Security Boulevard

  Applications are typically tested and guaranteed to function on specific Linux distributions, but may work on others as well. Kernel versions, libraries, and system calls are key factors affecting binary compatibility between distributions. Differences in the operating system’s ABI (Application Binary Interface) are also a frequent source of compatibility problems. Binary compatibility is an […]

The post What is binary compatibility, and what does it mean for Linux distributions? appeared first on TuxCare.

The post What is binary compatibility, and what does it mean for Linux distributions? appeared first on Security Boulevard.

As a part of the Microsoft security update, the tech giant had released several fixes to address 90 critical security flaws. Reports claim that 10 of them have zero day vulnerabilities and 6 out of these 10 have fallen prey to threat actor attempts for exploitation. In this article, we’ll cover these fixes and the […]

The post Microsoft Security Update: 90 Critical Vulnerabilities Fixed appeared first on TuxCare.

The post Microsoft Security Update: 90 Critical Vulnerabilities Fixed appeared first on Security Boulevard.

Choosing the correct cybersecurity service provider is critical for any business in today’s digital world. Rather than selecting a vendor, due diligence is required to secure your data, systems, and networks. To help you make your choice, here are the top 7 questions to ask cybersecurity service providers: 1. What is your experience in handling […]

The post Top 7 Questions to Ask Cybersecurity Service Providers first appeared on StrongBox IT.

The post Top 7 Questions to Ask Cybersecurity Service Providers appeared first on Security Boulevard.

In a recent conversation with Evan Kirstel on the What’s Up with Tech? podcast, Axio CEO Scott Kannry discussed the intersection of cybersecurity and risk management, highlighting the unique approach

Read More

The post Scott Kannry on the What’s Up with Tech? Podcast appeared first on Axio.

The post Scott Kannry on the What’s Up with Tech? Podcast appeared first on Security Boulevard.

Somebody asked me this profound question that (a) I feel needs an answer and that (b) I’ve never answered in the past:

If you run a SOC (or an equivalent D&R team), what things should you require (demand, request, ask, beg … depending on the balance of corporate power) of other teams? Dall-E via Copilot image gen, steampunk

Think of this not as SOC FAQs, but SOC FMDs — Frequently Made Demands…

To frame this a but, this is not about executive sponsorship (you should always “request” executive support, otherwise some efforts are not even worth starting, frankly), or other SOC success “pre-requisites.” This is about the key ongoing “asks” SOC makes of other teams and departments so that it has a chance of being successful with its mission over time.

So when asked this question, my ex-analyst mind went and produced a 3 pillar framework:

1. Assets information
2. Useful signals delivery
3. Triage partnership

Let’s review these three.

Assets Information

If a SOC is tasked with detection and response, they better know the lay of the land that they are defending. “Defender’s Advantage” and all that. If you don’t know the terrain better than the attacker, you already lost.

There is of course a lot of nuance to it, but at some basic level, there should be a way for a team deploying anything to report this to SOC for coverage, and for a SOC to ask a team for their list of assets to be monitored for threats. Assets here may mean servers (hey, the 1990s are NOT reality over, joking aside), cloud assets, SaaS services, applications, etc (it would also be handy for ZT efforts).

Summary: if your mission is to protect assets, ask for the list of assets (sorry, this came out very Capt Obvious, but this is in fact missed in some cases)

Useful Signals Delivery

You should ask for logs! Duh, is that you, Captain Obvious, again? Well, you should ask for specific logs relevant to your mission, you should ask for compliance with a sensible logging policy, and to cover custom applications, you should ask for compliance with a sensible (this means: short!) log standard.

Don’t just ask for “logs”, ask for logs and other telemetry you can use given the tools, process and people you have. Ask for relevant context data too. If you need EDR deployed, ask. If you need to sniff traffic because EDR cannot go there, ask for NDR.

If you need logging enabled, ask for types you need (logging policy, short and sweet). If you need them delivered, ask for access to supported log pipelines or mechanisms. If they need to develop logs for custom applications, offer a log standard, then ask for compliance with it (log standard must be short and thus implementable by unmotivated developers…)

Don’t fall victim to “application is deployed, app owner never provides logs, app owner assumes that SOC will detect any threat” syndrome (this is real, please don’t laugh!). If you cannot get the logs, ask for Plan B (you do have a Plan B?).

Basic Plan B examples may include: I really want EDR here, but I can’t have it; I can then ask for logs + NDR to mitigate the visibility gap. Another: I really want logs from this application, but can’t have it. I can get OS logs, would it help? Yes, but only if I get these events, and also get logs from another system that this one connects to.

Triage Partnership

You have assets, you have signals … what do you do with all this? Well, to be very fair to many solid SOC teams, sometimes the answer is “not a whole lot” or “who the hell knows.” Unless… unless the team that runs the system (IT, DevOps, etc) and/or the team that owns the system (business, etc) helps figure out what the thing is saying via those logs.

This means you do need to ask for alert triage help. Yes, I know, I know: many SOCs are not used to this, and prefer to ad hoc it for those “rare” cases where they need help. My favorite example where ad hoc does NOT work well is DLP alerts. Back in my analyst days, there was a lively debate among the analysts covering DLP about who should own DLP, security or business (!). In that vision, even if security owns DLP, business has to play an equal role otherwise “X emailed Y about Z” and “X uploaded Y to Z” alerts destroy the SOC due to its lack of capability to understand whether this is apocalyptic, merely bad, or perfectly normal, just rare.

Distributed alert response is a thing at some elite D&R teams (famous example, more current example). But even if SOC owns triage, it needs to ask for help. This is needed even more for data related alerts (What is this data and how valuable is it? Can it go out that way?) and application security alerts (What is the app threat model? Can the app do that? Should it?). As a side note, there is probably another blog here about how to plan appsec to D&R collaboration…

Anything BIG I missed? Anything else you as a SOC leader demanded from other units and departments?

Related blogs:

• Baby ASO: A Minimal Viable Transformation for Your SOC
• Learn Modern SOC and D&R Practices Using Autonomic Security Operations (ASO) Principles
• EP187 Conquering SOC Challenges: Leadership, Burnout, and the SIEM Evolution
• EP180 SOC Crossroads: Optimization vs Transformation — Two Paths for Security Operations Center
• EP73 Your SOC Is Dead? Evolve to Output-driven Detect and Respond!

Not a SOC FAQ! This is SOC FMD! was originally published in Anton on Security on Medium, where people are continuing the conversation by highlighting and responding to this story.

The post Not a SOC FAQ! This is SOC FMD! appeared first on Security Boulevard.

Frances Haugen, who famously blew the whistle on Facebook and its susceptibility to manipulation, has renewed concerns over the social-networking company. This time, she’s laser-focused on misinformation during the 2024 presidential election. “We are in a new, very nebulous era where we need to think more holistically and creatively” in defending cyberdefenses, Haugen said in..

The post Facebook Whistleblower Fears Election Abuse appeared first on Security Boulevard.

According to "Voice of a Threat Hunter 2024" Security teams need to keep evolving their strategies to protect their organizations against...

The post How Security Teams are Strengthening Their Threat Hunting appeared first on Security Boulevard.

New and updated coverage for Windows Downdate Attacks, Quick Share Vulnerability Exploit, MagicRAT, and More

The post Windows Downdate Attacks, Quick Share Vulnerability Exploit, and More: Hacker’s Playbook Threat Coverage Round-up: August 2024 appeared first on SafeBreach.

The post Windows Downdate Attacks, Quick Share Vulnerability Exploit, and More: Hacker’s Playbook Threat Coverage Round-up: August 2024 appeared first on Security Boulevard.

Authors/Presenters:Qingkai Shi, Xiangzhe Xu, Xiangyu Zhang

Many thanks to USENIX for publishing their outstanding USENIX Security ’23 Presenter’s content, and the organizations strong commitment to Open Access. Originating from the conference’s events situated at the Anaheim Marriott; and via the organizations YouTube channel.

Permalink

The post USENIX Security ’23 – Extracting Protocol Format As State Machine Via Controlled Static Loop Analysis appeared first on Security Boulevard.

The post How fernao magellan Customized 140 Automation Use Cases appeared first on AI-enhanced Security Automation.

The post How fernao magellan Customized 140 Automation Use Cases appeared first on Security Boulevard.

With the March 2025 deadline for PCI DSS v4.0 compliance looming, businesses face the challenge of adapting to over 50 new security requirements. Among these, eSkimming protections are crucial for safeguarding online transactions. Time is running out—begin your compliance efforts today to stay ahead of the curve and secure your payment systems.

The post The Urgent Need to Get MOVING for PCI DSS v4.0 Compliance appeared first on Source Defense.

The post The Urgent Need to Get MOVING for PCI DSS v4.0 Compliance appeared first on Security Boulevard.

Situational awareness in cybersecurity is hard! And poor situational awareness can be disastrous in cybersecurity. For a CISO, it could mean missing acting on a critical gap in the security program, leading to a data breach that damages the company’s reputation and incurs massive fines. For a Director of Security Operations, it could result in …

Read More

The post Seeing the Unseen: How Generative AI Elevates Situational Awareness in Cybersecurity appeared first on Security Boulevard.

Should’ve listened to Edison: After the arrest of Pavel Durov—the Telegram CEO—comes news of domestic extremists using the chat app to organize.

The post ‘Terrorgram’ Telegram Terrorists Trash Transformers — Grid in Peril appeared first on Security Boulevard.

SaaS breaches are on the rise, and nearly half the corporate victims have more than 2,500 employees. Those are among the sobering conclusions from a survey of security experts at 644 organizations in six countries — the U.S., UK, France, Germany, Japan and Australia — by AppOmni, which found a third of organizations suffered a SaaS data..

The post One-Third Of Companies Suffered SaaS Breach This Year appeared first on Security Boulevard.

via the inimitable Daniel Stori at Turnoff.US!

Permalink

The post Daniel Stori’s ‘XZ Backdoor’ appeared first on Security Boulevard.

SaaS Security Posture Management is important to SaaS security. Learn how to mitigate identity risks and protect your SaaS environment more effectively.

The post How to Strengthen Your SaaS Security Posture Management appeared first on Security Boulevard.

The Criminal Justice Information Services (CJIS) is a division of the US Federal Bureau of Investigation (FBI) that is the centralized source of criminal justice information (CJI) for state, local, and federal law enforcement and criminal justice agencies and authorized third parties. To ensure the protection of CJI, which provides critical data on fugitives and […]

The post What’s New in CJIS 5.9.5 as it Relates to Firmware Security? appeared first on Eclypsium | Supply Chain Security for the Modern Enterprise.

The post What’s New in CJIS 5.9.5 as it Relates to Firmware Security? appeared first on Security Boulevard.

A new variant of the Gafgy botnet has recently been discovered by cybersecurity researchers. As per media reports, the botnet appears to be machines with weak SSH passwords for mining crypto. In this article, we’ll dive into the details of the Gafgyt botnet and learn more about the attacks. Let’s begin! The Gafgyt Botnet Uncovered […]

The post Gafgyt Botnet: Weak SSH Passwords Targeted For GPU Mining appeared first on TuxCare.

The post Gafgyt Botnet: Weak SSH Passwords Targeted For GPU Mining appeared first on Security Boulevard.

The cybersecurity landscape is evolving at an unprecedented pace, driven by rapid technological advancements and increasingly sophisticated cyber threats. What was sufficient yesterday, will be lacking for tomorrow. Organizations must stay ahead of these changes to protect their assets and data effectively. To thrive, cybersecurity strategies need to evolve — moving beyond the reactive and fragmented approaches that are often commonplace. Instead, businesses must prioritize strategic foresight, adaptability, and maturity in their security programs.

Cybersecurity risks are continually growing. CISOs, CIOs, CEOs, and Boards are under immense pressure to manage these threats while simultaneously enabling business success. The challenge is significant, but with the right approach and insights, organizations can achieve greater security and unlock new value that is necessary for sustainability.

Here are several areas where the cybersecurity industry must evolve to meet these demands:

1. Strategic Alignment

Cybersecurity is no longer just a technical issue — it’s a business issue. The industry must evolve to ensure cybersecurity programs are directly aligned with an organization’s strategic goals. This involves defining clear and impactful cybersecurity objectives that resonate with the C-suite and Board members. It’s essential that cybersecurity is seen as a business enabler rather than a cost center, helping drive business outcomes while protecting critical assets.

2. Building Dynamic Capabilities

Static security programs are no longer sufficient in today’s fast-evolving threat landscape. Organizations need dynamic approaches to cybersecurity that adapts to emerging risks and threats. The industry must foster the development of continuously evolving security programs that are agile enough to respond to new challenges without compromising business operations. Building a strategic and adaptable cybersecurity framework is crucial for long-term success.

3. Optimizing Risk and Costs

Effective cybersecurity does not have to be exorbitantly expensive. Organizations should focus on identifying areas where risk mitigation can be improved while simultaneously optimizing costs. The evolution of cybersecurity practices will increasingly involve finding the optimal balance between robust security measures, friction to users, and cost efficiency, allowing organizations to manage their security investments wisely without sacrificing protection.

4. Sustainable Risk Management

Organizations must build cybersecurity programs that are not only effective but also sustainable. The future of cybersecurity lies in the creation of flexible, long-term risk management strategies that can scale with the organization. By ensuring that security efforts are adaptable and sustainable, organizations can continue to thrive in the face of changing threats and business needs. The focus must shift from quick fixes to long-term risk management.

5. Enhancing Maturity and Value

The maturity of a cybersecurity program is a key indicator of an organization’s ability to handle threats effectively and efficiently in alignment with expectations. The cybersecurity industry needs to guide organizations on their journey toward greater maturity, helping them move from reactive measures to proactive and strategic cybersecurity initiatives. This evolution in maturity brings not only better security but also enhances overall business value, providing organizations with a competitive edge in their industry.

6. Executive Translation of Cybersecurity Concepts

One of the biggest challenges in cybersecurity is the communication gap between technical teams and executive leaders. For the industry to truly excel, cybersecurity professionals must be able to translate complex cybersecurity concepts into language that resonates with both executives and employees. This ensures that risk-based decisions are understood and embraced across the organization, leading to smarter and more informed business practices.

Conclusion

The cybersecurity industry must evolve in key areas to remain effective and relevant in today’s challenging landscape. Strategic alignment, dynamic capabilities, cost optimization, sustainable risk management, maturity growth, and executive communication are all areas where organizations can excel. By embracing these approaches, businesses can enhance their cybersecurity programs and not only reduce risk but also create value and drive success.

If your organization is ready to assess, improve, or enhance the maturity of its cybersecurity program, seeking expert guidance can help navigate this complex evolution. As a cybersecurity strategist, I offer flexible consulting engagements designed for CISOs, C-suites, and Boards to help drive meaningful change. Together, we can advance your security efforts and achieve sustainable growth in cybersecurity maturity.

The post Evolving Cybersecurity: Aligning Strategy with Business Growth appeared first on Security Boulevard.

While programs like CTEM may be upcoming, Gartner® Hype Cycle for Security Operations recommends making incremental shifts early on.

The post Gartner® Hype Cycle™ for Security Operations, 2024 appeared first on SafeBreach.

The post Gartner® Hype Cycle™ for Security Operations, 2024 appeared first on Security Boulevard.