Ransomware isn’t a tech failure - it’s a market failure. If you think the
hardest part is getting hacked, wait until the lawyers, insurers, and PR
firms show up.
The post Why Ransomware Isn’t Just a Technology Problem (It’s Worse) appeared first on Security Boulevard.
Why is Satisfaction with NHIs Paramount in Security Expertise? When it comes to managing security, Non-Human Identities (NHIs) have become a critical focus for many CISOs and security professionals. This growing importance prompts the question: Why does satisfaction with NHIs play a significant role in demonstrating security expertise? Why NHIs are Essential for Security Management […]
The post Why NHIs Leave Security Experts Satisfied appeared first on Entro.
The post Why NHIs Leave Security Experts Satisfied appeared first on Security Boulevard.
Are Your Non-Human Identities Prepared for Emerging Cybersecurity Threats? Understanding the readiness and response efficiency of your Non-Human Identities (NHIs) to new cybersecurity threats is crucial. This post seeks to shed light on the criticality of managing NHIs robustly and how it aids businesses in minimizing data breaches and improving overall cybersecurity. What Sets NHIs […]
The post Are Your NHIs Capable of Handling New Threats? appeared first on Entro.
The post Are Your NHIs Capable of Handling New Threats? appeared first on Security Boulevard.
Author/Presenter: Jason Odoom
Our sincere appreciation to BSidesLV, and the Presenters/Authors for publishing their erudite Security BSidesLV24 content. Originating from the conference’s events located at the Tuscany Suites & Casino; and via the organizations YouTube channel.
The post Bsideslv24 – Proving Ground – Unleashing The Future Of Development: The Secret World Of Nix & Flakes appeared first on Security Boulevard.
CMMC mandates that companies working as part of the government supply line need to comply with a level of security determined by their handling of controlled information. Identifying the level of compliance necessary for your business is the first step in achieving that compliance. The second step is scoping. All About Scoping for CMMC What […]
The post How to Handle CMMC Scoping for Remote Employees appeared first on Security Boulevard.
Why Are NHIs Crucial for IT Stability? How often do we consider Non-Human Identities (NHIs) and their role in IT stability? Many organizations are unaware of the strategic importance of NHI management. With more businesses adopt cloud-based solutions, the science of managing and protecting these machine identities becomes paramount. Understanding the Significance of NHIs and […]
The post How NHIs Contribute to IT Stability appeared first on Entro.
The post How NHIs Contribute to IT Stability appeared first on Security Boulevard.
The Proactive Cyber Defense: Why Embrace NHIs? How often do you consider the role of Non-Human Identities (NHIs)? The significance of NHIs cannot be downplayed. Ensuring the security of these machine identities or NHIs is a cornerstone for a proactive cyber defense strategy. Delving into Non-Human Identities NHIs refer to machine identities used in cybersecurity. […]
The post Being Proactive with NHIs in Cyber Defense appeared first on Entro.
The post Being Proactive with NHIs in Cyber Defense appeared first on Security Boulevard.
Does Your Cybersecurity Strategy Justify NHI Costs? Organizations must frequently evaluate their strategies to ascertain if the costs of implementing and maintaining specific security measures are justified. The scenario is no different when it comes to Non-Human Identities (NHIs) and their associated costs. So, is the investment in NHI management justified? The answer, quite simply, […]
The post Are Expenditures on NHI Justified? appeared first on Entro.
The post Are Expenditures on NHI Justified? appeared first on Security Boulevard.
Author/Presenter: Randall Wyatt
Our sincere appreciation to BSidesLV, and the Presenters/Authors for publishing their erudite Security BSidesLV24 content. Originating from the conference’s events located at the Tuscany Suites & Casino; and via the organizations YouTube channel.
The post BSidesLV24 – Proving Ground – You Can Be Neurodivergent And Succeed In InfoSec appeared first on Security Boulevard.
In a world where credential breaches cost companies millions, strong authentication isn't optional—it's essential. This comprehensive guide breaks down seven critical domains of identity security into actionable strategies that protect your systems without sacrificing user experience.
The post Best Practices for User Authentication and Authorization in Web Applications: A Comprehensive Security Framework appeared first on Security Boulevard.
Sooner or later, it’s going to happen. AI systems will start acting as agents, doing things on our behalf with some degree of autonomy. I think it’s worth thinking about the security of that now, while its still a nascent idea.
In 2019, I joined Inrupt, a company that is commercializing Tim Berners-Lee’s open protocol for distributed data ownership. We are working on a digital wallet that can make use of AI in this way. (We used to call it an “active wallet.” Now we’re calling it an “agentic wallet.”)
I talked about this a bit at the RSA Conference...
The post Privacy for Agentic AI appeared first on Security Boulevard.
In the digital healthcare landscape, electronic health records (EHRs) are foundational to patient care, operational efficiency and regulatory compliance.
The post Enhancing EHR Security: Best Practices for Protecting Patient Data appeared first on Security Boulevard.
With the right cloud database architecture, you gain versatility as well as optimal security.
The post The Cloud Illusion: Why Your Database Security Might Be at Risk appeared first on Security Boulevard.
Penetration testing is vital to keeping your business safe in today’s digital landscape, where cyber threats are ever present. It ensures your business’s sensitive data is protected, validating the robustness of the defensive measures your business has implemented. With cyber attacks on the rise, proactive measures like penetration testing (also known as ethical hacking) aren’t…
The post Preparing your business for a penetration test appeared first on Sentrium Security.
The post Preparing your business for a penetration test appeared first on Security Boulevard.
Author/Presenter: Larissa Fonseca
Our sincere appreciation to BSidesLV, and the Presenters/Authors for publishing their erudite Security BSidesLV24 content. Originating from the conference’s events located at the Tuscany Suites & Casino; and via the organizations YouTube channel.
The post BSidesLV24 – Proving Ground – And What If It Was Hacked? Tactics And Impacts Of Adversarial Machine Learning appeared first on Security Boulevard.
The Treasury Department is moving to cut off Huione Group, a Cambodian conglomerate, from the U.S. financial system, saying the firm and its multiple entities laundered billions of dollars for North Korea's Lazarus Group and criminal gangs running pig-butchering scams from Southeast Asia.
The post Treasury Moves to Ban Huione Group for Laundering $4 Billion appeared first on Security Boulevard.
Innovation is never a straight path. Every successful SaaS product or software starts with identifying the right customer problems and differentiating in a competitive landscape....Read More
The post 6 Essential Frameworks to Find the Right Customer Problems & Standing Out in a Crowded Software Marketplace appeared first on ISHIR | Software Development India.
The post 6 Essential Frameworks to Find the Right Customer Problems & Standing Out in a Crowded Software Marketplace appeared first on Security Boulevard.
Consider this: your pre-production scans might flag hundreds of vulnerabilities, but which ones are actually being exploited in your live environment? The uncomfortable truth is that without visibility into your production runtime, you're operating in the dark, potentially focusing resources on threats that pose minimal immediate risk while critical exposures remain unseen. The strategic imperative now is to implement robust controls within production to gain that crucial visibility, allowing for informed prioritization and a tangible reduction in your organization's true security risk.
The post Cybersecurity Insights with Contrast CISO David Lindner | 05/02/25 appeared first on Security Boulevard.
In this special edition of the Cybersecurity Snapshot, we’re highlighting some of the most valuable guidance offered by the U.S. Cybersecurity and Infrastructure Security Agency in the past 12 months. Check out best practices, recommendations and insights on protecting your cloud environments, OT systems, software development processes and more.
In case you missed it, here’s CISA’s advice on six cybersecurity areas.
1 - How to choose cyber secure OT productsIf your organization is shopping around for operational technology (OT) products, CISA published a guide in January 2025 aimed at helping OT operators choose OT products designed with strong cybersecurity features.
Titled “Secure by Demand: Priority Considerations for Operational Technology Owners and Operators when Selecting Digital Products,” the publication highlights 12 cybersecurity elements that OT products should have, including:
According to CISA, many OT products aren’t designed and developed securely, so they ship with issues such as weak authentication, known vulnerabilities and insecure default settings.
In fact, the agency says it’s common for hackers to specifically target OT products they know are insecure, instead of going after specific organizations. Thus, it’s critical for organizations, especially those in critical infrastructure sectors, to pick OT products that are built securely.
“When security is not prioritized nor incorporated directly into OT products, it is difficult and costly for owners and operators to defend their OT assets against compromise,” reads the guide, published in collaboration with other U.S. and international agencies.
Back in September 2024, CISA sounded the alarm on critical infrastructure organizations’ susceptibility to common, well-known attack methods in its “CISA Analysis: Fiscal Year 2023 Risk and Vulnerability Assessments” report.
The report’s findings are based on risk and vulnerability assessments (RVAs) of the security of 143 critical infrastructure organizations that CISA and the U.S. Coast Guard conducted in 2023.
Specifically, CISA and USCG assessors had the most success gaining initial access, attaining network permanence, evading defenses and moving laterally by using valid accounts, phishing schemes and default credentials — all simple attack methods.
For example, the use of valid accounts, which are legitimate accounts whose login credentials have been compromised, was the most successful attack technique for achieving:
Valid-account use also ranked as the second most successful attack technique for evading defenses.
(Source: “CISA Analysis: Fiscal Year 2023 Risk and Vulnerability Assessments” report, September 2024)
The report offers troves of recommendations to critical infrastructure organizations, including:
For more information about protecting critical infrastructure environments and about operational technology (OT) security, check out these Tenable resources:
Looking to learn more about software bills of materials (SBOMs), which in theory help boost your software supply chain security by listing all ingredients in a software product, such as an application?
In October 2024, CISA updated the document “Framing Software Component Transparency,” which offers foundational guidance about SBOMs, such as what they are and how to implement them.
SBOMs’ purpose is to provide granular visibility into all software components in your environment. Thus, an SBOM should help you locate all instances of a component with a newly disclosed flaw, such as a critical vulnerability — as happened with the Log4j utility.
However, the software industry is still working through complex SBOM-related challenges in areas including standards, data comprehensiveness and interoperability.
“Framing Software Component Transparency” zeroes in on the challenge of “universally identifying and defining certain aspects of software components.”
Specifically, the CISA guidance states the need to:
A few months later, CISA tackled a related topic: secure software development.
The best practices are organized into two categories — software development process goals and product design goals — and include:
The recommendations “will help to protect the sector from cyber incidents, identify and address vulnerabilities prior to product release, improve incident response, and significantly improve software security,” CISA said in a statement.
For more information about SBOMs:
For more information about secure software development:
In July 2024, CISA published a must-read report explaining how its red team probed a large federal agency’s network, quickly found a way in and stayed undetected for months.
The 29-page report details the so-called SilentShield assessment from CISA’s red team, explains what the agency’s security team should have done differently and offers concrete recommendations and best practices you might find worth reviewing.
Mimicking the modus operandi of a typical nation-state attacker, CISA’s red team exploited a known vulnerability on an unpatched web server, gaining access to the agency’s Solaris environment. Separately, the red team also breached the network’s Windows environment via a phishing attack.
Once inside, the red team exploited other weaknesses, such as unsecured admin credentials, to extend the scope of the breach, which went undetected for five months. At that point, CISA alerted the agency about the SilentShield operation.
CISA has authorization to conduct SilentShield assessments, whose purpose is to work with the impacted agency and help its security team strengthen its cyberdefenses.
Here’s a brief sampling of the assessed agency’s security weaknesses:
Recommendations include:
To get more details, read the report, titled “CISA Red Team’s Operations Against a Federal Civilian Executive Branch Organization Highlights the Necessity of Defense-in-Depth.”
For more information about the threat from nation-state cyber attackers:
In a move to boost the U.S. government’s cloud security, CISA released in December 2024 a set of required cybersecurity actions for federal civilian agencies — mostly focused on applying secure configuration baselines to their cloud apps.
The mandate to secure cloud environments comes via the Binding Operational Directive (BOD) 25-01 — titled “Implementing Secure Practices for Cloud Services.”
“Malicious threat actors are increasingly targeting cloud environments and evolving their tactics to gain initial cloud access,” CISA said in a statement.
The guidance, while applicable only to U.S. federal civilian agencies, can be helpful to all organizations in the public and private sectors. Its foundation is CISA’s Secure Cloud Business Applications (SCuBA) project, which offers recommendations for hardening the configuration of cloud services.
“The scope of the BOD 25-01 includes all production or operational cloud tenants (operating in or as a federal information system) utilizing Microsoft 365,” Tenable Staff Research Engineer Mark Beblow explained in a recent blog about this directive.
“CISA may release additional SCuBA Secure Configuration Baselines for other cloud products which would fall under the scope of this directive,” he added.
Earlier in 2024, CISA joined the National Security Agency to publish five information sheets detailing cloud security best practices and mitigations in areas including cloud IAM; keys management; network segmentation and encryption; and data protection.
Here are the links to the documents:
To get more details and analysis on these cloud security best practices and mitigations, read the blog “CISA and NSA Cloud Security Best Practices: Deep Dive” from Tenable Senior Research Engineer Zan Liffick.
To learn more about cloud security, check out these Tenable resources:
CISA has been pushing its “Secure by Design” program, which encourages software manufacturers to build cybersecurity into the design of their products, which the agency firmly believes would dramatically lower cyber risk.
Examples of this effort are CISA’s calls to stamp out well-known software flaws that nonetheless remain prevalent in applications and other software products, such as traversal vulnerabilities, OS command injection vulnerabilities and cross-site scripting vulnerabilities.
Also part of the program is the Secure by Design pledge, an initiative CISA launched in May 2024 to encourage software manufacturers to voluntarily commit to secure software development practices, such as using multi-factor authentication and being more transparent in vulnerability reporting.
Tenable was one of the 68 original signatories of the pledge. “This initiative is a commitment to enhance the security posture of our products and, by extension, the broader digital ecosystem,” Tenable CSO and Head of Research Bob Huber wrote in a blog.
As part of the Secure by Design initiative, CISA also reached out to technology buyers, encouraging them to seek software products designed and built securely. To help technology buyers make this assessment, CISA, joined by cyber agencies from the Five Eyes countries — Australia, Canada, New Zealand, U.S. and U.K. — published the guide “Secure-by-Design: Choosing Secure and Verifiable Technologies.”
The 40-page document seeks “to assist procuring organizations to make informed, risk-based decisions” about digital products and services, and is aimed at executives, cybersecurity teams, product developers, risk advisers, procurement specialists and others.
“It is important that customers increasingly demand manufacturers embrace and provide products and services that are secure-by-design and secure-by-default,” reads the guide.
The authoring agencies define the secure-by-design principles that software manufacturers should follow when building digital products and services. Here’s a sampling:
The guide is divided into two main sections: External procurement considerations, which is by far the longest; and internal procurement considerations. Topics covered include:
For more information about the secure-by-design concept:
Is your company considering implementing a consistent and uniform set of foundational cybersecurity practices for all teams and departments throughout the organization? If so, you might want to check out how CISA plans to lead such an effort across 100-plus federal agencies.
CISA will be in charge of the project, which it detailed in the document “Federal Civilian Executive Branch (FCEB) Operational Cybersecurity Alignment (FOCAL) Plan,” announced in September 2024.
The goal: To standardize the cybersecurity operations of civilian agencies in the executive branch, known by the acronym FCEB, to ensure they can all properly manage cyber risk in today’s complex and fast-evolving threat landscape.
Currently, these agencies architect their IT and cybersecurity operations independently, and consequently their ability to manage cyber risk varies. “There is no cohesive or consistent baseline security posture across all FCEB agencies” and as a result “the FCEB remains vulnerable,” CISA says in the FOCAL plan’s document.
The FOCAL plan focuses on five core areas:
“The FOCAL Plan was developed for FCEB agencies, but public and private sector organizations should find it useful as a roadmap to establish their own plan to bolster coordination of their enterprise security capabilities,” CISA said in a statement.
To get more details, check out the Tenable blog “CISA Releases FOCAL Plan to Help Federal Agencies Reduce Cyber Risk” from Tenable Director of Security Engineering Garrett Cook.
The post Cybersecurity Snapshot: CISA’s Best Cyber Advice on Securing Cloud, OT, Apps and More appeared first on Security Boulevard.
The UK’s National Cyber Security Centre just released its white paper on “Advanced Cryptography,” which it defines as “cryptographic techniques for processing encrypted data, providing enhanced functionality over and above that provided by traditional cryptography.” It includes things like homomorphic encryption, attribute-based encryption, zero-knowledge proofs, and secure multiparty computation.
It’s full of good advice. I especially appreciate this warning:
When deciding whether to use Advanced Cryptography, start with a clear articulation of the problem, and use that to guide the development of an appropriate solution. That is, you should not start with an Advanced Cryptography technique, and then attempt to fit the functionality it provides to the problem. ...
The post NCSC Guidance on “Advanced Cryptography” appeared first on Security Boulevard.
