Google cybersecurity researchers confirm that the Iranian-sponsored APT42 threat group is being ongoing phishing campaigns against President Biden, Vice President Harris, and ex-President Trump in an attempt to influence the upcoming presidential elections.
The post Google: Iranian Group APT42 Behind Trump, Biden Hack Attempts appeared first on Security Boulevard.
A couple of weeks ago, Balbix was recognized as a Representative Vendor in the newly created Exposure Assessment Platforms (EAPs) category in the Gartner® Hype Cycle™ reports for Security Operations and Managing Operational Technology, 2024. In the report, Gartner mentioned that deploying “the EAP platform has high benefits, with 20-50% market penetration expected within 2-5 …
The post Balbix Recognized in Three 2024 Gartner® Hype Cycle™ Reports appeared first on Security Boulevard.
The recent Federal Communications Commission (FCC) settlement with TracFone Wireless, Inc. (TracFone) for $16 million highlights a critical vulnerability within the mobile telecommunications industry: API security. The investigation revealed unauthorized access to customer data through weaknesses in TracFone's mobile carrier APIs. This incident reminds mobile carriers to prioritize robust API security measures to safeguard customer data and ensure network integrity.
Mobile Carrier APIs: Essential Tools with Potential RisksMobile networks rely heavily on APIs to connect with partners, enable customer self-service features, and integrate with third-party applications. While these APIs offer valuable functionalities, they also introduce security risks. Here's a deeper dive into the factors contributing to API vulnerabilities within the mobile landscape:
A data breach involving mobile APIs can cascade, impacting the carrier and its customers. Here's a breakdown of the potential consequences:
Salt Security offers a comprehensive API security platform explicitly designed to address the unique challenges mobile carriers face. Our solution leverages advanced AI and machine learning to identify and prevent real-time API attacks. Here's how Salt Security empowers mobile carriers to fortify their networks:
The TracFone case illustrates the critical need for robust API security in the mobile telecommunications industry. By implementing a comprehensive API security solution like Salt Security, Tracfone would have been protected from and notified of the attacks that lead to PII exposure and unauthorized access to their APIs. In today's digital age, prioritizing API security is not just an option but a strategic imperative for mobile carriers.
If you would like to learn more about Salt and how we can help you on your API Security journey through discovery, posture management, and run-time threat protection, please contact us, schedule a demo, or check out our website.
The post TracFone Breach Underscores Critical Need for Mobile Carrier API Security appeared first on Security Boulevard.
Did you know that 75% of people are already using Generative AI (GenAI) at work? GenAI tools are defined as any artificial intelligence that can generate content such as text, images, videos, code, and other data using generative models, often in response to prompts. Examples include Open AI’s ChatGPT, GitHub’s Copilot, Claude, Dall-E, Gemini, and […]
The post Your Employees are Already Using GenAI. How Will You Communicate the Security Risks? appeared first on CybeReady.
The post Your Employees are Already Using GenAI. How Will You Communicate the Security Risks? appeared first on Security Boulevard.
Data breaches and privacy concerns are all too common today. That’s why the Australian Health Records and Information Privacy Act 2002 (HRIPA) is highly relevant. This legislation ensures that your privacy is rigorously protected when you share your medical history or undergo a procedure. HRIPA mandates strict protocols for healthcare providers, requiring them to handle […]
The post The Key Components of HRIPA Compliance appeared first on Centraleyes.
The post The Key Components of HRIPA Compliance appeared first on Security Boulevard.
The team at CyberSaint is thrilled to announce the latest additions and updates made to the CyberStrong solution. These latest updates will focus on reporting and remediation. To start off, we’ve made it easier to customize reporting with our latest changes to remediation reports. Additionally, we’ve implemented revisions to the RoSI calculations for enhanced risk analysis and introduced custom risk values and presets.
The post August Product Update appeared first on Security Boulevard.
Security is enhanced with the introduction of dynamic zero-trust security, a method that continuously assesses the security posture of devices and users on the network.
The post Beyond Zero-Trust: The Impact of Adaptive Micro-Segmentation on Network Security appeared first on Security Boulevard.
Currently accessing the free legacy DNS Blocklists (DNSBLs) via the Public Mirrors, and using GoDaddy's network? You'll need to make some minor changes to your email infrastructure. The changes are simple to implement, but if you fail to do so, you could find that at some point post-September 26th 2024, all or none of your email is blocked!
The post If you query the legacy DNSBLs via GoDaddy move to Spamhaus Technology’s free Data Query Service appeared first on Security Boulevard.
Stewart and Trey join us to talk about driving cybersecurity policies for the nation, what makes a good policy, what makes a bad policy, supply chain research and policies, and overall how we shape policies that benefit cybersecurity. Show Notes
The post BTS #36 - Supply Chain Policies - Stewart Scott, Trey Herr appeared first on Eclypsium | Supply Chain Security for the Modern Enterprise.
The post BTS #36 – Supply Chain Policies – Stewart Scott, Trey Herr appeared first on Security Boulevard.
The search landscape is undergoing a seismic shift. Traditional search engines are being challenged by AI-powered platforms like Perplexity and SearchGPT. This new era promises more personalized, intuitive, and efficient information retrieval. Are you ready for the future of search?
The post The Future of Search: AI-Powered Transformation appeared first on Security Boulevard.
Authors/Presenters:uhong Nan, Sun Yat-sen University; Xueqiang Wang, University of Central Florida; Luyi Xing and Xiaojing Liao, Indiana University Bloomington; Ruoyu Wu and Jianliang Wu, Purdue University; Yifan Zhang and XiaoFeng Wang, Indiana University Bloomington
Many thanks to USENIX for publishing their outstanding USENIX Security ’23 Presenter’s content, and the organizations strong commitment to Open Access. Originating from the conference’s events situated at the Anaheim Marriott; and via the organizations YouTube channel.
The post USENIX Security ’23 – Are You Spying on Me? Large-Scale Analysis on IoT Data Exposure through Companion Apps appeared first on Security Boulevard.
The post 8 Must-Ask Questions for AI Security Vendors appeared first on AI-enhanced Security Automation.
The post 8 Must-Ask Questions for AI Security Vendors appeared first on Security Boulevard.
Analyst firms play an important role in the tech vendor landscape. Their reports help buyers and would-be buyers learn about vendors and their offerings. In cybersecurity, in particular, buyers use analysts’ outputs to build shortlists prior to thee kick-offs of their individual deep dive evaluations — in some categories of tools, the field is simply […]
The post Five Gartner Reports. Four Categories. What Does OX Security Do Anyway? appeared first on OX Security.
The post Five Gartner Reports. Four Categories. What Does OX Security Do Anyway? appeared first on Security Boulevard.
See These CVEs: Patch Tuesday—ten zero-days, seven Critical vulns, zero time to waste.
The post August Patch Pileup: Microsoft’s Zero-Day Doozy Dump appeared first on Security Boulevard.
Your home or small office (SOHO router) is likely being targeted by cybercriminals, malware, and nation-state actors alike. Though this targeting often has nothing to do with wanting to spy on you, your SOHO router can be a valuable resource for threat actors looking to conceal their malicious traffic and activity.
Unfortunately, targeting of SOHO routers is growing primarily due a multifaceted problem - which includes vendors selling routers with poor security and many users not understanding the importance of updating their devices.
TABLE OF CONTENTS
Malware, cybercriminals, and state-backed threat actors target SOHO routers. They've done so increasingly over the last few years.
To backtrack a little , it's important to understand that a lot of threat actors target routers - which can include modems and gateways - alongside internet-of-things (IoT devices). Here I will focus on "routers" as general term, as this can include gateways (which are router/modem combinations and extremely popular for home/small offices users).
For simplicity's sake, I'll also focus on malware, cybercriminals, and state-backed threat actors. (Yes, state-backed APTs or hackers have and do target SOHO routers in pursuing their own goals.)
To be fair, malware, botnets and cybercriminals often go together; botnets are often used by cybercriminals to carry out their goals, whether that is overloading servers to keep a service offline or launching distributed credential stuffing attacks. However, botnets regularly use malware like Mirai variants - which are considered a self-replicating worm - to "automatically" launch attacks and recruit devices into the botnet, so it felt important enough to make the distinction.
The poor state of SOHO router securityBefore diving into why threat actors find "regular" consumer routers interesting enough to bother "hacking" them, it's important to understand the security landscape of the SOHO router market. Admittedly, this topic itself could be an entire post (or website - check out routersecurity.org, but put simply - it's not good.
Without even considering the technical ability of the end user, SOHO routers are routinely plagued with issues - top of the list are security vulnerabilities. While it is not reasonable or feasible to expect firmware and software to be completely free of security issues, perhaps in the modern age some shouldn't be as prevalent as they are (ex: failing to sanitize input or straight up broken security controls). There are many reasons security vulnerabilities can crop up in SOHO routers, but I am willing to bet many are due to lack of security-oriented review and/or just insecure design.
Security vulnerabilities in router firmware is too large of a topic to cover in just a section of this post. Fortunately, there are many examples where consumer routers had some pretty nasty vulnerabilities I can point you to:
The problem has not gone unnoticed by agencies in the US - and some other government agencies from other governments.
In light of the nation-state actor Volt Typhoon exploiting security vulnerabilities in SOHO routers (there's more information on that later in this post), the US Cybersecurity and Infrastructure Security Agency (CISA) has urged vendors to incorporate "Secure by Design" principles into their firmware/software. The Federal Communications Commission (FCC) has proposed the "US Cyber Trust Mark" for smart devices - though it could (and should) include SOHO routers.
Misconfigurations, poor updating practices, and use of EOL devicesThis section primarily pertains to end user behavior, which when combined with router manufacturer blunders, makes quite the interesting (and compounded) issue.
While misconfigurations can certainly be default values, users may misconfigure their routers by enabling or disabling features. For example, some SOHO routers may support remote management. Some users may enable this despite not truly needing it while not understanding the risk of exposing the administrator login panel of their router to the public internet.
In fact, even CISA has described the risks of exposing administrative interfaces of devices like routers to the public internet. While their guidance is directed towards more sophisticated organizations, the basics do apply here.
Many people do not know or understand that router firmware should be updated regularly, as updated firmware can include security fixes for vulnerabilities. As such, millions of SOHO routers either do not have the most recent updates installed or updates are installed after a considerable amount of time has passed - enough time for possible exploitation by attackers. As I've noted in other posts, this is important as the time between vulnerability disclosure and exploitation attempts continues to shorten.
Automatic updates can fix this, but the availability of automatic updates (and whether they are even enabled by default) depends on manufacturer, model, and submodel. Of course, users should realize (automatically) updating is not without slight risk of introducing new bugs or inconveniences, but it's certainly better than the alternative in most situations - on the receiving end of n-day vulnerability exploitation.
Just like with any other device, router models eventually become "old" or "legacy" after a number of years. Eventually, manufacturer support - including updates for the firmware - for some models ceases, reaching end of life (EOL). Since devices may not be "broken" or "dead" when the EOL period arrives, many people fail to replace their devices. As such, vulnerabilities discovered in these EOL models often do not get updates, leaving them open for exploitation by attackers:
The post Your SOHO Router is a Juicy Target for Hackers appeared first on Security Boulevard.
This article provides a comprehensive overview of threat intelligence services, highlighting the importance, methodology, benefits, etc.
The post What is Threat Intelligence? appeared first on Security Boulevard.
via the respected Software Engineering expertise of Mikkel Noe-Nygaard and the lauded Software Engineering / Enterprise Agile Coaching work of Luxshan Ratnaravi at Comic Agilé!
The post Comic Agilé – Mikkel Noe-Nygaard, Luxshan Ratnaravi – #303 — The Scrum Master To-Do List appeared first on Security Boulevard.
Software bill of materials (SBOMs) are essential elements for managing software security and compliance, especially in light of increasing open source risks.
The post How to audit SBOMs for enhanced software security appeared first on Security Boulevard.
As businesses enhance their risk management techniques, the importance of efficient audit procedures and robust internal controls cannot be overstated. Audit procedures are used by audit teams to identify and assess risks. Auditors can also recommend mitigation, such as a control effectiveness deficiency that could impact an organization’s operations and financial health. But how do...
The post How Audit Procedures and Internal Controls Improve Your Compliance Posture appeared first on Hyperproof.
The post How Audit Procedures and Internal Controls Improve Your Compliance Posture appeared first on Security Boulevard.
As we move through 2024, three events are causing significant disruption in the Public Key Infrastructure (PKI) landscape – the Entrust CA distrust incident, Google’s proposal for 90-day TLS certificate validity, and post-quantum cryptography (PQC) standardization. These events come with unique challenges and opportunities and are compelling organizations to rethink their approach to PKI and […]
The post Top Trends in 2024 Reshaping the PKI Landscape appeared first on Security Boulevard.
