IT Governance

FEBRUARY 23, 2023

In yet another controversial policy move, Twitter announced this week that it’s removing text-based 2FA (two-factor authentication) for non-paying users. It has focused on the costs that Twitter incurs as a result of SMS-based authentication, when the real threat is to users. Twitter has instructed users to remove SMS authentication.

Authentication 104

Authentication Security Passwords Risk 104

Data Breach Today

JANUARY 17, 2023

Push Technology and One-Time Passcodes for MFA Just Aren't Secure Enough Attackers have caught up with legacy multifactor authentication tools that use push technology or one-time passcodes, boosting the need for phishing-resistant MFA, says Jeremy Grant.

Government 130

Government Phishing Authentication Security 130

Security Affairs

APRIL 24, 2024

Nation-state actor UAT4356 has been exploiting two zero-days in ASA and FTD firewalls since November 2023 to breach government networks. Early in 2024, a customer contacted Cisco to report a suspicious related to its Cisco Adaptive Security Appliances (ASA). Cisco Talos researchers tracked this cyber-espionage campaign as ArcaneDoor.

Government 106

Government Authentication Communications Access 106

Security Affairs

NOVEMBER 20, 2023

The Canadian government discloses a data breach after threat actors hacked two of its contractors. Data belonging to current and former Government of Canada employees, members of the Canadian Armed Forces and Royal Canadian Mounted Police personnel have been also exposed. Both contractors suffered a security breach in October.

Data breaches 114

Data breaches Government IT Ransomware 114

Security Affairs

NOVEMBER 16, 2023

Google TAG revealed that threat actors exploited a Zimbra Collaboration Suite zero-day ( CVE-2023-37580 ) to steal emails from governments. The first campaign aimed at a government organization in Greece, threat actors sent emails containing exploit urls to their targets. The exploit was used to steal the Zimbra authentication token.

Government 118

Government Authentication Phishing IT 118

IT Governance

JULY 21, 2022

This week, we discuss NCSC and ICO advice to the legal profession, a new phishing campaign that bypasses multifactor authentication, and the huge increase in the number of ransomware and phishing attacks this year. Plus, we talk to Gary Hibberd about his new book, The Art of Cyber Security.

Phishing 105

Phishing Ransomware Government IT 105

Thales Cloud Protection & Licensing

NOVEMBER 27, 2023

How better key management can close cloud security gaps troubling US government (Part 1 of 2) sparsh Tue, 11/28/2023 - 05:20 Bruce Schneier recently blogged : A bunch of networks, including US Government networks , have been hacked by the Chinese. But “negligent security practices” are not a new concern for the US Government.

Cloud 83

Cloud Government Security Marketing 83

IBM Big Data Hub

FEBRUARY 5, 2024

For federal and state governments and agencies, identity is the crux of a robust security implementation. Numerous individuals disclose confidential, personal data to commercial and public entities daily, necessitating that government institutions uphold stringent security measures to protect their assets.

Security 96

Security Authentication Compliance Access 96

Data Breach Today

DECEMBER 4, 2020

Experian's David Britton on Identity Governance and Security Organizations can enhance security while maintaining a good customer experience by leveraging data for authentication, says David Britton of Experian.

Customer Experience 176

Customer Experience Security Authentication Government 176

Thales Cloud Protection & Licensing

OCTOBER 4, 2022

Cybersecurity Awareness Month: Resilient Multi-factor Authentication (MFA) and Strong Passwords. This year, the Cybersecurity and Infrastructure Security Agency (CISA) and the National Cybersecurity Alliance (NCA) coordinate the collaboration between the government and industry, running a human-centric campaign themed “See Yourself in Cyber”.

Authentication 127

Authentication Passwords Cybersecurity Personal data 127

Security Affairs

AUGUST 21, 2023

Ivanti warned customers of a new critical Sentry API authentication bypass vulnerability tracked as CVE-2023-38035. The software company Ivanti released urgent security patches to address a critical-severity vulnerability, tracked as CVE-2023-38035 (CVSS score 9.8), in the Ivanti Sentry (formerly MobileIron Sentry) product.

Authentication 86

Authentication Risk Access Government 86

Data Breach Today

OCTOBER 14, 2022

Stopping Cyberattacks by Moving Away From Password-Based Authentication The January memorandum from President Biden’s Office of Management and Budget calls for adopting multifactor authentication that includes the verification of device-based security controls, continuous monitoring, and authentication and mandates a switch to phishing-resistant MFA (..)

Phishing 130

Phishing Government Authentication Passwords 130

The Last Watchdog

MARCH 4, 2020

However, to fully capture the benefits of an IoT-centric economy, a cauldron of privacy and security concerns must first be quelled. I’m referring to the Public Key Infrastructure, or PKI, and the underlying TLS/SSL authentication and encryption protocols. And if you’re not doing integrity checks, you’ll be exposed.”

IoT 127

IoT Authentication Security Encryption 127

Data Matters

MARCH 3, 2022

CISA has also suggested lowering reporting thresholds and empowering organizations’ chief information security officers to be involved in the decision-making process in light of the heightened threat environment. Government Issues Warning of Threat Against U.S. See also our prior post in Data Matters, U.S. The post U.S.

Government 141

Government Cybersecurity Authentication Information Security 141

Security Affairs

JULY 13, 2023

Cybersecurity and Infrastructure Security Agency (CISA) and Federal Bureau of Investigation (FBI) on July 12, 2023 have published a joint advisory to warn organizations and allow them to enhance organizational cybersecurity posture and position organizations to detect similar malicious activity via implementing the listed logging recommendations.

Government 78

Government Authentication Cloud Access 78

Schneier on Security

NOVEMBER 21, 2023

Google’s Threat Analysis Group announced a zero-day against the Zimbra Collaboration email server that has been used against governments around the world. TAG has observed four different groups exploiting the same bug to steal email data, user credentials, and authentication tokens. The vulnerability was discovered in June.

Security 94

Security Authentication Government IT 94

Security Affairs

MARCH 7, 2023

Researchers discovered a new info stealer dubbed SYS01 stealer targeting critical government infrastructure and manufacturing firms. The last stage malware is the PHP-based SYS01stealer malware which is able to steal browser cookies and abuse authenticated Facebook sessions to steal information from the victim’s Facebook account.

Government 96

Government Manufacturing Authentication Cybersecurity 96

Rocket Software

MAY 15, 2020

On May 7, IT and technology businesses around the world celebrated World Password Day, a day meant to remind everyone of the importance of keeping personal and business data protected and secure. Passwords used to be simple to secure: you had to create a username and a unique password, and that was essentially it. Secure Sign-In.

Authentication 52

Authentication Passwords Security Access 52

Thales Cloud Protection & Licensing

JULY 3, 2019

I recently had the pleasure of sharing some industry insights from our 2019 Data Threat Report-Federal Edition on Cyberwire’s Daily Podcast –specifically addressing the gap in security responsibility many federal agencies face today as they move tremendous amounts of sensitive data into multicloud environments.

Government 120

Government Security Encryption IoT 120

Thales Cloud Protection & Licensing

JUNE 24, 2021

How FIDO 2 authentication can help achieve regulatory compliance. Businesses are governed by an increasingly complex network of regulations, jurisdictions, and standards which dictate security and privacy requirements. One common denominator in all regulations is the need for strong authentication. Compliance with PSD2.

Authentication 71

Authentication Compliance GDPR Personal data 71

Schneier on Security

JANUARY 19, 2023

A group of Swiss researchers have published an impressive security analysis of Threema. As one example, we present a cross-protocol attack which breaks authentication in Threema and which exploits the lack of proper key separation between different sub-protocols.

Security 118

Security Encryption Paper Authentication 118

Security Affairs

NOVEMBER 21, 2023

Experts warn of a surge in NetSupport RAT attacks against education, government, and business services sectors. The most impacted sectors are education, government, and business services. These infected websites host a PHP script which displays a seemingly authentic update. implacavelvideos[.]com).

Education 113

Education Government Business Services Archiving 113

Schneier on Security

MARCH 29, 2023

Jenny Blessing and Ross Anderson have evaluated the security of systems designed to allow the various Internet messaging platforms to interoperate with each other: The Digital Markets Act ruled that users on different platforms should be able to exchange messages with each other. This opens up a real Pandora’s box.

Security 83

Security Metadata Paper Authentication 83

Rocket Software

JULY 24, 2020

With the COVID-19 pandemic remodelling the global IT workforce to a ‘work from home’ approach, CTO’s from all sectors are now asking questions about how secure their critical business applications actually are. . Rocket Software has always been at the forefront of the challenge of host application security.

Authentication 63

Authentication Data breaches Marketing Manufacturing 63

Security Affairs

JANUARY 16, 2024

Experts warn that recently disclosed Ivanti Connect Secure VPN and Policy Secure vulnerabilities are massively exploited in the wild. is an Authentication Bypass issue that resides in the web component of Ivanti ICS 9.x, x and Ivanti Policy Secure. x) and Ivanti Policy Secure. x) and Ivanti Policy Secure.

Security 85

Security Authentication Military Government 85

Krebs on Security

MAY 12, 2022

KrebsOnSecurity has learned the alleged compromise is tied to a cybercrime and online harassment community that routinely impersonates police and government officials to harvest personal information on their targets. The DEA declined to comment on the validity of the claims, issuing only a brief statement in response.

Authentication 264

Authentication Passwords Government Access 264

Schneier on Security

NOVEMBER 8, 2023

We can and should get the benefits of the cloud while taking security back into our own hands. These ideas, which we’ll refer to in the aggregate as “decoupling,” allow us to rethink both security and privacy. In security this is called Least Privilege. Here we outline a strategy for doing that.

Security 97

Security Cloud Encryption Privacy 97

Security Affairs

FEBRUARY 25, 2024

Every week the best security articles from Security Affairs are free for you in your email box. Iran Crisis Russia-Aligned TAG-70 Targets European Government and Military Mail Servers in New Espionage Campaign U.S. A new round of the weekly SecurityAffairs newsletter arrived!

Military 97

Military Security Ransomware Insurance 97

eSecurity Planet

MARCH 4, 2022

National Security Agency (NSA) released comprehensive network security guidance on March 3, on the same day that the Cybersecurity and Infrastructure Security Agency (CISA) released its longest-ever list of exploited vulnerabilities. Limit authentication attempts. Store passwords with secure algorithms.

Security 126

Security Authentication Cybersecurity Encryption 126

Schneier on Security

DECEMBER 14, 2018

Attackers are targeting two-factor authentication systems: Attackers working on behalf of the Iranian government collected detailed information on targets and used that knowledge to write spear-phishing emails that were tailored to the targets' level of operational security, researchers with security firm Certfa Lab said in a blog post.

Authentication 81

Authentication Passwords Phishing Government 81

Security Affairs

JANUARY 13, 2024

Every week the best security articles from Security Affairs are free for you in your email box. A new round of the weekly SecurityAffairs newsletter arrived! Enjoy a new round of the weekly SecurityAffairs newsletter, including the international press.

Security 109

Security Ransomware Data breaches Cybersecurity 109

Security Affairs

JUNE 8, 2020

The Indian Government fixed a flaw in the secure document wallet service Digilocker that could have potentially allowed anyone’s access without password. DigiLocker is an online service provided by Ministry of Electronics and IT (MeitY), Government of India under its Digital India initiative. Pierluigi Paganini.

Authentication 90

Authentication Passwords Encryption Access 90

Security Affairs

AUGUST 7, 2022

Every week the best security articles from Security Affairs free for you in your email box. The post Security Affairs newsletter Round 377 appeared first on Security Affairs. A new round of the weekly SecurityAffairs newsletter arrived! Pierluigi Paganini. SecurityAffairs – hacking, newsletter).

Security 124

Security Manufacturing Passwords Ransomware 124

IT Governance

OCTOBER 6, 2022

This October is Cyber Security Awareness Month, an event designed to educate people about information security and the steps they can take to stay safe online. Now in its nineteenth year, the campaign provides tools and resources to help people learn more about the cyber security industry and the ways they can get involved.

Security awareness 130

Security awareness Security Phishing Passwords 130

Krebs on Security

SEPTEMBER 13, 2023

Credentials stolen by info-stealers often end up for sale on cybercrime shops that peddle purloined passwords and authentication cookies (these logs also often show up in the malware scanning service VirusTotal ). government inboxes. Microsoft Corp.

Passwords 270

Passwords Authentication Sales Data breaches 270

Security Affairs

SEPTEMBER 11, 2022

Every week the best security articles from Security Affairs free for you in your email box. The post Security Affairs newsletter Round 383 appeared first on Security Affairs. A new round of the weekly SecurityAffairs newsletter arrived! Follow me on Twitter: @securityaffairs and Facebook. Pierluigi Paganini.

Security 97

Security Ransomware Phishing Authentication 97

The Last Watchdog

JANUARY 27, 2022

Such consolidation across markets is good news for customers and vendors alike in terms of market growth and maximizing security investments. Throughout this period, the risk level of the acquirer is much higher than the acquired company, creating a major cybersecurity gap as they merge their tech stack and security tools together.

Privacy 233

Privacy Security Risk Marketing 233