Tag: risk
-
Washington State Filed Lawsuit Against T-Mobile Massive Data Breach
Washington State Attorney General Bob Ferguson filed a consumer protection lawsuit against T-Mobile for its alleged failure to secure sensitive personal information of over 2 million residents. This lawsuit comes in the wake of a massive data breach that exposed the personal details of Washingtonians, putting them at heightened risk of fraud and identity theft.…
-
The biggest data breach fines, penalties, and settlements so far
Tags: access, apache, attack, breach, business, china, ciso, communications, compliance, control, credentials, credit-card, cyberattack, cybercrime, cybersecurity, data, data-breach, email, finance, flaw, framework, GDPR, google, hacker, Hardware, identity, Internet, law, leak, linkedin, microsoft, mobile, monitoring, network, office, phone, privacy, regulation, risk, service, software, technology, tool, training, update, vulnerabilitySizable fines assessed for data breaches in recent years suggest that regulators are getting more serious about cracking down on organizations that don’t properly protect consumer data.Hit with a $ 1.3 billion fine for unlawfully transferring personal data from the European Union to the US, Meta tops the list of recent big-ticket sanctions, with one…
-
How CISOs can forge the best relationships for cybersecurity investment
Tags: access, ai, business, ceo, cio, ciso, communications, control, cyber, cybersecurity, data, finance, framework, group, guide, metric, network, privacy, risk, risk-analysis, risk-management, threat, tool, zero-trustWhen it comes to securing cybersecurity investments there are many things at play. The key often lies in the CISO’s ability to build relationships with key stakeholders across the organization. However, CISOs are being tasked with protecting their organizations while navigating budget constraints.Although nearly two-thirds of CISOs report budget increases, funding is only up 8%…
-
News Alert: Security Risk Advisors joins Microsoft Intelligent Security Association (MISA)
Philadelphia, Pa., Jan. 7, 2025, CyberNewswire, Security Risk Advisors today announced it has become a member of the Microsoft Intelligent Security Association (MISA), an ecosystem of independent software vendors (ISVs) and managed security service providers (MSSPs) that have integrated… (more”¦) First seen on securityboulevard.com Jump to article: securityboulevard.com/2025/01/news-alert-security-risk-advisors-joins-microsoft-intelligent-security-association-misa/
-
FDA Warns of Cyber Risks in Guidance for AI-Enabled Devices
New Non-Binding Recommendations Target Medical Device Makers, Software Developers. Manufacturers are eager to incorporate AI into a wide range of medical devices, from cardiac monitors that can spot developing heart problems to medical imaging systems that can find malignancies a radiologist might miss. The FDA released new guidance this week on how to secure these…
-
Moxa Warns of Critical Industrial Router Vulnerabilities
Flaws Enable Privilege Escalation and Remote Exploitation. Taiwanese industrial computing firm Moxa Technologies is warning customers about two high-severity vulnerabilities affecting its routers and network appliances, posing significant security risks to operational technology environments. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/moxa-warns-critical-industrial-router-vulnerabilities-a-27234
-
New Research Highlights Vulnerabilities in MLOps Platforms
New research by Security Intelligence has revealed security risks in MLOps platforms including Azure ML, BigML and Google Vertex AI First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/vulnerabilities-mlops-platforms/
-
Security Risk Advisors joins the Microsoft Intelligent Security Association
Philadelphia, Pennsylvania, 7th January 2025, CyberNewsWire First seen on hackread.com Jump to article: hackread.com/security-risk-advisors-joins-the-microsoft-intelligent-security-association/
-
Moxa router flaws pose serious risks to industrial environmets
Moxa warns of two flaws in its routers and security appliances that enable privilege escalation and remote command execution. Moxa addressed privilege escalation and OS command injection vulnerabilities in cellular routers, secure routers, and network security appliances. Below are the descriptions for both vulnerabilities: Moxa released firmware updates to address vulnerabilities CVE-2024-9140 and CVE-2024-9138. Affected…
-
Russian hackers turn trusted online stores into phishing pages
Tags: breach, credentials, credit-card, cybercrime, cybersecurity, data, email, finance, hacker, phishing, risk, russia, service, tactics, theft, threat, wordpressIn a smart campaign, Russian cybercriminals are turning trusted online stores into phishing pages that capture sensitive details through convincing payment interfaces.According to a research by the cybersecurity firm Slashnext, the Russian miscreants have built a WordPress plugin, PhishWP, which creates fake payment pages that look like trusted services, such as Stripe.”WordPress is one of…
-
Making the most of cryptography, now and in the future
Enterprise cryptography faces risks beyond just the advent of quantum computers. For starters, there is no guarantee that the traditional algorithms have not been broken. … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2025/01/07/cryptography-risks/
-
How eBPF is changing appsec – Impart Security
Tags: application-security, business, cloud, control, data, defense, network, risk, technology, tool, vulnerabilityWhat happens when cutting-edge technology meets the reality of securing modern applications? That’s the question our expert panel tackled in this conversation on how eBPF is reshaping application security. Moderated by Katie Norton of IDC, the discussion featured Brian Joe (Impart Security), Francesco Cipollone (Phoenix Security), and Daniel Pacak (cloud-native security consultant), who brought insights…
-
More telecom firms were breached by Chinese hackers than previously reported
Tags: access, at&t, attack, breach, china, cisco, communications, cyber, cyberespionage, cybersecurity, data, defense, disinformation, espionage, exploit, finance, fortinet, framework, government, group, hacker, Hardware, infrastructure, intelligence, international, microsoft, mobile, network, phone, regulation, risk, risk-management, router, spy, technology, threat, vulnerabilityChinese hackers linked to the Salt Typhoon cyberespionage operation have breached even more US telecommunications firms than initially reported.New victims, Charter Communications, Consolidated Communications, and Windstream, add to a growing list that already includes AT&T, Verizon, T-Mobile, and Lumen Technologies.Earlier, the US authorities informed that nine telecom firms have been affected by the Chinese espionage…
-
US Treasury incident a clear warning on supply chain security in 2025
A cyber incident at the US Department of the Treasury blamed on a Chinese state actor raises fresh warnings about supply chain risk after it was found to have originated via vulnerabilities in a remote tech support product First seen on computerweekly.com Jump to article: www.computerweekly.com/news/366617488/US-Treasury-incident-a-clear-warning-on-supply-chain-security-in-2025
-
PoC Exploit Released for Critical OpenSSH Vulnerability (CVE-2024-6387)
An alarming new development emerged in the cybersecurity landscape with the release of a proof-of-concept (PoC) exploit targeting the critical vulnerability identified as CVE-2024-6387. This vulnerability, discovered by researchers at Qualys, allows remote unauthenticated attackers to execute arbitrary code on vulnerable OpenSSH servers, posing a significant risk to users relying on this widely utilized protocol…
-
âš¡ THN Weekly Recap: Top Cybersecurity Threats, Tools and Tips [6 Jan]
Every tap, click, and swipe we make online shapes our digital lives, but it also opens doors”, some we never meant to unlock. Extensions we trust, assistants we rely on, and even the codes we scan are turning into tools for attackers. The line between convenience and vulnerability has never been thinner.This week, we dive…
-
Personal liability sours 70% of CISOs on their role
Tags: breach, business, ceo, ciso, control, corporate, cybersecurity, group, insurance, jobs, ransomware, risk, technologyWith legal accountability tightening around those charged with maintaining enterprise cybersecurity, security leaders appear to be increasingly frustrated with their roles, eyeing the exit, and hesitant to pursue CISO gigs in the future. More than two thirds (70%) of CISOs recently surveyed said that “stories of CISOs being held personally liable for cybersecurity incidents has negatively…
-
12 cybersecurity resolutions for 2025
Tags: advisory, ai, api, attack, awareness, breach, business, ceo, chatgpt, china, ciso, communications, control, crowdstrike, cyber, cyberattack, cybersecurity, data, data-breach, deep-fake, defense, detection, email, identity, insurance, jobs, law, malicious, phishing, ransomware, risk, risk-assessment, risk-management, strategy, supply-chain, technology, threat, tool, training, vulnerabilityAs cyber threats continue to evolve, CISOs must prepare for an increasingly complex threat landscape. From dealing with AI-driven attacks to managing changing regulatory requirements, it’s clear that 2025 will be another big year for CISOs.But staying ahead requires more than just implementing the next cutting-edge set of tools or technologies. It demands a shift…
-
Critical Windows LDAP flaw could lead to crashed servers, RCE attacks
Researchers have published a proof-of-concept exploit for a pair of Windows Lightweight Directory Access Protocol (LDAP) flaws that could lead to server crashes or remote code execution (RCE) on Windows servers.”Active Directory Domain Controllers (DCs) are considered to be one of the crown jewels in organizational computer networks,” noted researchers at security firm SafeBreach, who…
-
Das anhaltende Risiko der Remote-Code-Ausführung
Im Jahr 2023 wurden fast 29.000 Schwachstellen veröffentlicht, 3.800 mehr als im Jahr 2022. Noch beunruhigender als die schiere Menge der Schwachstellen im Jahr 2023 ist, dass mehr als die Hälfte von ihnen mit einem CVSS-Score bewertet wurden, der auf einen hohen oder kritischen Schweregrad hinweist ein Anstieg von 57 % im Vergleich zum ……
-
Cyber leaders are bullish on generative AI despite risks: report
Executives say they would overhaul tooling in exchange for better generative AI capabilities, according to a CrowdStrike survey. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/cyber-security-generative-AI-pros-CrowdStrike/736406/
-
ASUS Critical Vulnerabilities Let Attackers Execute Arbitrary Commands
In a recent security advisory, ASUS has alerted users to critical vulnerabilities affecting several of its router models. These flaws, tracked as CVE-2024-12912 and CVE-2024-13062, pose severe risks by allowing attackers to execute arbitrary commands on compromised devices. ASUS has advised users to act immediately by updating their routers to stay protected. About the Vulnerabilities The two vulnerabilities…
-
The Critical Risk of Using Dummy Email Domains in Payment Gateways
During our recent security assessments across multiple clients, we discovered a concerning pattern: many companies are unknowingly exposing their customers’ sensitive payment information through a simple yet critical misconfiguration in… First seen on securityboulevard.com Jump to article: securityboulevard.com/2025/01/the-critical-risk-of-using-dummy-email-domains-in-payment-gateways/