Security Boulevard

Why is Secrets Rotation Crucial for Cloud Security? Are you familiar with the concept of secrets rotation? Does it sound like an unfamiliar cybersecurity jargon that goes over your head? Or do you already know and understand its implications but are unsure about its connection with cloud security? Either way, this post will clarify the […]

The post Safe Secrets Rotation: A Must for Modern Clouds appeared first on Entro.

The post Safe Secrets Rotation: A Must for Modern Clouds appeared first on Security Boulevard.

Is Your Organization Paying Enough Attention to Non-Human Identities? Organizations extensively utilize cloud services and automated systems. In doing so, they inevitably fragment their digital presence into countless Non-Human Identities (NHIs). NHIs, essentially machine identities, are created by combining an encrypted password, token, or key—called a “Secret”—and the permissions granted by a destination server. As […]

The post Unlocking Innovation with Protected Machine Identities appeared first on Entro.

The post Unlocking Innovation with Protected Machine Identities appeared first on Security Boulevard.

Stop stealthy Layer 7 DDoS attacks in 2025 that bypass CDNs. With DataDome’s AI-powered, edge-based protection, you can ensure uninterrupted operations---blocking threats in real time.

The post How to Stop Layer 7 DDoS Attacks in 2025 appeared first on Security Boulevard.

Your IT department can be a valuable ally in overcoming inevitable resistance to change Modern and effective corporate security teams operate in a complex digital environment. You access and connect data from social media, court records, weather, cameras, access logs, and much more — all to keep your people and assets safe. But despite the…

The post 6 Ways IT Can Help You Modernize Case Management Software appeared first on Ontic.

The post 6 Ways IT Can Help You Modernize Case Management Software appeared first on Security Boulevard.

TL;DR

• Insurance companies host large amounts of sensitive data (PII, PHI, etc.) and often have complex environments due to M&A and divestitures
• Most breaches start with human error
• Fortune 500 companies rely on Microsoft Active Directory as a backbone for Identity and Access Management
• Attackers target Active Directory to move laterally and escalate privilege
• An Attack Path Management solution can proactively find and remove attack paths

Insurance companies collect sensitive data — think medical history or credit card information — to fully understand the value of what they’re insuring and the risk they’re taking on. The same risk then applies to the protection and storage of sensitive data.

In the hands of a bad actor, it’s a treasure trove for data brokerage on the dark web.

Compounding the problem is that insurance industries are embracing digital transformation, creating apps that collect data and giving every policyholder a login to access their information. As they should! Insurance companies need to stay agile with the latest technology to speed up internal business processes and increase customer satisfaction. But the hard truth is that 68% of data breaches start with someone either falling for a social engineering scheme or leaking data by mistake.

Keeping a bad actor at bay in Active Directory

Many organizations rely on Active Directory to manage user access to other important company systems and resources. Misconfigurations and technical debt within Active Directory combine over time to create attack paths. These attack paths can allow adversaries to move through the environment with ease and blend in with administrative behavior.

One of the most efficient ways to mitigate the risk of a breach is by proactively mapping and removing these attack paths. Insurance companies should focus on removing all attack paths to Tier 0 and other critical assets.

A good Attack Path Management solution will prioritize Tier Zero attack paths, provide detailed remediations and continuously monitor to protect against regression.

Why insurers carry unique digital risk

Insurance companies often rely on legacy technology, and over time technical debt piles up, slowing down the speed of business.

Additionally, mergers and acquisitions in the insurance industry increase the likelihood of adopting existing misconfigurations and generous privileges, while divestitures might leave a trail of digital backdoors after separating. The directory environment can become too entangled to sort out manually.

And as mentioned earlier, the insurance industry is prone to collecting and storing sensitive data that makes insurance companies an attractive target for bad actors.

Attack Path Management enhances your security posture

Adding an Attack Path Management solution to your security stack accomplishes two goals: visualizing your complex environment and the relationships between systems, devices and users and finding potential attack paths to remediate.

Over time, access permissions become difficult to track — contractors get temporary credentials, new applications require special permissions, and remote employees log in from personal devices. These small oversights changes can snowball into major security gaps.

Choosing a tool that continuously scans your environment for new devices, users and permissions/configurations puts your blue team back in the driver’s seat when it comes to vulnerability management. You can stop reacting to threats and start proactively shutting down attack paths.

BloodHound Enterprise removes risk at the root Example of a network of users and devices that shows the relationship to one another.

BloodHound Enterprise, the leading Attack Path Management solution, can help you quickly and effectively visualize, prioritize and remove attack paths without disrupting operations. You can remediate with confidence as BloodHound finds the most efficient choke points to sever thousands of attack paths, often with a single fix.

Other benefits of BloodHound Enterprise include:

• Network visuals to help better understand complex directory environments due to mergers and acquisitions and divestitures
• Measure your Identity risk and exposure in Active Directory, Entra ID and hybrid environments
• Eliminate years of technical debt
• Continuously audit for new Identity risk introduced into your environment

To learn more about BloodHound Enterprise and the problem of Identity-based attack paths click here. If you’re ready for a demo, reach out.

Insurance companies can reduce risk with Attack Path Management was originally published in Posts By SpecterOps Team Members on Medium, where people are continuing the conversation by highlighting and responding to this story.

The post Insurance companies can reduce risk with Attack Path Management appeared first on Security Boulevard.

Author/Presenter: Michael Brown

Our sincere appreciation to DEF CON, and the Authors/Presenters for publishing their erudite DEF CON 32 content. Originating from the conference’s events located at the Las Vegas Convention Center; and via the organizations YouTube channel.

Permalink

The post DEF CON 32 – The Wild And Wonderful World Of Early Microprocessors With A Focus On 6502 appeared first on Security Boulevard.

One of the most pivotal decisions an organization faces is whether to build an in-house Security Operations Center (SOC) or outsource security operations to a Managed Security Service Provider (MSSP). While the choice may seem straightforward at first glance, the long-term implications—on finances, operations, and risk management—are anything but simple. Like all things in life, […]

The post SOC vs MSSP: Which is Right for Your Business? appeared first on Centraleyes.

The post SOC vs MSSP: Which is Right for Your Business? appeared first on Security Boulevard.

T4 redefines ASM by ensuring only authorized workloads can utilize NHIs through robust isolation powered by mTLS and a “ring-fenced” authorization map. With T4, unauthorized workloads are stopped in their tracks, slashing the attack surface and mitigating risks before they become breaches. Focusing on ASM first delivers immediate, impactful reductions in risk—because with T4, attackers never get a foot in the door.

The post TrustFour’s OWASP 2025 NHI Top Ten Coverage appeared first on TrustFour: Workload and Non-Human Identity Attack Surface Security.

The post TrustFour’s OWASP 2025 NHI Top Ten Coverage appeared first on Security Boulevard.

via the comic humor & dry wit of Randall Munroe, creator of XKCD

Permalink

The post Randall Munroe’s XKCD ‘Chemical Formulas’ appeared first on Security Boulevard.

A zero-day vulnerability in SonicWall’s Secure Mobile Access (SMA) 1000 was reportedly exploited in the wild according to researchers.

Update January 23: The Analysis and Identifying affected systems sections have been updated to include confirmation of exploitation from SonicWall and how to identify assets using Tenable Attack Surface Management.

View Change Log

Background

On January 22, SonicWall published a security advisory (SNWLID-2025-0002) for a newly disclosed vulnerability in its Secure Mobile Access (SMA) 1000 product, a remote access solution.

CVE Description CVSSv3 CVE-2025-23006 SonicWall SMA 1000 Deserialization of Untrusted Data Vulnerability 9.8 Analysis

CVE-2025-23006 is a deserialization of untrusted data vulnerability in the appliance management console (AMC) and central management console (CMC) of the SonicWall SMA 1000. An unauthenticated, remote attacker could exploit this vulnerability by sending a specially crafted request to a vulnerable device. Successful exploitation would grant the attacker arbitrary command execution on the device. The advisory specifies that “specific conditions” could allow for OS command execution, though it’s unclear from the information provided by SonicWall what those conditions might be.

Possible active exploitation in the wild

According to SonicWall’s Product Security Incident Response Team (PSIRT), there are reports of “possible active exploitation” of this flaw “by threat actors.” While specific details are not known at this time, the vulnerability was reported to SonicWall by researchers at Microsoft Threat Intelligence Center (MSTIC).

In a knowledge base article, SonicWall explicitly said that CVE-2025-23006 "has been confirmed as being actively exploited in the wild" and that the vulnerability should "be treated with the utmost severity."

Historical exploitation of SonicWall SMA vulnerabilities

SonicWall products have been a frequent target for attackers over the years. Specifically, the SMA product line has been targeted in the past by ransomware groups, as well as being featured in the Top Routinely Exploited Vulnerabilities list co-authored by multiple United States and International Agencies. The following are a list of known SMA vulnerabilities that have been exploited in the wild:

CVE Description Tenable Blog Links Year CVE-2019-7481 SonicWall SMA100 SQL Injection Vulnerability 1 2019 CVE-2019-7483 SonicWall SMA100 Directory Traversal Vulnerability - 2019 CVE-2021-20016 SonicWall SSLVPN SMA100 SQL Injection Vulnerability 1, 2, 3, 4, 5 2021 CVE-2021-20038 SonicWall SMA100 Stack-based Buffer Overflow Vulnerability 1, 2, 3 2021 Proof of concept

At the time this blog was published, no proof-of-concept (PoC) code had been published for CVE-2025-23006. If and when a public PoC exploit becomes available for CVE-2025-23006, we anticipate a variety of attackers will attempt to leverage this flaw as part of their attacks.

Solution

SonicWall has released version 12.4.3-02854 to address this vulnerability, which impacts version 12.4.3-02804 and earlier. According to SonicWall, SMA 100 series and SonicWall Firewall devices are not impacted.

The advisory also provides a workaround to reduce potential impact. This involves restricting access to the AMC and CMC to trusted sources. The advisory also notes to review the best practices guide on securing SonicWall appliances.

Identifying affected systems

A list of Tenable plugins for this vulnerability can be found on the individual CVE page for CVE-2025-23006 as they’re released. This link will display all available plugins for this vulnerability, including upcoming plugins in our Plugins Pipeline.

Tenable Attack Surface Management customers are able to identify these assets using a filtered search for SMA devices:

 

Get more information

• SonicWall SNWLID-2025-0002 Security Advisory
• Product Notice: Urgent Security Notification - SMA 1000 (CVE-2025-23006)

Change Log

Update January 23: The Analysis and Identifying affected systems sections have been updated to include confirmation of exploitation from SonicWall and how to identify assets using Tenable Attack Surface Management.

Join Tenable's Security Response Team on the Tenable Community.
Learn more about Tenable One, the Exposure Management Platform for the modern attack surface.

The post CVE-2025-23006: SonicWall Secure Mobile Access (SMA) 1000 Zero-Day Reportedly Exploited appeared first on Security Boulevard.

Articles related to cyber risk quantification, cyber risk management, and cyber resilience.

The post An Overview​​ of Cyber Risk Modeling | Kovrr appeared first on Security Boulevard.

Learn to bypass EDR detection using NtContinue for hardware breakpoints without triggering ETW Threat Intelligence. This technical blog explores kernel debugging, debug registers, and EDR evasion with code examples.

The post ETW Threat Intelligence and Hardware Breakpoints appeared first on Praetorian.

The post ETW Threat Intelligence and Hardware Breakpoints appeared first on Security Boulevard.

Author/Presenter: Kevin Mitchell

Our sincere appreciation to DEF CON, and the Authors/Presenters for publishing their erudite DEF CON 32 content. Originating from the conference’s events located at the Las Vegas Convention Center; and via the organizations YouTube channel.

Permalink

The post DEF CON 32 – Bluetooth Blues: Unmasking CVE 2023-52709 – The TI BLE5-Stack Attack appeared first on Security Boulevard.

Secrets buried in container registries pose a silent risk. Learn about their hidden vulnerabilities and what steps you can take to safeguard your infrastructure.

The post Protecting the Backbone of Modern Development: Scanning Secrets in Container Registries appeared first on Security Boulevard.

The modern enterprise is fluid, dynamic and distributed. The old network perimeter is gone. And threat actors bypass corporate defenses with ease—often simply using stolen or cracked credentials. This is the world that Zero Trust was designed for. A cybersecurity approach with a history dating back over a decade, it’s now finding favor among global organizations thanks to US government mandates. At its heart, it’s about protecting critical systems, and the data flowing through, them from compromise.

The post The Future of Data Security is Zero Trust: Here’s Why appeared first on Security Boulevard.

In the past year, 68% of data breaches involved the human element, according to Verizon.

From disgruntled employees committing sabotage to innocent mistakes, humans are one of your organization's greatest information security risks. In fact, a shocking amount of high-profile data breaches in recent years have occurred because of employee behaviors. 

While it's crucial for information security pros to understand human vulnerabilities, the root cause of data breaches isn't always as simple as human action. In many cases, a combination of technical, policy, and human failures can contribute to an incident with data loss.

The post 9 Internal Data Breach Examples to Learn From appeared first on Security Boulevard.

The new SonarQube Server LTA release is as value-packed as ever. Look forward to high-impact AI capabilities, more secure code at every angle, supercharged developer productivity, and even better enterprise and operational capabilities. As always, there's something for everyone with the LTA!

The post SonarQube Server 2025.1 LTA Release Announcement appeared first on Security Boulevard.

Last month, Henry Farrell and I convened the Third Interdisciplinary Workshop on Reimagining Democracy (IWORD 2024) at Johns Hopkins University’s Bloomberg Center in Washington DC. This is a small, invitational workshop on the future of democracy. As with the previous two workshops, the goal was to bring together a diverse set of political scientists, law professors, philosophers, AI researchers and other industry practitioners, political activists, and creative types (including science fiction writers) to discuss how democracy might be reimagined in the current century...

The post Third Interdisciplinary Workshop on Reimagining Democracy (IWORD 2024) appeared first on Security Boulevard.

An increase in compliance activities such as the creation of software bills of materials (SBOMs), performing software composition analysis (SCA) scans on code repositories, and securing the attack surface created by artificial intelligence (AI) applications are among the key software security trends highlighted in the latest edition of the Building Security in Maturity Model (BSIMM) report.

The post BSIMM15 highlights compliance and AI security: Why modern tooling is key appeared first on Security Boulevard.

Fall was a busy conference season for Tidal Cyber. My colleagues and I participated in events including Black Hat, FutureCon, Health-ISAC, FS-ISAC, ATT&CKCon, and numerous regional Cybersecurity Summits. As we spoke with attendees, one of the big takeaways was that organizations are trying to understand their risk associated with using AI. Rick Gordon and I had the opportunity to dig into this in more detail at the ACSC 2024 Annual Member Conference. The theme was “Developing AI Governance and Security Practice”, and several discussions focused on how organizations can assess the risk versus the reward of bringing AI into their organization as a business tool. 

The post Operationalizing MITRE ATLAS to Defend Against Attacks on AI appeared first on Security Boulevard.