SYMMETRY CUSTOMER CASE STUDY Leading Fintech Accelerates PCI DSS 4.0 Compliance with Symmetry Systems ABOUT Industry:Fintech Size:1K – 3K employees...
The post Leading Fintech Accelerates PCI DSS 4.0 Compliance with Symmetry Systems appeared first on Symmetry Systems.
The post Leading Fintech Accelerates PCI DSS 4.0 Compliance with Symmetry Systems appeared first on Security Boulevard.
Microsoft addresses 157 CVEs in the first Patch Tuesday release of 2025 and the largest Patch Tuesday update ever with three CVEs exploited in the wild, and five CVEs publicly disclosed prior to patches being made available.
Microsoft patched 157 CVEs in its January 2025 Patch Tuesday release, with 10 rated critical and 147 rated as important. Our counts omitted two vulnerabilities, one reported by GitHub and another reported by CERT/CC. To date, the January 2025 Patch Tuesday release is the largest ever from Microsoft.
This month’s update includes patches for:
Remote code execution (RCE) vulnerabilities accounted for 36.9% of the vulnerabilities patched this month, followed by elevation of privilege (EoP) vulnerabilities at 25.5%.
Important CVE-2025-21333, CVE-2025-21334, CVE-2025-21335 | Windows Hyper-V NT Kernel Integration VSP Elevation of Privilege VulnerabilitiesCVE-2025-21333, CVE-2025-21334 and CVE-2025-21335 are EoP vulnerabilities in the Windows Hyper-V NT Kernel Integration Virtualization Service Provider (VSP). All three vulnerabilities were assigned a CVSSv3 score of 7.8 and rated important. An authenticated, local attacker could exploit this vulnerability to elevate privileges to SYSTEM. Two of the three vulnerabilities were unattributed, with CVE-2025-21333 being attributed to an Anonymous researcher.
According to Microsoft all three vulnerabilities were exploited in the wild as zero-days. No specific details about the in-the-wild exploitation were public at the time this blog post was released.
Important CVE-2025-21186, CVE-2025-21366, CVE-2025-21395 | Microsoft Access Remote Code Execution VulnerabilityCVE-2025-21186, CVE-2025-21366 and CVE-2025-21395 are RCE vulnerabilities in Microsoft Access, a database management system. All three vulnerabilities were assigned a CVSSv3 score of 7.8 and rated important. A remote, unauthenticated attacker could exploit this vulnerability by convincing a target through social engineering to download and open a malicious file. Successful exploitation would grant an attacker arbitrary code execution privileges on the vulnerable system. This update “blocks potentially malicious extensions from being sent in an email.”
According to Microsoft, these three vulnerabilities were publicly disclosed prior to a patch being available (zero-days). They are attributed to Unpatched.ai, which uses artificial intelligence (AI) to “help find and analyze” vulnerabilities.
Important CVE-2025-21308 | Windows Themes Spoofing VulnerabilityCVE-2025-21308 is a spoofing vulnerability affecting Windows Themes. This vulnerability received a CVSSv3 score of 6.5 and was publicly disclosed prior to a patch being made available. According to Microsoft, successful exploitation requires an attacker to convince a user to load a malicious file, then convince the user to “manipulate the specially crafted file.” Microsoft has provided a list of mitigations including disabling New Technology LAN Manager (NTLM) or using group policy to block NTLM hashes. For more information on the mitigation guidance, please refer to the Microsoft advisory.
Important CVE-2025-21275 | Windows App Package Installer Elevation of Privilege VulnerabilityCVE-2025-21275 is an EoP vulnerability in the Microsoft Windows App Package Installer. It was assigned a CVSSv3 score of 7.8 and is rated important. A local, authenticated attacker could exploit this vulnerability to obtain SYSTEM privileges. These types of flaws are often associated with post-compromise activity, after an attacker has breached a system through other means.
According to Microsoft, this vulnerability was publicly disclosed prior to a patch being available. It is attributed to an Anonymous researcher.
Critical CVE-2025-21297, CVE-2025-21309 | Windows Remote Desktop Services Remote Code Execution VulnerabilityCVE-2025-21297 and CVE-2025-21309 are critical RCE vulnerabilities affecting Windows Remote Desktop Services. Both of these vulnerabilities were assigned CVSSv3 scores of 8.1, however CVE-2025-21309 was assessed as “Exploitation More Likely” according to Microsoft’s Exploitability Index, while CVE-2025-21297 was assessed as “Exploitation Less Likely.”
According to Microsoft, successful exploitation of these flaws requires an attacker to connect to a system with the Remote Desktop Gateway role and trigger a race-condition that creates a use-after-free scenario which can be leveraged to execute arbitrary code.
Critical CVE-2025-21298 | Windows OLE Remote Code Execution VulnerabilityCVE-2025-21298 is a RCE vulnerability in Microsoft Windows Object Linking and Embedding (OLE). It was assigned a CVSSv3 score of 9.8 and is rated critical. It has been assessed as “Exploitation More Likely.” An attacker could exploit this vulnerability by sending a specially crafted email to a target. Successful exploitation would lead to remote code execution on the target system if the target opens this email using a vulnerable version of Microsoft Outlook or if their software is able to preview the email through a preview pane.
Microsoft’s advisory for this vulnerability recommends configuring Microsoft Outlook to read email messages “in plain text format” instead of a rich format that will display other types of content, such as photos, animations or specialized fonts. To configure Outlook in this way, please refer to the following article, Read email messages in plain text.
Tenable SolutionsA list of all the plugins released for Microsoft’s January 2025 Patch Tuesday update can be found here. As always, we recommend patching systems as soon as possible and regularly scanning your environment to identify those systems yet to be patched.
For more specific guidance on best practices for vulnerability assessments, please refer to our blog post on How to Perform Efficient Vulnerability Assessments with Tenable.
Get more informationJoin Tenable's Security Response Team on the Tenable Community.
Learn more about Tenable One, the Exposure Management Platform for the modern attack surface.
The post Microsoft’s January 2025 Patch Tuesday Addresses 157 CVEs (CVE-2025-21333, CVE-2025-21334, CVE-2025-21335) appeared first on Security Boulevard.
As we stand on the threshold of 2025, the cybersecurity landscape is undergoing a dramatic transformation, largely driven by artificial intelligence and emerging threat vectors. Drawing from Nuspire’s recent cybersecurity outlook webinar, let’s explore the key trends and challenges that organizations will face in the coming year. Looking Back to Move Forward Before diving into 2025 predictions, it’s worth noting ... Read More
The post The AI Revolution: Navigating Cybersecurity Challenges in 2025 appeared first on Nuspire.
The post The AI Revolution: Navigating Cybersecurity Challenges in 2025 appeared first on Security Boulevard.
via the comic humor & dry wit of Randall Munroe, creator of XKCD
The post Randall Munroe’s XKCD ‘Trimix’ appeared first on Security Boulevard.
The post Sanitizing Unstructured Data In Motion—and Why It’s Important appeared first on Votiro.
The post Sanitizing Unstructured Data In Motion—and Why It’s Important appeared first on Security Boulevard.
Around the year 1900, an author (Rudyard Kipling) wrote a poem called “The Elephant’s Child.” In it, he writes: “I keep six honest serving men They taught me all I knew Their names are What and Why and When And How and Where and Who.” Little did Kipling know that these six friends would someday […]
The post Six Friends Every Security Team Needs appeared first on Security Boulevard.
Microsoft is suing 10 unknown people involved in a sophisticated scheme to exploit users credentials to access the vendor's Azure OpenAI AI services, bypass security guardrails, and post harmful images using its cloud systems.
The post Microsoft Sues Group for Creating Tools to Bypass Azure AI Security appeared first on Security Boulevard.
Commvault today added an ability to automatically recover the instances of Microsoft Active Directory (AD) that have become primary targets of cybersecurity attacks.
The post Commvault Adds Ability to Recover Entire Instances of Active Directory appeared first on Security Boulevard.
In this episode, host Peter dives into the challenges of the tech job market in 2023 and 2024 and introduces us to Julia, a dynamic writer and content strategist with a fascinating background in computational cognitive neuroscience. Julia shares insights on: The art of connecting products and services with customers in meaningful ways. A unique […]
The post Reemployment Project: Meet Julia High appeared first on Security Boulevard.
CISA in two years has seen the number of critical infrastructure organizations signing up for its CPG services double, which has improved the overall security in most sectors, but more needs to be done to strengthen what has become a target adversarial state-sponsored threat groups.
The post Critical Infrastructure Seeing Benefits of Government Program, CISA Says appeared first on Security Boulevard.
Explore key trends in the BSIMM15 report, such as securing AI and the software supply chain, plus recommendations for enhancing your software security program.
The post BSIMM15: New focus on securing AI and the software supply chain appeared first on Blog.
The post BSIMM15: New focus on securing AI and the software supply chain appeared first on Security Boulevard.
On January 7, we published a press release to share our five predictions for cybersecurity in 2025. Over the next few weeks, we’ll publish a blog series that provides additional commentary on each prediction. This is the second blog in the series. Check out the first and second blogs here. Prediction Key Takeaways: We […]
The post 2025 Prediction 3: Digital Security Will Expand Beyond Privacy Concerns To Include Holistic, Integrated Cyber and Physical Protection appeared first on BlackCloak | Protect Your Digital Life™.
The post 2025 Prediction 3: Digital Security Will Expand Beyond Privacy Concerns To Include Holistic, Integrated Cyber and Physical Protection appeared first on Security Boulevard.
Nisos
The Insider Threat Digital Recruitment Marketplace
Nisos routinely monitors mainstream and alternative social media platforms, as well as cloud-based messaging applications and dark web forums...
The post The Insider Threat Digital Recruitment Marketplace appeared first on Nisos by Nisos
The post The Insider Threat Digital Recruitment Marketplace appeared first on Security Boulevard.
In this article, we touch on the trends and predictions that in the year 2025 and beyond will fashion cloud security.
The post Future-Proofing Cloud Security: Trends and Predictions for 2025 and Beyond appeared first on Security Boulevard.
Fifteen Best Practices to Navigate the Data Sovereignty Waters
josh.pearson@t…
Tue, 01/14/2025 - 08:04
Data sovereignty—the idea that data is subject to the laws and regulations of the country it is collected or stored in—is a fundamental consideration for businesses attempting to balance harnessing the power of data analytics, ensuring compliance with increasingly stringent regulations, and protecting the privacy of their users.
At Thales, we believe that data sovereignty doesn’t obstruct innovation; it enables it. With the right tools and expertise, businesses can navigate the murky waters of data sovereignty, taking advantage of data’s huge potential while securely processing and storing data wherever it is. So, to help you along the way, here are our 15 best practices for navigating the data sovereignty water.
Regulation and compliance Compliance Encryption Thales | Cloud Protection & Licensing Solutions
More About This Author >
Data sovereignty—the idea that data is subject to the laws and regulations of the country it is collected or stored in—is a fundamental consideration for businesses attempting to balance harnessing the power of data analytics, ensuring compliance with increasingly stringent regulations, and protecting the privacy of their users.
At Thales, we believe that data sovereignty doesn’t obstruct innovation; it enables it. With the right tools and expertise, businesses can navigate the murky waters of data sovereignty, taking advantage of data’s huge potential while securely processing and storing data wherever it is. So, to help you along the way, here are our 15 best practices for navigating the data sovereignty water.
360-degree Data Protection MechanismNavigating data sovereignty requires comprehensive data security and resilience, which 360-degree data protection mechanisms provide. A 360-degree data protection mechanism is a holistic approach to data security encompassing all data management aspects. It ensures that data is protected throughout its lifecycle, from creation to deletion, across all environments—on-premises, cloud, hybrid, and multi-cloud.
Automation in Security ManagementOrganizations often use multiple cloud environments to meet data sovereignty requirements. This approach provides geographic flexibility, helping to ensure compliance with local regulations in various regions. Similarly, some jurisdictions may require a different cloud environment from others.
However, achieving scalability and adequate security across multiple cloud services can take time and effort. The more cloud environments an organization has, the more work a security team must do to secure them. By automating security tasks and processes, organizations allow security teams to secure multiple cloud environments while minimizing manual effort.
Data Classification
Data classification and governance ensure compliance with data sovereignty by categorizing data based on sensitivity and applying appropriate security measures. They enforce localized data storage, automated compliance, and consistent security controls, facilitate auditing and regulatory reporting, and manage cross-border data transfers to adhere to local and international laws.
Transparency and Control Over DataTransparency and control over data are crucial for data sovereignty as they ensure organizations can track, manage, and secure data in compliance with local laws. This visibility helps maintain regulatory compliance, enforce data localization policies, and swiftly address security issues, safeguarding sensitive information within jurisdictional boundaries.
Understand the Nature of Data in Cloud MigrationAs noted, to meet data sovereignty requirements, organizations will often have to set up cloud data centers in multiple jurisdictions and, as such, carry out cloud migration. Understanding the nature of data in cloud migration is crucial for successful cloud migration and handling of sensitive information. It ensures appropriate security measures, compliance with regulatory requirements, and effective data management strategies, preventing data breaches and maintaining data integrity during the transition to the cloud environment.
Robust Data Management and GovernanceRobust data management and governance are critical parts of any data protection legislation. To implement robust data management and governance, organizations should establish clear policies and procedures for data classification, access control, and lifecycle management, use automated tools for monitoring, auditing, and enforcing compliance, and regularly update policies to reflect regulatory changes and ensure consistent data protection across all systems and environments.
Robust Encryption Strategies and Pseudonymization
Robust encryption strategies and pseudonymization are crucial for protecting sensitive data and meeting data sovereignty requirements. Encryption ensures data is securely stored and transmitted, safeguarding it from unauthorized access or breaches. Pseudonymization further anonymizes data, reducing the risk of identification if data is compromised. These measures protect sensitive information and help organizations comply with data residency laws by ensuring data is stored and processed within required geographic boundaries.
Effective Key Management to Map Data SensitivityHowever, poor key management can render even the most robust encryption algorithms ineffective. Effective key management is foundational to data sovereignty: while cryptographic algorithms are public, the associated keys must remain secret. Critical management practices such as classification, key assignment, access controls, rotation and revocation, and auditing and monitoring ensure that sensitive data is protected according to its level of sensitivity.
Crypto Agility and Quantum-Resistant Algorithms AwarenessCrypto agility and awareness of quantum-resistant algorithms are crucial for preparing organizations for future technological shifts and ensuring long-term data security.
Crypto agility enables organizations to adopt and integrate new cryptographic standards and algorithms as they evolve. This flexibility ensures that data remains protected against emerging threats and vulnerabilities.
With quantum computing advancements threatening current encryption methods, awareness and adoption of quantum-resistant algorithms are essential. These algorithms are designed to withstand attacks from quantum computers, safeguarding data integrity and confidentiality in the future.
Backup and Disaster Recovery StrategiesAll data protection regulations will require organizations to have backup and disaster recovery strategies to be resilient against security incidents such as ransomware attacks.
Zero Trust Network Access (ZTNA)ZTNA ensures that only necessary and authenticated individuals and machines can access a network, thus preventing unauthorized access and potential data breaches. Most jurisdictions require ZTNA in their data protection regulations.
Digital Identity and Access ManagementSimilarly, digital identity and access management (IAM) is crucial for data sovereignty and security, as it ensures that only authorized users access sensitive data. IAM, particularly in zero-trust models, verifies identities and enforces least privilege access, preventing unauthorized access across cloud environments, safeguarding data integrity, and compliance with regulatory requirements.
Regular Audits and Compliance ChecksRegular audits and compliance checks ensure the effectiveness of data protection and control strategies over time while confirming compliance with different jurisdictions’ data protection regulations.
Keep Abreast with Emerging TechnologiesTechnologies for cybersecurity defenders and attackers are evolving at an unprecedented speed. To keep up with data sovereignty, it’s crucial to be aware of developments on either side of the battle. By doing so, organizations can adapt to new challenges and ensure up-to-date security measures.
Data Residency Awareness in Different JurisdictionsMost importantly, it’s crucial to understand data protection laws in different jurisdictions. By practicing data residency awareness, organizations ensure they store and process data according to local laws, respect privacy rights, and prevent legal violations. This awareness helps organizations navigate complex regulatory landscapes and avoid penalties related to data sovereignty and privacy breaches.
Transforming data sovereignty from a risk to an opportunity
Implementing the above best practices using this checklist will help organizations navigate data sovereignty’s murky waters. New data protection regulations are coming thick and fast, particularly in the US, so there’s no better time to get on top of your data sovereignty requirements.
For more information on data sovereignty, how it will affect businesses, and how to thrive in the digital economy while upholding the highest standards of data security and privacy, check out the 2024 Thales Data Security Directions Council Report, Data Sovereignty: Who Owns Your Data and Can You Control It?
Schema {January 14, 2025
The post Fifteen Best Practices to Navigate the Data Sovereignty Waters appeared first on Security Boulevard.
CISOs must take advantage by making the most of their limited time with effective and informative messaging.
The post Conveying Your Security Needs to the Board in Six Minutes or Less appeared first on Security Boulevard.
Web-based attacks are becoming increasingly sophisticated, and payment parameter tampering stands out as a silent yet potent threat. This attack involves manipulating parameters exchanged between the client and server to alter sensitive application data, such as user credentials, permissions, product prices, or quantities. The data targeted in parameter tampering is typically stored in cookies, hidden […]
The post What is Payment Parameter Tampering And How to Prevent It? appeared first on Kratikal Blogs.
The post What is Payment Parameter Tampering And How to Prevent It? appeared first on Security Boulevard.
Discover how Grip complements SSPM tools by uncovering shadow SaaS, and addressing identity risks, providing comprehensive SaaS security for your organization.
The post Grip vs SSPM: What’s the Difference? | Grip Security appeared first on Security Boulevard.
Discover how Grip complements CASBs by reducing alert noise, uncovering shadow SaaS, and providing identity-based insights for comprehensive SaaS security.
The post Grip vs CASB: What’s the Difference? appeared first on Security Boulevard.
6 min readFrom dynamic workloads to API-driven systems, managing non-human identities requires a new approach to security at scale.
The post Why Scalability Matters in Non-Human Identity and Access Management appeared first on Aembit.
The post Why Scalability Matters in Non-Human Identity and Access Management appeared first on Security Boulevard.
