DataDome detected a 135% surge in malicious bot attacks during December 2025. Discover how AI-powered bots targeted retailers and how we defended customers
The post 135% Surge: Inside the Holiday Bot Attacks of December 2025 appeared first on Security Boulevard.
Session 8A: Email Security
Authors, Creators & Presenters: Ka Fun Tang (The Chinese University of Hong Kong), Che Wei Tu (The Chinese University of Hong Kong), Sui Ling Angela Mak (The Chinese University of Hong Kong), Sze Yiu Chau (The Chinese University of Hong Kong)
PAPER
A Multifaceted Study on the Use of TLS and Auto-detect in Email Ecosystems
Various email protocols, including IMAP, POP3, and SMTP, were originally designed as "plaintext" protocols without inbuilt confidentiality and integrity guarantees. To protect the communication traffic, TLS can either be used implicitly before the start of those email protocols, or introduced as an opportunistic upgrade in a post-hoc fashion. In order to improve user experience, many email clients nowadays provide a so-called "auto-detect" feature to automatically determine a functional set of configuration parameters for the users. In this paper, we present a multifaceted study on the security of the use of TLS and auto-detect in email clients. First, to evaluate the design and implementation of client-side TLS and auto-detect, we tested 49 email clients and uncovered various flaws that can lead to covert security downgrade and exposure of user credentials to attackers. Second, to understand whether current deployment practices adequately avoid the security traps introduced by opportunistic TLS and auto-detect, we collected and analyzed 1102 email setup guides from academic institutes across the world, and observed problems that can drive users to adopt insecure email settings. Finally, with the server addresses obtained from the setup guides, we evaluate the sever-side support for implicit and opportunistic TLS, as well as the characteristics of their certificates. Our results suggest that many users suffer from an inadvertent loss of security due to careless handling of TLS and auto-detect, and organizations in general are better off prescribing concrete and detailed manual configuration to their users.
ABOUT NDSS
The Network and Distributed System Security Symposium (NDSS) fosters information exchange among researchers and practitioners of network and distributed system security. The target audience includes those interested in practical aspects of network and distributed system security, with a focus on actual system design and implementation. A major goal is to encourage and enable the Internet community to apply, deploy, and advance the state of available security technologies.
Our thanks to the Network and Distributed System Security (NDSS) Symposium for publishing their Creators, Authors and Presenter’s superb NDSS Symposium 2025 Conference content on the Organizations' YouTube Channel.
The post NDSS 2025 – A Multifaceted Study On The Use of TLS And Auto-detect In Email Ecosystems appeared first on Security Boulevard.
Users and developers have hailed Linux as the operating system that “just works,” celebrating it for decades as a symbol of open source strength, speed, and security. Linux’s architecture and permissions model have long helped maintain cybersecurity resilience, fostering a reputation for near-invincible security. However, without additional layers of security to protect enterprise environments beyond..
The post The Myth of Linux Invincibility: Why Automated Patch Management is Key to Securing the Open Source Enterprise appeared first on Security Boulevard.
Cybersecurity headlines often focus on threat actors and attack vectors, but the quietest and most dangerous threat in cybersecurity may be within our own teams. The difficulty of detecting cyber threats is accelerating, and the volume, creativity, and effectiveness of attacks show no signs of slowing. These dynamics significantly strain cybersecurity and IT professionals, causing..
The post The Silent Scourge: A Call to Action Against Burnout in Cybersecurity appeared first on Security Boulevard.
As environments become more complex and grow, the instinctive response has been to add more tools. Organizations now manage an average of 45 cybersecurity products, which gives the impression of broad protection. Yet the organizations seeing the most meaningful reductions in breaches are the ones using continuous threat exposure management rather than those with the..
The post Attackers Don’t Guess and Defenders Shouldn’t Either appeared first on Security Boulevard.
Traditional compliance often forces companies to expose sensitive information to prove they follow the rules. This approach increases the risk of breaches and raises severe privacy concerns. With rising regulatory pressure and stricter data sovereignty laws, more organizations are exploring zero-knowledge frameworks as a safer alternative. Zero-knowledge proofs (ZKPs) allow businesses to prove adherence without..
The post Zero-Knowledge Compliance: How Privacy-Preserving Verification Is Transforming Regulatory Technology appeared first on Security Boulevard.
A practical guide to the Backend for Frontend pattern for secrets management.
The post Stop Leaking API Keys: The Backend for Frontend (BFF) Pattern Explained appeared first on Security Boulevard.
Cybersecurity risk is no longer an abstract concern relegated to IT teams, it is a material business risk that boards and senior leaders must actively manage.UK government research indicates that around 43% of businesses experienced a cyber security breach or attack in the past year, underlining how common these incidents have become across sector, from…
The post The Boardroom Case for Penetration Testing appeared first on Sentrium Security.
The post The Boardroom Case for Penetration Testing appeared first on Security Boulevard.
In this blog, we show union-type structured output allows AI agents to handle uncertain outcomes, critical for auditable and accurate vulnerability triage.
The post Embracing Uncertainty with AI Agents: Vulnerability Assessment using Pydantic AI appeared first on Realm.Security.
The post Embracing Uncertainty with AI Agents: Vulnerability Assessment using Pydantic AI appeared first on Security Boulevard.
A powerful integration between Azul and OpenRewrite enables enterprises to automatically identify and remove unused and dead code.
The post How to Automate Safe Removal of Unused Code appeared first on Azul | Better Java Performance, Superior Java Support.
The post How to Automate Safe Removal of Unused Code appeared first on Security Boulevard.
Today’s K–12 schools operate in a far more complex landscape than ever before. A safe learning environment surpasses classroom walls or school hallways. Learning now extends into digital platforms, cloud-based tools, and connected devices that students use daily. As a result, school safety must evolve to protect students academically, emotionally, psychologically, and online. Safety and ...
The post Creating a Safe Learning Environment in K-12 Schools Without Adding Complexity appeared first on ManagedMethods Cybersecurity, Safety & Compliance for K-12.
The post Creating a Safe Learning Environment in K-12 Schools Without Adding Complexity appeared first on Security Boulevard.
Explore the need for integration between site reliability engineering (SRE) and security teams to enhance organizational resilience through shared goals, frameworks, and automation.
The post Bridging the Gap Between SRE and Security: A Unified Framework for Modern Reliability appeared first on Security Boulevard.
Secure your MCP deployments with quantum-resistant integrity verification. Learn how to protect machine-to-machine model contexts from future quantum threats.
The post Quantum-Durable Integrity Verification for Machine-to-Machine Model Contexts appeared first on Security Boulevard.
How Does Agentic AI Transform NHI Management? Are cybersecurity professionals fully leveraging Agentic AI for Non-Human Identities (NHIs) and Secrets Security Management? With technology advances, the integration of Agentic AI into cybersecurity practices has become crucial, especially when dealing with NHIs. These machine identities, formed by combining encrypted credentials with access permissions, are paramount in […]
The post What innovations are shaping Agentic AI today? appeared first on Entro.
The post What innovations are shaping Agentic AI today? appeared first on Security Boulevard.
Are Non-Human Identities the Key to Unlocking Data Security with Agentic AI? Where data security is paramount, many organizations grapple with the potential vulnerabilities that Agentic AI might introduce if not managed properly. Central to this discussion is the role of Non-Human Identities (NHIs) and Secrets Security Management—a subject demanding the attention of cybersecurity experts […]
The post How secure is your data with Agentic AI? appeared first on Entro.
The post How secure is your data with Agentic AI? appeared first on Security Boulevard.
How Do Non-Human Identities Influence Cybersecurity Strategies? What role do Non-Human Identities (NHIs) play in your cybersecurity strategy? Where technology is increasingly shaped by machine-to-machine interactions, the significance of NHIs has grown exponentially. These identities are not just essential but central to infrastructure integrity. NHIs encompass machine identities, which are represented through unique “Secrets” such […]
The post How scalable are secret management methods for NHIs? appeared first on Entro.
The post How scalable are secret management methods for NHIs? appeared first on Security Boulevard.
Are You Prepared to Leverage the Full Potential of Non-Human Identities in Complex Networks? Organizations are increasingly reliant on complex networks, with machine identities playing a critical role in maintaining security and operational integrity. But how capable are these Non-Human Identities (NHIs) when navigating such intricate environments? Understanding Non-Human Identities Non-Human Identities are pivotal to […]
The post How capable are NHIs in managing complex networks? appeared first on Entro.
The post How capable are NHIs in managing complex networks? appeared first on Security Boulevard.
Session 8A: Email Security
Authors, Creators & Presenters: Ka Fun Tang (The Chinese University of Hong Kong), Che Wei Tu (The Chinese University of Hong Kong), Sui Ling Angela Mak (The Chinese University of Hong Kong), Sze Yiu Chau (The Chinese University of Hong Kong)
PAPER
A Multifaceted Study on the Use of TLS and Auto-detect in Email Ecosystems
Various email protocols, including IMAP, POP3, and SMTP, were originally designed as "plaintext" protocols without inbuilt confidentiality and integrity guarantees. To protect the communication traffic, TLS can either be used implicitly before the start of those email protocols, or introduced as an opportunistic upgrade in a post-hoc fashion. In order to improve user experience, many email clients nowadays provide a so-called "auto-detect" feature to automatically determine a functional set of configuration parameters for the users. In this paper, we present a multifaceted study on the security of the use of TLS and auto-detect in email clients. First, to evaluate the design and implementation of client-side TLS and auto-detect, we tested 49 email clients and uncovered various flaws that can lead to covert security downgrade and exposure of user credentials to attackers. Second, to understand whether current deployment practices adequately avoid the security traps introduced by opportunistic TLS and auto-detect, we collected and analyzed 1102 email setup guides from academic institutes across the world, and observed problems that can drive users to adopt insecure email settings. Finally, with the server addresses obtained from the setup guides, we evaluate the sever-side support for implicit and opportunistic TLS, as well as the characteristics of their certificates. Our results suggest that many users suffer from an inadvertent loss of security due to careless handling of TLS and auto-detect, and organizations in general are better off prescribing concrete and detailed manual configuration to their users.
ABOUT NDSS
The Network and Distributed System Security Symposium (NDSS) fosters information exchange among researchers and practitioners of network and distributed system security. The target audience includes those interested in practical aspects of network and distributed system security, with a focus on actual system design and implementation. A major goal is to encourage and enable the Internet community to apply, deploy, and advance the state of available security technologies.
Our thanks to the Network and Distributed System Security (NDSS) Symposium for publishing their Creators, Authors and Presenter’s superb NDSS Symposium 2025 Conference content on the Organizations' YouTube Channel.
The post NDSS 2025 – A Multifaceted Study On The Use of TLS And Auto-detect In Email Ecosystems appeared first on Security Boulevard.
via the comic artistry and dry wit of Randall Munroe, creator of XKCD
The post Randall Munroe’s XKCD ‘Fishing’ appeared first on Security Boulevard.
Deepfakes have moved from novelty to a practical weapon — and Brian Long, CEO of Adaptive Security, says most organizations still aren’t built to handle what comes next. Long explains why AI-driven impersonation has become one of the fastest-growing forms of social engineering: it’s cheap, widely accessible, and increasingly convincing across channels that traditional security..
The post Fighting Deep Fakes: Think Like the Attacker appeared first on Security Boulevard.
