VPN exploitation rose in 2020, organizations slow to patch critical flaws

RDP and VPNs will remain a prime target for cybercriminals as remote and hybrid work continue, Trustwave said.

By Samantha Schwartz • June 18, 2021

Critical infrastructure sites face greater cyberthreat amid remote connectivity

Moody's warns oil, electric and other critical infrastructure providers are increasingly attractive targets for ransomware.

By David Jones • June 18, 2021

CISOs, CIOs see heightened mobile security threat amid shift to hybrid

Mobile devices are difficult to secure because of a combination of untrusted personal apps and data stored on the same device, one security expert said.

By David Jones • June 16, 2021

Patched Microsoft Teams vulnerability shows the delicacy of messaging platforms

A researcher said the patched vulnerability could have granted access to files in OneDrive and the ability to execute business email compromise.

By David Jones • June 15, 2021

APT actors ramp up cyber campaign targeting Pulse Secure VPNs

Mandiant researchers have identified four new malware families in an ongoing campaign targeting several key sectors, including the U.S. defense industry.

By David Jones • May 28, 2021

Compromised cloud costs companies $6.2M annually, study finds

Attackers heavily target Microsoft 365 and Google Workspace accounts using brute force or phishing attacks, according to Ponemon Institute research.

By David Jones • May 27, 2021

Threat actors scan for vulnerabilities faster than enterprises can respond: Palo Alto

Within five minutes of Microsoft's March disclosure of Exchange zero days, cyber adversaries began scanning networks for the flaw, research found. 

By David Jones • May 26, 2021

Off-the-shelf tools, unsophisticated techniques threaten industrial systems

Attacks have targeted internet-exposed OT providers that range from water control systems to solar energy panels, Mandiant research found.

By David Jones • May 25, 2021

AI will change scale and scope of hacking, security expert says

Artificial intelligence could push the boundaries of hacking in ways that increase risk, according to security thought leader Bruce Schneier. But, AI could also boost defenses. 

By David Jones • May 18, 2021

Colonial Pipeline disconnects OT systems to silo ransomware IT threat

Anxiety is rising among corporate security officials concerned about the impact of ransomware among critical infrastructure providers.

By David Jones • May 12, 2021

Critical infrastructure flaws surface after years of underinvestment, inaction

Providers — particularly in the energy sector — knew the warning signs but were slow to respond.

By David Jones • May 11, 2021

Demand for software transparency grows in more vulnerable supply chains

Catching vulnerabilities before the code is packaged into proprietary solutions has industry at a standstill.

By Samantha Schwartz • May 11, 2021

VPN vulnerabilities haunt defense industry as threat actors find new openings

APT actors have exploited longstanding vulnerabilities in Pulse Secure and other devices to gain access to government agencies and the private sector. 

By David Jones • May 10, 2021

3 reasons why you're more vulnerable than you think to fraud

Fraud prevention in the age of multiple digital channels has become a never-ending struggle and maintaining a seamless user experience and security is crucial.

May 10, 2021

Cyberthreats dog the US supply chain, complicated by global competition

As companies acquire components and services, they need mechanisms to ensure backdoors are not lurking in their systems, experts at the Hack the Capitol 2021 conference said.

By David Jones • May 5, 2021

Password managers are a necessary — yet vulnerable — last line of defense

The Passwordstate breach is forcing CISOs and researchers to review vendors and reassess security practices.

By David Jones • May 4, 2021

Work from home means far less security visibility, report says

The number of incidents are surging as companies shift to multicloud environments and struggle to track endpoint and IoT security. 

By David Jones • April 28, 2021

Cyberattack on Passwordstate tests confidence in password managers

The supply chain attack is raising questions about how best to deploy and secure the tools as corporations face heightened threats across the globe.

By David Jones • April 27, 2021

Software bug bests MacOS notarization protocols

The update, which fixes the bug, is available in MacOS version 11.3.

By Samantha Schwartz • April 27, 2021

Attackers leverage Pulse Secure VPNs to target defense, financial industries

Cybersecurity and Infrastructure Security Agency warned federal agencies of "unacceptable risk" in the latest campaign linked to suspected APT actors.

By David Jones • April 22, 2021

Companies take second look at third-party risk management programs

As part of the supply chain web, monitoring the vendors of a company's vendor, called Nth party risk, has become a critical part of protecting companies from potential threats.

By David Jones • April 20, 2021

25% of utilities exposed to SolarWinds hack amid growing ICS vulnerabilities, analysts say

Security experts warn it may be too soon to tell whether follow-on activity has occurred.

By Robert Walton • April 16, 2021

Poor management of privileged accounts leaves organizations open to attack

Access gaps open the door for malicious threat actors to hide inside the corporate systems using trusted identities to exfiltrate data. 

By David Jones • April 15, 2021

Feds launch coordinated effort to mitigate remaining Microsoft Exchange flaws

A court-approved operation to remove web shells coincided with a push to get government and private sector systems patched with critical security updates.

By David Jones • April 14, 2021

100M devices susceptible to NAME:WRECK DNS vulnerabilities, researchers say

Each vulnerability could lead to a denial of service attack, or an attacker could take control of a susceptible device through remote code execution.

By Samantha Schwartz • April 14, 2021