Application Security
Cloud security startup Aqua Security has partnered with the Center for Internet Security (CIS) to create guidelines for software supply chain security and followed...
Hi, what are you looking for?
SecurityWeek
Malware & Threats
Hackers pushed a poisoned arrayref version that added a dependency to fetch a malicious payload from a remote server.
Supply Chain Security
Over 95% of the affected companies were exposed before the malicious LiteLLM packages were published.
Supply Chain Security
LiteLLM was compromised through the Trivy hack and abused to distribute information-stealing malware to its users.
Application Security
The startup analyzes subtle telemetry signals to detect attacks that traditional security tools cannot see inside accelerator-powered AI infrastructure.
ICS/OT
OT:Icefall: 56 vulnerabilities plague OT devices from 10 different major industrial manufacturers
Cyberwarfare
Air raid sirens sounded in the Israeli cities of Jerusalem and Eilat on Sunday evening and it appears that they were triggered by a...
Compliance
Divergent goals often result in data protection laws that are fundamentally flawed
Cybercrime
Teachers unable to get paychecks. Tax and customs systems paralyzed. Health officials unable to access medical records or track the spread of COVID-19. A...
Application Security
Jit, an Israeli startup promising technology to help developers simplify security when deploying cloud apps, has banked an eye-opening $38.5 million in seed-stage funding.The...
Management & Strategy
The Coalition to Reduce Cyber Risk (CR2) announced this week that it has been joined by 37 organizations across eight countries in signing a...
Cybercrime
It doesn’t pay to pay. This advice on ransomware payment is often given, but rarely enumerated. Now it has been. A new study finds...
Cloud Security
Hundreds of companies are showcasing their products and services this week at the 2022 edition of the RSA Conference in San Francisco.
Cybersecurity Funding
Question: If we can mitigate file encryption ransomware with backup, can we mitigate double extortion by adding advanced PII protection through data encryption or tokenization?
Application Security
Ten Eleven Ventures has joined a growing list of cybersecurity-focused venture capital firms raising new funds to invest in startups solving information security problems.
Application Security
Venture capital powerhouse Sequoia is leading a massive $50 million early-stage investment in Chainguard, a startup created by a team of ex-Google software engineers...
Cyberwarfare
Microsoft says it has uncovered and disabled the OneDrive infrastructure of a Lebanon-based threat actor targeting organizations in Israel.
Cloud Security
Cloud security startup JupiterOne has raised $70 million in a new round of financing that values the company north of $1 billion.
Supply Chain Security
CISA's SBOM champion Allan Friedman and YL Ventures’ Andy Ellis joins JupiterOne’s CISO Sounil Yu dig deeper into the U.S. government's response to supply...
ICS/OT
Critical industries must prepare themselves for a new wave of ransomware attacks specifically targeting OT
Application Security
Boston, Mass.-based Tidelift, a company on a mission to address open source supply chain “health and security,” has raised $27 million in Series C...
Application Security
WhiteSource Changes Company Name to Mend
Malware & Threats
A popular Python package was compromised recently and replaced with a malicious version apparently designed to help the attacker obtain AWS credentials.
Supply Chain Security
Security researchers at SentinelLabs are calling attention to a software chain supply attack targeting Rust developers with malware aimed directly at infecting GitLab Continuous...
Join as speakers examine the various components of ASM strategy, the push to mandate continuous asset visibility and inventory tools, and the use of red-teaming, bug bounties and pen-tests in modern security programs.
RegisterIn this live webinar, learn how to define your minimum viable business, identify the systems it depends on, measure actual recovery time against business requirements, and present the gaps to the board as measurable risk.
RegisterExpert Insights
For twenty-five years, "data" in security meant logs and events. But logs are a lossy representation of reality.
(Danelle Au)
Organizations must distinguish identity verification, authentication and threat detection, or risk successfully authenticating the attackers they are trying to stop.
(Torsten George)
Silent patches can become exploit intelligence for attackers while leaving defenders without the context needed to prioritize risk.
(Tod Beardsley)
The skills that get a CISO hired are rarely the skills they are judged on later. Most security leaders are stuck in that gap. Closing it is the real job.
(Sravish Sridhar)
As AI dramatically shortens the time from vulnerability disclosure to exploitation, enterprises must look beyond patching to reduce application risk.
(Joshua Goldfarb)