Security Boulevard

How Can NHIs Serve as the Crucial Backbone in Overall System Protection? What if there was a foolproof method for safeguarding your organization’s systems and data from potential threats? A diligent layer of security that offers complete visibility and control over system vulnerabilities? The answer lies in the competent management of Non-Human Identities (NHIs) and […]

The post How Can NHIs Enhance Overall System Security? appeared first on Entro.

The post How Can NHIs Enhance Overall System Security? appeared first on Security Boulevard.

Is Proactive NHI Management Our Best Bet Against Cyber Threats? The importance of non-human identities (NHIs) in cybersecurity cannot be overstated. These unique identifiers for automated systems and machine-to-machine communication form the bedrock of modern business infrastructure. But how can we contend with the risks they pose? Proactive NHI management might just be the solution. […]

The post Why Proactive NHI Management is a Must? appeared first on Entro.

The post Why Proactive NHI Management is a Must? appeared first on Security Boulevard.

Why Is Secrets Management Crucial for Your Cloud Environment? Do you think your cloud infrastructure is immune to threats? If you believe that solely relying on encrypted passwords, keys, or tokens is enough, you might want to reconsider. My research and insights emphasize the importance of secrets security management. NHIs are machine identities employed for […]

The post Are Your Cloud Secrets Safe From Threats? appeared first on Entro.

The post Are Your Cloud Secrets Safe From Threats? appeared first on Security Boulevard.

Why are Machine Identities Crucial to Cybersecurity Strategies? How often do we ruminate about the myriad of digital interactions happening behind the scenes of our daily operations? Machine-to-machine communication forms the backbone of modern business infrastructure. With the proliferation of internet-connected devices and automated processes, the concept of Non-Human Identities (NHIs) is increasingly relevant. In […]

The post Secure Your Machine Identities Effectively appeared first on Entro.

The post Secure Your Machine Identities Effectively appeared first on Security Boulevard.

Let's talk about the real story behind Google's DMARC maze, shall we? (You might want to go pour yourself a cup of coffee, this’ll take ~14 minutes, but it’s the guide I wish I had.)

The post Top 10 Challenges Implementing DMARC in GWS appeared first on Security Boulevard.

Author/Presenter: Carl Richell (CEO and Founder, System76, Inc.)

Our sincere appreciation to LinuxFest Northwest (Now Celebrating Their Organizational 25th Anniversary Of Community Excellence), and the Presenters/Authors for publishing their superb LinuxFest Northwest 2025 video content. Originating from the conference’s events located at the Bellingham Technical College in Bellingham, Washington; and via the organizations YouTube channel.

Thanks and a Tip O' The Hat to Verification Labs :: Penetration Testing Specialists :: Trey Blalock GCTI, GWAPT, GCFA, GPEN, GPCS, GCPN, CRISC, CISA, CISM, CISSP, SSCP, CDPSE for recommending and appearing as speaker at the LinuxFest Northwest conference.

Permalink

The post LinuxFest Northwest: See How Far COSMIC Has Come This Year appeared first on Security Boulevard.

Introduction Keeping your applications secure while offering a smooth user experience can be tricky — especially when working with OAuth 2.0. This popular framework makes it easy to give users access without sharing passwords, but if not handled carefully, it can lead to significant security risks. A crucial aspect of this is how to secure...

The post OAuth 2.0 Security Best Practices: How to Secure OAuth Tokens & Why Use PKCE appeared first on Security Boulevard.

After this week’s attention to META and Yandex localhost abuses, it is time to revisit a core feature/option of protective DNS that offers a feel-good moment to those that applied this safety technique long before this abuse report came about.

The in-depth report that triggered this is: Disclosure: Covert Web-to-App Tracking via Localhost on Android. I will address the META approach in a separate blog article, but here I want to focus on the Yandex approach to tracking users, specifically with the intent to bypass modern privacy standards and public policy. As with the vast majority of transactions online, including non-monetary information exchanges, DNS plays a necessary role. Yandex used yandexmetrica[.]com as a way to make a localhost connection since it resolved to 127.0.0.1. Yandexmetrica literally was designed to live inside your own device.

Most modern DNS servers offer DNS Rebind Protection; some are on by default, some include 127.0.0.0/8 and 0.0.0.0, while others include only rfc1918.

There’s a long archive of discussions on the relative merits of blocking DNS to 127.0.0.1 and our perspective is from doing this to millions of endpoints successfully as evidenced by the simple result that our users, by default, were protected against this Yandex tracking effort many millions of times. According to passive DNS records, Yandex has been doing this since October 2017! At the same time, DNS rebind protection protected users against any other tracking effort that utilizes the same technique. The most common reason this protection technique has not been implemented in the past is due to its one-size-fits-all approach on traditional protective DNS resolvers, but more on that later.

In the case of adam:ONE default, the anmuscle.conf file includes this line:

private-subnets=127.0.0.0/8,10.0.0.0/8,172.16.0.0/12,169.254.0.0/16,192.168.0.0/16,::ffff:a00:0/104,::ffff:ac10:0/108,::ffff:a9fe:0/112,::ffff:c0a8:0/112,fd00::/8,fe80::/10

private-subnets is what we use to check against DNS answers, and if matched, that destination is re-written and effectively blocked. Consider the difference here:

unprotectedendpoint ~ % dig @1.1.1.1 localhost.fictitious.io +short 127.0.0.1

Compare the above result with an attempt to resolve the same domain when DNS rebind protection mode is on:

protectedendpoint ~ % dig localhost.fictitious.io +short 192.168.1.1

From this protected endpoint, the adam:ONE live log shows the end user the detail like this:

The re-written answer is that of the block page, which does not offer anything except adam:ONE services, including the block page. And if it’s the end-user browser that made an attempt at some obscure service, this is the experience:

Note that this block is a result of either (a) blocked domain, or (b) a DNS rebind protection decision — defense-in-depth.

Legitimate private IP address usage in the public DNS

The objections network administrators have against DNS rebind protection is due to the false positives for legitimate usage. Our approach is to offer exemptions on a domain or rule basis. Broadly speaking, we find legitimate usage in these key categories:

1. License validation. A vendor of proprietary hardware/software solution often uses localhost license validation in order for the site/location to interact with the vendor’s internet infrastructure. ReserveAmerica.com uses this (see local.reserveamerica.com)
2. BYOD devices with corporate split VPNs for internal services. A significant number of Fortune 500 companies are using this approach to have public DNS records of internal private IP infrastructure. This is the case for ctr.cantire.com for example.
3. Split-horizon DNS services by companies like Synology (quickconnect.to), Unifi and even our own DynDNS service that is included for any subscriber.
4. Special apps like Plex and SQRL to facilitate an experience of complex solutions with a simple end-user experience.

When the live log shows Blocked: System private IP address and it falls into a legitimate category, the simple solution is to exempt such a domain. Within the adam:ONE dashboard, this can be facilitated by simply adding a reference DNS resolver that does not process any rebind protection:

When applied to an endpoint policy legitimate localhost lookups work just fine, like this:

C:\Users\David>nslookup Default Server: adamone Address: 192.168.1.1 > set type=A > local.reserveamerica.com. Server: adamone Address: 192.168.1.1 Non-authoritative answer: Name: local.reserveamerica.com Address: 127.0.0.1

In essence, any forwarding rule is exempted from DNS Rebind protection.

Yandex behaviour change

We can confirm that Yandex have changed their behaviour since this report was published. Regarding Yandex, when I checked today, there is no longer a 127.0.0.1 answer to yandexmetrica.com:

unprotectedendpoint ~ % dig @1.1.1.1 yandexmetrica.com ; <<>> DiG 9.20.2 <<>> @1.1.1.1 yandexmetrica.com ; (1 server found) ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 45689 ;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 1232 ;; QUESTION SECTION: ;yandexmetrica.com. IN A ;; AUTHORITY SECTION: yandexmetrica.com. 300 IN SOA ns3.yandex.ru. sysadmin.yandex.ru. 1749738001 900 600 3600000 300 ;; Query time: 401 msec ;; SERVER: 1.1.1.1#53(1.1.1.1) (UDP) ;; WHEN: Thu Jun 13 10:24:59 EDT 2025 ;; MSG SIZE rcvd: 104 Conclusion

DNS Rebind protection offers tremendous value. Applying this simple technique with an exemption process for legitimate uses meets the needs of apps, services and users alike while raising the security posture against any other actor that may attempt a rebinding exploit in the future.

1 post - 1 participant

Read full topic

The post DNS Rebind Protection Revisited appeared first on Security Boulevard.

Paris, Jun. 3, 2025, CyberNewswire–Arsen, the cybersecurity startup known for defending organizations against social engineering threats, has announced the release of its new Vishing Simulation module, a cutting-edge tool designed to train employees against one of the fastest-growing … (more…)

The post News alert: Arsen launches AI-powered vishing simulation to help combat voice phishing at scale first appeared on The Last Watchdog.

The post News alert: Arsen launches AI-powered vishing simulation to help combat voice phishing at scale appeared first on Security Boulevard.

Author/Presenter: Nikolay Sivko (Co-Founder And CEO At Coroot)

Our sincere appreciation to LinuxFest Northwest (Now Celebrating Their Organizational 25th Anniversary Of Community Excellence), and the Presenters/Authors for publishing their superb LinuxFest Northwest 2025 video content. Originating from the conference’s events located at the Bellingham Technical College in Bellingham, Washington; and via the organizations YouTube channel.

Thanks and a Tip O' The Hat to Verification Labs :: Penetration Testing Specialists :: Trey Blalock GCTI, GWAPT, GCFA, GPEN, GPCS, GCPN, CRISC, CISA, CISM, CISSP, SSCP, CDPSE for recommending and appearing as speaker at the LinuxFest Northwest conference.

Permalink

The post LinuxFest Northwest: Chaos Testing Of A Postgres Cluster On Kubernetes appeared first on Security Boulevard.

Uncover the hidden risks of Shadow AI and learn 8 key strategies to address it.

The post Shadow AI: Examples, Risks, and 8 Ways to Mitigate Them appeared first on Security Boulevard.

While we talk a lot on this site about the US Government’s various cybersecurity frameworks, like FedRAMP and CMMC, there’s one significant framework that deserves just as much attention: ISO 27001. ISO 27001, being an ISO standard, is an international framework for cybersecurity divorced from any one country’s government. It’s a way for businesses operating […]

The post ISO 27001 Risk Register Setup: Step-by-Step Guide appeared first on Security Boulevard.

More Meta mess: Pundits accuse Zuckerberg’s latest app of having a “dark pattern,” tricking the over 50s into oversharing.

The post Meta AI is a ‘Privacy Disaster’ — OK Boomer appeared first on Security Boulevard.

A Wake-Up Call for HR in the Age of Deepfakes and Remote Work

In 2025, HR leaders are facing a new kind of threat: highly convincing fake applicants, AI-powered resume fraud, and deepfake interview proxies. What used to be fringe or far-fetched is now a weekly reality for talent teams.

From fake IT workers linked to nation-states to deepfake-driven interview fraud, the threats have never been more diverse, or more advanced. According to HYPR's 2025 State of Passwordless Identity Assurance report, 95% of organizations experienced a deepfake incident in the last year, and nearly 40% had a GenAI-related security breach.

This field-ready guide outlines 10 bottom-of-funnel actions to equip HR teams with real-world tactics, tools, and strategies to detect, prevent, and respond to identity fraud in recruiting and onboarding. Each step is designed to be immediately implementable and mapped to core tools HR professionals already use.

The post HR’s 2025 Guide to Preventing Interview and Onboarding Fraud appeared first on Security Boulevard.

Aim Security researchers found a zero-click vulnerability in Microsoft 365 Copilot that could have been exploited to have AI tools like RAG and AI agents hand over sensitive corporate data to attackers simply by issuing a request for the information in a specially worded email. Microsoft fixed the security flaw.

The post Zero-Click Flaw in Microsoft Copilot Illustrates AI Agent, RAG Risks appeared first on Security Boulevard.

Kubernetes is powerful, but managing it in-house can be a major drain on your engineering resources. That’s why many organizations are turning to Fairwinds Managed Kubernetes-as-a-Service (KaaS): we handle the complexity, so you can focus on building what matters most—your applications and your business differentiations. It’s easy to be confused by the differences between Managed Kubernetes-as-a-Service and managed Kubernetes services, such as those offered by Amazon (Elastic Kubernetes Service or EKS), Google (Google Kubernetes Engine or GKE), and Microsoft (Azure Kubernetes Service or AKS), so let's clarify how they're different. 

The post A Guide to Managed Kubernetes-as-a-Service Shared Responsibility Model appeared first on Security Boulevard.

Author/Presenter: Sam Groveman (Research Associate)

Our sincere appreciation to LinuxFest Northwest (Now Celebrating Their Organizational 25th Anniversary Of Community Excellence), and the Presenters/Authors for publishing their superb LinuxFest Northwest 2025 video content. Originating from the conference’s events located at the Bellingham Technical College in Bellingham, Washington; and via the organizations YouTube channel.

Thanks and a Tip O' The Hat to Verification Labs :: Penetration Testing Specialists :: Trey Blalock GCTI, GWAPT, GCFA, GPEN, GPCS, GCPN, CRISC, CISA, CISM, CISSP, SSCP, CDPSE for recommending and appearing as speaker at the LinuxFest Northwest conference.

Permalink

The post LinuxFest Northwest: Easy Modular Sensors And Automation appeared first on Security Boulevard.

We’re witnessing a shift in enterprise architecture: AI agents are moving from supporting roles to autonomous actors that drive decisions, trigger transactions, and interact directly with APIs — often on behalf of users. As a result, identity management is evolving. Identity isn’t just for humans anymore — it’s becoming the security backbone for intelligent, non-human...

The post How identity management is shifting into the agent era appeared first on Strata.io.

The post How identity management is shifting into the agent era appeared first on Security Boulevard.

Paris, France, 13th June 2025, CyberNewsWire

The post Arsen Launches AI-Powered Vishing Simulation to Help Organizations Combat Voice Phishing at Scale appeared first on Security Boulevard.

Identiverse 2025 exposed the urgent need for NHI governance. From AI agents to orphaned credentials, NHIs and their sprawling secrets are today’s most overlooked risks.

The post Identiverse 2025: Trust, Delegation, and the Era of Continuous Identity appeared first on Security Boulevard.