Help Net Security

Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: Microsoft patches two zero-days exploited in the wild (CVE-2024-43573, CVE-2024-43572) For October 2024 Patch Tuesday, Microsoft has released fixes for 117 security vulnerabilities, including two under active exploitation: CVE-2024-43573, a spoofing bug affecting the Windows MSHTML Platform, and CVE-2024-43572, a remote code execution flaw in the Microsoft Management Console (MMC). SOC teams are frustrated with their security tools Security operations … More →

The post Week in review: Microsoft fixes two exploited zero-days, SOC teams are losing trust in security tools appeared first on Help Net Security.

The EU Council has adopted the Cyber Resilience Act (CRA), a new law that aims to make consumer products with digital components safe(r) to use. CRA requirements The CRA outlines EU-wide cybersecurity standards for digital products, i.e. products that are connected – either directly or indirectly – to another device or to a network. This category includes “smart” home appliances, TVs, thermostats, toys, wearable health technology, baby monitoring systems, and so on. Some connected products … More →

The post EU adopts Cyber Resilience Act to secure connected products appeared first on Help Net Security.

Canonical released Ubuntu 24.10 Oracular Oriole, which brings notable advancements, including an updated kernel, new toolchains, and the GNOME 47 desktop environment, along with significant enhancements in software security. “Oracular Oriole sets a new pace for delivering the latest upstream kernel and toolchains,” said Mark Shuttleworth, CEO of Canonical, “Experimental new security features demonstrate our commitment to continually elevate the Linux desktop experience in conversation with the community for the next 20 years and beyond.” … More →

The post Ubuntu 24.10 Oracular Oriole brings tighter security controls appeared first on Help Net Security.

92% of healthcare organizations experienced at least one cyber attack in the past 12 months, an increase from 88% in 2023, with 69% reporting disruption to patient care as a result, according to Proofpoint. Healthcare organizations struggle to mitigate risks from cyberattacks Among the organizations that suffered the four most common types of attacks – cloud compromise, ransomware, supply chain, and business email compromise (BEC) – 56% reported poor patient outcomes due to delays in … More →

The post Data loss incidents impact patient care appeared first on Help Net Security.

The frequency, sophistication, and impact of cyber-attacks on financial institutions have been rising. Given the economic system’s interconnected nature, disruptions in one institution can have cascading effects on the broader financial market, leading to systemic risks. Regulators have responded with increasingly stringent requirements. One of the most significant regulatory developments in this context is the European Union’s Digital Operational Resilience Act (DORA), which will come into force on January 17th, 2025. Dimitri Chichlo, CISO at … More →

The post DORA regulation’s nuts and bolts appeared first on Help Net Security.

In this Help Net Security interview, Glen Leonhard, Director of Key Management at Cryptomathic, discusses the role of cryptographic agility in mitigating risks posed by quantum computing. Cryptographic agility enables organizations to seamlessly transition to post-quantum algorithms without disrupting existing systems. Leonhard also emphasizes its broader role in adapting to new vulnerabilities, regulations, and industry standards. With the advent of quantum computing, how does cryptographic agility play a role in mitigating potential security risks? Quantum … More →

The post Unlocking the power of cryptographic agility in a quantum world appeared first on Help Net Security.

ESET researchers discovered that the organized scammer network Telekopye has expanded its operations to target users of popular accommodation booking platforms like Booking.com and Airbnb. They have also increased the sophistication of their victim selection and of targeting the two booking sites, where the phishing pages are even more believable than regular online marketplace ones. The Telekopye scammer network Telekopye is a toolkit that operates as a Telegram bot turning online marketplace scams into illicit … More →

The post Scammers target Airbnb and Booking.com users appeared first on Help Net Security.

Here’s a look at the most interesting products from the past week, featuring releases from Action1, BreachLock, Commvault, Dashlane, Data Theorem, Edgio, Frontegg, and Qualys. Qualys Enterprise TruRisk Management unifies asset inventory and risk factors Qualys launched the Risk Operations Center (ROC) with Enterprise TruRisk Management (ETM). The solution enables CISOs and business leaders to manage cybersecurity risks in real time, transforming fragmented, siloed data into actionable insights that align cyber risk operations with business … More →

The post New infosec products of the week: October 11, 2024 appeared first on Help Net Security.

Beginning with iOS 18, iPadOS 18, macOS Sequoia, and visionOS 2, the Passwords app allows you to manage your passwords, passkeys, and verification codes. Passwords app interface Creating passkeys Passkeys are a password alternative designed to offer a more convenient and secure, password-free sign-in experience for websites and apps. Passkeys are inherently strong, there are no shared secrets, and are less vulnerable to phishing than passwords. During the account registration process, the operating system generates … More →

The post How to setup passkeys in Apple Passwords app appeared first on Help Net Security.

Governance, risk, and compliance (GRC) frameworks help professionals assess an organization’s risk posture, align technological initiatives with business goals, and ensure regulatory compliance. However, choosing the appropriate framework can be a complex and challenging task. Inside this North American guide (EU guide available here), you’ll find answers to these questions and more: How does Governance, Risk and Compliance protect organizations? What are the essential GRC frameworks? What frameworks address cybersecurity and privacy? What international frameworks … More →

The post What you need to know to select the right GRC framework, North American Edition appeared first on Help Net Security.

ESET released its updated ESET Vulnerability and Patch Management module. With the new update, ESET V&PM has expanded to support Linux1 (desktops and servers), as well as macOS2 devices, covering broader parts of a business’ ecosystem. The V&PM module is also now presented in a new dashboard, improved for greater visibility and transparency, enhancing its ease of use while giving an instant overview of vulnerability and patching status across a network. “We believe that top-level … More →

The post ESET updates Vulnerability and Patch Management module appeared first on Help Net Security.

Simbian announced a suite of AI Agents that work alongside security teams to enhance the intelligence, speed, and coverage of their entire security program. The suite of AI Agents, which runs on the Simbian Security Accelerator Platform, addresses the top pain points of Security Operations Center (SOC) analysts; Threat Hunters; and Governance, Risk, and Compliance (GRC) teams. These AI Agents autonomously handle security functions that were not possible to automate in the past, and they … More →

The post Simbian unveils AI Agents to address the top pain points for SOC analysts appeared first on Help Net Security.

Ketch launched Third Party Risk Intelligence, a new suite of diagnostics and management tools for brands to manage how third party vendors collect data across digital properties. As regulatory enforcement increases and wiretapping lawsuits surge, businesses face growing legal and compliance risks. Recent trends show an uptick in class action suits targeting brands for privacy violations through tracking technologies that act as unauthorized wiretaps on digital properties. The plaintiffs’ bar is aggressively pursuing cases around … More →

The post Ketch Third Party Risk Intelligence provides control over trackers, tags, and cookies appeared first on Help Net Security.

watchTowr announced a $19 million Series A funding round led by Peak XV, formerly known as Sequoia India & Southeast Asia, with repeat participation from Prosus Ventures and Cercano Management. The company will use the funds to capture market leadership and accelerate global growth by expanding its go-to-market, research and engineering teams. The latest investment brings its total funding raised to $29 million. Over the past year, watchTowr has seen significant adoption from critical infrastructure … More →

The post watchTowr raises $19 million to accelerate global growth appeared first on Help Net Security.

Mozilla has pushed out an emergency update for its Firefox and Firefox ESR browsers to fix a vulnerability (CVE-2024-9680) that is being exploited in the wild. About CVE-2024-9680 Reported by ESET malware researcher Damien Schaeffer, CVE-2024-9680 is a use-after-free vulnerability in the browser’s Animation timelines and, according to Mozilla, has been exploited to achieve code execution in the content process. Additional details about the vulnerability or the attacks are yet to be shared. According to … More →

The post Actively exploited Firefox zero-day fixed, update ASAP! (CVE-2024-9680) appeared first on Help Net Security.

Responding directly to an increased global threat environment, Fivecast launched a Discovery solution that empowers analysts and investigators across both the Government and Corporate sectors to uncover intelligence insights faster to help protect communities and businesses. Fivecast Discovery automates and accelerates the processes of digital footprinting, information verification and identity resolution. These capabilities significantly enhance the crucial initial stages of intelligence investigations which can typically be impeded by huge data volumes, complex threats and resource … More →

The post Fivecast Discovery drives better analytical outputs appeared first on Help Net Security.

The Internet Archive has suffered a data breach, leading to the compromise of email addresses, screen names and bcrypt password hashes of some 31 million users. The compromise was revealed on Wednesday afternoon, when the digital library’s website began showing a JavaScript pop-up saying: “Have you ever felt like the Internet Archive runs on sticks and is constantly on the verge of suffering a catastrophic security breach? It just happened. See 31 million of you … More →

The post Internet Archive data breach, defacement, and DDoS: Users’ data compromised appeared first on Help Net Security.

Qualys launched the Risk Operations Center (ROC) with Enterprise TruRisk Management (ETM). The solution enables CISOs and business leaders to manage cybersecurity risks in real time, transforming fragmented, siloed data into actionable insights that align cyber risk operations with business priorities. The application consolidates both Qualys and non-Qualys security risk data, including from technology alliances like Forescout, Identity Threat Protection with Okta AI, Microsoft, Oracle, and Wiz across cloud, on-premises and hybrid environments. Organizations are facing … More →

The post Qualys Enterprise TruRisk Management unifies asset inventory and risk factors appeared first on Help Net Security.

Adaptiva announces the latest feature release for OneSite Patch: vulnerability dashboards. These new dashboards provide real-time visibility into Common Vulnerabilities and Exposures (CVEs) in the environment and patches that can remediate them–empowering organizations to find and fix vulnerabilities efficiently. IT and security teams often struggle to obtain real-time data that unifies vulnerability discovery and remediation status within the IT environment. This includes understanding how many vulnerabilities have available patches and the deployment status of those … More →

The post Adaptiva improves collaboration between IT and security teams with vulnerability dashboards appeared first on Help Net Security.

Filling roles within the cyber sector is an ongoing battle. The shortfall of workers risks creating a vicious cycle within existing cyber teams: With fewer team members to spread the workload on, you risk burning out security professionals. Many make the mistake of valuing certifications over wider experiences, which neglects a person’s eagerness to learn or strong transferable skills that could make them a great fit for a cyber career with the right development opportunities. … More →

The post Widening talent pool in cyber with on-demand contractors appeared first on Help Net Security.