Tag: technology
-
Security leaders top 10 takeaways for 2024
Tags: access, ai, attack, automation, best-practice, breach, business, ciso, cloud, compliance, corporate, crowdstrike, cybercrime, cybersecurity, data, deep-fake, detection, email, finance, fraud, governance, group, guide, hacker, identity, incident response, infosec, ISO-27001, office, okta, phishing, privacy, programming, regulation, risk, risk-management, saas, security-incident, service, software, startup, strategy, technology, threat, tool, training, vulnerabilityThis year has been challenging for CISOs, with a growing burden of responsibility, the push to make cybersecurity a business enabler, the threat of legal liability for security incidents, and an expanding attack landscape.As the year comes to a close, CISOs reflect on some of the takeaways that have shaped the security landscape in 2024.…
-
The Hidden Risks of Mobile Calls and Messages: Why EndEnd Encryption is Just the Starting Line
Tags: access, android, breach, business, communications, control, cybercrime, cybersecurity, data, encryption, endpoint, espionage, government, identity, intelligence, mobile, network, risk, service, startup, technology, threat, tool, update, vulnerabilityThe recent breaches of sovereign telecom networks in the United States, underscores how highly connected but fragmented public networks are increasingly vulnerable to sophisticated attacks. Another rising concern is the blind trust organizations and individuals put into consumer-grade messaging apps such as WhatsApp to share government and commercially-sensitive information. Some of the biggest risks concerning these…
-
Platforms are the Problem
Tags: ai, breach, business, chatgpt, cloud, cyber, cybercrime, cybersecurity, data, defense, detection, finance, firewall, fraud, infrastructure, intelligence, LLM, network, saas, service, technology, threat, toolA better path forward for cybersecurity Why is it that cybersecurity is struggling to keep pace with the rapidly evolving threat landscape? We spend more and more, tighten our perimeters, and still there are trillions of dollars being lost to cybercrime and cyber attacks. Setting aside the direct costs to individuals and businesses, and the…
-
Time of Reckoning Reviewing My 2024 Cybersecurity Predictions
Tags: ai, attack, automation, awareness, breach, business, chatgpt, china, compliance, cyber, cyberattack, cybercrime, cybersecurity, data, data-breach, disinformation, election, espionage, exploit, healthcare, incident response, infrastructure, jobs, law, linkedin, malware, monitoring, moveIT, phishing, privacy, ransomware, regulation, risk, russia, service, software, supply-chain, technology, threat, tool, ukraine, update, vulnerability, warfare, zero-dayThe brutal reality is that cybersecurity predictions are only as valuable as their accuracy. As 2024 comes to a close, I revisit my forecasts to assess their utility in guiding meaningful decisions. Anyone can make predictions (and far too many do), but actually being correct is another matter altogether. It is commonplace for security companies…
-
US Updates a Science and Technology Pact With China to Reflect Growing Rivalry and Security Threats
The new agreement has a narrower scope and additional safeguards to minimize the risk to national security. The post US Updates a Science and Technology Pact With China to Reflect Growing Rivalry and Security Threats appeared first on SecurityWeek. First seen on securityweek.com Jump to article: www.securityweek.com/us-updates-a-science-and-technology-pact-with-china-to-reflect-growing-rivalry-and-security-threats/
-
Ransomware in the Global Healthcare Industry”¯
Healthcare organizations are increasingly relying on digital systems to facilitate their daily workflow, but the prevalence of outdated legacy technology in the sector is rendering it vulnerable to cyberattacks with severe consequences.”¯”¯ “¯ First seen on securityboulevard.com Jump to article: securityboulevard.com/2024/12/ransomware-in-the-global-healthcare-industry/
-
Iran-Linked IOCONTROL Malware Targets SCADA and Linux-Based IoT Platforms
Iran-affiliated threat actors have been linked to a new custom malware that’s geared toward IoT and operational technology (OT) environments in Israel and the United States.The malware has been codenamed IOCONTROL by OT cybersecurity company Claroty, highlighting its ability to attack IoT and supervisory control and data acquisition (SCADA) devices such as IP cameras, routers,…
-
How to turn around a toxic cybersecurity culture
Tags: access, advisory, attack, authentication, awareness, business, ciso, compliance, control, cyber, cybersecurity, data, governance, group, guide, healthcare, jobs, password, phishing, risk, sans, service, strategy, technology, threat, training, vulnerability, zero-trustA toxic cybersecurity culture affects team turnover, productivity, and morale. Worse yet, it places enterprise systems and data at risk.In a toxic cybersecurity culture, everybody believes that cybersecurity is somebody else’s job, says Keri Pearlson, executive director for Cybersecurity at MIT Sloan (CAMS), a research consortium focusing on cybersecurity leadership and governance issues. “They don’t…
-
Microsoft Windows ‘Best Fit’ character conversion ‘ripe for exploitation’
Tags: api, application-security, attack, cve, exploit, flaw, injection, malicious, microsoft, mitigation, office, programming, software, switch, technology, tool, vulnerability, windowsSecurity researchers have outlined a novel attack vector that exploits the “Best Fit” character conversion technology built into Windows.The technology comes into play in string conversions, particularly when characters cannot be directly represented in a target character set.However, application security experts Orange Tsai and Splitline Huang from Taiwanese firm DEVCORE used a presentation at Black…
-
US Sanctions Chinese Cybersecurity Firm for Firewall Exploit, Ransomware Attacks
SUMMARY The United States has taken strong action against a Chinese cybersecurity company, Sichuan Silence Information Technology, for… First seen on hackread.com Jump to article: hackread.com/us-sanctions-chinese-cybersecurityfirm-firewall-ransomware/
-
How AI agents are the next wave of generative technology
As agentic technology grows more popular, some are optimistic about what appears to be the next phase of AI. However, there are concerns about the tasks agents are doing. First seen on techtarget.com Jump to article: www.techtarget.com/searchenterpriseai/news/366617158/How-AI-agents-are-the-next-wave-of-generative-technology
-
KeyTrap DNSSEC: The day the internet (almost) stood still
Tags: attack, cyberattack, cybersecurity, data, dns, email, exploit, germany, google, Internet, mitigation, service, software, technology, vulnerabilityA severe vulnerability in the internet lookup protocol DNSSEC carried the potential to make much of the web functionally inaccessible for many, according to a presentation at Black Hat Europe.DNSSEC (Domain Name System Security Extensions) offers mitigation against various types of cyberattacks, including DNS spoofing and cache poisoning, by providing a way to cryptographically authenticate…
-
Why did China hack the world’s phone networks?
Tags: access, breach, china, communications, cyberattack, cybercrime, cybersecurity, government, group, hacker, Internet, microsoft, network, phone, service, technologySalt Typhoon breached dozens of telecoms around the world<ul><li><a href=”https://www.theguardian.com/info/2022/sep/20/sign-up-for-the-techscape-newsletter-our-free-technology-email”>Don’t get TechScape delivered to your inbox? Sign up here</li></ul>Chinese hackers <a href=”https://www.theguardian.com/technology/2024/dec/04/chinese-hackers-american-cell-phones”>have breached dozens of telecommunications companies around the world. The breach, christened Salt Typhoon by Microsoft cybersecurity researchers, has afforded the cybercriminals unprecedented access not only to information on who has been texting or…
-
New Chinese Surveillance Tool Attack Android Users Since 2017
Wuhan Chinasoft Token Information Technology Co., Ltd. developed EagleMsgSpy, a surveillance tool operational since 2017, which, installed as an APK, secretly collects extensive user data, including chat messages, screen recordings, audio, call logs, contacts, SMS, location, and network activity. Because the data is sent to a command-and-control server, there is a possibility that it could…
-
BadRAM Attack Breaches AMD Secure VMs with $10 Device
Researchers have uncovered a vulnerability that allows attackers to compromise AMD’s Secure Encrypted Virtualization (SEV) technology using a $10 device. This breakthrough exposes a previously underexplored weakness in memory module security, specifically in cloud computing environments where SEV is widely used to protect sensitive data, which is shared on the BadRAM page. Modern computers depend…
-
Attackers can abuse the Windows UI Automation framework to steal data from apps
An accessibility feature built into Windows to facilitate the use of computers by people with disabilities can be abused by malware to steal data from other applications or control them in malicious ways that evades detection by most endpoint protection systems.The Windows UI Automation framework has existed since the days of Windows XP and provides…
-
CVE-2020-12271 Exploited: FBI Seeks Chinese Hacker Behind 81,000 Device Breach
The US Department of Justice announced the unsealing of an indictment against Guan Tianfeng, a Chinese national associated with Sichuan Silence Information Technology Co. Ltd., for his alleged role in... First seen on securityonline.info Jump to article: securityonline.info/cve-2020-12271-exploited-fbi-seeks-chinese-hacker-behind-81000-device-breach/
-
Chinese APT Groups Targets European IT Companies
Evidence Mounts for Chinese Hacking ‘Quartermaster’. A probable Chinese nation-state threat actor compromised Visual Studio Code and Microsoft Azure cloud infrastructure to target Western technology firms for espionage, security firms Tinexta Cyber and SentinelLabs said. The companies call the campaign Operation Digital Eye. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/chinese-apt-groups-targets-european-companies-a-27030
-
US Defense Bill Includes Major Focus on Tech, AI and Cyber
Defense Bill Targets Key Investments in AI, Cybersecurity and Quantum Technologies. An $895 billion National Defense Authorization Act features key provisions for significant investments in artificial intelligence, cybersecurity and quantum technology, including initiatives aimed at enhancing the Pentagon’s technological capabilities. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/us-defense-bill-includes-major-focus-on-tech-ai-cyber-a-27028
-
Top Tech Conferences Events to Add to Your Calendar in 2025
A great way to stay current with the latest technology trends and innovations is by attending conferences. Read and bookmark our tech events guide. First seen on techrepublic.com Jump to article: www.techrepublic.com/article/top-tech-conferences-events/
-
US sanctions Chinese cybersecurity firm over global malware campaign
Tags: attack, breach, china, computer, control, corporate, credentials, cve, cyber, cyberattack, cybersecurity, email, encryption, exploit, finance, firewall, fraud, government, group, healthcare, identity, infection, infrastructure, intelligence, international, malicious, malware, monitoring, network, office, password, ransomware, risk, service, software, sophos, technology, terrorism, threat, tool, vulnerability, zero-dayThe US government has imposed sanctions on Chinese cybersecurity firm Sichuan Silence Information Technology and one of its employees, Guan Tianfeng, for their alleged involvement in a 2020 global cyberattack that exploited zero day vulnerabilities in firewalls.The actions were announced by the US Department of the Treasury and the Department of Justice (DOJ), which also…
-
Black Hat Europe preview: Cryptographic protocol attacks and AI in the spotlight
Tags: access, ai, application-security, attack, authentication, backdoor, best-practice, computer, conference, control, cybercrime, cybersecurity, data, dns, encryption, exploit, finance, github, government, hacker, healthcare, identity, injection, Internet, LLM, malicious, microsoft, mitigation, office, open-source, radius, RedTeam, risk, service, sophos, technology, tool, training, vulnerability, vulnerability-management, windowsThis week in London Black Hat Europe will feature a diverse range of talks and presentations covering the latest developments in cybersecurity.The opening keynote on Wednesday will be delivered by Frédérick Douzet, a professor of geopolitics at the University of Paris 8, and director of the French Institute of Geopolitics research team. No preview is…
-
US sanctions Chinese cyber firm for compromising ‘thousands’ of firewalls in 2020
Sichuan Silence Information Technology Company and one of its employees, Guan Tianfeng, were the targets of the sanctions, and the Justice Department indicted Guan for his role in the attacks. The State Department also issued a $10 million reward for additional information on the company or Guan.]]> First seen on therecord.media Jump to article: therecord.media/us-sanctions-chinese-cyber-firm-compromising-firewalls
-
SPA is for Single-Page Abuse! Using Single-Page Application Tokens to Enumerate Azure
Author: Lance B. Cain Overview Microsoft Azure is a leading cloud provider offering technology solutions to companies, governments, and other organizations around the globe. As such, many entitles have begun adopting Azure for their technology needs to include identity, authentication, storage, application management, and web services. One of the most common methods for organizations to begin…
-
Traveling for the Holidays? Your Digital Identity Is Along for the Ride
Traveling for the Holidays? Your Digital Identity Is Along for the Ride andrew.gertz@t“¦ Tue, 12/10/2024 – 14:20 Identity & Access Management Access Control Thales – Cloud Protection & Licensing Solutions More About This Author > Thales Contributors: Frederic Klat, Sales Acceleration Director, and Ward Duchamps, Director of Strategy and Innovation, CIAM If you’re one…
-
Cato Networks Introduces Industry’s First SASE-native IoT/OT Security Solution
Cato Networks, the SASE provider, today announced the industry’s first SASE-native IoT/OT security solution. With the introduction of Cato IoT/OT Security, Cato is enabling enterprises to dramatically simplify the management and security of Internet of Things (IoT) and operational technology (OT) devices. Cato IoT/OT Security converges device discovery and classification, policy enforcement, and threat prevention…