CISO Strategy
Okta is blaming the recent hack of its support system on an employee who logged into a personal Google account on a company-managed laptop.
Hi, what are you looking for?
SecurityWeek
Cloud Security
A total of 22 patches were releaased, a majority for code execution, privilege escalation, and information disclosure vulnerabilities.
Cloud Security
A threat actor is claiming the exfiltration of millions of records from McDonald’s, TCS, Vodafone, and other large organizations.
Artificial Intelligence
Build your strategy around answering these questions to ensure employees use AI productively while keeping sensitive data, IP, and agent behavior within the boundaries...
Cloud Security
Named CosmosEscape, the vulnerability exposed the primary key for Cosmos DB accounts, granting full read and write access.
Cloud Security
In response to a spate of embarrassing hacks, Redmond pushes ‘Secure Future Initiative’ promising faster cloud patches, better management of identity signing keys and...
Cloud Security
Palo Alto Networks has entered into a definitive agreement to acquire Dig Security, a provider of Data Security Posture Management (DSPM) technology.
Cloud Security
A threat actor is reportedly harvesting IAM credentials from public GitHub repositories within five minutes of exposure.
Cloud Security
Proofpoint removes a formidable competitor from the crowded email security market and adds technology to address risk from misdirected emails.
Cloud Security
Researchers document the Wiki-Slack attack, a new technique that uses modified Wikipedia pages to target end users on Slack.
Cloud Security
Amazon is rolling out an independent cloud for Europe as it looks to address strict regulations that companies and those in the public sector...
Application Security
Michigan startup raises $75 million in new funding as venture capital investors bet big on attack surface management technologies.
Cloud Security
VMware described the bug as an out-of-bounds write issue in its implementation of the DCE/RPC protocol. CVSS severity score of 9.8/10.
Cloud Security
Since 2020, Island has raised a total of $325 million to help protect corporate data flowing through SaaS and internal web applications.
Cloud Security
Cisco warns that unauthenticated, remote attackers can log into devices using root account, which has default, static credentials that cannot be changed or deleted.
Cloud Security
GitHub beefs up its secret scanning feature, now allowing users to check the validity of exposed credentials for major cloud services.
Cloud Security
The widely believed notion that the network and the cloud are two different and distinct entities is not true.
Cloud Security
AWS says an internal threat intel decoy system called MadPot has successfully trapped nation state-backed APTs like Volt Typhoon and Sandworm.
Cloud Security
Sysdig enhanced its existing CNAPP offering with a cloud attack graph, risk prioritization, attack path analysis, a searchable inventory, and complete agentless scanning.
Cloud Security
Israeli security startup Gem Security has raised a total of $34 million to tackle cloud threat detection and incident response.
Cloud Security
Intel announces general availability of attestation service that is part of Trust Authority, a new portfolio of security software and services.
Application Security
The cash-and-stock transaction provides capabilities for CrowdStrike to beef up its enterprise cloud security portfolio.
Artificial Intelligence
Exposed data includes backup of employees workstations, secrets, private keys, passwords, and over 30,000 internal Microsoft Teams messages.
Cloud Security
A high-severity vulnerability can be exploited to execute code remotely on any Windows endpoint within a Kubernetes cluster.
Join as speakers examine the various components of ASM strategy, the push to mandate continuous asset visibility and inventory tools, and the use of red-teaming, bug bounties and pen-tests in modern security programs.
RegisterIn this live webinar, learn how to define your minimum viable business, identify the systems it depends on, measure actual recovery time against business requirements, and present the gaps to the board as measurable risk.
RegisterExpert Insights
For twenty-five years, "data" in security meant logs and events. But logs are a lossy representation of reality.
(Danelle Au)
Organizations must distinguish identity verification, authentication and threat detection, or risk successfully authenticating the attackers they are trying to stop.
(Torsten George)
Silent patches can become exploit intelligence for attackers while leaving defenders without the context needed to prioritize risk.
(Tod Beardsley)
The skills that get a CISO hired are rarely the skills they are judged on later. Most security leaders are stuck in that gap. Closing it is the real job.
(Sravish Sridhar)
As AI dramatically shortens the time from vulnerability disclosure to exploitation, enterprises must look beyond patching to reduce application risk.
(Joshua Goldfarb)