Aggregator

本篇是云原生安全系列的开篇

Cyware has added Compromised Credential Management to the Cyware Intel Packaged Solution, a pre-configured threat intelligence program-in-a-box that enables security teams to operationalize threat intelligence faster by eliminating complex integrations and configurations. Built on Cyware Intel Exchange and pre-bundled with Team Cymru premium threat feeds, the packaged solution provides instant, out-of-the-box capabilities, allowing security teams to skip months of setup and focus immediately on detecting and responding to advanced cyber threats. This launch adds Compromised … More →

The post Cyware strengthens threat intelligence management appeared first on Help Net Security.

In cybersecurity, the three main types of indicators are a critical concept for threat detection and response. These main types are indicators of compromise, behavior, and attack (IOCs, IOBs, IOAs). Let’s elaborate on their essence, difference, and use.   Distinction in a Nutshell  Indicators of Compromise  IOCs are pieces of evidence that suggest that a system, […]

The post How Indicators of Compromise, Attack, and Behavior Help Spot and Stop Cyber Threats appeared first on ANY.RUN's Cybersecurity Blog.

CISA has added one new vulnerability to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation.

• CVE-2021-20035 SonicWall SMA100 Appliances OS Command Injection Vulnerability

These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise.

Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities established the Known Exploited Vulnerabilities Catalog as a living list of known Common Vulnerabilities and Exposures (CVEs) that carry significant risk to the federal enterprise. BOD 22-01 requires Federal Civilian Executive Branch (FCEB) agencies to remediate identified vulnerabilities by the due date to protect FCEB networks against active threats. See the BOD 22-01 Fact Sheet for more information.

Although BOD 22-01 only applies to FCEB agencies, CISA strongly urges all organizations to reduce their exposure to cyberattacks by prioritizing timely remediation of Catalog vulnerabilities as part of their vulnerability management practice. CISA will continue to add vulnerabilities to the catalog that meet the specified criteria.

CISA is aware of public reporting regarding potential unauthorized access to a legacy Oracle cloud environment. While the scope and impact remains unconfirmed, the nature of the reported activity presents potential risk to organizations and individuals, particularly where credential material may be exposed, reused across separate, unaffiliated systems, or embedded (i.e., hardcoded into scripts, applications, infrastructure templates, or automation tools). When credential material is embedded, it is difficult to discover and can enable long-term unauthorized access if exposed.

The compromise of credential material, including usernames, emails, passwords, authentication tokens, and encryption keys, can pose significant risk to enterprise environments. Threat actors routinely harvest and weaponize such credentials to: 

• Escalate privileges and move laterally within networks.
• Access cloud and identity management systems.
• Conduct phishing, credential-based, or business email compromise (BEC) campaigns.  
• Resell or exchange access to stolen credentials on criminal marketplaces.
• Enrich stolen data with prior breach information for resale and/or targeted intrusion. 

CISA recommends the following actions to reduce the risks associated with potential credential compromise: 

• For Organizations:
  • Reset passwords for any known affected users across enterprise services, particularly where local credentials may not be federated through enterprise identity solutions.  
  • Review source code, infrastructure-as-code templates, automation scripts, and configuration files for hardcoded or embedded credentials and replace them with secure authentication methods supported by centralized secret management.
  • Monitor authentication logs for anomalous activity, especially involving privileged, service, or federated identity accounts, and assess whether additional credentials (such as API keys and shared accounts) may be associated with any known impacted identities.
  • Enforce phishing-resistant multi-factor authentication (MFA) for all user and administrator accounts wherever technically feasible.
  • For additional information for or on Cloud security best practices please review the following Cybersecurity Information Sheets: CISA and NSA Release Cybersecurity Information Sheets on Cloud Security Best Practices.
• For Users:
  • Immediately update any potentially affected passwords that may have been reused across other platforms or services.
  • Use strong, unique passwords for each account and enable phishing-resistant multifactor authentication (MFA) on services and applications that support it. For more information on using strong passwords, see CISA’s Use Strong Passwords web page. For more information on phishing-resistant MFA see CISA’s Implementing Phishing-Resistant MFA Fact Sheet.
  • Remain alert against phishing attempts (e.g., referencing login issues, password resets, or suspicious activity notifications) and reference Phishing Guidance: Stopping the Attack Cycle at Phase One.

Organizations should report incidents and anomalous activity to CISA’s 24/7 Operations Center at [email protected] or (888) 282-0870.  

 Disclaimer:  

The information in this report is being provided “as is” for informational purposes only. CISA does not endorse any commercial entity, product, company, or service, including any entities, products, or services linked within this document. Any reference to specific commercial entities, products, processes, or services by service mark, trademark, manufacturer, or otherwise, does not constitute or imply endorsement, recommendation, or favoring by CISA. 

The future of the Common Vulnerabilities and Exposures (CVE) program hangs in the balance: MITRE, the not-for-profit US organization that runs it, could lose the US federal funding that helps them maintain it. But others have been waiting in the wings and are getting ready to pick up the vulnerability tracking mantle. “On Wednesday, April 16, 2025, the current contracting pathway for MITRE to develop, operate, and modernize CVE and several other related programs, such … More →

The post Funding uncertainty may spell the end of MITRE’s CVE program appeared first on Help Net Security.