Week in review: 150+ HP multifunction printers open to attack, how to combat ransomware with visibility
Here’s an overview of some of last week’s most interesting news, articles and interviews:
Determined APT is exploiting ManageEngine ServiceDesk Plus vulnerability (CVE-2021-44077)
An APT group is leveraging a critical vulnerability (CVE-2021-44077) in Zoho ManageEngine ServiceDesk Plus to compromise organizations in a variety of sectors, including defense and tech.
150+ HP multifunction printers open to attack (CVE-2021-39237, CVE-2021-39238)
Over 150 HP multifunction printers (MFPs) are open to attack via two exposed physical access port vulnerabilities (CVE-2021-39237) and two different font parsing vulnerabilities (CVE-2021-39238) discovered by F-Secure security consultants Timo Hirvonen and Alexander Bolshev.
300.000+ users downloaded malware droppers from Google Play
Since August 2021, malware peddlers have managed to spread four families of Android banking trojans via malware droppers introduced in Google Play. They did it by employing a series of tricks to bypass the app store’s restrictions, evade automatic detection, and trick users into believing the apps they downloaded are legitimate and innocuous.
Putting the “sec” in DevSecOps: An overall reduction of risk
In this Help Net Security interview, Cindy Blake, Senior Security Evangelist at GitLab, talks about the importance of integrating security in DevSecOps and how to overcome the complexity of such integration.
82% of IT leaders looking to cloud for critical mainframe applications to remain competitive
LzLabs announced the results of its latest global survey, conducted by Vanson Bourne, revealing that the desire to migrate, modernize and embrace cloud for critical mainframe applications is rapidly increasing amongst global IT decision makers.
API security awareness: The first step to better assessing the risk
In this Help Net Security interview, Tal Steinherz, CTO at Wib, talks about the importance of API security awareness and how to tackle numerous threats that are plaguing it.
Phishing attacks top 260,000 in Q3 2021
An APWG’s report reveals that it saw 260,642 phishing attacks in July 2021 – the highest monthly total observed since APWG began its reporting program in 2004.
Behavioral biometrics: A promising tool for enhancing public safety
Biometric identity capture is currently the most promising solution to secure the movements of every individual—online and in the physical world—and to prevent fraud of any kind. The field is working on a further headway: behavioral biometric technology. The way the behavioral aspect complements biometrics could cater for safer, more reliable, and faster identification.
Addressing the cybersecurity skills gap with higher education
Although the field of cybersecurity has expanded exponentially over the past decade, the fact that the workforce in the field has not increased adequately has now become obvious. The number of skilled and qualified workers is not enough to meet the demand, and national labour markets are disrupted worldwide, Europe included, as a consequence.
Big salaries alone are not enough to hire good cybersecurity talent: What else can companies do?
Amid the severe and ongoing cyber skills shortages, both cybersecurity firms and in-house IT and cybersecurity departments are struggling to hire enough talented and qualified individuals.
Most challenging security threats for CTOs
59% of CTOs still see human error as the main security threat to their business, alongside other prominent concerns such as ransomware (49%) and phishing (36%), a research from STX Next reveals.
Implications of strengthening the cybersecurity of small business in America
As a small business, using resources made available to you by regulatory authorities provides room for differentiation in the market and establishes security as a key deliverable to your customers.
Massive online crime crackdown leads to 1,000 arrests
An operation coordinated by INTERPOL codenamed HAECHI-II saw police arrest more than 1,000 individuals and intercept a total of nearly $27 million of illicit funds, underlining the global threat of cyber-enabled financial crime.
How to combat ransomware with visibility
As new attacks generate headlines each week, we get real-world use cases for how ransomware proliferates in diverse ways, including social engineering attacks and exploitation of vulnerabilities. These incidents not only cost millions of dollars in recovery, but they also have led to delays in patient treatment and possibly even loss of life.
Alarming rise in cyberattacks against healthcare facilities, 68 attacks in Q3 2021 only
Last month saw an alarming rise in cyberattacks against healthcare facilities. Ransomware attacks across the globe locked 68 care providers out of their respective networks during Q3 of this year alone, threatening patient safety and privacy. Experts fear that patients will suddenly be unable to receive critical care at a targeted facility without a holistic whole-facility cybersecurity approach.
The ripple effect: Why protection against supply chain attacks is a must
The SolarWinds supply chain attack certainly ruffled a lot of important feathers. On the flip side, it has brought global awareness and the first signs of action against what may become one of the key cyber threats of the decade. Today, we’re at a key moment in time where preventing these attacks is within reach, while the cost of failing to do so is too high to ignore.
Control failures are behind a growing number of cybersecurity incidents
Data from a survey of 1,200 enterprise security leaders reveals that an increase in tools and manual reporting combined with control failures are contributing to the success of threats such as ransomware, which costs organizations an average of $1.85 million in recovery, according to Panaseer.
How phishing kits are enabling a new legion of pro phishers
Malicious emails can be used to reach many targets with relative ease, and criminals can purchase ready-made phishing kits that bundle together everything they need for a lucrative campaign.
Despite the popularity of password managers, many still use pen and paper
Password managers are a near-defacto standard for organizations, with 86% reporting they are being put to use, according to a Bitwarden survey of over 400 U.S. IT decision makers across a wide range of industries. This reflects a 9% increase in the use of password managers over the past year.
The importance of vulnerability management for your organization
Everyone is familiar with home burglaries. Criminals case a house looking for easy access through open windows, unlocked doors, open garages, and the like. Hackers take the same approach electronically and look for network vulnerabilities that grant them access to the data they want. And small to mid-size businesses are an ideal target, since they have fewer resources to dedicate to security efforts than larger companies.
Top tech trends for 2022
Info-Tech Research Group has revealed its annual top tech trends insights for the coming year, based on insights from 475 IT professionals who participated in an industry survey, exploring how ripple effects from the pandemic will impact the evolving digital economy in 2022.
Major trends in online identity verification for 2022
As more of our lives move online, we expect identity fraud attempts to continue apace. Fortunately, technology is still one step ahead. While some trends may seem bleak, there are straightforward and convenient ways to thwart identity thieves.
Phishing kits’ favorite brand? Amazon
Research conducted by Egress and Orpheus Cyber has revealed a surge in phishing kits imitating major brands in the lead up to Black Friday, as security experts warn that cybercriminals are stepping up their phishing attacks over the holiday shopping season.
20% off official (ISC)² CISSP online self-paced training
If you’re ready to make achieving CISSP a goal, now is the best time to commit. Take advantage of year-end savings and get the flexibility to prepare for the CISSP exam on your schedule without sacrificing quality for convenience. Now until December 15, get 20% off Official (ISC)² CISSP Online Self-Paced Training when bundled with an exam voucher.
Secure cloud products and services with new CIS Benchmarks
The cloud continues to expand with new products and services constantly introduced by cloud service providers (CSPs). The Center for Internet Security (CIS) responded with more resources to help secure these capabilities in the cloud. The Beginner’s Guide to Secure Cloud Configurations describes how users can secure public cloud accounts, products, services, and more.
Open source cloud native security analyzer Terrascan embeds security into native DevOps tooling
Tenable enhanced Terrascan, an open source cloud native security analyzer that helps developers secure Infrastructure as Code (IaC). The new capabilities enable organizations to embed security into their DevOps tooling, pipelines and supply chains, mitigating risks before infrastructure is provisioned.
Acra: Open-source database protection with field-level encryption and intrusion detection
Cossack Labs updated its flagship open-source product Acra database security suite to version 0.90.0 and made many of its core security features previously available only for enterprise customers free in Acra Community Edition.
Infosec products of the month: November 2021
Here’s a look at the most interesting products from the past month, featuring releases from 1Password, Avast, Boxcryptor, Code42, ColorTokens, Cynamics, Fortanix, Hiya, Huntsman Security, Imperva, iStorage, Jetico, Netscout, Palo Alto Networks, Siren, Saviynt, StorONE, Tenable, The Linux Foundation, ThreatQuotient, Tufin, Viavi Solutions and WatchGuard.
New infosec products of the week: December 3, 2021
Here’s a look at the most interesting product releases from the past week, featuring releases from Castellan Solutions, Cossack Labs, Immuta, IriusRisk, Tenable, ThreatConnect, Verimatrix and Zerto.