Security Boulevard

via the cosmic humor & dry-as-the-desert wit of Randall Munroe, creator of XKCD

Permalink

The post Randall Munroe’s XKCD ‘Renormalization’ appeared first on Security Boulevard.

Microsegmentation has become a foundational component of enterprise security and a Zero Trust Architecture (ZTA). As threats continue to grow in complexity, the ability to contain and limit the spread of an attack inside the network is critical. Traditional perimeter-focused security … Read More

The post The Role of Microsegmentation in Managing Lateral Movement Through Inbound and Outbound Traffic Policies  appeared first on 12Port.

The post The Role of Microsegmentation in Managing Lateral Movement Through Inbound and Outbound Traffic Policies  appeared first on Security Boulevard.

This second annual study offers a deeper look at how organizations are using AI to detect and respond to attacks faster, where it’s making the biggest impact, and what’s holding adoption back.

The post The State of AI in Cybersecurity 2025: What’s Working, What’s Lagging, and Why It Matters Now More Than Ever appeared first on Security Boulevard.

Learn about the differences between security scanning and runtime protection in application security testing. Explore tools and tech.

The post Application Security Testing: Security Scanning and Runtime Protection Tools appeared first on Security Boulevard.

Author/Presenter: Cybelle Olivera, Mauro Eldritch

Our sincere appreciation to BSidesLV, and the Presenters/Authors for publishing their erudite Security BSidesLV24 content. Originating from the conference’s events located at the Tuscany Suites & Casino; and via the organizations YouTube channel.

Permalink

The post BSidesLV24 – GroundFloor – The B-Side That No One Sees: The Ransomware That Never Reached Mainstream Popularity appeared first on Security Boulevard.

Continuing on API client security, we cover more sandbox bypasses, this time in Bruno and Hoppscotch, as well as JavaScript sandboxing best practices.

The post Scripting Outside the Box: API Client Security Risks (2/2) appeared first on Security Boulevard.

Discover the comprehensive roadmap for B2B SaaS companies to achieve enterprise readiness. Learn essential infrastructure requirements, compliance frameworks, enterprise features, and go-to-market strategies from a serial founder who scaled through product-led growth.

The post The Enterprise Readiness Playbook: Transform Your B2B SaaS from Startup to Enterprise-Grade appeared first on Security Boulevard.

By Kevin Hanes, CEO of Reveal Security A few weeks ago, I shared a thought that sparked a lot of discussion: SaaS is not a black box we can ignore. It’s a rich, dynamic attack surface – and one that attackers are increasingly targeting. That urgency was echoed powerfully in JPMorgan CISO Patrick Opet’s open letter to SaaS vendors. That letter stuck with me. It was direct, overdue, and – perhaps most importantly – public. So I want to return to this topic, because we’re still not talking about it enough. And we need to. SaaS Is the New Enterprise Perimeter We’ve long known our software supply chains carry risk. But something has shifted. SaaS apps – from email to collaboration platforms to CRM tools – have become deeply embedded in enterprise workflows. They’re where your customers are served, where your data lives, where your employees and contractors operate every day. That also makes them fertile ground for adversaries. We’ve seen this in many high-profile breaches: where the damage happened not on the network but in a third-party SaaS app. These are scenarios where the attacker has credentials — maybe stolen, maybe exploited — and proceeds to move laterally, conduct recon, and then manipulate workflows or exfiltrate data. The threat is real and it’s growing. We’ve seen reports in the last couple of weeks on this pattern described as an ‘insider threat’. Among these are the North Korean IT workers hacks into U.S. companies using stolen identities and the attack against Coinbase, in which threat actors recruited and bribed support agents to steal customer data from the company’s customer support systems. No One Gets to Hide Behind the Shared Responsibility Model Anymore Patrick Opet emphasized the need for a shift in how we approach SaaS security: “Software providers must prioritize security over rushing features. Comprehensive security should be built in or enabled by default.” “We must modernize security architecture to optimize SaaS integration and minimize risk.” This hits a nerve. The shared responsibility model — especially in SaaS — has too often become a shield vendors use to deflect accountability. But the reality is: shared responsibility can’t mean shared blindness. Let me be clear: it’s not just about the provider. It’s about how we as defenders secure access and then monitor what happens after authentication. SaaS providers rarely give you the telemetry to know when something unusual is happening inside your tenant. Traditional SIEM and endpoint tools don’t cut it here. And many organizations have no visibility at all into how identities are behaving across their ecosystem (dare I say “network”?) of SaaS applications. That’s exactly the blind spot attackers are counting on. So What Do We Do About It? We start by acknowledging the risk. SaaS isn’t “someone else’s problem.” It’s part of your infrastructure — and it deserves the same rigor as anything behind your firewall. Mandiant also stresses the importance of this in a recent investigations report noting the rise of adversaries targeting SaaS applications: “SaaS applications pose an interesting dilemma for organizations as there is a gray area of where and who should conduct monitoring to identify issues. For the applications where proprietary or guarded information exists, Mandiant recommends that an organization ensures they have a robust logging capability that their security teams can review for signs of malicious intent.” Second, we push for better from our vendors. I applaud Pat’s leadership in doing that. It takes courage to challenge an ecosystem that’s historically under-incentivized to prioritize enterprise-grade security. Finally, we invest in visibility, detection and response capabilities purpose-built for SaaS. That’s what we’re doing at Reveal Security: helping enterprises detect abnormal and malicious identity behavior inside and across cloud and SaaS applications — not through static rules or anomaly scores, but by understanding the typical behavior of each identity and flagging deviations that matter. We do this for all workforce identities — human, non-human, AI, or bot. Because let’s face it: adversaries don’t care about the shared responsibility model. They care about taking what’s yours. And if you don’t know what’s happening inside your apps, they already have the upper hand. Let’s keep this conversation going — openly, urgently, and with the shared understanding that cloud and SaaS security is enterprise security. The more we treat it that way, the better prepared we’ll be. – Kevin

The post Let’s Talk About SaaS Risk – Again… This Time, Louder. appeared first on RevealSecurity.

The post Let’s Talk About SaaS Risk – Again… This Time, Louder. appeared first on Security Boulevard.

Discover how SPICE, WIMSE, and SCITT are redefining workload identity, digital trust, and software supply chain integrity in modern machine-first environments.

The post Standards for a Machine‑First Future: SPICE, WIMSE, and SCITT appeared first on Security Boulevard.

Security tools have mastered detection – but visibility without action still leaves you exposed. Exposure management platforms promise to bridge the gap between alerts and real risk reduction. But not all platforms deliver. Use this guide to ask the 10 questions that separate real exposure remediation from just another dashboard. CTEM Stage 1 – Visibility […]

The post 10 Questions to Ask Before Investing in an Exposure Management Platform appeared first on VERITI.

The post 10 Questions to Ask Before Investing in an Exposure Management Platform appeared first on Security Boulevard.

It started like any other Monday morning. Coffee cups steamed beside keyboards, servers hummed gently in climate-controlled rooms, and email inboxes pinged with weekend catch-up. But within minutes, that ordinary...

The post Ransomware Simulation Playbook- Build Real-World Cyber Resilience Without Paying the Price appeared first on Strobes Security.

The post Ransomware Simulation Playbook- Build Real-World Cyber Resilience Without Paying the Price appeared first on Security Boulevard.

Your Data, Your Responsibility: Securing Your Organization's Future in the Cloud
madhav
Tue, 05/20/2025 - 04:37

Cloud adoption has fundamentally changed the way businesses operate, offering scalability, agility, and cost efficiencies that were unimaginable just a decade ago. But with this shift comes a necessary conversation: the cloud can also introduce complex security risks without the right care and practices in place.

Think sensitive and regulated data, intellectual property (IP), or code for your next winning product. When it comes to the future of your organization, business leaders must ask themselves:

• How are we making sure our critical data and IP are completely protected in the cloud?
• Who has access to the keys and protocols which are designed to protect our sensitive information?
• Are we consistently managing and securing keys across different cloud environments?
• Are we simply taking a “good enough” approach to cloud security without considering real risks?

If these are not questions that are already being discussed with teams, they need to be.

The Complexity of Multi-Cloud Security

The Thales 2025 Data Threat Report highlights that entities must rethink their approach to data security due to structural and geopolitical changes. In the AI era, the data businesses collect, store, process and share takes center stage. Although data breach rates fell to 45% in 2025 from 56% in 2021, cloud and application security continue to be the greatest security concerns for security leaders.

Cyberattacks are also becoming more sophisticated and tenacious. According to the Thales 2024 Cloud Security Study, 44% of organizations reported experiencing a cloud data breach, with 14% encountering such incidents within the past year. Among these breaches, 31% were attributed to misconfiguration or human error. Organizations that are not taking proactive steps will realize it’s only a matter of time before they become part of that statistic.

Who is Really Responsible for Cloud Security?

Too many business leaders assume that cloud security is their Cloud Service Provider’s (CSP’s) total responsibility, which is a dangerous misconception. In reality, the CSP and the customer share responsibility – or as Google put it, they share fate.

This is called the Shared Responsibility Model, and it defines clear boundaries:

• Cloud providers are responsible for securing the infrastructure—the physical data centers, networks, and hardware.
• The customer is responsible for securing their data, applications, and user access.

This means that although cloud-native security protocols, like encryption, help to protect the provider’s infrastructure, it does not necessarily protect the customer. If their data is compromised, it is they—not the cloud provider—who will fall foul of regulators and face the financial, legal, and reputational consequences.

Businesses need to ask themselves who in their organization is ensuring that the security strategy aligns with these realities.

The Security Challenges of Hybrid IT

Today’s IT environments are a mix of on-premises, hybrid, and multi-cloud services, creating previously unimagined levels of complexity. Security teams, finding themselves on the back foot, are being forced to bolt on security point products as an afterthought or look towards cloud-native security controls— that could mean relinquishing direct control over their access security.

Leveraging multiple clouds results in a fragmented approach that leads to siloed security solutions that are difficult to manage, gaping holes in protection across different platforms, and soaring costs and inefficiencies due to a lack of integration.

The truth is that as cloud environments only continue to grow, IT teams will continue to battle to manage multiple disconnected security tools. This is not a scalable approach—so entities need to consider what they are doing to consolidate and strengthen security across all cloud environments.

Cloud Security Risks: Are You Leaving the Door Open?

Many firms trust cloud-native controls, like encryption, to protect their data but do not consider where the encryption keys are stored. If they are managed within the same cloud ecosystem, this could put the business at risk. This is why:

• Single Point of Failure – If bad actors breach cloud tenant, they could get their hands on the business’s data, and the encryption keys to keep it safe.
• Regulatory Gaps – Compliance frameworks like GDPR, DORA, and PCI-DSS now require stricter key control. Data sovereignty requirements also mandate control over key management. Businesses must establish whether depending on a CSP meets these evolving regulations.
• Separation of Duties – After all, encryption can only be as secure as its key management process, so companies must understand who actually controls their encryption keys.

The 2025 Thales report indicates that there has been some good progress in protecting sensitive data:

• 68% of organizations report that they encrypt 40% or more of their sensitive cloud data.
• 57% of organizations use MFA to protect access to cloud assets, with 40% of them using phishing resistant methods like biometrics and passkeys.

However, there’s still room for improvement. The question businesses need to ask themselves is, what is their appetite for being at risk?

Are You Protecting the Lifeblood of Your Business?

A company’s intellectual property, business models, and proprietary data set it apart from the competition. But in a cloud-driven world, many organizations fail to consider how well they are truly protecting their value.

Firms should ask themselves:

• Are we in control of our competitive edge in the cloud?
• Could third parties gain access to our sensitive business data?
• What happens if our trade secrets are leaked or misused?

Breaches do not just impact data—they impact business reputation, revenue, and future success. In competitive markets, a single data breach can result in crippling fines, negative publicity, and lost customers. According to a global study by IBM the average cost of a data breach has risen to $4.88 million—a very sobering statistic.

Organizations invest fortunes in R&D and innovation and should think about whether it is worth risking losing it all due to poor cloud security.

The Potential Security Gaps in Cloud Provider Protections

Various cloud models require different security approaches—for instance, IaaS environments require security controls that won’t always translate well to SaaS deployments. One CSP’s security capabilities won’t necessarily apply to a different cloud vendor’s environment, and unfortunately, hybrid and multi-cloud environments create many more security gaps than companies realize.

When security is implemented in a siloed, reactive fashion, the result is inefficiencies and inconsistencies, high management overheads, uncontrollable costs, security blind spots, and loss of control. Organizations need to ensure that cloud security isn’t being implemented in a disjointed, piecemeal way.

Cloud Security Must Be Proactive, Not Reactive

According to the Thales 2025 Data Threat Report, 64% of organizations cite cloud security as their most pressing concern, since both SaaS data and cloud storage remain top attack targets. Losing sensitive data is the number one security concern for entities moving to the cloud. Data Loss Prevention (DLP) and encryption are top security controls, but how encryption keys are managed is of utmost importance.

Businesses need to establish who controls their encryption keys, where they are stored, and, importantly, can they retrieve them if needed—or are they locked in by a cloud provider?

The Thales DTR report echoes that sentiment; secrets management emerged as the top security challenge for DevSecOps engineers. According to Gartner, by 2027, more than 60% of organizations will adopt a centralized multicloud Key Management as a Service (KMaaS) to integrate with native CSP key management due to increased impacts of international data residency and privacy requirements.

Are You Asking the Right Questions?

Cloud security is not just an IT problem—it’s a business risk that impacts the entire organization. Businesses need to ask their teams:

• What are we doing to protect our most valuable data and IP in the cloud?
• How can I improve my security across all clouds while complementing cloud-native security?
• What is the best approach to deploying encryption and key management?
• Who actually controls our encryption keys?
• How are we ensuring compliance with evolving regulations?

The businesses that proactively address these questions will not only protect their data but also secure their competitive advantage for years to come. The question, is are you one of them?

Next steps

• Learn how to leverage the cloud without giving up control
• Discover best practices for cloud data protection and key management
• Explore Thales cloud security solutions
• Speak to a Thales cloud security expert

Brian Robertson | Principal Product Marketing Manager
More About This Author > basic

The post Your Data, Your Responsibility: Securing Your Organization’s Future in the Cloud appeared first on Security Boulevard.

Understanding the Realm of Non-Human Identities in Cloud Security Is your organization fully prepared to confront the new wave of cloud security challenges? If your answer is uncertain or negative, have you considered transforming your cybersecurity strategy to include Non-Human Identities (NHIs) and secrets management? Imagine the NHIs as ‘tourists’ traveling, with ‘passports’ being their […]

The post Adapting to New Security Challenges in the Cloud appeared first on Entro.

The post Adapting to New Security Challenges in the Cloud appeared first on Security Boulevard.

Feeling Overwhelmed By the Complexity of Cybersecurity? Are you one of the many professionals struggling to stay ahead of increasingly complex and evolving cybersecurity threats? If so, you’re not alone. The task of securing data and applications, particularly in the realm of the cloud, becomes more of a daunting task with each passing day. However, […]

The post Feeling Relieved with Solid Secrets Management appeared first on Entro.

The post Feeling Relieved with Solid Secrets Management appeared first on Security Boulevard.

Why is Identity Theft Prevention a Vital Component of Good Security? Have you ever considered the potential cost of a security breach and the resulting identity theft? According to the Federal Trade Commission (FTC), identity theft affected 4.8 million people in 2020, resulting in a financial loss of a staggering $56 billion. This striking statistic […]

The post Getting Better at Preventing Identity Theft appeared first on Entro.

The post Getting Better at Preventing Identity Theft appeared first on Security Boulevard.

Does your Organization Struggle with Compliance? If so, you’re not alone. Compliance with cybersecurity regulations often involves navigating a complex web of rules, many of which are constantly changing. This can be a burdensome task for any organization, particularly those operating. But what if there was a way to alleviate this burden? Enter the field […]

The post Relaxing the Burden of Compliance with Automation appeared first on Entro.

The post Relaxing the Burden of Compliance with Automation appeared first on Security Boulevard.

Learn the 10 most overlooked SaaS security risks, including shadow tenants, unmanaged identities, and risky OAuth scopes, and how to detect and reduce them.

The post 10 SaaS Security Risks Most Organizations Miss | Grip appeared first on Security Boulevard.

by Source Defense Don’t Trust Your Online Revenue Channel to Sub-par Solutions for eSkimming Security (Beware the big box “me too” solutions) As PCI DSS 4.0.1 enforcement has driven demand for eSkimming security and compliance controls (also known as client-side protection), several big-box CDN and “swiss army knife” security vendors have rushed to capitalize –

The post Revenue Risk Hidden in Fly by Night New eSkimming Tools appeared first on Source Defense.

The post Revenue Risk Hidden in Fly by Night New eSkimming Tools appeared first on Security Boulevard.

Customers using Application Detection and Response (ADR) technology blocked a remarkable number of attacks over the past month. For the second time since we began writing this monthly report, we’ve seen a massive escalation of attacks against a small number of applications, and all of the attacks were blocked. 

The post ADR Blocks Spike in Cyber Attacks and Sharp Rise in Path Traversal Attacks | April Attack Data | Contrast Security appeared first on Security Boulevard.

via the inimitable Daniel Stori at Turnoff.US!

Permalink

The post Randall Munroe’s XKCD ‘Modern’ appeared first on Security Boulevard.