Tag: least-privilege

Flax Typhoon exploited ArcGIS to gain long-term access

Oct 15, 2025 3:54 PM

Tags: access, ai, attack, backup, ciso, control, data, data-breach, detection, encryption, endpoint, espionage, exploit, government, group, india, infrastructure, intelligence, kev, least-privilege, macOS, malicious, monitoring, network, password, risk, sbom, service, software, supply-chain, threat, unauthorized, update, windows

Who is at risk?: In the first documented case confirmed by ArcGIS, where the malicious SOE was used, ReliaQuest identified that the password for the ArcGIS portal administrator account was a leet password of unknown origin, suggesting that the attacker had access to the administrative account and was able to reset the password.”Any organization that…
Oracle issues second emergency patch for E-Business Suite in two weeks

Oct 14, 2025 11:23 AM

Tags: attack, business, cve, cybersecurity, data, exploit, google, governance, group, identity, infrastructure, intelligence, kev, least-privilege, malicious, mandiant, monitoring, network, oracle, strategy, threat, update, vulnerability, zero-trust

Immediate actions for CVE-2025-61884: Oracle has provided patches for CVE-2025-61884 for all affected versions covered under Premier Support or Extended Support. However, security experts warned that patching alone may not be sufficient. The lessons from the recent CVE-2025-61882 attacks show that organizations need to hunt for signs of prior compromise even after applying fixes.In a…
Dull but dangerous: A guide to 15 overlooked cybersecurity blind spots

Oct 13, 2025 2:24 PM

Tags: access, ai, api, attack, backup, cloud, control, corporate, credentials, crypto, cybersecurity, data, detection, dns, edr, email, encryption, endpoint, exploit, firewall, firmware, governance, guide, iam, identity, iot, leak, least-privilege, linux, malicious, mfa, network, password, phishing, phone, ransomware, resilience, saas, sbom, service, siem, strategy, supply-chain, tool, unauthorized, update, vulnerability

Server time synchronization (NTP drift) Skewed clocks create a perfect cover for attackers. When your servers disagree about when events happened, correlation dies and forensics becomes fiction. Yet most organizations treat NTP like plumbing: set once and forget.Fix this now: Enforce a secure NTP hierarchy with authenticated sources. Monitor offset religiously. Block unauthorized NTP traffic…
Dull but dangerous: A guide to 15 overlooked cybersecurity blind spots

Oct 13, 2025 2:24 PM

Tags: access, ai, api, attack, backup, cloud, control, corporate, credentials, crypto, cybersecurity, data, detection, dns, edr, email, encryption, endpoint, exploit, firewall, firmware, governance, guide, iam, identity, iot, leak, least-privilege, linux, malicious, mfa, network, password, phishing, phone, ransomware, resilience, saas, sbom, service, siem, strategy, supply-chain, tool, unauthorized, update, vulnerability

Server time synchronization (NTP drift) Skewed clocks create a perfect cover for attackers. When your servers disagree about when events happened, correlation dies and forensics becomes fiction. Yet most organizations treat NTP like plumbing: set once and forget.Fix this now: Enforce a secure NTP hierarchy with authenticated sources. Monitor offset religiously. Block unauthorized NTP traffic…
FBI seizes BreachForums servers as threatened Salesforce data release deadline approaches

Oct 10, 2025 9:24 PM

Tags: attack, dark-web, data, detection, extortion, governance, infrastructure, intelligence, leak, least-privilege, radius, ransomware, risk, saas, service

Targeting SaaS: Rik Ferguson, VP security intelligence at Forescout, agreed that any disruption was likely to be a temporary setback.”It burns infrastructure, yields intelligence, and sows distrust among criminals. But the gang’s dark-web leak site is still up, and they explicitly say the campaign continues,” he told CSO Online by email.”That tells you everything about…
Don’t Let Your Cloud Security Catch a Bad Case of Permission Creep

Oct 7, 2025 5:35 PM

Tags: access, attack, breach, cloud, compliance, control, data, exploit, governance, iam, identity, international, Internet, kubernetes, least-privilege, mfa, risk, service, software, technology, threat, tool, vulnerability

Cloud security teams are often blind to one of the biggest threats to cloud environments: a web of over-privileged identities that create pathways for attackers. Learn how to regain control of your cloud identities by automating the enforcement of least privilege across your environment. Key takeaways The gradual accumulation of excessive and unused cloud permissions,…
Don’t Let Your Cloud Security Catch a Bad Case of Permission Creep

Oct 7, 2025 5:35 PM

Tags: access, attack, breach, cloud, compliance, control, data, exploit, governance, iam, identity, international, Internet, kubernetes, least-privilege, mfa, risk, service, software, technology, threat, tool, vulnerability

Cloud security teams are often blind to one of the biggest threats to cloud environments: a web of over-privileged identities that create pathways for attackers. Learn how to regain control of your cloud identities by automating the enforcement of least privilege across your environment. Key takeaways The gradual accumulation of excessive and unused cloud permissions,…
Security Lessons For All From GitHub’s Hardened Package Publication For npm

Oct 2, 2025 10:41 PM

Tags: github, least-privilege

GitHub is hardening npm publishing rules but the underlying lessons can be applied by all developers: WebAuthn for writes, OIDC, and short-lived least-privilege credentials. First seen on securityboulevard.com Jump to article: securityboulevard.com/2025/10/security-lessons-for-all-from-githubs-hardened-package-publication-for-npm/
Why DevOps Still Struggles with Least Privilege (Even in 2025)

Sep 19, 2025 9:16 PM

Tags: access, credentials, least-privilege

5 min readWhile least privilege remains a fundamental security principle, DevOps teams consistently fail to apply it to non-human identities, like CI/CD pipelines and applications. This struggle stems from a reliance on outdated, static credentials and a tension between development velocity and security, making a shift to ephemeral, policy-driven access a critical and necessary solution.…
What’s New in Tenable Cloud Security: A More Personalized, Global and Comprehensive Experience

Sep 18, 2025 9:16 PM

Tags: best-practice, cloud, compliance, container, control, data, fintech, framework, infrastructure, kubernetes, least-privilege, microsoft, oracle, risk, service, threat, tool, update, vulnerability

Check out the latest enhancements to our CNAPP product, including a more intuitive user experience with customizable dashboards, and stronger workload protection and data security. These improvements are designed to help you personalize workflows and gain deeper visibility across workloads, compliance frameworks and cloud databases. Key takeaways Tenable Cloud Security is now more personalized and…
No More Blind Spots: Achieving Complete SDLC Visibility in a Multi-Cloud World

Sep 17, 2025 1:15 AM

Tags: access, attack, breach, business, ciso, cloud, compliance, container, control, data, exploit, identity, infrastructure, least-privilege, monitoring, programming, risk, service, software, threat, vulnerability

Struggling with a messy, multi-cloud environment? Learn how Tenable’s unified cloud security approach helps you eliminate dangerous blind spots, attain complete visibility and control, and secure your assets from the first line of code to full production. Key takeaways Fragmented multi-cloud environments create risky blind spots, making unified visibility essential to identify and manage security…
New Tenable Report: How Complexity and Weak AI Security Put Cloud Environments at Risk

Sep 10, 2025 6:22 PM

Tags: access, ai, attack, authentication, breach, cloud, control, credentials, cyber, cybersecurity, data, governance, iam, identity, least-privilege, metric, mfa, monitoring, resilience, risk, security-incident, skills, software, strategy, threat, tool

This survey, commissioned by Tenable and developed in collaboration with the Cloud Security Alliance, warns that rapid cloud and AI adoption, combined with insecure identities and a reactive posture, leave organizations exposed. The report urges a strategic shift to preventive security with a unified view of risk and mature identity governance. Key takeaways Organizations are…
Ransomware upstart ‘The Gentlemen’ raises the stakes for OT”‘heavy sectors

Sep 10, 2025 5:16 PM

Tags: access, attack, breach, ceo, ciso, credentials, cybersecurity, data, defense, endpoint, group, healthcare, insurance, intelligence, least-privilege, monitoring, network, ransomware, resilience, risk, supply-chain, threat, tool, update, vulnerability, zero-trust

High-stakes industries make prime targets: The attacks have been spread across 17 countries, with Thailand and the US being the top targets, followed by Venezuela and India. The Gentlemen ransomware group already has a victim count of 27, with manufacturing and construction industries being the key targets, followed by healthcare, insurance, and others.”These sectors are…
Breaking Down Silos: Why You Need an Ecosystem View of Cloud Risk

Sep 9, 2025 5:08 PM

Tags: access, attack, business, ciso, cloud, compliance, container, cvss, cyber, data, data-breach, exploit, governance, grc, identity, infrastructure, Internet, least-privilege, metric, network, risk, threat, tool, training, vulnerability

A disjointed approach to cloud security generates more noise than clarity, making it hard for you to prioritize what to fix first. Learn how Tenable dissolves this challenge by integrating cloud security into a unified exposure management platform giving you the context to pinpoint your organization’s biggest cyber risks. Don’t just manage cloud security understand…
Breaking Down Silos: Why You Need an Ecosystem View of Cloud Risk

Sep 9, 2025 5:08 PM

Tags: access, attack, business, ciso, cloud, compliance, container, cvss, cyber, data, data-breach, exploit, governance, grc, identity, infrastructure, Internet, least-privilege, metric, network, risk, threat, tool, training, vulnerability

A disjointed approach to cloud security generates more noise than clarity, making it hard for you to prioritize what to fix first. Learn how Tenable dissolves this challenge by integrating cloud security into a unified exposure management platform giving you the context to pinpoint your organization’s biggest cyber risks. Don’t just manage cloud security understand…
The New Edge: Tunnel-Free, AI and Quantum-Ready

Sep 5, 2025 8:20 PM

Tags: access, ai, attack, automation, china, cloud, compliance, computing, control, cryptography, cyber, cybersecurity, data, defense, endpoint, firewall, framework, GDPR, healthcare, infrastructure, iot, least-privilege, malicious, mobile, network, office, resilience, risk, strategy, technology, threat, tool, unauthorized, vpn, vulnerability, zero-trust
Identity-First Security: Mitigating the Cloud’s Greatest Risk Vector

Sep 4, 2025 8:20 PM

Tags: access, ai, attack, best-practice, breach, business, cloud, credentials, data, defense, exploit, framework, google, iam, identity, infrastructure, least-privilege, microsoft, phishing, ransomware, risk, service, strategy, threat, vulnerability

Compromised credentials are now the leading cause of cloud breaches, making identity your most critical attack surface. A new IDC white paper explores why this shift is happening and where traditional defenses fall short. Read on to learn how Tenable’s identity-first approach turns this risk into your strongest defense. Hack the user, own the cloud.…
Why the Principle of Least Privilege Is Critical for Non-Human Identities

Sep 4, 2025 4:20 PM

Tags: automation, least-privilege

Overprivileged non-human identities expose enterprises to massive risk. Enforcing least privilege with automation and visibility is critical for security. First seen on securityboulevard.com Jump to article: securityboulevard.com/2025/09/why-the-principle-of-least-privilege-is-critical-for-non-human-identities/
Storm-0501 debuts a brutal hybrid ransomware attack chain

Aug 27, 2025 7:23 PM

Tags: access, attack, backup, breach, ciso, cloud, data, exploit, least-privilege, microsoft, ransom, ransomware, risk, threat, vulnerability

A holistic approach to put organizations under pressure: Microsoft’s DiGrippo emphasizes that the unique aspect of this new method is that it leverages hybrid environments that have both on-prem and cloud assets. “They put you in a situation where you’re under a significant amount of pressure because they’ve escalated privileges for themselves on both your…
Storm-0501 debuts a brutal hybrid ransomware attack chain

Aug 27, 2025 7:23 PM

Tags: access, attack, backup, breach, ciso, cloud, data, exploit, least-privilege, microsoft, ransom, ransomware, risk, threat, vulnerability

A holistic approach to put organizations under pressure: Microsoft’s DiGrippo emphasizes that the unique aspect of this new method is that it leverages hybrid environments that have both on-prem and cloud assets. “They put you in a situation where you’re under a significant amount of pressure because they’ve escalated privileges for themselves on both your…
New security features beef up Google Cloud Platform

Aug 19, 2025 6:54 PM

Tags: access, ai, attack, authentication, cloud, compliance, computing, control, credentials, data, defense, detection, encryption, finance, google, governance, group, iam, incident response, intelligence, least-privilege, monitoring, network, privacy, RedTeam, risk, service, soar, soc, technology, threat, tool, unauthorized, update, vulnerability, waf, zero-trust

CSO in an email.”One of the biggest security improvements that we’re announcing is within our AI Protection solution [part of a customer’s GCP Security Command Center]. As organizations rapidly adopt AI, we’re developing new capabilities to help them keep their initiatives secure.”These include new capabilities for automated discovery of AI agents and Model Context Protocol…
Cooking with Code: A DevOps Kitchen Secured by Thales

Aug 19, 2025 1:54 PM

Tags: access, ai, api, cctv, cloud, compliance, control, data, encryption, GDPR, identity, infrastructure, injection, least-privilege, malicious, mfa, military, monitoring, PCI, service, software, strategy, tool, waf, zero-day, zero-trust

Cooking with Code: A DevOps Kitchen Secured by Thales madhav Tue, 08/19/2025 – 05:13 In today’s hyperconnected digital world, deploying applications is a lot like running a high-performance, Michelin-star kitchen. You need the right setup, a disciplined process, and seamless coordination, where every tool, role, and task moves in harmony, executed flawlessly. Speed and precision…
The AI Security Dilemma: Navigating the High-Stakes World of Cloud AI

Aug 6, 2025 11:11 PM

Tags: access, ai, attack, cloud, container, control, credentials, cve, data, data-breach, flaw, google, identity, infrastructure, intelligence, least-privilege, microsoft, risk, service, software, tool, training, vulnerability, vulnerability-management

AI presents an incredible opportunity for organizations even as it expands the attack surface in new and complex ways. For security leaders, the goal isn’t to stop AI adoption but to enable it securely. Artificial Intelligence is no longer on the horizon; it’s here, and it’s being built and deployed in the cloud at a…
The age of infostealers is here. Is your financial service secure?

Aug 5, 2025 2:28 PM

Tags: access, ai, antivirus, authentication, awareness, breach, business, computer, credentials, cybersecurity, data, defense, detection, edr, endpoint, finance, Hardware, identity, intelligence, least-privilege, malware, mfa, monitoring, network, password, risk, service, siem, threat, tool, unauthorized, vulnerability

What financial institutions must do now: The stealthy nature of infostealers means traditional security measures are often inadequate. These programs are designed to operate in silence, avoiding detection by not disrupting performance. As a result, cybersecurity in the estate management space must evolve, not reactively, but proactively.First, organizations must implement robust endpoint detection and response…
Ransomware goes cloud native to target your backup infrastructure

Aug 5, 2025 10:28 AM

Tags: access, api, authentication, backup, cloud, container, control, credentials, cybercrime, data, defense, exploit, google, group, identity, infrastructure, least-privilege, linkedin, linux, malicious, malware, mfa, north-korea, ransomware, social-engineering, strategy, threat, vulnerability, vulnerability-management

Credential compromise and misconfiguration woes: More sophisticated threat groups have developed social engineering techniques to the point where they reliably trick targets into helping them to bypass multi-factor authentication (MFA) controls before ransacking compromised cloud-hosted environments.For example, threat actors are using compromised OAuth tokens to bypass MFA and inject malicious code into developer ecosystems via…
Ransomware attacks: The evolving extortion threat to US financial institutions

Aug 4, 2025 2:28 PM

Tags: access, ai, antivirus, attack, backup, banking, breach, business, cloud, communications, compliance, control, credentials, crime, crimes, cyber, cybercrime, cybersecurity, dark-web, data, ddos, defense, detection, edr, email, encryption, endpoint, extortion, finance, firewall, governance, group, identity, incident response, infrastructure, insurance, intelligence, international, korea, law, leak, least-privilege, lessons-learned, linkedin, linux, lockbit, login, malicious, mfa, monitoring, network, north-korea, organized, phishing, ransom, ransomware, resilience, risk, rust, service, soc, social-engineering, software, startup, strategy, supply-chain, tactics, theft, threat, tool, training, update, usa, vmware, vulnerability, warfare, windows, zero-trust

Before sunrise on a chilly November morning, I got the kind of call no security leader ever wants. A mid-sized U.S. bank had been hit overnight hard. Customers couldn’t access their accounts, ATMs were non-functional and every screen in the company’s environment glowed with the same ominous message: their systems were encrypted, and data had…
MCP: securing the backbone of Agentic AI

Aug 4, 2025 11:56 AM

Tags: access, ai, attack, authentication, business, ciso, control, credentials, cyber, data, detection, injection, least-privilege, mfa, monitoring, RedTeam, risk, security-incident, service, supply-chain, training

Four cornerstones for securing MCP servers: CISOs can largely rely on the proven basic principles of cyber security for MCP they just need to adapt them in a few places. Pure checklists fall short here. Instead, a clear, principles-based approach is required. Four central pillars have proven themselves in practice: Strong authentication and clean credential…
Mind the overconfidence gap: CISOs and staff don’t see eye to eye on security posture

Jul 31, 2025 10:28 AM

Tags: ai, attack, awareness, business, ciso, compliance, control, cyber, cybersecurity, data, defense, detection, grc, group, hacker, identity, incident response, intelligence, international, least-privilege, metric, network, phishing, ransomware, risk, risk-assessment, risk-management, soc, strategy, technology, threat, tool, training, update

Misplaced priorities: Investments often favor visibility and compliance over “core capabilities like detection engineering, incident response, and threat containment,” according to Santiago Pontiroli, lead security researcher at cybersecurity vendor Acronis TRU.Delayed adaptation: AI-driven threats demand faster, smarter defenses, but key upgrades (such as behavior-based analytics or automation) are often postponed due to underestimated risk, according…
Top 10 MCP vulnerabilities: The hidden risks of AI integrations

Jul 23, 2025 9:12 PM

Tags: access, ai, api, attack, authentication, backdoor, breach, business, data, data-breach, detection, email, encryption, github, google, identity, injection, least-privilege, LLM, login, malicious, mfa, network, risk, social-engineering, software, sql, supply-chain, theft, threat, tool, unauthorized, vulnerability

Living off AI attacks: A threat actor posing as an employee, business partner, or customer sends a request to a human support agent. But the request contains a hidden prompt injection with instructions that only an AI can read. When the human employee passes the request on to their AI assistant it then, by virtue…
8 trends transforming the MDR market today

Jul 18, 2025 10:40 AM

Tags: access, ai, at&t, attack, automation, breach, cloud, compliance, control, cyber, cybersecurity, data, detection, edr, endpoint, framework, GDPR, google, identity, infrastructure, intelligence, iot, least-privilege, monitoring, mssp, network, nis-2, ransomware, risk, service, siem, soc, sophos, strategy, technology, threat, tool, zero-trust

Digital transformation complexifies the attack surface: As businesses modernize their IT environments, the complexity of securing hybrid and cloud-native infrastructures increases, making MDR an attractive option for scalable, expert-led protection, experts say.The shift to hybrid work, IoT adoption, and an increase in cloud migrations have dramatically expanded attack surfaces, while ransomware and AI-powered attacks constantly…