Help Net Security

Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: Millions of Synology NAS devices vulnerable to zero-click attacks (CVE-2024-10443) Synology has released fixes for an unauthenticated “zero-click” remote code execution flaw (CVE-2024-10443, aka RISK:STATION) affecting its popular DiskStation and BeeStation network attached storage (NAS) devices. Google patches actively exploited Android vulnerability (CVE-2024-43093) Google has delivered fixes for two vulnerabilities endangering Android users that “may be under limited, targeted exploitation”: … More →

The post Week in review: Zero-click flaw in Synology NAS devices, Google fixes exploited Android vulnerability appeared first on Help Net Security.

A vulnerability (CVE-2024-5910) in Palo Alto Networks Expedition, a firewall configuration migration tool, is being exploited by attackers in the wild, the Cybersecurity and Infrastructure Security Agency (CISA) confirmed on Thursday. About CVE-2024-5910 Unearthed and reported by Brian Hysell of Synopsys Cybersecurity Research Center (CyRC), CVE-2024-5910 stems from missing authentication for a critical function, which can lead to an Expedition admin account takeover for attackers with network access to the installation. A security update fixing … More →

The post Critical Palo Alto Networks Expedition bug exploited (CVE-2024-5910) appeared first on Help Net Security.

Mirantis launched Mirantis Harbor Registry Support and Mirantis KubeVirt Support offerings, providing support for managing container image registries and virtual machine workloads within any Kubernetes environment, irrespective of the underlying infrastructure or Kubernetes distribution. “For organizations seeking pure open-source deployments, Mirantis is committed to empowering them with the support they need to manage their Kubernetes environments effectively,” said Randy Bias, VP – open source strategy and technology, Mirantis. “Our new Harbor and KubeVirt support offerings … More →

The post Mirantis provides support offerings for Harbor Registry and KubeVirt appeared first on Help Net Security.

AppOmni announced a significant partnership that combines the company’s Zero Trust Posture Management (ZTPM) solution with Cisco’s Security Service Edge (SSE) technology suite to enable zero trust principles at the application layer in Security-as-a-Service (SaaS) applications. The combined solution provides organizations with end-to-end zero trust from the endpoint to the application and greatly improves security in complex SaaS installations, with enhanced visibility and monitoring into everything from configurations to user behaviors. With a secure environment … More →

The post AppOmni partners with Cisco to extend zero trust to SaaS appeared first on Help Net Security.

In a bold move, Apple has published a draft ballot for commentary to GitHub to shorten Transport Layer Security (TLS) certificates down from 398 days to just 45 days by 2027. The Apple proposal will likely go up for a vote among Certification Authority Browser Forum (CA/B Forum) members in the upcoming months. Apple isn’t the first of the big players to suggest such a move. Last year, Google announced its intention to mandate 90-day … More →

The post Apple’s 45-day certificate proposal: A call to action appeared first on Help Net Security.

Am I Isolated is an open-source container security benchmark that probes users’ runtime environments and tests for container isolation. The Rust-based container runtime scanner runs as a container, detecting gaps in users’ container runtime isolation. It also provides guidance to improve users’ runtime environments to offer stronger isolation guarantees. “The status quo of containers is that they don’t contain. The lack of container isolation has dire consequences in a cloud native environment, including container escapes, … More →

The post Am I Isolated: Open-source container security benchmark appeared first on Help Net Security.

In this Help Net Security video, David Cottingham, CEO of Airlock Digital, discusses the 2023-2030 Australian Cyber Security Strategy and reviews joint and individual cybersecurity efforts, progress, and strategies over the past year. The Australian Government’s 2023-2030 Cyber Security Strategy, released on November 22, 2023, aims to position Australia as a global leader in cyber security by 2030. The Strategy outlines an approach to protecting Australians by enhancing cyber resilience and managing risks. It introduces … More →

The post A closer look at the 2023-2030 Australian Cyber Security Strategy appeared first on Help Net Security.

AI-enhanced malicious attacks are the top emerging risk for enterprises in the third quarter of 2024, according to Gartner. Key emerging risks for enterprises It’s the third consecutive quarter with these attacks being the top of emerging risk. IT vendor criticality and an unsettled regulatory and legal environment are new, top emerging enterprise risks. During the third quarter of 2024, Gartner surveyed 286 senior risk and assurance executives and managers to examine and compare emerging … More →

The post Why AI-enhanced threats and legal uncertainty are top of mind for risk executives appeared first on Help Net Security.

Here’s a look at the most interesting products from the past week, featuring releases from Atakama, Authlete, Symbiotic Security, and Zywave. Atakama introduces DNS filtering designed for MSPs Atakama announced the latest expansion of its Managed Browser Security Platform, introducing DNS filtering explicitly designed for Managed Service Providers (MSPs). This new feature enables comprehensive in-browser and network-level filtering, providing a full-spectrum DNS solution that secures browsers and entire network environments. Zywave enhances Cyber Quoting to … More →

The post New infosec products of the week: November 8, 2024 appeared first on Help Net Security.

Fortinet announced the expansion of GenAI capabilities across its product portfolio with the launch of two new integrations with FortiAI, Fortinet’s AI-powered security assistant that uses GenAI to guide, simplify, and automate security analyst activities. “Our commitment to AI innovation is reflected in our expansion of generative AI, which now enhances seven different products across our portfolio,” said John Maddison, CMO at Fortinet. “By integrating FortiAI in such a broad range of solutions, we’re equipping … More →

The post Fortinet expands GenAI capabilities across its portfolio with two new additions appeared first on Help Net Security.

Malwarebytes announced the acquisition of AzireVPN, a renowned privacy-focused VPN provider. Malwarebytes has long been a defender of user privacy through its portfolio of consumer solutions, including Malwarebytes Privacy VPN and its free ad and scam blocker web extension Malwarebytes Browser Guard. This acquisition further supports the company’s mission to reimagine consumer cybersecurity to protect devices and data, no matter where users are located, how they work and play, or the size of their wallet. … More →

The post Malwarebytes acquires AzireVPN to boost security for customers appeared first on Help Net Security.

Drawbridge is debuting a real-time executive summary of a manager’s cyber risk program. The aim is to enable alternative investment managers (alts managers) to strengthen executive confidence in their firm’s cyber posture by working with their Drawbridge cybersecurity experts. General partners and board members can use these insights to quickly assess vulnerabilities and make resourcing decisions. Through its existing client hub, an executive summary offers a consolidated view of essential, actionable insights into cybersecurity governance, … More →

The post Drawbridge simplifies cyber governance for alternative investment firms appeared first on Help Net Security.

A recent spear-phishing campaign targeting industrial and engineering companies in Europe was aimed at saddling victims with the popular GuLoader downloader and, ultimately, a remote access trojan that would permit attackers to steal information from and access compromised computers whenever they wish. “The emails are sent from various email addresses including from fake companies and compromised accounts. The emails typically hijack an existing email thread or request information about an order,” Tara Gould, Threat Research … More →

The post Industrial companies in Europe targeted with GuLoader appeared first on Help Net Security.

AudioEye launched Accessibility Protection Status, a new benchmark in digital accessibility compliance that empowers businesses to achieve better transparency, clarity, and control over their digital accessibility efforts. With a more accurate representation of accessibility efforts beyond arbitrary numerical scores, the Accessibility Protection Status provides companies with a clear path for digital accessibility compliance. “This innovation builds on our legacy as pioneers in digital accessibility and reflects our ongoing commitment to proactive, comprehensive solutions that help … More →

The post AudioEye Accessibility Protection Status identifies high-impact areas for improvement appeared first on Help Net Security.

North Korean hackers are targeting crypto-related businesses with phishing emails and novel macOS-specific malware. The crypto-related phishing campaign Since July 2024, phishing emails seemingly containing helpful information on risks related to the rise of the price of Bitcoin have been sent to intended victims in cryptocurrency-related industries, SentinelLabs researchers have found. The phishing email (Source: SentinelLabs) The email urges the recipient to click on the “Open” button to download a PDF file, but doing that … More →

The post North Korean hackers employ new tactics to compromise crypto-related businesses appeared first on Help Net Security.

Cisco has fixed a critical command injection vulnerability (CVE-2024-20418) affecting its Ultra-Reliable Wireless Backhaul (URWB) Access Points that can be exploited via a HTTP requests and allows complete compromise of the devices. There are no workarounds to address this flaw, though vulnerable access points can be protected by switching off URWB mode, the company shared in the advisory. The good news is that the vulnerability was discovered by a Cisco employee during internal security testing … More →

The post Critical vulnerability in Cisco industrial wireless access points fixed (CVE-2024-20418) appeared first on Help Net Security.

Zywave announced an enhancement to its Cyber Quoting solution with the addition of embedded benchmarking. Brokers can now leverage industry data and loss profiles from similar organizations to provide their clients with more sophisticated insight into coverage limit adequacy and potential loss gaps. Launched in April 2024, Cyber Quoting is a centralized quoting platform that brings together global cyber insurers and U.S. distributors, connecting them through a simplified, transparent submission process that provides key insights … More →

The post Zywave enhances Cyber Quoting to provide insight into coverage limit adequacy and potential loss gaps appeared first on Help Net Security.

In this Help Net Security interview, Buzz Hillestad, CISO at Prismatic, discusses how AI’s advancement reshapes cybercriminal skillsets and lowers entry barriers for potential attackers. Hillestad highlights that, as AI tools become more accessible, organizations must adapt their defenses to anticipate evolving threats. How might the development of AI technology impact the skillsets required for cybercriminals? Will AI lower the barrier to entry for potential attackers? The development of AI technology will dramatically shift the … More →

The post How AI will shape the next generation of cyber threats appeared first on Help Net Security.

AWS offers a comprehensive suite of security tools to help organizations manage compliance, protect sensitive data, and detect threats within their environments. From AWS Security Hub and Amazon GuardDuty to Amazon Macie and AWS Config, each tool is vital in enhancing visibility, automating responses, and maintaining a secure cloud infrastructure. This article explores these AWS security essentials, providing insights into how they work together to protect cloud environments from potential risks and ensure robust compliance. … More →

The post AWS security essentials for managing compliance, data protection, and threat detection appeared first on Help Net Security.

In September 2024, the Federal Trade Commission (FTC) released an eye-opening report that digs into the data habits of nine major tech giants, including Amazon (Twitch), ByteDance (TikTok), Discord, Facebook, Reddit, Snap, Twitter, WhatsApp, and YouTube. The findings reveal extensive, often unsettling, data aggregation practices that go beyond user expectations and present considerable privacy risks. This article breaks down key privacy challenges and offers practical guidance to help organizations safeguard consumer data in today’s complex … More →

The post Consumer privacy risks of data aggregation: What should organizations do? appeared first on Help Net Security.