Krebs on Security

MAY 10, 2022

Microsoft today released updates to fix at least 74 separate security problems in its Windows operating systems and related software. This month’s patch batch includes fixes for seven “critical” flaws, as well as a zero-day vulnerability that affects all supported versions of Windows. By all accounts, the most urgent bug Microsoft addressed this month is CVE-2022-26925 , a weakness in a central component of Windows security (the “ Local Security Authority ” process

Authentication 305

Authentication Ransomware Security IT 305

Dark Reading

MAY 11, 2022

Enterprises should consider online data brokers as part of their risk exposure analysis if they don't already do so.

Risk 113

Risk 113

Hanzo Learning Center

MAY 11, 2022

Some things that are great on their own turn out to be even better as half of a dynamic duo. We’re talking peanut butter and jelly. Burgers and fries. Hall and Oates. And now: data loss prevention (DLP) and ediscovery.

98

98

Data Breach Today

MAY 13, 2022

Areas of Proposed Investments Include SBOMs, Software Supply Chains The Linux Foundation and the Open Source Security Foundation have put forth a nearly $150 million investment plan, spread across two years, to strengthen open-source security in the U.S. The plan was announced at the Open Source Software Security Summit II in Washington, D.C., on Thursday.

Security 351

Security 351

Advertisement

Many software teams have migrated their testing and production workloads to the cloud, yet development environments often remain tied to outdated local setups, limiting efficiency and growth. This is where Coder comes in. In our 101 Coder webinar, you’ll explore how cloud-based development environments can unlock new levels of productivity. Discover how to transition from local setups to a secure, cloud-powered ecosystem with ease.

Cloud

Krebs on Security

MAY 12, 2022

The U.S. Drug Enforcement Administration (DEA) says it is investigating reports that hackers gained unauthorized access to an agency portal that taps into 16 different federal law enforcement databases. KrebsOnSecurity has learned the alleged compromise is tied to a cybercrime and online harassment community that routinely impersonates police and government officials to harvest personal information on their targets.

Authentication 289

Authentication Passwords Government Access 289

AIIM

MAY 12, 2022

Late last year, the Securities and Exchange Commission announced that J.P. Morgan Securities LLC had agreed to pay $125 million to help settle charges of “widespread and longstanding failures by the firm and its employees to maintain and preserve written communications” over the course of several years. On the same day, the Commodity Futures Trading Commission (“CFTC”) levied a $75 million fine against J.P.

Communications 118

Communications Information governance Compliance Government 118

Data Breach Today

MAY 7, 2022

2nd $5m reward for conviction of actual or potential Conti incident participants The U.S. State Department is offering rewards of up to $10 million for information that leads to the identification or location of members of any individual who holds a key leadership position in the Conti ransomware variant transnational organized crime group.

Ransomware 312

Ransomware 312

Krebs on Security

MAY 7, 2022

Apple , Google and Microsoft announced this week they will soon support an approach to authentication that avoids passwords altogether, and instead requires users to merely unlock their smartphones to sign in to websites or online services. Experts say the changes should help defeat many types of phishing attacks and ease the overall password burden on Internet users, but caution that a true passwordless future may still be years away for most websites.

Passwords 253

Passwords Authentication Phishing Cloud 253

eSecurity Planet

MAY 9, 2022

Burp is one of the top-rated security suites for pentesting and ethical hacking. While there are paid professional and enterprise editions, you can install the community edition for free and even use it directly from Kali Linux. The Burp suite is widely used by security professionals to perform advanced scans and various traffic interceptions (e.g., HTTP requests).

Education 131

Education Cybersecurity IT Security 131

Advertisement

Large enterprises face unique challenges in optimizing their Business Intelligence (BI) output due to the sheer scale and complexity of their operations. Unlike smaller organizations, where basic BI features and simple dashboards might suffice, enterprises must manage vast amounts of data from diverse sources. What are the top modern BI use cases for enterprise businesses to help you get a leg up on the competition?

Schneier on Security

MAY 11, 2022

Georgetown has a new report on the highly secretive bulk surveillance activities of ICE in the US: When you think about government surveillance in the United States, you likely think of the National Security Agency or the FBI. You might even think of a powerful police agency, such as the New York Police Department. But unless you or someone you love has been targeted for deportation, you probably don’t immediately think of Immigration and Customs Enforcement (ICE).

Government 130

Government Access IT Security 130

Data Breach Today

MAY 12, 2022

Russia Continues Its Cyber Offensive, Launches New DDoS Attacks on Ukraine Viasat's satellite communications suffered an outage an hour before the Russian invasion of Ukraine began on Feb. 24. The company said it was a cyberattack, but did not identify the attacker. The U.S., U.K., EU and Ukraine have now attributed this attack to Russia.

Communications 307

Communications IT 307

Dark Reading

MAY 9, 2022

Cybersecurity has to be a top priority as enterprises begin incorporating the use of nonfungible tokens into their business strategies, brand-awareness campaigns, and employee-communication efforts, experts say.

Communications 130

Communications Cybersecurity 130

Security Affairs

MAY 10, 2022

Microsoft Patch Tuesday security updates for May 2022 address three zero-day vulnerabilities, one of them actively exploited. Microsoft Patch Tuesday security updates for May 2022 addressed three zero-day vulnerabilities, one of which is under active attack. The IT giant fixed a total of 74 flaws in Microsoft Windows and Windows Components,NET and Visual Studio, Microsoft Edge (Chromium-based), Microsoft Exchange Server, Office and Office Components, Windows Hyper-V, Windows Authentication Metho

Authentication 137

Authentication Security Cybersecurity IT 137

Advertisement

After a year of sporadic hiring and uncertain investment areas, tech leaders are scrambling to figure out what’s next. This whitepaper reveals how tech leaders are hiring and investing for the future. Download today to learn more!

IT

eSecurity Planet

MAY 10, 2022

The average downtime cost businesses over $1 million per hour in 2021, which can quickly add up, considering the average downtime for ransomware attacks is 22 days. Unfortunately, many organizations don’t have business continuity solutions in place to help them avoid major spurts of downtime. Business continuity software can point out vulnerabilities in a company’s network, build plans, and keep the business running during a crisis.

Cloud 120

Cloud Risk Compliance Artificial Intelligence 120

Data Breach Today

MAY 9, 2022

New Microsoft Services Help Clients Hunt Threats and Extend XDR Beyond the Endpoint Microsoft plans to roll out new managed services that give organizations the expertise needed to proactively hunt for threats and extend XDR beyond the endpoint. Microsoft Security Experts features new managed services as well as existing services around incident response and modernization.

Security 303

Security 303

Data Matters

MAY 12, 2022

Antitrust and consumer protection law—long separate provinces, even within a dual-mission government enforcement agency like the FTC that covers both fields—at last seem to be converging, as reflected in recent government enforcement activity, statements by the FTC’s leadership, and novel private litigation theories. Sean Royall, who co-leads Sidley’s Antitrust and Consumer Protection practice and is a former Deputy Director of the FTC’s Bureau of Competition, recently called attention to this t

Privacy 105

Privacy Government 105

Hunton Privacy

MAY 10, 2022

On May 10, 2022, Connecticut Governor Ned Lamont signed An Act Concerning Personal Data Privacy and Online Monitoring , after the law was previously passed by the Connecticut General Assembly in April. Connecticut is now the fifth state to enact a consumer privacy law. Upon taking effect on July 1, 2023, the law, also known as the Connecticut Data Privacy Act (“CTDPA”), will apply to individuals and entities that (1) conduct business in Connecticut, or produce products or services that are targe

Privacy 118

Privacy Personal data Sales B2B 118

Speaker: Anindo Banerjea, CTO at Civio & Tony Karrer, CTO at Aggregage

When developing a Gen AI application, one of the most significant challenges is improving accuracy. This can be especially difficult when working with a large data corpus, and as the complexity of the task increases. The number of use cases/corner cases that the system is expected to handle essentially explodes. 💥 Anindo Banerjea is here to showcase his significant experience building AI/ML SaaS applications as he walks us through the current problems his company, Civio, is solving.

eSecurity Planet

MAY 12, 2022

User’s of F5’s BIG-IP application services could be vulnerable to a critical flaw that allows an unauthenticated attacker on the BIG-IP system to run arbitrary system commands, create or delete files, or disable services. The vulnerability is recorded as CVE-2022-1388 with a 9.8 severity rating, just below the highest possible rating of 10.

Insurance 119

Insurance Risk Access Passwords 119

Data Breach Today

MAY 10, 2022

Healthcare sector organizations should prepare to deal with potential hacktivist attacks tied to controversy surrounding the U.S. Supreme Court's leaked draft ruling and eventual final decision involving Roe vs. Wade, says attorney Erik Weinick of the law firm Otterbourg PC.

294

294

KnowBe4

MAY 13, 2022

A March 2022 report from the Senate Committee on Homeland Security and Governmental Affairs zeros in on the growing problem of ransomware and lessons learned so far.

Ransomware 126

Ransomware Security Phishing 126

Security Affairs

MAY 11, 2022

US Critical Infrastructure Security Agency (CISA) adds critical CVE-2022-1388 flaw in F5 BIG-IP products to its Known Exploited Vulnerabilities Catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added critical CVE-2022-1388 flaw in F5 BIG-IP products to its Known Exploited Vulnerabilities Catalog. According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities , FCEB agencies have to address the identified vulne

IT 129

IT Cybersecurity Access Security 129

Advertisement

Cloud Development Environments (CDEs) are changing how software teams work by moving development to the cloud. Our Cloud Development Environment Adoption Report gathers insights from 223 developers and business leaders, uncovering key trends in CDE adoption. With 66% of large organizations already using CDEs, these platforms are quickly becoming essential to modern development practices.

Cloud

eSecurity Planet

MAY 10, 2022

Hackers have found a way to infect Windows Event Logs with fileless malware , security researchers have found. Kaspersky researchers on May 4 revealed “a new stash for fileless malware.” During a “very targeted” campaign, hackers used Windows Event Logs to inject shellcode payloads and operate stealthily. This new approach is highly sophisticated yet could still become popular, as it seems quite efficient for injecting malicious DLL and evading detection.

Encryption 117

Encryption Libraries Communications Security 117

Data Breach Today

MAY 12, 2022

CyberArk Ventures Will Give Visibility Into Adjacent Markets and Offer Integrations CyberArk has unveiled a $30 million fund to back early-stage startups with unique approaches to solving large problems in the cybersecurity industry. CyberArk Ventures will offer the company broader visibility into adjacent markets and provide high-value integrations that can evolve over time.

Marketing 283

Marketing Cybersecurity 283

Threatpost

MAY 13, 2022

An account promoting the project—which offers a range of threat activity from info-stealing to crypto-mining to ransomware as individual modules—has more than 500 subscribers.

Mining 114

Mining Ransomware Security 114

Schneier on Security

MAY 9, 2022

Apple Mail now blocks email trackers by default. Most email newsletters you get include an invisible “image,” typically a single white pixel, with a unique file name. The server keeps track of every time this “image” is opened and by which IP address. This quirk of internet history means that marketers can track exactly when you open an email and your IP address, which can be used to roughly work out your location.

File names 115

File names Marketing IT Privacy 115

Speaker: Aindra Misra, Senior Manager, Product Management (Data, ML, and Cloud Infrastructure) at BILL

Join us for an insightful webinar that explores the critical intersection of data privacy and AI governance. In today’s rapidly evolving tech landscape, building robust governance frameworks is essential to fostering innovation while staying compliant with regulations. Our expert speaker, Aindra Misra, will guide you through best practices for ensuring data protection while leveraging AI capabilities.

Data Privacy

KnowBe4

MAY 10, 2022

The China-based threat actor Mustang Panda is conducting spear phishing campaigns against organizations in NATO countries and Russia, as well as entities in the US and Asia, according to researchers at Cisco Talos. The goal of this activity is cyberespionage.

Phishing 120

Phishing 120

Data Breach Today

MAY 10, 2022

A Perfect Storm Turned a Minor Security Event into a Debacle A hacking group called Lapsus$ caused major headaches for identity vendor Okta in March when it dropped incriminating but misleading screenshots of a security breach. Brett Winterford of Okta breaks down what happened and why visibility into third-party support operations is important.

Security 263

Security IT 263

Hunton Privacy

MAY 13, 2022

On May 10, 2022, as part of the Queen’s Speech , the UK government announced its intention to introduce a Data Reform Bill (the “Bill”). The UK government’s background and briefing notes to the Queen’s Speech state that the purpose of the Bill is to “take advantage of the benefits of Brexit to create a world class data rights regime…that reduces burdens on businesses, boosts the economy, helps scientists to innovate and improves the lives of people in the UK.”.

Personal data 113

Personal data GDPR Government Risk 113