Security Boulevard

IntroductionLogonBox is pleased to announce the immediate availability of LogonBox SSPR 2.4.12.This release includes performance improvements for large user counts, disabled account license changes, and retries for cloud-delivered OTP messages. The changelog at the bottom lists all new features and bugs fixed.Reducing memory footprintWhen large numbers of users and groups exist, this could cause issues [...]

Read More...

The post LogonBox SSPR 2.4.12 – Now Available appeared first on LogonBox.

The post LogonBox SSPR 2.4.12 – Now Available appeared first on Security Boulevard.

A survey of 625 IT and IT security professionals in the U.S. published today finds only half (50%) consider the investments made in identity and access management (IAM) tools to be effective. Conducted by the Ponemon Institute on behalf of GuidePoint Security, a provider of cybersecurity services, the survey also finds only 44% have high..

The post Survey Surfaces Scope of Identity and Access Management Challenges appeared first on Security Boulevard.

One of the most talked-about developments in cybersecurity this month is Zscaler’s acquisition of Red Canary, a move that highlights a larger industry trend: the growing demand for unified, automated security platforms that accelerate threat detection and response. But what does this really mean for security teams looking to stay ahead of ransomware, advanced threats,

The post Why Zscaler’s Acquisition of Red Canary Matters to Your Cybersecurity Strategy appeared first on Seceon Inc.

The post Why Zscaler’s Acquisition of Red Canary Matters to Your Cybersecurity Strategy appeared first on Security Boulevard.

Traditional PKI often creates security and agility bottlenecks due to manual processes and poor integration. As enterprises adopt cloud, DevOps, and Zero Trust, automated and scalable certificate management becomes essential. Modern PKI solutions must offer automation, policy enforcement, seamless integration, and broad coverage. Automated Internal PKI provides centralized control and lifecycle automation, enabling secure, efficient digital transformation.

The post From bottleneck to business enabler: making PKI work for digital transformation appeared first on Security Boulevard.

The world has a long history of hiding messages in plain sight. My own crude attempts as a kid included hours spent inserting code words and number sequences into notes and messages to avoid detection by parents, teachers and other kids. And occasionally whipping out my Batman decoder ring to figure out messages being hidden..

The post Scientists Use AI Chatbots to Carry Encrypted Messages Undetectable by Cybersecurity Systems  appeared first on Security Boulevard.

A breath of fresh air: Security fixes and other updates will be “orchestrated” by Redmond’s own update tool.

The post Microsoft Opens Windows Update to 3rd-Party Apps appeared first on Security Boulevard.

The latest Go release — Go 1.24, released in February 2025 — introduced a significant security enhancement: the os.Root type. 

The post Navigating os.Root and Path Traversal Vulnerabilities | Go 1.24 Detection and Protection Methods | Contrast Security appeared first on Security Boulevard.

As open source adoption accelerates across the enterprise, so too does its complexity. Development teams are building software with hundreds of components, each carrying its own risks, release cycles, and dependencies.

The post Streamline SCA with Sonatype’s build-safe automation appeared first on Security Boulevard.

Microsoft is phasing out password features in Authenticator. Transition to Edge for autofill and explore passwordless authentication. Learn more!

The post Microsoft Authenticator Phases Out Password Features and Apple Watch Support appeared first on Security Boulevard.

Discover the implications of the 19 billion passwords leaked in the RockYou2024 breach. Learn essential actions to secure your accounts now!

The post 19 Billion Passwords Leaked: Protect Yourself from Cyber Threats appeared first on Security Boulevard.

How k0s, a lightweight Kubernetes distribution, joins the CNCF Sandbox, enhancing cloud-native computing. Explore its features today!

The post k0s Enters CNCF Sandbox: A New Lightweight Kubernetes Option appeared first on Security Boulevard.

Discover AWS's new Product Lifecycle page for tracking service changes and updates. Stay informed and enhance your cloud strategy today!

The post AWS Centralized Product Lifecycle Page: Enhance Transparency & Info appeared first on Security Boulevard.

PALO ALTO, California, 29th May 2025, CyberNewsWire

The post Fullscreen BitM Attack Discovered by SquareX Exploits Browser Fullscreen APIs to Steal Credentials in Safari appeared first on Security Boulevard.

Encrypted Client Hello (ECH) has been in the news a lot lately. For some background and relevant and recent content, see:

• IETF Proposed Standard
• Cloudflare Blog from 2023 announcing ECH support
• RSA 2025 talk: ECH: Hello to Enhanced Privacy or Goodbye to Visibility?
• Corrata White Paper “Living with ECH”
• Security Now podcast coverage of the above in Episode 1027

C Suite and Security Operators’ concerns about ECH

The push for ECH primarily is of interest to privacy-seeking end users using an untrusted transit. The dynamics are at odds with security professionals responsible for their users and endpoints, regardless of transit. This blog article is written for the latter group.

There are enough motivations for ECH adoption that it is bound to happen since ECH client support is already present in modern browsers. In my own lab network, I just checked my ech logs over the last few hours. These domains have been contacted, all via ECH:

api.ecomsend.com app.backinstock.org cdn.discordapp.com discordapp.com oidc.iam.cfapi.net textify-cdn.com ublockorigin.pages.dev vector.im

As articulated in Corrata’s White Paper titled “Living with ECH”, the following statement caught our attention:

"A rapid increase in the use of Encrypted Client Hello would mean that it would no longer be possible to directly detect the destination of much internet traffic. Security tools designed to keep enterprises safe would lose some of the visibility they rely on.”

In a world where security operators have good reasons to be concerned about the destination of any connection made over the internet, this is a legitimate concern, especially considering these two trends that the paper points out:

• Phishing use:

"Our analysis of phishing detections shows that over 90% use Cloudflare infrastructure”

• Spike in ECH adoption:

“The spike in detections of the cloudflare-ech.com domain observed in the latter part of 2024 was the catalyst for this research.”

How SNI has traditionally been used for lightweight target domain detection

Even encrypted traffic still offers the Server Name Identification in clear-text. This can be seen with a simple packet capture on any gateway, for example:

gateway#: tcpdump -i eth1 port 443 -w capture.pcap

(where eth1 is the LAN interface)

For any device on the LAN of such a gateway, can attempt to make a browser connection to www.google.com and the packet capture will contain the domain as can be extracted like this:

% tshark -r capture.pcap -Y "tls.handshake.type == 1" -T fields -e tls.handshake.extensions_server_name www.google.com

The visited domain is available in plain text. At this point, it is trivial for the gateway security appliance to map the destination FQDN and allow (or deny) by policy. Most security appliances rely on this mechanism for detection, with or without a protective DNS resolver in play.

How SNI fails when ECH is used

If we repeat the same exercise as above for a domain where ECH is enabled, the packet capture does not include the actual visited domain, let’s use one of my visited domains from above, vector.im and we see the ech= response when making a TYPE65 query:

endpoint$ kdig @1.1.1.1 +https TYPE65 vector.im +short 1 . alpn=h3,h2 ipv4hint=172.64.80.1 ech=AEX+DQBB3gAgACCtcqyZIqDPl/JQduQQfIk5c+oiXxPWNUECS9qO7zLoIwAEAAEAAQASY2xvdWRmbGFyZS1lY2guY29tAAA= ipv6hint=2606:4700:130:436c:6f75:6466:6c61:7265 gateway#: tcpdump -i eth1 port 443 -w captureECH.pcap endpoint$ curl -v -k --ech true --doh-url https://cloudflare-doh/dns-query https://vector.im % tshark -r captureECH.pcap -Y "tls.handshake.type == 1" -T fields -e tls.handshake.extensions_server_name cloudflare-ech.com

Note that there’s no vector.im showing up anywhere in cleartext. Only cloudflare-ech.com is visible. This is the loss of visibility that concerns the security community.

Protective DNS to the rescue (partially)

Any available Protective DNS Resolver can block by policy on a per-FQDN basis, whether known-bad or untrusted by another assessment. However, it is only a partial solution because of the ease of the endpoint using an alternate DNS resolver, including widely-available DoH providers such as 1.1.1.1. This is a common circumvention strategy used by browsers/applications as well as by malware. In such a case, the designated Protective DNS server isn’t even in use, so it offers no protection.

The complete FIX: DNS at the root of trust

The way this is accomplished is with Don’t Talk To Strangers (DTTS) which is a default-deny-all approach for every connection, unless first permitted by policy, and subsequently looked up by adam:ONE’s caching resolver. Each destination allow-rule is permits a single source and a single destination for the period of the Time To Live (TTL) offered to the query source. This includes well-known as well as unknown DoH servers. Note that it isn’t a list of known DoH servers to block. Here’s a logical flow of the DTTS approach:

When DNS is treated as the root of trust for all network connections, every destination IP network connection is necessarily mapped back to a fully qualified domain name. The only exception to this would be for IPs that are not discovered by DNS, and are explicitly trusted.

Closing other DNS vulnerabilities

• Hijack Do53 traffic destined anywhere except as authorized - this approach allows simultaneous convenience for any legacy endpoints using another DNS server (such as commonly hard-coded 8.8.8.8 operational devices), while still offering answers by policy
• Offer DNS encryption internally as well as upstream via DDR and DNR standards - this approach makes the DNS environment immediately compliant with CISA DNS Security standards

Conclusion

The biggest gains with this approach can be summarized as:

• ECH adoption no longer a security risk
• Security-focused: from before the connection begins, security is the proactive model, not a reactive one
• Lightweight - the replacement of the middle box now requires less horsepower, offers a faster experience with lower latency
• Future-proofed, when DNS is treated as the root of network trust

1 post - 1 participant

Read full topic

The post Unmasking ECH: Why DNS-at-the-Root-of-Trust Holds the Key to Secure Connectivity appeared first on Security Boulevard.

A hybrid security model provides the ability to deploy a variety of rule sets for specific applications while providing a single, centralized way to manage it all.

The post Your IT Infrastructure is Hybrid. So Why Not Your Security Model? appeared first on Security Boulevard.

An identity threat detection approach built on access intelligence is key to identifying and disrupting campaigns like Volt Typhoon. 

The post An Enterprise Playbook to Defending Against Volt Typhoon  appeared first on Security Boulevard.

Executives are under digital siege—and most don’t even know it.

Related: Shareholders sue over murder

At RSAC 2025, I sat down with Chuck Randolph, SVP of Strategic Intelligence and Security at 360 Privacy, to unpack a … (more…)

The post RSAC Fireside Chat: Cyber risk mitigation turns personal–defending the CEO as an attack vector first appeared on The Last Watchdog.

The post RSAC Fireside Chat: Cyber risk mitigation turns personal–defending the CEO as an attack vector appeared first on Security Boulevard.

A new report from Varonis examines nearly 10 billion files and suggests that AI is a ticking time bomb for your data.

The post AI is a Ticking Time Bomb for Your Data, Reveals New Report From Varonis  appeared first on Security Boulevard.

We've reached a point where customers won't wait even a few seconds for an app to load or a login to work. In this new era of digital impatience, CIAM platforms have become business critical, serving as direct contributors to conversion rates, user retention, and data protection.

The post Find the Best CIAM Solution for Your Business: A Comprehensive Guide to Modern Customer Identity Management appeared first on Security Boulevard.

Cloud security isn’t just about merely collecting data. You need to extract meaning from it if you want to actually improve your defenses. And while this may sound simple in practice, any seasoned cloud security practitioner will be quick to tell you otherwise. The challenge today isn’t about what you’re not seeing. Your traffic logs..

The post What Your Traffic Logs Aren’t Telling You About Cloud Security appeared first on Security Boulevard.