’s advanced Jira integration! Bridging the gap between security and development has never been easier.

The post Product Updates: Escape’s Advanced Jira Integration – Send Remediation Details to Your Developers appeared first on Security Boulevard.

Discover how Komori, a century-old printing giant, is leading the charge in cybersecurity innovation by adapting to internet-connected risks and utilizing advanced solutions like NodeZero to safeguard their legacy.

The post Century-Long Innovation: A Legacy of Outpacing Cyber Threats appeared first on Horizon3.ai.

The post Century-Long Innovation: A Legacy of Outpacing Cyber Threats appeared first on Security Boulevard.

Authors/Presenters:Peixuan Gao, Anthony Dalleggio, Jiajin Liu, Chen Peng, Yang Xu, H. Jonathan Chao

Our sincere thanks to USENIX, and the Presenters & Authors for publishing their superb 21st USENIX Symposium on Networked Systems Design and Implementation (NSDI '24) content, placing the organizations enduring commitment to Open Access front and center. Originating from the conference’s events situated at the Hyatt Regency Santa Clara; and via the organizations YouTube channel.

Permalink

The post USENIX NSDI ’24 – Sifter: An Inversion-Free and Large-Capacity Programmable Packet Scheduler appeared first on Security Boulevard.

Critical Security Vulnerabilities (CVE-2024-38856 and CVE-2024-45195) in Apache OFBiz Expose Enterprise Systems to Potential Data Breaches and Disruption of Critical Business Functions Affected Platform  Apache OFBiz is an open-source framework designed for enterprise resource planning (ERP). It supports a range of web applications necessary for various business functions, including human resources, accounting, inventory management, customer...

The post CVE-2024-38856 and CVE-2024-45195 – Apache OFBiz Security Vulnerabilities – August 2024 appeared first on TrueFort.

The post CVE-2024-38856 and CVE-2024-45195 – Apache OFBiz Security Vulnerabilities – August 2024 appeared first on Security Boulevard.

A US news website recently faced a 1.85 billion request DDoS attack. Learn how DataDome stopped the attack in its tracks, keeping the customer safe.

The post How DataDome Protected a US News Website from a 12-Hour DDoS Attack appeared first on Security Boulevard.

Artificial intelligence (AI) is already embedded deep into the economic and social fabric of the world. It does everything from operating website chatbots to authenticating users with their bank. It keeps planes in the sky and cars on the road. It identifies criminals and reviews mortgage and job applications. But as it becomes more important to our daily lives, regulators are getting nervous.

The post The EU AI Act and the Need for Data-Centric Security appeared first on Security Boulevard.

Permiso today added a Universal Identity Graph engine that makes it simpler for cybersecurity teams to visually map the relationship between individuals, applications and systems to better enforce zero-trust IT policies.

The post Permiso Launches Universal Identity Graph to Advance Zero-Trust IT appeared first on Security Boulevard.