Week in review: New Intel CPU vulnerabilities, SharePoint servers under attack
Here’s an overview of some of last week’s most interesting news and articles:
High-risk vulnerability in Cisco’s secure boot process impacts millions of devices
Red Balloon Security has discovered a high-risk vulnerability in Cisco’s secure boot process which impacts a wide range of Cisco products in use among enterprise and government networks, including routers, switches and firewalls.
Tips to spring clean your company’s social media and stay protected
Spring is a great time for organizations and businesses to examine or re-evaluate the security posture of their social media presence and related activities.
Identity theft victims could lead us to accept more security-improving friction
Far too many individuals who have never been victims of identity theft and financial crimes don’t understand how devastating those are to victims.
Intel MDS attack mitigation: An overview
Intel has revealed that some of its CPUs are vulnerable to a number of new speculative execution attacks that may allow attackers to stealing sensitive data and keys/passwords.
Microsoft plugs wormable RDP flaw, new speculative execution side channel vulnerabilities
Microsoft has released fixes for 79 vulnerabilities, 22 of which are deemed critical. Among the fixes is that for CVE-2019-0708, a “wormable” RDP flaw that is expected to be weaponised by attackers very soon.
Despite warnings, most people still don’t change their passwords
64% of people use the same password for some, or even all, of their online accounts, while only 21% use a different password for each account.
The lurking danger of hacked email reply chains
Although phishing has been around in various forms since the 1990s, recent news has shown that it continues to evolve – and remains a major threat. These days, phishing tactics are so sophisticated it can be difficult to spot a scam – particularly in the case of hijacked email reply chains.
What does it take to be an infosec product strategist?
Choosing a security product that will best fit your organization’s needs is a challenge exacerbated by the “polluted, turbulent sea of ineffectual security products” that you’ll need to wade through in order to find the right and effective solution.
PII capturing websites still applying poor security measures one year after GDPR
One year after the EU General Data Protection Regulation (GDPR) went into effect, 1 in 10 PII capturing websites belonging to the top 10 UK financial services organizations are still doing so without adequate security measures, potentially breaching GDPR guidelines, RiskIQ has discovered.
How can we give cybersecurity analysts a helping hand?
It’s tough being a cybersecurity analyst these days. Over the last few years we have been repeatedly reminded of the challenge they are now facing, primarily through the steady stream of high-profile data breaches that have hit the headlines.
What CISOs should focus on when deciding on a strategy
The effectiveness of an organization’s security strategy and implementation can sometimes be difficult to assess. Michael Hamilton, President and CISO of CI Security, says looking at a number of key performance indicators can help.
WhatsApp flaw used to install spyware by simply calling the target
A security vulnerability in the popular Facebook-owned end-to-end encrypted messaging app WhatsApp allowed attackers to install spyware on smartphones without any user interaction, Financial Times has reported.
CISOs: What would you do over?
The first theme CISOs talked about was regretting they hadn’t built a strategic plan for their new security programs early on. They noted that they could have saved themselves a lot of extra work and gone a lot faster if they had spent the time to flesh out a roadmap.
SharePoint servers under attack through CVE-2019-0604
CVE-2019-0604, a critical vulnerability opening unpatched Microsoft SharePoint servers to attack, is being exploited by attackers to install a web shell.
Security spring cleaning: 5 tips for tidying up network safeguards
Networks need regular cleaning just like your home, car or garage. Why? The answer is simple – poor security hygiene can lead to major data breaches. If you don’t regularly review your network, potential weaknesses and vulnerabilities will stack up.
Half of companies missed GDPR deadline, 70% admit systems won’t scale
Even if given two years notice to achieve GDPR compliance, only half of companies self-reported as compliant by May 25, 2018, a DataGrail survey reveals.
Google offers free replacement for buggy Titan Security Keys
Misconfigured Bluetooth pairing protocols in Google’s Titan Security Keys may allow attackers to communicate with users’ security key or with the device their key is paired with, Google has warned.
Cybersecurity skills shortage still the root cause of rising security incidents
The cybersecurity skills shortage is worsening for the third year in a row and has impacted nearly three quarters (74 percent) of organizations, as revealed in the third annual global study of cybersecurity professionals by the Information Systems Security Association (ISSA) and independent industry analyst firm Enterprise Strategy Group (ESG).
Memory analysis is the ground truth
While the majority of endpoint protection solutions are focused on identifying the symptoms or behaviors of a machine to detect suspicious activity — for example, abnormal network connections or data leakage — the real threat lies in the malicious code that is running in memory.
Organizations dissatisfied with WAFs ineffective protection, time-consuming management, high cost
Only 40% of organizations are satisfied with their web application firewall (WAF), according to the Ponemon Institute report released by Cequence Security.
The six biggest cybersecurity risks facing the utilities industry
The utilities industry is rapidly modernizing its infrastructure, adding more digitized equipment and connectivity across devices, plants, and systems. This evolution to “smart infrastructure” represents a positive, paradigm shift for the industry.
When all else fails, organizations realize they must share threat intel
A large majority of security IT decision makers are ready and willing to share valuable threat intelligence data to help the collective industry make better, more informed decisions when it comes to cyber attacks, an IronNet Cybersecurity report reveals.
New infosec products of the week: May 17, 2019
A rundown of infosec products released last week.