Security Boulevard

Are You Doing Enough to Secure Your Cloud NHIs? Is your organization’s cloud security robust enough to protect your non-human identities (NHIs)? This is a question that has been increasingly haunting CISOs, cybersecurity professionals, and businesses thriving in the cloud. With cloud computing continues to revolutionize industries like finance, travel, healthcare, and DevOps, the need […]

The post Are Your Cloud NHIs Truly Protected? appeared first on Entro.

The post Are Your Cloud NHIs Truly Protected? appeared first on Security Boulevard.

Is Managing Non-Human Identities the Key to Achieving Robust Cloud-Native Security? Where humans and machines square off, intent on breaching each other’s defenses. However, an important facet often goes unnoticed – Non-Human Identities (NHIs). NHIs are machine identities, especially in the context of cloud-native security. Understanding the Strategic Importance of NHI NHIs are crafted by […]

The post Unleashing Powerful Cloud-Native Security Techniques appeared first on Entro.

The post Unleashing Powerful Cloud-Native Security Techniques appeared first on Security Boulevard.

Why is NHI Security Critical in Risk Management? Have you ever considered the potential security risk lurking? The reality is that the growing complexity of IT infrastructures, particularly in the cloud, presents new challenges for risk management and cyber protection. Among the most notable security risks lies in the management of Non-Human Identities (NHIs). Overseeing […]

The post Why Securing NHIs Reduces Your Cyber Risk appeared first on Entro.

The post Why Securing NHIs Reduces Your Cyber Risk appeared first on Security Boulevard.

Cybersecurity 2025: The Trends Defining Risk and How to Stay Ahead Cybersecurity 2025: The Trends Defining Risk and How to Stay Ahead The rules of cybersecurity are shifting—again. As 2025 unfolds, companies face a paradox: digital acceleration is non-negotiable, but it’s also becoming their biggest liability. From API sprawl to AI-driven phishing, today’s threats evolve […]

The post Cybersecurity 2025: The Trends Defining Risk and How to Stay Ahead appeared first on Cyber security services provider, data privacy consultant | Secureflo.

The post Cybersecurity 2025: The Trends Defining Risk and How to Stay Ahead appeared first on Security Boulevard.

Jun 06, 2025 - Lina Romero - LLM04: Data & Model Poisoning
Excerpt:
In this blog series, we’re breaking down the OWASP Top 10 risks for LLMs and explaining how each one manifests and can be mitigated. Today’s risk is #4 on the list: Data and Model Poisoning. Read on to learn more…
Summary:
Data & Model Poisoning is the fourth risk listed in the OWASP Top 10 for LLM. Read on to learn how this risk affects LLMs, and what you can do to prevent it.
Blog text:
AI is the biggest thing in tech right now, and AI breaches and incidents have been making headlines all year. We’ve seen a rise not only in the volume but also in the complexity of attacks across the board, leading security teams to scramble to patch these problems. But most of the time, they are already too late, as AI security requires a proactive approach, from code to cloud.
What is Data & Model Poisoning?
Data poisoning refers to any time data is manipulated to introduce vulnerabilities to a model. These vulnerabilities often consist of biases, misinformation or hallucinations which can cause the model to behave against its training, and backdoors which remain inactive until they are triggered, making it difficult to test for them. Data poisoning can occur during training stages of the LLM’s lifecycle from early pre-training and fine-tuning to embedding. The risks associated with data poisoning are higher in models distributed through shared repositories or those that draw from external data sources which may contain unverified or even malicious content.
Examples:
Attackers introducing harmful information to the model during its training period, leading to biased outputs. Users unknowingly sharing sensitive information with the model, which it exposes later. Developers not putting enough restrictions on the information the model consumes, leading to it ingesting inaccurate data sources.
Mitigating the Risk
In order to prevent data poisoning proactively, OWASP recommends tracking data origins to verify their accuracy at all stages of model development and continuing to vet data sources rigorously, validating outputs against trusted sources regularly to proactively monitor for any poisoning. As usual, testing also plays a large role in determining risk levels in a model. Staying on top of versioning is also a critical part of evading data poisoning. Sandboxing, infrastructure controls, and anomaly detection can also help to filter and limit exposure to untrustworthy data sources. Fine-tune datasets for specific models and use cases in order to produce clear, defined outputs. Security teams and developers need to monitor training loss and regularly analyze the model for signs of poisoning. Finally, Retrieval-Augmented Generation (RAG) and grounding techniques can reduce risks of hallucinations However, even all of these measures cannot fully protect against the risk of data poisoning, especially when data lineage remains hidden and, and poisoned content risks don’t show up in tests, or certain bad behaviours only show up when triggered. Security teams must remain vigilant in the face of these mounting risks. If your organization is struggling with AI security, see how FireTail can work for you. Schedule a demo, or start a free trial here, today.

The post LLM04: Data & Model Poisoning – FireTail Blog appeared first on Security Boulevard.

Seeking a FedRAMP authority to operate is a critical part of any cloud service looking to work with the government in an official capacity. It’s required if you are going to handle controlled unclassified information on behalf of the government or its contractors, and since the requirements trickle down, you don’t even necessarily have to […]

The post Avoid FedRAMP Delays: 7 Common SSP Mistakes to Fix appeared first on Security Boulevard.

Modern data centers stand at the heart of global business and digital innovation. But behind every rack and server, data center managers must juggle rapid advances in technology, mounting regulatory pressure, and relentless demands for efficiency and uptime. This post unpacks the eight ...

The post 8 Challenges Data Center Managers Must Overcome in 2025 appeared first on Hyperview.

The post 8 Challenges Data Center Managers Must Overcome in 2025 appeared first on Security Boulevard.

When the Beatles sang the famous lyric “She came in through the bathroom window,” they were riffing on a real event, a fan who bypassed the front door and broke into Paul McCartney’s home. It was a metaphor for intrusion from the unexpected. In 2025, it’s also a strikingly accurate portrait of how cybercriminals are..

The post They Deepfaked Through the Bathroom Window: How Cybercriminals Are Targeting Executives & Key Personnel at Home appeared first on Security Boulevard.

OpenAI just published its annual report on malicious uses of AI.

By using AI as a force multiplier for our expert investigative teams, in the three months since our last report we’ve been able to detect, disrupt and expose abusive activity including social engineering, cyber espionage, deceptive employment schemes, covert influence operations and scams.

These operations originated in many parts of the world, acted in many different ways, and focused on many different targets. A significant number appeared to originate in China: Four of the 10 cases in this report, spanning social engineering, covert influence operations and cyber threats, likely had a Chinese origin. But we’ve disrupted abuses from many other countries too: this report includes case studies of a likely task scam from Cambodia, comment spamming apparently from the Philippines, covert influence attempts potentially linked with Russia and Iran, and deceptive employment schemes...

The post Report on the Malicious Uses of AI appeared first on Security Boulevard.

What if your smartwatch could spot a heart condition before your doctor did? That’s not science fiction, it’s today’s reality. Powered by artificial intelligence, wearable...Read More

The post AI and Wearable Health Tech: Real-Time Insights for Preventive Care appeared first on ISHIR | Software Development India.

The post AI and Wearable Health Tech: Real-Time Insights for Preventive Care appeared first on Security Boulevard.

Check out a new roadmap for adopting quantum-resistant cryptography. Plus, find out how your company can create a better cybersecurity environment. In addition, MITRE warns about protecting critical infrastructure from cyber war. And get the latest on exposure response strategies and on CISO compensation and job satisfaction.

Dive into five things that are top of mind for the week ending June 6.

1 - Group releases roadmap for adopting post-quantum cryptography

Is your organization looking for guidance on how to carry out its migration to post-quantum cryptography (PQC)? A group that includes MITRE, Microsoft and IBM just released a roadmap designed to help organizations plan and execute their adoption of PQC.

Titled “Post-Quantum Cryptography (PQC) Migration Roadmap,” the 20-page document from the “Post Quantum Cryptography Coalition” breaks down PQC migrations into four major stages:

• Preparation, which includes identifying the transition’s main goals, assigning a project leader and identifying key stakeholders
• Baseline understanding, which includes a comprehensive inventory of the data and assets to be protected, as well as determining required resources and budgets
• Planning and execution, which includes collaboration with internal and external partners to either acquire or develop the necessary tools for the migration
• Monitoring and evaluation, which includes establishing metrics for tracking the project’s progress and for reassessing cryptographic security, based on the evolution of quantum capabilities
   

"This roadmap empowers CIOs and CISOs to act decisively, taking proactive steps to protect sensitive data now and in the future,” Wen Masters, MITRE’s VP of cyber technologies, said in a statement. 

Transitioning to PQC, also known as quantum-resistant cryptography, is a complex process that’s expected to take the typical enterprise multiple years to complete and, as such, it will require exacting planning and ultra-precise execution.

Embarking on the process to adopt PQC is necessary because when quantum computers become generally available — expected to happen at some point between 2030 and 2040 — they’ll be able to crack today’s public key cryptographic algorithms, which protect all types of digitally stored and transmitted data

Algorithms for quantum-resistant encryption are already available. The U.S. National Institute of Standards and Technology (NIST) released three quantum-resistant algorithm standards in 2024 and expects to release a fourth in 2026. There’s another PQC standard called Covercrypt from the European Telecommunications Standards Institute (ETSI). Earlier this year, NIST picked its fifth PQC algorithm, expected to be available for use in 2027. 

Other resources designed to help organizations with PQC adoption include NIST’s white paper “Considerations for Achieving Crypto Agility” and the U.K. National Cyber Security Centre’s (NCSC) “Timelines for migration to post-quantum (PQC) cryptography.” 

For more information about how to protect your organization against the quantum computing cyber threat:

• “How to achieve crypto-agility and future-proof security” (TechTarget)
• “Moody’s sounds alarm on quantum computing risk, as transition to PQC ‘will be long and costly’” (Industrial Cyber)
• “Post-quantum cryptography migration use cases” (IETF)
• “US unveils new tools to withstand encryption-breaking quantum. Here's what experts are saying” (World Economic Forum)
• “You need to prepare for post-quantum cryptography now. Here’s why” (SC World)
• “Quantum and the Threat to Encryption” (SecurityWeek)

2 - How to establish a great cybersecurity culture in your org

Corporate culture can have a major impact on the success or failure of a company’s cybersecurity efforts. So how do you create an organizational environment that boosts cybersecurity?

That’s the question the U.K. National Cyber Security Centre (NCSC) tackled with the publication this week of its “Cyber security culture principles” guidance. The document unpacks six core recommendations aimed at getting the staff to embrace cybersecurity processes. 

“The principles describe cultural conditions that are essential underpinnings for an organisation to be cyber secure and offer an approach to developing that culture,” reads an NCSC blog.
 

Here’s a high-level view of three of these principles:

• Frame cyber as an enabler: Foster a sense that cybersecurity is everyone’s responsibility by clearly positioning it as a “shared purpose.” Demonstrate how cybersecurity isn’t a barrier to but rather a facilitator for achieving business goals.
• Encourage openness: Make it easy for employees to report security issues and to ask questions. Investigate issues fairly and transparently, with the goal of fixing problems and sharing lessons learned, as opposed to affixing blame.
• Embrace change: Stay attuned to emerging cyber risks and be ready to modify cybersecurity processes accordingly. Show how this capacity to adapt to new cyber threats helps strengthen the organization’s resilience.

For more information about creating a healthy cybersecurity culture in your organization:

• “How to Create an Enterprise-Wide Cybersecurity Culture” (Information Week)
• “A new age of cybersecurity culture” (KPMG)
• “Signs Your Organization's Culture Is Hurting Your Cybersecurity” (Dark Reading)
• “How to turn around a toxic cybersecurity culture” (CSO)
• “Creating a Culture of Cybersecurity Awareness” (IT Executives Council)

VIDEO

Improve Your Cyber Security Culture (SANS Institute)

3 - MITRE: U.S. critical infrastructure must be ready for cyber war

In addition to preventing and mitigating standalone cyber threats and attacks, U.S. critical infrastructure organizations must have a plan in case a lengthy, widespread cyber war breaks out.

That’s the call from MITRE, which has published a fact sheet with key actions for getting critical infrastructure organizations ready for an all-out cyber conflict that disrupts multiple essential services for a sustained period of time.

Titled “5 Steps To Prepare Critical Infrastructure for a Cyber War,” the document is aimed at critical infrastructure operators; federal, state and local governments; businesses; and communities.
 

The fact sheet is based on a classified tabletop exercise held at MITRE’s headquarters in December in which 70 government and private-sector organizations participated in a simulated cyber war.

“The event revealed the urgent need for infrastructure owners/operators, government agencies, and communities to shift from addressing isolated cyber incidents to preparing for large-scale cyber conflicts lasting weeks to months,” the document reads.

Here are five steps MITRE views as necessary for critical infrastructure organizations to get ready for a cyber war scenario:

• Create a civil defense mindset: Make citizens aware that basic services like electricty, water, telecom and transportation may be impacted. Stakeholders should plan how to issue emergency responses and how to prioritize restoration efforts.
• Manage limited resources: Critical infrastructure operators should test their incident response plans, while governments must plan with businesses how to address service outages.
• Plan to operate under extreme conditions: Recovering from the impacts of cyber war requires planning for coping with devastating outages that last weeks. Measures should include training staff for manual, disconnected operations, and boosting cyber resilience.
• Strengthen emergency communications systems: Develop communication systems and processes that’ll withstand a cyber war’s disruptions, along with ways to authenticate the identity of those involved.
• Ensure workforce readiness: Because the workforce will likely shrink during a cyber war emergency, contingency plans should be made to operate with a smaller staff, including training workers for this scenario.

Full details about the tabletop exercise are available to U.S. critical infrastructure owners and operators, as well as to government agencies. Those interested can request access by writing to this email address: [email protected].

For more information about cyber warfare:

• “Preparing for Cyber Warfare: 6 Key Lessons From Ukraine” (Dark Reading)
• “Cyberwarfare: The new frontlines” (Cybersecurity Guide)
• “‘Russia can turn the lights off’: how the UK is preparing for cyberwar” (The Guardian)
• “The Growing Threat of Cyberwarfare from Nation-States” (PaymentsJournal)
• “Russia’s Most Notorious Special Forces Unit Now Has Its Own Cyber Warfare Team” (Wired)

4 - Tenable webinar poll spotlights exposure response strategies

During our recent “Tenable Vulnerability Management Customer Update, June 2025” webinar, we polled attendees on their exposure response strategies and challenges. Check out what they said.

(152 webinar attendees polled by Tenable, June 2025) 

 (145 webinar attendees polled by Tenable, June 2025. Respondents could choose more than one answer.)

Watch this on-demand webinar to get the latest on Tenable Vulnerability Management and to learn how to develop exposure response strategies.

5 - Despite high salaries, many CISOs at large orgs are dissatisfied

With median salaries north of $500,000 and top earners making $1.3 million-plus annually, CISOs at large enterprises are making bank, but, ironically, job dissatisfaction among them is high.

That’s according to the “2025 Compensation and Budget for CISOs in Large Enterprises Benchmark Report” from IANS Research and Artico Search, which also found that a large percentage of these CISOs are actively looking for new jobs.

“Large enterprise CISOs might be among the highest paid across industries, yet our report reveals that many CISOs feel stretched too thin, and low job satisfaction keeps them open to new opportunities,” reads an IANS Research blog about the report.

Specifically, many of these CISOs are unhappy with their team’s budget and, to a lesser extent with their compensation. It’s also common for them to struggle broadening their focus from overseeing cybersecurity technology to supporting business initiatives.

“When elevating an enterprise CISO role, the position is less about technical acumen and more about business risk and business alignment,” Matt Comyns, Artico Search co-founder and president, said in the blog. 

“In some respects, the market is training technical leaders in a way that is mismatched from the aspired job of CISO,” he added.
 

(Source: “2025 Compensation and Budget for CISOs in Large Enterprises Benchmark Report” from IANS Research and Artico Search, May 2025)

The report defines these CISOs as those who work at enterprises with more than $1 billion in revenue. They make an average of about $700,000 in total compensation annually.

For more information about CISO trends:

• “Why Security Leaders Are Opting for Consulting Gigs” (Dark Reading)
• “CISO Burnout Is Increasing — Here’s How to Help Them” (Reworked)
• “CISO Paychecks: Worth the Growing Security Headaches?” (Dark Reading)
• “Has the CISO finally been accepted as a key strategic player?” (Deloitte)
• “CISOs in 2025: Evolution of a High-Profile Role” (Information Week)

The post Cybersecurity Snapshot: Experts Issue Best Practices for Migrating to Post-Quantum Cryptography and for Improving Orgs’ Cyber Culture appeared first on Security Boulevard.

Insight No. 1 — Fixing threat actor names

Microsoft and CrowdStrike announced that they’ll work together on the headache of multiple  names for the same threat actors. But what matters most is who did it (if we know), what they accessed and what’s being done about it. That’s what customers, media and leadership want to hear. What if, in the heat of a live incident response, the only thing slowing you down was trying to decipher whether "Storm-0530" was a new group or just another name for something you already knew? We spend valuable cycles on threat actor branding, an exercise largely irrelevant to immediate crisis management. The focus should always be on actionable intelligence: understanding the breach, assessing the damage and rapidly restoring operations.

The post Cybersecurity Insights with Contrast CISO David Lindner | 06/06/25 appeared first on Security Boulevard.

Discover what went wrong in the Commvault breach: How AppOmni’s powerful SaaS security platform steps in to stop threats before they strike.

The post OAuth Tokens: The Danger Behind the Commvault Breach appeared first on AppOmni.

The post OAuth Tokens: The Danger Behind the Commvault Breach appeared first on Security Boulevard.

Artificial Intelligence, known to simplify complexities, is trending among organizations. Hence, AI being a buzzword is no more relevant in the context when looking at the near and far future of cybersecurity. The intricacy of cyber threats across industries increased the demand for AI-driven pentest tools in 2025. These smartest tools don’t just scan and […]

The post Top AI-Driven Pentest Tools 2025 appeared first on Kratikal Blogs - Information Hub For Cyber Security Experts.

The post Top AI-Driven Pentest Tools 2025 appeared first on Security Boulevard.

The rapid pace of technological change, evolving regulations, and shifting customer expectations require CIAM systems that can adapt and evolve over time. The organizations that build sustainable competitive advantages through CIAM are those that invest in flexible, extensible architectures that can accommodate future requirements without requiring complete system replacements.

The post CIAM Across Industries: A Journey Through Digital Identity Neighborhoods appeared first on Security Boulevard.

Skybox Is Gone. The Risk of Waiting Isn’t. Skybox is gone, but your compliance deadlines, audit obligations, and security risks are very much alive. Here’s why EMEA organisations must act...

The post Skybox Is Gone. The Risk of Waiting Isn’t. appeared first on Security Boulevard.

LAS VEGAS — Zscaler Inc. on Tuesday announced advanced artificial intelligence (AI) security capabilities to tackle the complexities in deploying advanced AI tools in large, distributed environments at its developers conference here. The new features are built to harness the power of AI for laser-focused precision, automated threat neutralization and turbocharged collaboration to unify users,..

The post Zscaler Tightens AI Security With New Tools appeared first on Security Boulevard.

Barracuda Networks this week added a dashboard that leverages multiple artificial intelligence (AI) technologies to unify the management of its cybersecurity tools and services at no additional cost. Brian Downey, vice president of product management for Barracuda Networks, said BarracudaONE will make it possible to streamline workflows in a way that ultimately makes it simpler..

The post Barracuda Networks Leverages AI to Integrate Cybersecurity Workflows appeared first on Security Boulevard.

Learn how leading security teams are shifting fraud detection upstream, using intent-based signals and AI-driven defenses to stop fraud before it ever reaches checkout.

The post 5 Takeaways from the “Detect Bad Intent Early” Webinar: How to Stop Fraud Before It Starts appeared first on Security Boulevard.

The post Turn Compliance Into a Competitive Advantage appeared first on Votiro.

The post Turn Compliance Into a Competitive Advantage appeared first on Security Boulevard.