Security Boulevard

Data breaches are on the rise. In the US, last year broke new records in terms of breach volumes. The bad news is that costs are also increasing. The latest IBM study reveals that they surged 10% annually to reach nearly $4.9m on average in 2024. Although there are several mooted causes of this rise, one of the most critical appears to be the growing challenge of shadow data.

The post As Breach Costs Surge, Companies Need a Better Way to Find Shadow Data appeared first on Security Boulevard.

It may feel like beating a dead horse to say it, but the threat of software supply chain attacks is increasing at an alarming rate. And, in fact, it can’t be said too often.

Two recent reports illustrate this point: The "2024 Verizon Data Breach Investigation Report" (DBIR) found that breaches stemming from third-party software development skyrocketed by 68% from what was reported in Verizon’s 2023 report. And ReversingLabs’ "State of Software Supply Chain Security 2024" report chronicled the dramatic rise in threats from open-source repositories (1300%), as well as a string of high-profile attacks on commercial software — from SolarWinds' Orion update that was released to thousands of firms and federal agencies in 2020 to the exposure of CircleCI users’ software secrets and the hack of VoIP vendor 3CX in 2023. 

As software producers, enterprise buyers, and other key stakeholders prepare their cybersecurity and risk management efforts for 2025, they should be looking for ways to prevent and quickly mitigate any and all software supply chain attacks. But modern enterprise security programs suffer from a sprawl of uncoordinated tools and continually fail at achieving software supply chain security (SSCS). This calls for a new era of SSCS management, one in which universal controls can prioritize the mitigation of these threats.

ReversingLabs is now introducing the Software Assurance Foundational Evaluation (SAFE) report as a part of RL Spectra Assure. This report is much more than the simple list of components that a software bill of materials (SBOM) provides, offering much-needed visibility into the risks and threats in the entire application or software binary, in context.

Here’s how Spectra Assure’s new SAFE Report works — and why the time for SAFE is now.

The post Why SAFE. Why Now. appeared first on Security Boulevard.

Authors/Presenters:Yiming Zhang, Yuxin Hu, Zhenyu Ning, Fengwei Zhang, Xiapu Luo, Haoyang Huang, Shoumeng Yan, Zhengyu He

Many thanks to USENIX for publishing their outstanding USENIX Security ’23 Presenter’s content, and the organizations strong commitment to Open Access. Originating from the conference’s events situated at the Anaheim Marriott; and via the organizations YouTube channel.

Permalink

The post USENIX Security ’23 – SHELTER: Extending Arm CCA with Isolation in User Space appeared first on Security Boulevard.

2 min read Journey with us through the identity cosmos, where understanding and safeguarding both humans and non-humans is mission-critical.

The post The Enterprise Identity Universe: Users, Non-Humans, and Consumers [Infographic] appeared first on Aembit.

The post The Enterprise Identity Universe: Users, Non-Humans, and Consumers [Infographic] appeared first on Security Boulevard.

A primer on how to best prepare for the migration to PQC The United Nations has proclaimed 2025 the International Year of Quantum Science and Technology—and for good reason. Across the globe, the quantum community is making monumental strides toward building stable, commercially viable quantum computers. As the vision of quantum technology entering mainstream applications […]

The post 8 Essential Considerations for Post-Quantum Cryptography Migration appeared first on Security Boulevard.

MEDIA ADVISORY Presenters at Microsoft Booth 1240 will also show how Strata’s Maverics  “Disconnected Mode” enables identity continuity and maintains uninterrupted access to apps when internet connectivity is unavailable BOULDER, Colo., Aug. 1, 2024 — Strata Identity, the Identity Orchestration company, today announced that as a member of the Microsoft Intelligent Security Association (MISA) it...

The post Strata Identity to Demonstrate How to Modernize Legacy Identity Systems to Microsoft Entra ID at Black Hat 2024 appeared first on Strata.io.

The post Strata Identity to Demonstrate How to Modernize Legacy Identity Systems to Microsoft Entra ID at Black Hat 2024 appeared first on Security Boulevard.

This article is the fifth in a series of five covering key API security topics and provides some answers to common questions we often get when talking to potential customers. The series will cover the following topics: API Discovery API Posture Management Attack Protection API Security Testing Attack Detection and Threat Hunting (this article) API […]

The post Attack Detection and Threat Hunting – Common Topics We’re Asked About appeared first on Cequence Security.

The post Attack Detection and Threat Hunting – Common Topics We’re Asked About appeared first on Security Boulevard.

The post The Cyber Fallout: Navigating the Aftermath of a Credit Union Breach appeared first on Votiro.

The post The Cyber Fallout: Navigating the Aftermath of a Credit Union Breach appeared first on Security Boulevard.

Where to Begin With thousands of unfilled positions reported year over year, why is it so hard to get a […]

The post One Does Not Simply … Get a Cybersecurity Job appeared first on Security Boulevard.

Nisos
Building Trustworthy AI: Contending with Data Poisoning

As Artificial Intelligence (AI) and Machine Learning (ML) systems are adopted and integrated globally, the threat of data poisoning attacks remains...

The post Building Trustworthy AI: Contending with Data Poisoning appeared first on Nisos by Nisos

The post Building Trustworthy AI: Contending with Data Poisoning appeared first on Security Boulevard.

Revolutionizing security testing with continuous security validation.

The post Democratizing Defense: AttackIQ Flex 2.0 Empowers Every Organization appeared first on AttackIQ.

The post Democratizing Defense: AttackIQ Flex 2.0 Empowers Every Organization appeared first on Security Boulevard.

In the ultramodern, mercurial sphere of cybersecurity, somehow a 1700-year-old quote from Helena of Constantinople still deeply resonates. Even with seemingly robust defenses, the smallest vulnerability can be an open invitation for threats like AsyncRAT to infiltrate your system, underscoring the importance of continuous testing to ensure that your existing controls - your rat traps - are functioning effectively.

The post Rat Traps: Emulating AsyncRAT with AttackIQ Flex appeared first on AttackIQ.

The post Rat Traps: Emulating AsyncRAT with AttackIQ Flex appeared first on Security Boulevard.

One of the critical challenges that leading fintech companies like PayPal, Square, Google and many others face in this digital age is fraud. Traditionally, fraud detection relies on each company analyzing its own user data in a centralized manner. These systems often lack visibility into fraud attacks occurring on other platforms, resulting in reactive rather..

The post Join the Fight: Calling Fintech Leaders to Unite With Federated Learning for Superior Fraud Detection appeared first on Security Boulevard.

Season 3, Episode 11: Vulnerability management is critical to any Zero Trust strategy, but you probably already know that. Fortra’s Tyler Reguly breaks down severity vs. risk.

The post Applying Vulnerability Management to Zero Trust: Insights from Fortra’s Tyler Reguly appeared first on Security Boulevard.

Artifact integrity is crucial in maintaining software security and trustworthiness. High-profile breaches like SolarWinds, CodeCov, 3CX, and JumpCloud have shown how altering artifact contents can lead to significant security vulnerabilities, enabling attackers to infiltrate and compromise software supply chains. This is the first in a series of blog posts about the importance of artifact integrity, ... Read more

The post Securing Artifacts: Keyless Signing with Sigstore and CI/MON appeared first on Cycode.

The post Securing Artifacts: Keyless Signing with Sigstore and CI/MON appeared first on Security Boulevard.

In October 2023, Google announced the launch of kvmCTF, a new vulnerability reward program (VRP) designed to improve the security of the Kernel-based Virtual Machine (KVM) hypervisor. This innovative program comes with bounties of up to $250,000 for full VM escape exploits, marking a significant step in fortifying virtual machine (VM) environments against zero-day vulnerabilities. […]

The post kvmCTF: Google’s $250K Bounty for KVM Zero-Day Vulnerabilities appeared first on TuxCare.

The post kvmCTF: Google’s $250K Bounty for KVM Zero-Day Vulnerabilities appeared first on Security Boulevard.

This Article Insider Risk Digest: July was first published on Signpost Six. | https://www.signpostsix.com/

Welcome to this month’s Insider Risk Digest. This month, we explore a range of insider threats affecting sectors from government to entertainment and pharmaceuticals. Highlights include potential espionage in critical infrastructure projects, a former CIA analyst’s espionage charges, and significant corporate breaches at Disney and Roche. We also examine ethical controversies at OpenAI and organized […]

This Article Insider Risk Digest: July was first published on Signpost Six. | https://www.signpostsix.com/

The post Insider Risk Digest: July appeared first on Security Boulevard.

Two-plus decades of enduring wave after wave of mobile app malware and fraud has finally taken its toll on users.

Now comes a global survey from Appdome and OWASP that reveals the vast majority of consumers are fed up.

I … (more…)

The post Black Hat Fireside Chat: Consumers demand secure mobile apps; it’s high time for brands to deliver first appeared on The Last Watchdog.

The post Black Hat Fireside Chat: Consumers demand secure mobile apps; it’s high time for brands to deliver appeared first on Security Boulevard.

If you’ve landed here, chances are you know just how challenging getting SOC 2 certification can be. Dealing with manual processes, spreadsheets, and endless piles of documentation can feel like a never-ending battle.  I get it—it’s overwhelming and inefficient. In your search for a more streamlined approach, you’re likely looking for a solution beyond SOC […]

The post Best 5 SOC 2 Compliance Software in 2024 appeared first on Centraleyes.

The post Best 5 SOC 2 Compliance Software in 2024 appeared first on Security Boulevard.

As per recent media reports, two Russian nationals have pleaded guilty in a United States (US) court for affiliate participation in the LockBit ransomware attacks. The two individuals part of the LockBit ransomware scheme have been identified as Ruslan Magomedovich Astamirov and Mikhail Vasiliev. In this article, we’ll dive into the details of the plea […]

The post LockBit Ransomware: Two Russians Plead Guilty For Attacks appeared first on TuxCare.

The post LockBit Ransomware: Two Russians Plead Guilty For Attacks appeared first on Security Boulevard.