Tag: technology
-
China-Linked Earth Alux Uses VARGEIT and COBEACON in Multi-Stage Cyber Intrusions
Cybersecurity researchers have shed light on a new China-linked threat actor called Earth Alux that has targeted various key sectors such as government, technology, logistics, manufacturing, telecommunications, IT services, and retail in the Asia-Pacific (APAC) and Latin American (LATAM) regions.”The first sighting of its activity was in the second quarter of 2023; back then, it…
-
Privacy Roundup: Week 13 of Year 2025
Tags: access, ai, android, apple, application-security, breach, browser, cctv, chrome, cloud, cve, cybersecurity, data, detection, exploit, firmware, google, group, leak, linux, malware, microsoft, mobile, phishing, privacy, regulation, router, scam, service, software, technology, threat, tool, update, virus, vpn, vulnerability, zero-dayThis is a news item roundup of privacy or privacy-related news items for 23 MAR 2025 – 29 MAR 2025. Information and summaries provided here are as-is for warranty purposes. Note: You may see some traditional “security” content mixed-in here due to the close relationship between online privacy and cybersecurity – many things may overlap;…
-
Cybersecurity Leaders Share Three Challenges Exposure Management Helps Them Solve
Tags: access, attack, automation, best-practice, breach, business, cloud, container, control, cyber, cybersecurity, data, exploit, guide, infrastructure, Internet, microsoft, mobile, network, risk, risk-management, strategy, supply-chain, technology, threat, tool, vulnerability, vulnerability-management, zero-trustEach Monday, the Tenable Exposure Management Academy provides the practical, real-world guidance you need to shift from vulnerability management to exposure management. In this blog, we share three challenges cybersecurity leaders say exposure management helps them solve. You can read the entire Exposure Management Academy series here. Traditional vulnerability management is undergoing a transformation.…
-
How CISOs can balance business continuity with other responsibilities
Tags: attack, backup, breach, business, cio, ciso, compliance, cyber, cyberattack, cybersecurity, data, data-breach, finance, framework, healthcare, incident, incident response, metric, nist, ransomware, resilience, risk, service, strategy, supply-chain, technology, threat, usa, vulnerabilityCIO-CISO divide: Who owns business continuity?: While CISOs may find that their remit is expanding to cover business continuity, a lack of clear delineation of roles and responsibilities can spell trouble.To effectively handle business continuity, cybersecurity leaders need a framework to collaborate with IT leadership.Responding to events requires a delicate balance between thoroughness of investigation…
-
How can technology simplify the process of NHI compliance?
How is Technology Revolutionizing Non-Human Identities (NHI) Compliance? How can the integration of advanced technology streamline the process of NHI compliance? A robust cybersecurity strategy is indispensable, especially regarding the management of non-human identities (NHIs) and secrets for comprehensive cloud security. The critical importance of NHI and its intricacies lies in its ability to bridge……
-
Hoff’s Rule: People First
Dark Reading Confidential Episode 5: Christofer Hoff, chief secure technology officer at LastPass, shares the human side of the story of how he led his team through a major cyber incident and built from the ground up a security team and security culture. First seen on darkreading.com Jump to article: www.darkreading.com/cyberattacks-data-breaches/dark-reading-confidential-hoff-rule-people-first
-
A closer look at The Ultimate Cybersecurity Careers Guide
In this Help Net Security interview, Kim Crawley, cybersecurity expert and Professor at the Open Institute of Technology, discusses her latest book, The Ultimate Cybersecurity … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2025/03/27/kim-crawley-ultimate-cybersecurity-careers-guide/
-
RFID Hacking: Exploring Vulnerabilities, Testing Methods, and Protection Strategies
Radio-Frequency Identification (RFID) technology is everywhere”, powering everything from contactless payments and inventory tracking to access control systems. But while RFID systems makes life more convenient, it also introduces serious security… First seen on securityboulevard.com Jump to article: securityboulevard.com/2025/03/rfid-hacking-exploring-vulnerabilities-testing-methods-and-protection-strategies/
-
SandboxAQ Strengthens Leadership in Post-Quantum Security as NIST Approves HQC Algorithm
The National Institute of Standards and Technology (NIST) has officially added HQC (Hamming Quasi-Cyclic), co-invented by SandboxAQ, to its suite of post-quantum cryptographic (PQC) standards, the company announced today. HQC becomes the fifth algorithm selected by NIST in its ongoing effort to develop quantum-resistant encryption standards. Of the five, three will serve digital signature purposes,…
-
7 cutting-edge encryption techniques for reimagining data security
Tags: ai, computer, cryptography, data, dns, encryption, government, ibm, identity, nist, office, privacy, risk, software, technology, trainingPrivate information retrieval: Securing a database is fairly straightforward. Protecting the privacy of the users, however, is a bit more difficult. Private information retrieval algorithms make it possible for people to search the database for specific blocks of data without revealing too much to the database owner.This extra layer of protection relies on scrambling larger…
-
Die 10 häufigsten IT-Sicherheitsfehler
Von ungepatchten Sicherheitslücken bis hin zu unzureichenden Backups: Lesen Sie, wie sich die häufigsten IT-Sicherheitsfehler vermeiden lassen. Verschlüsselte Dateien und eine Textdatei mit einer Erpresser-Nachricht zeigen klar und deutlich: Ein Unternehmen ist einer Cyberattacke zum Opfer gefallen. Dabei ist das nur das Ende einer langen Angriffskette. Die Tätergruppe bewegt sich oft seit mehreren Wochen oder Monaten…
-
Commerce limits 19 Chinese, Taiwanese companies from buying U.S. tech
The sanctions place the companies under a strict licensing regime meant to limit their access to foundational technology for quantum computing, cloud and AI. First seen on cyberscoop.com Jump to article: cyberscoop.com/commerce-sanctions-chinese-firms-quantum-computing-ai-cloud/
-
Military AI caught in tension between speed and control
The use of artificial intelligence in military contexts can unlock a range of benefits for defence organisations, but also highlights a clear tension between speed and control baked into the technology First seen on computerweekly.com Jump to article: www.computerweekly.com/news/366621215/Military-AI-caught-in-tension-between-speed-and-control
-
The 7 technology trends that could replace passwords
230M stolen passwords met complexity requirements”, and were still compromised. Passwords aren’t going away for now, but there are new technologies that may increasingly replace them. Learn more from Specops Software about how to protect your passwords. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/the-7-technology-trends-that-could-replace-passwords/
-
New IOCONTROL Malware Let Attackers Control Critical Infrastructure Gain Remote Access
A new malware strain called IOCONTROL has emerged, posing a significant threat to Internet of Things (IoT) devices and operational technology (OT) systems, particularly those in critical infrastructure. First observed in December 2024, IOCONTROL is allegedly created by the anti-Israeli and pro-Iranian hacktivist group >>Cyber Av3ngers.
-
Mit GenAI zum Insider-Threat
Tags: ai, best-practice, ciso, cloud, cyersecurity, data-breach, framework, infrastructure, injection, intelligence, mitre, password, risk, risk-management, technology, threat, toolViele Unternehmen haben nicht auf dem Schirm, welche Sicherheitsprobleme durch die Nutzung von GenAI entstehen.Einer Analyse von Netskope zufolge sind GenAI-Daten-Uploads in Unternehmen innerhalb eines Jahres um das 30-Fache gestiegen. Darunter befinden sich demnach auch sensible Informationen wie Quellcodes, regulierte Daten, Passwörter und Schlüssel sowie geistiges Eigentum.Zudem nutzen drei von vier Unternehmen Apps mit integrierten…
-
Defense contractor to pay $4.6 million over third-party provider’s security weakness
A technology company based in Cambridge, Massachusetts, is the latest defense contractor to reach a settlement with the U.S. government for failing to meet federal cybersecurity requirements. First seen on therecord.media Jump to article: therecord.media/defense-contractor-to-pay-millions-over-cyber-practices
-
Clevo Devices Vulnerable as Boot Guard Private Key Leaks via Firmware Updates
A recent investigation has revealed that several Clevo-based devices are vulnerable due to a leak of Boot Guard private keys. This vulnerability was first reported on the Win-Raid forum and involves firmware updates containing sensitive Boot Guard Key Manifest (KM) and Boot Policy Manifest (BPM) private keys. Boot Guard is a security technology used by…
-
Legal impact on cybersecurity in 2025: new developments and challenges in the EU
Tags: 5G, authentication, compliance, corporate, cybersecurity, dora, finance, framework, fraud, identity, law, network, regulation, resilience, risk, service, strategy, technology, theftDORA Regulation: digital operational resilience in the financial sector: Regulation 2022/2554 (DORA) focuses on increasing the “Digital Operational Resilience” of financial institutions. Approved on 14 December 2022, DORA seeks to strengthen the security and robustness of financial sector entities’ information systems, with the aim of reducing technological risks and cyberthreats.As mentioned, DORA is applicable to…
-
Rising attack exposure, threat sophistication spur interest in detection engineering
Tags: access, ai, attack, automation, banking, ceo, ciso, cloud, compliance, cyber, cybersecurity, data, detection, endpoint, exploit, finance, framework, healthcare, infrastructure, insurance, intelligence, LLM, malware, mitre, network, programming, ransomware, RedTeam, risk, sans, siem, software, supply-chain, tactics, technology, threat, tool, update, vulnerability, zero-dayMore than the usual threat detection practices: Proponents argue that detection engineering differs from traditional threat detection practices in approach, methodology, and integration with the development lifecycle. Threat detection processes are typically more reactive and rely on pre-built rules and signatures from vendors that offer limited customization for the organizations using them. In contrast, detection…
-
Getting the Most Value Out of the OSCP: The PEN-200 Labs
Tags: access, ai, attack, compliance, container, cyber, cybersecurity, dns, docker, exploit, firewall, guide, hacking, Hardware, infrastructure, intelligence, jobs, kubernetes, microsoft, mitigation, network, open-source, oracle, penetration-testing, powershell, risk, security-incident, service, siem, skills, technology, tool, training, vmware, vulnerability, windowsHow to leverage the PEN-200 simulated black-box penetration testing scenarios for maximal self-improvement and career success. Disclaimer: All opinions expressed in this article are solely my own. I have reviewed the content to ensure compliance with OffSec’s copyright policies and agreements. I have not been sponsored or incentivized in any way to recommend or oppose any…
-
Data Connect announces vSOC Assure to streamline cyber risk assessments and increase cyber resilience
Data Connect, a leading cyber security services provider underpinned by elite cyber practitioners and technology, today announced the launch of vSOC Assure. The platform has been developed in response to the growing need for robust, ongoing security assessments and it goes beyond traditional cyber security audits, offering a structured, year-round approach to risk identification, remediation…
-
Gartner Names CYREBRO in Emerging Tech Report for Detection Response Startups
Ramat Gan, Israel, March 25th, 2025, CyberNewsWire CYREBRO, the AI-native Managed Detection and Response (MDR), today announced its recognition as a leading detection and response startup in the Gartner report, Emerging Tech: Techscape for Detection and Response Startups. This acknowledgment highlights CYREBRO’s innovative approach to cybersecurity, leveraging advanced technology and expert analysis to combat evolving…
-
Privacy-boosting tech could prevent breaches, data misuse with government aid, report says
The New America Open Technology Institute report comes amid DOGE access to sensitive government agency information that has alarmed experts. First seen on cyberscoop.com Jump to article: cyberscoop.com/privacy-boosting-tech-could-prevent-breaches-data-misuse-with-government-aid-report-says/
-
NIST Facing Challenges in Managing CVE Backlog in National Database
The National Institute of Standards and Technology (NIST) recently issued an update on its efforts to manage the backlog of Common Vulnerabilities and Exposures (CVEs) in the National Vulnerability Database (NVD). While NIST has regained its pre-summer 2024 processing speed for incoming CVEs, a significant increase in submissions has left the organization struggling to keep…