Tag: supply-chain
-
AI development pipeline attacks expand CISOs’ software supply chain risk
Tags: access, ai, api, application-security, attack, backdoor, breach, business, ciso, cloud, container, control, cyber, cybersecurity, data, data-breach, detection, encryption, exploit, flaw, fortinet, government, infrastructure, injection, intelligence, LLM, malicious, malware, ml, network, open-source, password, penetration-testing, programming, pypi, risk, risk-assessment, russia, saas, sbom, service, software, supply-chain, threat, tool, training, vpn, vulnerabilitydevelopment pipelines are exacerbating software supply chain security problems.Incidents of exposed development secrets via publicly accessible, open-source packages rose 12% last year compared to 2023, according to ReversingLabs (RL).A scan of 30 of the most popular open-source packages found an average of six critical-severity and 33 high-severity flaws per package.Commercial software packages are also a…
-
Large enterprises scramble after supply-chain attack spills their secrets
tj-actions/changed-files, corrupted to run credential-stealing memory scraper. First seen on arstechnica.com Jump to article: arstechnica.com/information-technology/2025/03/supply-chain-attack-exposing-credentials-affects-23k-users-of-tj-actions/
-
Malicious PyPI Packages Stole Cloud Tokens”, Over 14,100 Downloads Before Removal
Cybersecurity researchers have warned of a malicious campaign targeting users of the Python Package Index (PyPI) repository with bogus libraries masquerading as “time” related utilities, but harboring hidden functionality to steal sensitive data such as cloud access tokens.Software supply chain security firm ReversingLabs said it discovered two sets of packages totaling 20 of them. The…
-
CIOs and CISOs take on NIS2: Key challenges, security opportunities
Tags: access, cio, ciso, compliance, cybersecurity, data, GDPR, group, healthcare, ISO-27001, jobs, monitoring, nis-2, office, organized, privacy, regulation, risk, skills, software, strategy, supply-chain, technology, trainingCompliance will be easier for some: There are CIOs and CISOs who have found NIS2 compliance relatively easy: those who have worked toward ISO/IEC 27001:2022 certification, whether they remained in the preparation phase or actually got certified.Those who have the certification report having found themselves with “80% of the work done”: the company is ready…
-
Silk Typhoon Targeting IT Supply Chains and Network Devices, Microsoft Reports
Tags: china, espionage, exploit, group, intelligence, microsoft, network, supply-chain, tactics, threatMicrosoft Threat Intelligence has issued new reporting about tactics being used by Silk Typhoon (also called APT27 or HAFNIUM by some researchers). Silk Typhoon is a Chinese espionage group, observed targeting Microsoft Exchange Servers in 2021, now reported to be targeting common IT solutions for initial access. Microsoft reports that Silk Typhoon exploits unpatched applications,……
-
Cyber-Risikomanagement in der Supply Chain – Eskalierende Bedrohungslandschaft für Lieferketten
First seen on security-insider.de Jump to article: www.security-insider.de/supply-chain-angriffe-schutz-lieferkette-a-11630a1cbc64b1e9b6d7a65efd5e83d4/
-
6 wichtige Punkte für Ihren Incident Response Plan
Tags: backup, business, ceo, ciso, compliance, cyber, cyberattack, cybersecurity, cyersecurity, finance, incident response, mail, ransomware, risk, security-incident, service, strategy, supply-chain, updateLesen Sie, welche Schritte für Ihren Notfallplan besonders wichtig sind.Wenn ein Unternehmen einen größeren Ausfall seiner IT-Systeme erlebt beispielsweise aufgrund eines Cyberangriffs ist es zu diesem Zeitpunkt nicht mehr voll geschäftsfähig. Deshalb ist ein effektiver Plan zur Reaktion auf Vorfälle (Incident Response, IR) unerlässlich.Es geht jedoch nicht nur darum, die Quelle eines Angriffs zu finden…
-
Unternehmen ertrinken in Software-Schwachstellen
Tags: ai, cve, cyersecurity, framework, open-source, risk, software, strategy, supply-chain, vulnerability, xssDie durchschnittliche Behebungszeit für Sicherheitslücken ist in den vergangenen fünf Jahren deutlich gestiegen. Laut dem aktuellen State of Software Security Report von Veracode ist die durchschnittliche Behebungszeit für Sicherheitslücken in den vergangenen fünf Jahren von 171 auf 252 Tage gestiegen.Darüber hinaus weist die Hälfte (50 Prozent) der Unternehmen inzwischen eine risikoreiche “Sicherheitsschuld” auf, die länger…
-
Sonatype Brings Supply Chain Security Tools to Open Source AI
First seen on scworld.com Jump to article: www.scworld.com/news/sonatype-brings-supply-chain-security-tools-to-open-source-ai
-
UK Government Report Calls for Stronger Open Source Supply Chain Security Practices
Report from the Department for Science, Innovation Technology (DSIT) finds weaknesses in current practices. The post UK Government Report Calls for Stronger Open Source Supply Chain Security Practices appeared first on SecurityWeek. First seen on securityweek.com Jump to article: www.securityweek.com/uk-government-report-calls-for-stronger-open-source-supply-chain-security-practices/
-
Companies are drowning in high-risk software security debt, and the breach outlook is getting worse
Flaw prevalence: Leading organizations have flaws in fewer than 43% of applications, while lagging organizations exceed 86%.Fix capacity: Leaders resolve over 10% of flaws monthly, whereas laggards address less than 1%.Fix speed: Top performers remediate half of flaws in five weeks; lower-performing organizations take longer than a year.Security debt prevalence: Less than 17% of applications…
-
Backdoor in Bluetooth-Chip entdeckt
Der Chip ESP32 kommt in zahlreichen Geräten zum Einsatz. Security-Forscher haben nun eine Sicherheitslücke gefunden.Der von der chinesischen Firma Espressif hergestellte ESP32 ist eine wichtige Komponente für die Wi-Fi- und Bluetooth-Konnektivität im IoT-Bereich (Internet of Things). Der Microchip kommt unter anderem in Smartphones, Computern, intelligenten Schlössern und medizinischen Geräten zum Einsatz. Forscher von Tarlogic Security…
-
Verifying the mix: How to handle softwarechain security
First seen on scworld.com Jump to article: www.scworld.com/resource/verifying-the-mix-how-to-handle-software-supply-chain-security
-
Chinese APT Silk Typhoon exploits IT supply chain weaknesses for initial access
Tags: access, apt, attack, authentication, china, citrix, cloud, control, corporate, credentials, data, detection, email, exploit, firewall, github, government, group, hacker, identity, Internet, ivanti, least-privilege, microsoft, network, password, service, software, supply-chain, threat, update, vpn, vulnerability, zero-dayTwo-way lateral movement: Aside from abusing cloud assets and third-party services and software providers to gain access to local networks, the Silk Typhoon attackers are also proficient in jumping from on-premise environments into cloud environments. The group’s hackers regularly target Microsoft AADConnect (now Entra Connect) servers which are used to synchronize on-premise Active Directory deployments…
-
IT Supply Chains Targeted By Silk Typhoon Attacks
First seen on scworld.com Jump to article: www.scworld.com/brief/it-supply-chains-targeted-by-silk-typhoon-attacks
-
Microsoft reveals Silk Typhoon supply chain attack
First seen on scworld.com Jump to article: www.scworld.com/news/microsoft-reveals-silk-typhoons-recent-supply-chain-targeting
-
Microsoft Warns of Silk Typhoon Hackers Exploiting Cloud Services to Attack IT Supply Chain
Microsoft Threat Intelligence has identified a significant shift in tactics by Silk Typhoon, a Chinese espionage group, now targeting common IT solutions such as remote management tools and cloud applications for initial access. This well-resourced and technically proficient threat actor has demonstrated a large targeting footprint among Chinese threat actors, exploiting vulnerabilities in edge devices…
-
Silk Typhoon hackers now target IT supply chains to breach networks
Microsoft warns that Chinese cyber-espionage threat group ‘Silk Typhoon’ has shifted its tactics, now targeting remote management tools and cloud services in supply chain attacks that give them access to downstream customers. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/silk-typhoon-hackers-now-target-it-supply-chains-to-breach-networks/
-
China Hackers Behind US Treasury Breach Caught Targeting IT Supply Chain
Silk Typhoon APT caught using IT supply chain entry points to conduct reconnaissance, siphon data, and move laterally on victim networks. The post China Hackers Behind US Treasury Breach Caught Targeting IT Supply Chain appeared first on SecurityWeek. First seen on securityweek.com Jump to article: www.securityweek.com/china-hackers-behind-us-treasury-breach-caught-targeting-it-supply-chain/
-
China-Linked Silk Typhoon Expands Cyber Attacks to IT Supply Chains for Initial Access
Tags: access, attack, china, corporate, cyber, exploit, flaw, hacking, intelligence, microsoft, supply-chain, tactics, technology, threat, zero-dayThe China-lined threat actor behind the zero-day exploitation of security flaws in Microsoft Exchange servers in January 2021 has shifted its tactics to target the information technology (IT) supply chain as a means to obtain initial access to corporate networks.That’s according to new findings from the Microsoft Threat Intelligence team, which said the Silk Typhoon…
-
Why Supply Chain Attacks Are The Biggest Threat To Businesses?
In 2024, approximately 183,000 customers worldwide were affected by supply chain attacks. In terms of frequency, the software supply chain experienced one attack every 48 hours. Surprisingly, India is among the most targeted countries, along with the USA, UK, Australia, Japan, and Germany. Manufacturing, healthcare, defense, and aerospace are among the most targeted sectors. Among……
-
British Tech Industry Backs UK Proposal on Software Security
Code of Practice for Software Vendors Sets Baseline Security Expectations. A British government proposal to strengthen software supply chain security received positive feedback from vendors who said voluntary best practices could strengthen cyber defenses. The guidelines suggest requiring multifactor authentication for developers and timely vulnerability patching. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/british-tech-industry-backs-uk-proposal-on-software-security-a-27645
-
Is your enterprise ‘cyber resilient’? Probably not. Here’s how other boards fixed that
Tags: backup, breach, business, ciso, cloud, compliance, control, cyber, cyberattack, cybersecurity, endpoint, finance, framework, governance, incident, metric, monitoring, nist, resilience, risk, service, strategy, supply-chain, tool, training, vulnerability, vulnerability-managementLockheed Martin: Lockheed Martin introduced its Cyber Resiliency Level (CRL) Framework and corresponding Scoreboard in 2018, illustrating a more formalized approach to measuring cyber resilience during this period. The company’s Cyber Resiliency Scoreboard includes tools like a questionnaire and dashboard for measuring the maturity levels of six categories, including Cyber Hygiene and Architecture.MIT: The Balanced Scorecard for Cyber Resilience (BSCR) provides…
-
New White House Plan to Track Spending Raises Cyber Risks
Trump’s Procurement Tracking Directive Could Expose Vast Government Data to Threats. The White House is mandating federal agencies to track and justify every procurement, a move aimed at transparency but one that experts warn could expose troves of sensitive financial data to hacking, nation-state cyber threats and potential supply chain vulnerabilities across government systems. First…
-
5 things to know about ransomware threats in 2025
Tags: access, attack, authentication, awareness, backup, breach, ciso, cloud, control, credentials, cyber, dark-web, data, data-breach, defense, detection, encryption, exploit, extortion, finance, fraud, group, healthcare, identity, incident response, infrastructure, Internet, iot, law, leak, mfa, monitoring, network, password, ransom, ransomware, risk, scam, service, software, sophos, supply-chain, technology, threat, tool, update, vpn, vulnerability, zero-day2. Mid-size organizations are highly vulnerable: Industry data shows mid-size organizations remain highly vulnerable to ransomware attacks. “CISOs need to be aware that ransomware is no longer just targeting large companies, but now even mid-sized organizations are at risk. This awareness is crucial,” says Christiaan Beek, senior director, threat analytics, at Rapid7.Companies with annual revenue…