Week in review: VPN attacks up nearly 2000%, Root of Trust for the cloud era
Here’s an overview of some of last week’s most interesting news and articles:
Unprotected CVS database exposed sensitive customer searches
Researchers have discovered an unprotected, exposed online database with over a billion records belonging to American healthcare company CVS Health.
How a conference room speakerphone might let attackers into your company network
Several egregious vulnerabilities affecting the Stem Audio Table conference room speakerphone could be exploited by attackers to eavesdrop on what’s being discussed in its proximity, download malicious firmware, achieve and maintain network persistence, and more, GRIMM researchers have discovered.
Vaccine passports challenged by data privacy and security implications
While some think vaccine apps could be the key to lifting travel restrictions, challenges have arisen regarding data privacy and security implications.
Microsoft Defender for Endpoint now detects jailbroken iOS devices
Microsoft has announced new and improved capabilities for enterprise security teams that use Microsoft Defender for Endpoint on Android and iOS and Microsoft threat and vulnerability management APIs.
Understanding the cloud shared responsibility model
Over the past year, we witnessed a transition to the cloud as companies had to quickly adjust to the almost instantaneous move to a remote work environment. But in many cases, they prioritized practicality over security to avoid business disruption, leaving many organizations vulnerable.
Apple fixes actively exploited vulnerabilities affecting older iDevices
Apple has released a security update for older iDevices (iPhones, iPads and iPods) to fix three vulnerabilities, two of which are zero-days that are apparently actively exploited in attacks in the wild.
VPN attacks up nearly 2000% as companies embrace a hybrid workplace
Because of the significant increase in VPN and RDP vulnerabilities, malware, botnet and exploitation activity are down compared to Q4, but threat actors are still on the prowl.
Ransomware attackers are leveraging old SonicWall SRA flaw (CVE-2019-7481)
Crowdstrike now warns that a cyber-criminal group is exploiting CVE-2019-7481 – an older SQL injection vulnerability affecting SonicWall Secure Remote Access (SRA) 4600 devices running firmware versions 8.x and 9.x – to penetrate organizations’ networks.
Top threats to consumer cyber safety
Norton Labs revealed the top cybersecurity trends from January to March 2021. Phishing campaigns remained the number one threat to consumer cyber safety, with top scams relating to the pandemic, including vaccine-oriented, financial relief, and tech support scams.
Open source UChecker tool detects vulnerable libraries on Linux servers
CloudLinux announced UChecker, a free open source tool that scans Linux servers for vulnerable libraries that are outdated and being used by other applications. This provides detailed actionable information regarding which application is using which vulnerable library and needs to be updated, which helps improve the security awareness patching process.
To identify cybersecurity vendor sustainability, start with the fundamentals
How can investors differentiate between a “value” cyber company and one that is getting “swept along” by the general market valuation uptick? What signs should they be looking for to indicate that they are getting true value for their investment money and how can investors differentiate between value investments and “bubble” investments?
Cyber criminals are targeting digital artists
Cyber criminals looking for a quick payout and valuables are targeting digital artists using NFTs (non-fungible tokens), warns security researcher Bart Blaze.
Are your cryptographic keys truly safe? Root of Trust redefined for the cloud era
Beneath the complex world of encryption use cases and algorithms lies a simple, fundamental principle: the encryption keys must remain a secret. As soon as an encryption key becomes known, it is worthless.
How do I select an ITSM solution for my business?
To select a suitable ITSM solution for your business, you need to think about a variety of factors. We’ve talked to several industry professionals to get their insight on the topic.
Bad cybersecurity behaviors plaguing the remote workforce
A report from Tessian reveals that 56% of IT leaders believe their employees have picked up bad cybersecurity behaviors since working from home. As organizations make plans for the post-pandemic hybrid workforce, the report reveals how security behaviors have shifted during the past year, the challenges as organizations transition to a hybrid work model, and why a fundamental shift in security priorities is required.
Phishing maintained near-record levels in the first quarter of 2021
The APWG’s new Phishing Activity Trends Report reveals that phishing maintained near-record levels in the first quarter of 2021, after landmark increases of 2020 in which reported phishing websites doubled.
PrivacyMic: A smart home system that doesn’t record speech
A team of University of Michigan researchers has developed a system that can inform a smart home – or listen for the signal that would turn on a smart speaker – without eavesdropping on audible sound.
Preventing security issues from destroying the promise of IoT
The promise of IoT is that sensors will become much less expensive to integrate and maintain, and therefore they will become far more ubiquitous. As IoT devices become more numerous, less capable, and less personalized, they create a Pandora’s box of security concerns.
Business leaders now feel more vulnerable to cyber attacks
45% of business leaders claim that their company has experienced more network security incidents as a result of the pandemic, according to a new survey from Telia Carrier.
Investing in the right future for the cloud
Migrating assets, application and infrastructure to the cloud is an underpinning objective for most digital transformation strategies, with the aim of creating a more agile and adaptable operation.
Can on-prem security experts make the move to the cloud?
As cloud computing grows in popularity across all use cases, cloud workloads have never been more attractive to malicious actors. A recent McAfee report points to a 630 percent increase in attacks aimed at cloud services since January 2020.
Are your cyber defenses stuck in the sandbox?
Installing a network sandbox to safeguard against external threats has been accepted by many as the gold standard for more than a decade. Sandbox-based cybersecurity solutions are a protected and isolated environment on a network that simulates a company’s production network for security testing and analysis purposes.
Corporate attack surfaces growing concurrently with a dispersed workforce
As businesses began offering more remote work options, their attack surfaces grew concurrently with their dispersed workforce. Coupled with increased reliance on public cloud services and vulnerable enterprise VPNs, large organizations not using zero trust security became more vulnerable to network intrusion attacks.
Why XSS is still an XXL issue in 2021
Cross-site scripting (XSS) attacks take advantage of coding flaws in the way websites or web applications generate input from users. Despite their longstanding reputation as a significant infosec problem, XSS attacks have remained a constant of the OWASP Top 10 Web Application Security Risks year after year and still make headlines.
How to secure data one firewall at a time
The need for secure data access management is top-of-mind in the C-suite and boardroom. The question I keep hearing from IT departments is how to do it right, that is, how to ensure security and governance without frustrating users or slowing innovation.
New infosec products of the week: June 18, 2021
A rundown of infosec products released last week.