New report reveals a coordinated campaign by five Chinese APT groups that dates back at least eight years and exploits underlooked remote access vulnerabilities in Linux servers.
Cyber Security
Cyber criminals, state-sponsored hackers and even the occasional disgruntled employee are constantly looking to gain unauthorized access for a variety of purposes: theft of money, cyber espionage, personal information for sale or for use in scams, and damage to critical infrastructure for just a few of the most common.
So how does an organization mitigate an entire world full of continual cyber attacks? Just as buildings have a number of necessary elements of physical security: access control, cameras, alarms and so on; there are similar key elements of cyber security that are absolutely vital for just about any modern business.
It starts with identifying and closing the most common doors that attackers use. For example, phishing attacks on employees are far and away the most common initial point of entry. The breach of even a low-level employee account can quickly turn into an escalation in access privileges and the ability to reach sensitive information. This is also true of smart devices, which are generally more poorly secured than computers and phones.
In just a few years, cyber extortion has gone from a fringe hacking activity to something that is now very much mainstream. In fact, it’s now possible for hackers to make upwards of $360,000 per year by joining a cyber extortion team.
Whether it is company culture or an individual attitude, developers do appear to be commonly shipping vulnerable code with the full knowledge that there are weaknesses in it.
A new study from ETH Zurich is causing some serious re-evaluation of the use of cloud-based password managers, as the researchers found an assortment of vulnerabilities in three of the most popular choices. This range of vulnerabilities make a similar range of known attacks possible, up to a dozen with the most readily compromised option.
European Commission publishes joint risk assessment report on 5G security highlighting the need for a "new security paradigm" to ensure high level of cybersecurity preparedness.
An as-of-yet undiagnosed compromise of the Salesloft Drift AI-driven platform has led to a rash of stolen OAuth tokens, in turn creating downstream breaches at some of the biggest names in the cybersecurity industry.
To many, the new SEC rules that require public companies to disclose “material” cybersecurity incidents within four days of determining their materiality may seem like a challenging, if not unreasonable, demand. Companies should put a priority on preparing incident response plans that will help them meet compliance.
SEC's new rule for public companies to report data breaches within four days is a significant step towards transparency, cybersecurity preparedness, and standardizing reporting practices. Since news of the law broke, many security professionals have however expressed conflicting opinions.
New rules voted in by the SEC last week require all publicly traded companies to report any cybersecurity breaches that could cause a material impact within four days. Timer doesn't start until the company determines that the breach could be material.
The study draws on a sample of over 1,000 C-Suite and board members and analyzed their personal devices and home network security and privacy. 87% of executive devices have no security measures at all installed.










