Security Boulevard

Authors/Presenters:Inyoung Bang and Martin Kayondo, Seoul National University; Hyungon Moon, UNIST (Ulsan National Institute of Science and Technology); Yunheung Paek, Seoul National University

Many thanks to USENIX for publishing their outstanding USENIX Security ’23 Presenter’s content, and the organizations strong commitment to Open Access. Originating from the conference’s events situated at the Anaheim Marriott; and via the organizations YouTube channel.

Permalink

The post USENIX Security ’23 – TRust: A Compilation Framework For In-Process Isolation To Protect Safe Rust Against Untrusted Code appeared first on Security Boulevard.

The sheer volume of vulnerabilities discovered each year—combined with limited time and resources—demands a more sophisticated strategy for prioritization. While the Common Vulnerability Scoring System (CVSS) has long been the industry standard for assessing the severity of vulnerabilities, it has significant limitations that can leave organizations exposed.  Limitations of the CVSS Scoring System  While this […]

The post Beyond CVSS: Advanced Vulnerability Prioritization Strategies for Modern Threats  appeared first on VERITI.

The post Beyond CVSS: Advanced Vulnerability Prioritization Strategies for Modern Threats  appeared first on Security Boulevard.

In today’s digital landscape, the threat of data breaches and cyber attacks looms large over organizations of all sizes. As a result, privileged access management (PAM) has become a critical component of cybersecurity strategies. It’s easy to see why. It’s estimated that 80% of security breaches involve privileged credentials, highlighting the importance of investing in […]

The post Understanding Privileged Access Management Pricing in 2024 appeared first on Security Boulevard.

Authors/Presenters:Inyoung Bang and Martin Kayondo, Seoul National University; Hyungon Moon, UNIST (Ulsan National Institute of Science and Technology); Yunheung Paek, Seoul National University

Many thanks to USENIX for publishing their outstanding USENIX Security ’23 Presenter’s content, and the organizations strong commitment to Open Access. Originating from the conference’s events situated at the Anaheim Marriott; and via the organizations YouTube channel.

Permalink

The post USENIX Security ’23 – TRust: A Compilation Framework For In-Process Isolation To Protect Safe Rust Against Untrusted Code appeared first on Security Boulevard.

As the back-to-school season begins, K-12 tech leaders face many cybersecurity and safety challenges. To help smooth the transition to a secure start to the 2024-2025 school year, we recently hosted a webinar featuring Samuel Hoch, the Technology Director at Catoosa Public Schools, and Robert Batson, the Technology Director at Tahlequah Public Schools. In this ...

The post Enhancing School Safety with Cloud Monitor: A Powerful Cyber Safety Protection Tool appeared first on ManagedMethods Cybersecurity, Safety & Compliance for K-12.

The post Enhancing School Safety with Cloud Monitor: A Powerful Cyber Safety Protection Tool appeared first on Security Boulevard.

DOJ inspectors have found the FBI is not labeling hard drives and other storage devices holding sensitive that are slated for destruction, making them hard to track, and that boxes of them can sit in a poorly secured facility for months.

The post Audit: FBI is Losing Track of Storage Devices Holding Sensitive Data appeared first on Security Boulevard.

Authors/Presenters:Yanmao Man, University of Arizona; Raymond Muller, Purdue University; Ming Li, University of Arizona; Z. Berkay Celik, Purdue University; Ryan Gerdes, Virginia Tech

Many thanks to USENIX for publishing their outstanding USENIX Security ’23 Presenter’s content, and the organizations strong commitment to Open Access. Originating from the conference’s events situated at the Anaheim Marriott; and via the organizations YouTube channel.

Permalink

The post USENIX Security ’23 – That Person Moves Like A Car: Misclassification Attack Detection For Autonomous Systems Using Spatiotemporal Consistency appeared first on Security Boulevard.

In response to the recent CISA Advisory (AA24-234A) outlining best practices for event logging and threat detection, AttackIQ, in alignment with CISA’s guidance, strongly encourages organizations to engage in continuous testing against known, real-world adversary behaviors and TTPs through rigorous security control validation.

The post Response to CISA Advisory (AA24-234A): Strengthening Defenses Through Effective Event Logging and Threat Detection appeared first on AttackIQ.

The post Response to CISA Advisory (AA24-234A): Strengthening Defenses Through Effective Event Logging and Threat Detection appeared first on Security Boulevard.

Every month, the Pondurance team hosts a webinar to keep clients current on the state of cybersecurity. In July, the team discussed threat intelligence, notable vulnerabilities and trends, security operations center (SOC) updates, and SOC engineering insights. Threat intelligence The Principal Digital Forensics and Incident Response (DFIR) Consultant discussed attacker-in-the-middle (AiTM) phishing and what the...

The post Novel Threat Tactics, Notable Vulnerabilities, and Current Trends for July appeared first on Pondurance.

The post Novel Threat Tactics, Notable Vulnerabilities, and Current Trends for July appeared first on Security Boulevard.

Earlier this summer, over a dozen bipartisan senators signed an amendment to the FAA reauthorization bill, calling for a pause on additional rollout of the TSA’s facial recognition technology until the program has been reviewed and approved by Congress. Though […]

The post Identities Aren’t for Sale: TSA Biometrics Technology and the Need for Consumer Consent appeared first on TechSpective.

The post Identities Aren’t for Sale: TSA Biometrics Technology and the Need for Consumer Consent appeared first on Security Boulevard.

Implementing shared threat intelligence across an alliance of cybersecurity experts creates a more robust security approach.

The post Pool Your Cybersecurity Resources to Build the Perfect Security Ecosystem appeared first on Security Boulevard.

via the comic & dry wit of Randall Munroe, creator of XKCD

Permalink

The post Randall Munroe’s XKCD ‘Classical Periodic Table’ appeared first on Security Boulevard.

Oink, oink, FAIL—you’re in jail: Kansas bank chief exec Shan Hanes stole money from investors, a church and others to buy cryptocurrency to feed a scam.

The post Pig Butchering at Heart of Bank Failure — CEO Gets 24 Years in Jail appeared first on Security Boulevard.

High threat level vulnerability CVE-2024-38178 discovered on Microsoft Edge browser : OFFICIAL CVE-2024-38178 PATCHING INFORMATION : A recent discovery has unveiled CVE-2024-38178, a critical vulnerability within Microsoft Windows, which impacts Internet Explorer mode in Microsoft Edge. With a CVSS v3 score of 7.5, CVE-2024-38178 poses a high threat level by enabling attackers to execute code...

The post CVE-2024-38178 Vulnerability within Microsoft Edge appeared first on TrueFort.

The post CVE-2024-38178 Vulnerability within Microsoft Edge appeared first on Security Boulevard.

The adoption of Cloud Native Application Protection Platforms (CNAPPs) has surged, reflecting a growing recognition of the need for comprehensive security across cloud environments. According to industry reports, the global CNAPP market is projected to grow at a CAGR of over 25% from 2023 to 2028 – and 40% of enterprises already have one. This […]

The post CNAPP found identity problems. How are you fixing them? appeared first on Security Boulevard.

In today’s hyper-connected digital landscape, APIs are the lifeblood of innovation, powering everything from customer experiences to internal operations. However, with this growing reliance on APIs comes a dark side—zombie and shadow APIs. These hidden, forgotten, or undocumented endpoints present significant security risks that traditional approaches simply can’t address. In this post, we’ll explore why these APIs are so dangerous and why Salt Security is the only solution capable of securing your entire API ecosystem.

What Are Zombie and Shadow APIs?

Before diving into the risks, it’s essential to understand what we mean by zombie and shadow APIs:

• Zombie APIs are endpoints that were once used but are now outdated, deprecated, or forgotten. These can linger in your environment long after they’re needed, exposing potential vulnerabilities.
• Shadow APIs are those created without the knowledge or approval of security teams. They often emerge when development teams build new endpoints without properly documenting or integrating them into the formal API management processes.

Both types of APIs are typically overlooked by traditional security tools, yet they are ripe targets for attackers. Unmonitored and unmanaged, these endpoints can provide easy access points for data breaches, unauthorized access, and other malicious activities.

The Risks of Zombie and Shadow APIs

The hidden nature of these APIs makes them particularly dangerous. Here are a few key reasons why:

1. Lack of Visibility: Without complete visibility into your API inventory, it’s impossible to secure what you don’t know exists. Zombie and shadow APIs are often undocumented, making it easy for them to fall under the radar.
2. Inconsistent Security Posture: These APIs might not adhere to current security standards, leaving them vulnerable to attacks like SQL injection, authentication bypasses, or data exfiltration.
3. Compliance and Data Privacy Risks: Undocumented APIs can inadvertently expose sensitive data, leading to compliance violations and hefty fines under regulations like GDPR and CCPA.
4. Operational Inefficiencies: Managing zombie and shadow APIs drains resources and introduces unnecessary complexity. Developers and security teams waste valuable time tracking down and mitigating issues with APIs that shouldn’t even exist.

Why Traditional Tools Fail to Address These Issues

Legacy security tools and API management platforms are ill-equipped to handle the dynamic and often chaotic nature of modern API environments. They rely on manual processes, static documentation, or simple API gateways that can’t adapt to the fluid development cycles and sprawling microservices architectures seen today. This leaves a critical gap in security that attackers are all too eager to exploit.

How Salt Security Solves the Zombie and Shadow API Problem

Salt Security’s API Protection Platform stands alone in its ability to discover, monitor, and secure every API in your environment—no matter how obscure or hidden it may be. Here’s how:

1. Comprehensive API Discovery: Salt Security continuously and automatically discovers all APIs in your environment, including zombie and shadow APIs. Our platform dynamically maps your entire API landscape, providing the full visibility you need to identify risks and eliminate blind spots.
2. API Posture Governance: Once discovered, Salt Security allows you to apply posture governance rules to bring them into compliance with your organization's regulatory or industry-specific guidelines. This helps to dramatically lower the risk profile that these shadow and zombie APIs presented before.
3. Advanced Behavioral Analysis: Using machine learning and AI, Salt Security analyzes the behavior of every API, identifying anomalies, outdated endpoints, and undocumented activity that could indicate a zombie or shadow API. This proactive approach lets you detect issues before they become full-blown security incidents.
4. Real-time Threat Detection and Response: Our platform doesn’t just discover hidden APIs—it actively protects them. Salt Security’s real-time threat detection capabilities ensure that even the most obscure APIs are monitored and secured against attacks. Deep insights into each API’s behavior allow us to quickly identify and mitigate threats specific to zombie and shadow APIs.
5. Extend API Security Left: Salt Security integrates seamlessly into your development pipeline, ensuring that zombie and shadow APIs are addressed at the earliest stages of development. By embedding governance and security into the CI/CD process, we help prevent the creation of risky, undocumented APIs from the start.

Why Salt Security Is the Only True Solution

While other solutions may claim to offer API protection, none provide the end-to-end capabilities needed to fully secure zombie and shadow APIs. Salt Security offers the most comprehensive AI-infused platform for API security, combining deep discovery, continuous monitoring, governance, and proactive threat detection. Our solution not only finds hidden APIs—it safeguards them, ensuring your organization’s API landscape remains resilient, compliant, and secure.

Conclusion

Zombie and shadow APIs represent a hidden yet significant threat to your organization’s security posture. With traditional tools falling short, it’s time to rethink your API security strategy. Salt Security’s unique capabilities make it the only solution capable of addressing the full spectrum of API threats—including those you can’t see.

By choosing Salt Security, you can rest assured that your APIs—documented or not—are fully protected, enabling your business to innovate without compromise.

If you want to learn more about Salt and how we can help you on your API Security journey through discovery, posture management, and run-time threat protection, please contact us, schedule a demo, or check out our website.

The post The Hidden Dangers of Zombie and Shadow APIs—and Why Only Salt Security Can Tackle Them appeared first on Security Boulevard.

We’re excited to announce the integration of Azure Boards into Strobes, enhancing your project management capabilities and streamlining your vulnerability tracking processes. Azure Boards Overview: Azure Boards is a project...

The post Introducing Azure Boards Integration in Strobes appeared first on Strobes Security.

The post Introducing Azure Boards Integration in Strobes appeared first on Security Boulevard.

This post walks through the vulnerabilities we disclosed affecting Gradio, and our work with Hugging Face to harden the Spaces platform after a recently reported potential breach.

The post NTLM Credential Theft in Python Windows Applications appeared first on Horizon3.ai.

The post NTLM Credential Theft in Python Windows Applications appeared first on Security Boulevard.

Discover why Escape is a better API security solution.

The post Escape vs Rapid7 appeared first on Security Boulevard.

EOL operating systems no longer receive critical security updates, leaving them highly vulnerable to evolving cybersecurity threats. End-of-life OSs often struggle to run modern software and hardware, resulting in compatibility issues, reduced performance, and lower productivity. Organizations using EOL systems face increased legal and financial risks due to non-compliance with regulations and the high costs […]

The post The Risks of Running an End Of Life OS – And How To Manage It appeared first on TuxCare.

The post The Risks of Running an End Of Life OS – And How To Manage It appeared first on Security Boulevard.