Week in review: Pulse Secure zero-day actively exploited, how to select an IAM solution
Here’s an overview of some of last week’s most interesting news, articles and interviews:
Infosecurity transformation and building proactive mitigation strategies
In this interview with Help Net Security, Marcos Christodonte II discusses his path in the industry as well as lessons learned along the way. He talks about the skills gap, the cybercrime economy and offers his predictions for the near future.
Attackers are exploiting zero-day in Pulse Secure VPNs to breach orgs (CVE-2021-22893)
Attackers have been exploiting several old and one zero-day vulnerability (CVE-2021-22893) affecting Pulse Connect Secure (PCS) VPN devices to breach a variety of defense, government, and financial organizations around the world. Beyond the immediate emergency for all users of the compromised equipment, what does this mean for the bigger picture of industrial cybersecurity?
Digital business requires a security-first mindset
While developing a seamless and successful digital mindset with a security strategy is not a simple task, the effort is crucial for the health of a company.
Facebook Messenger users targeted by a large-scale scam
A large-scale scam campaign targeting Facebook Messenger users all over the world has been detected by Group-IB.
Hackers found leveraging three SonicWall zero-day vulnerabilities
Attackers that seem to have “intimate knowledge” of the SonicWall Email Security product have been discovered leveraging three (at the time) zero-day vulnerabilities in the popular enterprise solution.
Employees don’t want to give up work flexibility after the pandemic is over
A research Qualtrics reveals what employees and customers want their experiences to look like in the future of work.
Securing vehicles from potential cybersecurity threats
Organizations in the automotive industry are no stranger to demands and mandates regarding car and passenger safety, so addressing the issue of cybersecurity of computerized, connected vehicles should, in theory, not be a huge problem.
Monero-mining botnet targets orgs through recent MS Exchange vulnerabilities
The recent Microsoft Exchange Server vulnerabilities might have initially been exploited by a government-backed APT group, but cybercriminals soon followed suit, using them to deliver ransomware and grow their botnet.
Transitioning to a SASE architecture
One way to understand why SASE is important is to consider the large amounts of data processing necessary to provide high levels of security.
Most users don’t know the capabilities and risks of QR codes
QR code usage continues to rise in popularity. In fact, 57% of respondents to a new Ivanti study claim to have noticed an increase in the usage of QR codes since mid-March 2020.
Improper cloud IAM leaving organizations at risk
There is an industry-wide cloud permissions gap crisis, leaving countless organizations at risk due to improper identity and access management (IAM), a CloudKnox Security report reveals.
Cybersecurity only the tip of the iceberg for third-party risk management
Most companies are missing key risks at more than one stage of the vendor risk lifecycle, yet few are expanding their TPRM programs to address these risks, according to Prevalent.
How do I select an identity management solution for my business?
To select a suitable identity management solution for your business, you need to think about a variety of factors. We’ve talked to several industry professionals to get their insight on the topic.
Bad bot traffic reaching an all-time high over the past year
In 2020, Imperva saw the highest percentage of bad bot traffic (25.6%) since 2014, while traffic from humans fell by 5.7%. More than 40% of all web traffic requests originated from a bot last year, suggesting the growing scale and widespread impact of bots in daily life.
COVID-19-themed cyberattack detections continue to surge
McAfee released its new report, examining cybercriminal activity related to malware and the evolution of cyber threats in the third and fourth quarters of 2020. In Q4, there was an average of 648 threats per minute, an increase of 60 threats per minute (10%) over Q3.
Approaching zero trust security strategically
With digital transformation efforts accelerating, the attack surface expanding exponentially and conventional perimeter-based security continuing to fail, there’s never been a better time for organizations to re-evaluate their options and consider taking their zero trust strategy seriously.
Security research project: The easiest way to get “experience” and land a job in cybersecurity
If you’re seeking a job in cybersecurity, the best way to set yourself apart is to demonstrate an aptitude for the skills actually needed to be a great threat hunter, investigator or researcher. But how can you demonstrate that aptitude if you don’t already have a job doing it?
Five steps to get employees invested in security awareness training
Remote work has become a new normal for industries worldwide, which presents exciting opportunities but also has the potential to expose critical security weaknesses, since employees tend to let their guards down while working from home.
Cloud Sniper: Manage and automate cloud security operations
Cloud Sniper is an open-source platform for managing cloud security operations that aims to make it easy for cloud teams to deal with security incidents.
How micro-segmentation creates an uphill battle for intruders
Network micro-segmentation plays a central role in the realization of zero trust strategies by severely limiting the lateral movement of an attacker and obstructing their ability to navigate the network.
Your ultimate guide to CISSP exam planning
Going for the CISSP, CCSP or another (ISC)² certification? You can find all the tools you’ll need to conquer your exam in (ISC)²’s Certification Prep Kit.
CISO’s guide to automating third-party cyber risk management
Automation is the key to rapid and comprehensive third-party cyber risk reduction. This guide gives you step-by-step instructions about how this can be accomplished.
Product showcase: Accurics
Launching from stealth in April 2020, Accurics aims to be a developer-first cybersecurity startup. With a strong focus on shifting security left, into the development phase, the software allows users to identify potential security issues early in the development cycle, when they are easier to mitigate.
New infosec products of the week: April 23, 2021
A rundown of the most important infosec products released last week.