Security Boulevard

Are we Really Securing our Machine Identities? In today’s dynamic world, where businesses increasingly rely on a multitude of applications that drive their operations, API security plays a pivotal role. However, as organizations speed towards digital transformation, are we giving enough attention to the safety of our Non-Human Identities (NHIs) and secrets? A Fresh Look […]

The post Getting Better: Evolving Practices in API Security appeared first on Entro.

The post Getting Better: Evolving Practices in API Security appeared first on Security Boulevard.

Why is Secrets Sprawl a Risk in Data Handling? As cybersecurity continues to evolve at an unprecedented pace, businesses are increasingly becoming aware of the need to secure their digital assets, including data and secrets. Among these, “Secrets Sprawl” has emerged as a significant concern in data handling. Secrets sprawl refers to the unchecked proliferation […]

The post Safe Handling of Data: Why Secrets Sprawl is a Risk appeared first on Entro.

The post Safe Handling of Data: Why Secrets Sprawl is a Risk appeared first on Security Boulevard.

Can Strategic Secrets Management Boost Your Confidence? In today’s unpredictable cybersecurity landscape, building confidence in your protections may appear like a challenging endeavour. Yet, the key rests in a proactive and comprehensive approach. Surprisingly, it all comes down to strategic secrets management, a holistic method that includes managing Non-Human Identities (NHIs). But how exactly can […]

The post Building Confidence with Strategic Secrets Management appeared first on Entro.

The post Building Confidence with Strategic Secrets Management appeared first on Security Boulevard.

Attackers targeted applications and application programming interfaces (APIs) with an average of 50 confirmed attacks per app in the month of November 2024. That’s down from the previous month, but an alarming number of attacks continue to circumvent other defenses, and are only caught by Contrast Application Detection and Response (ADR). Every 30 days, Contrast Security publishes data about the detection and response of real-world application and API attacks with ADR.

The post Top November Attacks | Contrast ADR Attack Data | Contrast Security appeared first on Security Boulevard.

Authors/Presenters: Bill Woodcock

Our sincere appreciation to DEF CON, and the Presenters/Authors for publishing their erudite DEF CON 32 content. Originating from the conference’s events located at the Las Vegas Convention Center; and via the organizations YouTube channel.

Permalink

The post DEF CON 32 – Digital Emblems-When Markings Are Required, But You Have No Rattle-Can appeared first on Security Boulevard.

Today, healthcare providers, insurers, and other HIPAA-covered entities are increasingly relying on websites to share information, engage with patients, and streamline operations. While websites offer numerous benefits, it’s crucial to understand the implications of online tracking technologies for the privacy and security of protected health information (PHI). This blog post examines the intersection of websites, […]

The post Websites and HIPAA: Navigating Online Tracking Technologies appeared first on Feroot Security.

The post Websites and HIPAA: Navigating Online Tracking Technologies appeared first on Security Boulevard.

The ARIA Cybersecurity team had a hugely productive week in Anaheim, California at the recent 2024 Rockwell Automation Fair. The event was a fantastic opportunity to make connections with companies from across different industries. They all shared one objective: to discover innovative new ways to protect their industrial operations from the dangerous new wave of sophisticated cyberattacks.

The post How Should OT Companies Measure Cyber Risk? | ARIA Cybersecurity appeared first on Security Boulevard.

Permalink

The post Randall Munroe’s XKCD ‘Seismologists’ appeared first on Security Boulevard.

Today, we at Flare announced our USD $30M Series B Round led by Base10 Partners with participation from Inovia Capital, White Star Capital, and Fonds de solidarité FTQ.  We have raised CAD $9.5M to this point, and plan for this fresh round of capital to accelerate our growth. We’ve seen consistent traction with triple digit […]

The post Flare Raises $30M Series B Led by Base 10 Partners to Continue Growth in Security Intelligence and Threat Exposure Management Markets appeared first on Flare | Cyber Threat Intel | Digital Risk Protection.

The post Flare Raises $30M Series B Led by Base 10 Partners to Continue Growth in Security Intelligence and Threat Exposure Management Markets appeared first on Security Boulevard.

The digital currency market is booming, and as security professionals, we must address the crucial question: Is crypto safe?  Following the re-election of former President Donald

The post Is crypto safe? What to know before investing in digital currencies appeared first on Security Boulevard.

by Source Defense The landscape of payment security is at a critical turning point. As we approach the March 31, 2025 PCI compliance deadline for implementing new e-skimming controls, organizations face mounting pressure to address what has become the predominant vector for payment fraud. This isn’t just another compliance checkbox – it represents a fundamental

The post The Growing Threat of E-Skimming: Why March 2025’s PCI Deadline Matters appeared first on Source Defense.

The post The Growing Threat of E-Skimming: Why March 2025’s PCI Deadline Matters appeared first on Security Boulevard.

Los Angeles, USA, 11th December 2024, CyberNewsWire

The post Resecurity introduces Government Security Operations Center (GSOC) at NATO Edge 2024 appeared first on Security Boulevard.

Vienna, Austria, Dec. 11, 2024, CyberNewswire — DMD Diamond, one of the oldest blockchain projects in the space, has announced the start of Open Beta for the DMD Diamond v4 blockchain.

Established in 2013, DMD Diamond is recognized as … (more…)

The post News alert: DMD Diamond invites developers to participate in open beta for its v4 blockchain first appeared on The Last Watchdog.

The post News alert: DMD Diamond invites developers to participate in open beta for its v4 blockchain appeared first on Security Boulevard.

Oasis Security today revealed that it worked with Microsoft to fix a flaw in its implementation of multi-factor authentication (MFA) that could have been used by cybercriminals to gain access to every major Microsoft cloud service

The post Oasis Security Details MFA Security Flaw Found in Microsoft Cloud Services appeared first on Security Boulevard.

This is a joint post with the Ruby Central team. The full report, which includes all of the detailed findings from our security audit of RubyGems.org, can be found here. Ruby Central hired Trail of Bits to complete a security assessment and a competitive analysis of RubyGems.org, the official package management system for Ruby applications. […]

The post Auditing the Ruby ecosystem’s central package repository appeared first on Security Boulevard.

Vienna, Austria, 11th December 2024, CyberNewsWire

The post DMD Diamond Launches Open Beta for v4 Blockchain Ahead of 2025 Mainnet appeared first on Security Boulevard.

Recent guidance from CISA and the FBI highlights best practices to monitor and harden network infrastructure. The guidance, published in response to high-profile attacks on telecom infrastructure, is applicable to a wider audience. This blog unpacks important points and explains how Tenable products can help with compliance scans.

In November, the Cybersecurity and Infrastructure Security Agency (CISA) and Federal Bureau of Investigation (FBI) released a joint statement concerning an investigation into cyberattacks on commercial telecommunications infrastructure. The ongoing investigation centers on threat actors believed to be affiliated with the People’s Republic of China (PRC) government. In response to the cyberattacks, U.S. and international government agencies, including CISA and the FBI, authored joint guidance to help network defenders improve network visibility and security. This guidance highlights the importance of monitoring and alerting, but also provides specific ways to strengthen cybersecurity with increased configuration management and strong identity hygiene. 

What’s this all about?

The U.S. government has been monitoring PRC-sponsored groups such as Volt Typhoon and Salt Typhoon because it suspects they may be preparing for a large-scale disruption of U.S. critical infrastructure. A press release from mobile telecom provider T-Mobile highlights the activity that it has identified, the controls that it had in place to help prevent a greater threat, as well as how it is collaborating with the authorities’ investigation. According to U.S. government officials, at least eight telecommunications companies have been targeted so far but there may be more. 

The new guidance can help prevent these attacks, whose main goal is to reportedly carry out cyber espionage activities on behalf of the Chinese government by, among other things, stealing customer call-records data. The guidelines pair well with recommendations in Center for Internet Security (CIS) Benchmarks for specific network devices. CIS Benchmarks are written and maintained by industry professionals with the goal of simplifying the implementation of security controls to help mitigate risk. By using CIS Benchmarks, network and security engineers can identify and harden configurations, and establish a more secure posture as suggested by the guidance.

We’ll be taking a closer look at the specific sections in the recent guidance and highlight CIS Benchmark recommendations that align with these objectives.

Strengthening visibility

This section highlights monitoring and alerting best practices. It breaks these guidelines into two sets of tasks: one for network engineers and another one for network defenders. However, the common goal is to help them find and trigger alerts on misconfigurations, changes and user account activity. One key recommendation is to use an independent and centralized log-storage environment, and if possible, a security information and event management (SIEM) solution built specifically to analyze the logs to produce alerts. 

Alerting should be focused on configuration changes; configurations that don’t meet specific criteria; and open ports or enabled services. In addition, devices that accept traffic from outside of the network (external facing) should be reviewed to ensure that only necessary services are accessible to and from the internet.

Examples of centralized logging criteria can be found in CIS Benchmarks for Cisco, Fortinet, Juniper Networks and Palo Alto Networks devices:

• Cisco: “Ensure Syslog Logging is configured”
• Fortigate: “Centralized Logging and Reporting”
• Juniper: “Ensure logging data is monitored”
• Palo Alto: “Syslog logging should be configured”

This section also focuses on monitoring user- and service-account logins to ensure that anomalous login activity is detected and prevented. Unused accounts should be disabled whenever possible. Some examples of this criteria can be found in CIS Benchmarks for Check Point Software and Palo Alto Networks devices:

• Check Point: “Ensure Deny access to unused accounts is selected”
• Palo Alto: “Ensure that the User-ID service account does not have interactive logon rights”

Hardening systems and devices

This section aims to help reduce risk by limiting access to the network and network devices; ensuring that communication is encrypted and secure; and providing more direct guidance with regards to Cisco-based devices. This section includes recommendations regarding access control and network segmentation, provides specific protocol guidelines (such as using only SNMPv3 when SNMP is necessary), and details what is considered to be “strong” encryption. 

First, network segmentation helps to limit movement across the network and to make it easier to inspect inbound and outbound traffic. It also helps to maintain a DMZ to contain the services that must face externally (towards the internet) and prevent direct access to backend resources and networks. Segmentation also involves creating and using VLANs, and the recommendation is that these VLANs should be used to group together devices of a similar nature, which is common in most networks. In addition to segmenting the network, the authoring agencies also recommend adopting Transport Layer Security-everywhere using strong algorithms. These guidelines can help keep threat actors out of corporate networks, as well as ensure that these actors are limited in what they can do and/or see if they manage to penetrate the outermost defenses. 

Another component of segmentation is initializing a default-deny access-control list (ACL), which can be done at the firewall level. This is important for all traffic types, but especially so when isolating management traffic for network devices. Most physical network devices, such as routers and switches, have dedicated ports for management traffic that can be attached to a physically segmented network in order to limit administrative access. Further controls on lateral movement are also recommended for the management network, and it is advisable to not manage devices directly from the internet. Some examples of segmentation and ACL firewall configurations can be found in CIS Benchmarks for Cisco, Juniper Networks, and Palo Alto Networks products.

• Cisco: “Restrict Access to VTY Sessions” and “Ensure explicit deny in access lists is configured correctly”
• Juniper: “Ensure firewall filters contain explicit deny and log term”
• Palo Alto: “Ensure application security policies exist when allowing traffic from an untrusted zone to a more trusted zone”

The guidance further identifies numerous insecure protocols and services and notes that they should be disabled. These include FTP, TFTP, SSHv1, HTTP, and SNMP v1/v2. Additionally, any network protocols or services in use should require authentication when available, including routing protocols. Meanwhile, you should use SNMP Version 3 with encryption and authentication. Having centralized authentication, authorization, and accounting (AAA) logging is emphasized here, in addition to prior mentions of syslog configuration. Examples of identifying and disabling protocols can be found in several CIS Benchmarks for Cisco, Fortinet, Juniper Networks, and Palo Alto Networks products:

• Cisco: “Set version 2 for 'ip ssh version'”
• Fortigate: “Disable all management related services on WAN port” and “Ensure only SNMPv3 is enabled”
• Juniper: “Ensure Web-Management is not Set to HTTP”
• Palo Alto: “Ensure HTTP and Telnet options are disabled for the management interface”

This section highlights specific criteria for Cisco devices. Disabling the Smart Install and Guest Shell features is recommended, as is disabling Telnet in favor of SSH. Specific commands are also provided to disable HTTP-only access so that device management is performed over HTTPS instead. If UI access is not necessary, the secure service should also be disabled. The specific password type recommended is type-8 when possible, and type-6 encryption for securing the Terminal Access Controller Access-Control System + (TACACS+) key. The document also links to the hardening guide for Cisco IOS XE and a guide for securing NX-OS devices.

Secure by design

The secure-by-design concept helps introduce the security conversation earlier in the development lifecycle. This approach helps ensure that security considerations are addressed at the beginning of the product lifecycle. Customers should make sure that products they plan to buy adhere to this principle. CISA has more information on its “Secure by Design” site. Tenable has committed to a secure-by-design approach, as can be seen in a recent initiative reported on here and here.

How Tenable can help

This overview is meant to help give network and security engineers a summary of the best practices, as well as provide insight on how CIS Benchmarks cover many of the guidance’s topics. Still, engineers should read the guidance to ensure they fully understand the material and how it relates to their own networks. It’s equally important to map out the network and understand what devices exist and where they are placed. However, this is only a first step in securing the network.

Tenable has several products, such as Tenable Vulnerability Management, Tenable Security Center, and Nessus that support auditing a wide array of devices and operating systems using CIS Benchmarks. These products could help with maintaining control over risk factors that threat actors often attempt to exploit. Tenable audits are written to test for the criteria of each automated recommendation in CIS Benchmarks. After an evaluation is run against the target, a result is provided as well as remediation text from the CIS Benchmark so that engineers can remediate and harden the device or operating system.

Tenable provides audit files for the following CIS Benchmarks to help organizations assess device configurations:

• CIS Check Point Firewall Benchmark v1.1.0 - Level 1, Level 2 
• CIS Cisco ASA 9.x Firewall Benchmark v1.1.0 - Level 1, Level 2 
• CIS Cisco Firewall v8.x Benchmark v4.2.0 - Level 1 
• CIS Cisco IOS XE 16.x Benchmark v2.1.0 - Level 1, Level 2 
• CIS Cisco IOS XE 17.x Benchmark v2.1.1 - Level 1, Level 2 
• CIS Cisco IOS XR 7.x v1.0.0 - Level 1, Level 2 
• CIS Cisco NX-OS Benchmark v1.1.0 - Level 1, Level 2 
• CIS Fortigate 7.0.x Benchmark v1.3.0 - Level 1, Level 2 
• CIS Juniper OS Benchmark v2.1.0 - Level 1, Level 2 
• CIS Palo Alto Firewall 10 Benchmark v1.2.0 - Level 1, Level 2 
• CIS Palo Alto Firewall 11 Benchmark v1.1.0 - Level 1, Level 2 

These CIS Benchmarks align with the intent of the CISA hardening guidance. The example below highlights the CIS Cisco IOS XE 17.x v2.1.1 CIS Benchmark, and how it relates to the CISA hardening guidance:

Section 1.1 - Authentication, Authorization and Accounting (AAA) configuration

• Strengthening visibility as AAA logging supports user account login monitoring, and tracking changes
• Hardening systems and devices by providing identity management and policy enforcement

Section 1.2 - Access Rules for device administration

• Hardening systems and devices by restricting device management, and ensuring sessions are limited

Section 1.3 - Banner Rules to communicate legal rights to users

• Strengthening visibility by informing users they are subject to monitoring, and the event logs can support prosecution

Section 1.4 - Password Rules to enforce secure credentials and password lifecycle

• Hardening systems and devices by ensuring strong passwords are utilized, and passwords are securely stored

Section 1.5 - SNMP Rules provides guidance for secure configuration parameters

• Hardening systems and devices by ensuring SNMP is disabled, or is configured with secure parameters

Section 2.1 - Global Service Rules to reduce attack surface and disable unnecessary services

• Hardening systems and devices by disabling unnecessary, unused, exploitable, or plaintext services and protocols

Section 2.2 - Logging Rules configures log collection and forwarding

• Strengthening visibility by collecting event logs, and forwarding to a central log collection source
• Hardening systems and devices by forwarding logs to a central log collection source

Section 2.3 - NTP Rules ensures system time is provided by a single, consistent source

• Strengthening visibility by ensuring a consistent time source for event logs
• Hardening systems and devices by requiring that NTP is authenticated

Section 2.4 - Lookback Rules for configuring device initiated connections to supporting services such as AAA, SYSLOG, or NTP

• Hardening systems and devices by ensuring that traffic is initiated from a specific source, which can be used to set ACLs/filtering

Section 3.1 - Routing Rules to disable unneeded services

• Hardening systems and devices by disabling unneeded services such as source routing

Section 3.2 - Border Router Filtering defines filtering between internal and external networks

• Hardening systems and devices by implementing a strategy to control inbound and egress traffic

Section 3.3 - Neighbor Authentication configures routing protocol authentication

• Hardening systems and devices by requiring routing protocols are authenticated

Learn more

• Tenable Nessus
• Tenable Security Center
• Tenable Vulnerability Management
• Tenable Research audits
• Who is CIS?
• "Enhanced Visibility and Hardening Guidance for Communications Infrastructure" joint publication from various U.S. and international government agencies

The post New CISA Hardening Guidance Provides Valuable Insights for Network Security Engineers appeared first on Security Boulevard.

Researchers in Europe unveil a vulnerability dubbed "BadRAM" that hackers can easily exploit using $10 hardware to bypass protections in AMD's Eypc server processors used in cloud environments and expose sensitive data stored in memory.

The post AMD Chip VM Memory Protections Broken by BadRAM appeared first on Security Boulevard.

This blog explores ten essential web design security practices every developer and business should adopt to stay ahead of potential attacks.

The post Top 10 Web Design Security Best Practices to Follow in 2025 appeared first on Security Boulevard.

Understanding the nuances between cybersecurity products and platforms is crucial for enhancing business protections and supporting businesses anywhere.

The post Cybersecurity Products or Platforms – Which is More Effective? appeared first on Security Boulevard.