Active Directory can be exploited through password spraying attacks and compromised credentials. Five Eyes recommends the following controls.
The post Enhancing AD Security Against Password Spraying Attacks appeared first on Security Boulevard.
CISA has added three new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation.
These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise.
Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities established the Known Exploited Vulnerabilities Catalog as a living list of known Common Vulnerabilities and Exposures (CVEs) that carry significant risk to the federal enterprise. BOD 22-01 requires Federal Civilian Executive Branch (FCEB) agencies to remediate identified vulnerabilities by the due date to protect FCEB networks against active threats. See the BOD 22-01 Fact Sheet for more information.
Although BOD 22-01 only applies to FCEB agencies, CISA strongly urges all organizations to reduce their exposure to cyberattacks by prioritizing timely remediation of Catalog vulnerabilities as part of their vulnerability management practice. CISA will continue to add vulnerabilities to the catalog that meet the specified criteria.
Enterprise organizations in recent years have come to recognize that attacks targeting software supply chains are a major threat. But the focus has been on attacks involving open-source software, since commercial software is a black box for many enterprises.
Cybersecurity incidents such as the one that SolarWinds disclosed in December 2020 have become increasingly common — as have vulnerability exploits used against trusted vendors and attacks on organizations handling enterprise data.
Here are five major commercial supply chain security incidents from the past year — and the lessons they offer for security stakeholders.
The post 5 commercial software attacks — and what you can learn from them appeared first on Security Boulevard.
The shift to 90-day certificates, Post-Quantum Cryptography (PQC), and crypto agility are interconnected strategies for enhancing cybersecurity. Shortened certificate lifespans improve agility and readiness for PQC, ensuring a seamless transition to future quantum-safe encryption. These trends reflect a proactive approach to building a resilient and adaptable digital security infrastructure.
The post Why 90-Day certificates, PQC, and crypto agility are more interconnected than you think appeared first on Security Boulevard.