Tue.Oct 08, 2019

article thumbnail

Developers' Code Reuse Security Conundrum: Cut, Paste, Fail

Data Breach Today

GitHub Projects Riddled With Flawed Stack Overflow Code, Researchers Find Code reuse kills - software quality, that is, according to a new study of C++ code snippets shared on Stack Overflow that were reused in more than 2,800 GitHub projects. But there's help for organizations that want to support their developers' urge to cut and paste prewritten code snippets.

Security 183
article thumbnail

Speakers Censored at AISA Conference in Melbourne

Schneier on Security

Two speakers were censored at the Australian Information Security Association's annual conference this week in Melbourne. Thomas Drake , former NSA employee and whistleblower, was scheduled to give a talk on the golden age of surveillance, both government and corporate. Suelette Dreyfus , lecturer at the University of Melbourne, was scheduled to give a talk on her work -- funded by the EU government -- on anonymous whistleblowing technologies like Dropbox and how they reduce corruption in countr

Insiders

Sign Up for our Newsletter

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

article thumbnail

Health Data Breach Tally: Ransomware Proliferates

Data Breach Today

Here's An Update on Additions to the 'Wall of Shame' Ransomware attacks are among the largest incidents added to the federal tally of major health data breaches in recent weeks. Attacks on a variety of clinics affected a total of more than 1 million individuals.

article thumbnail

New Unpatchable iPhone Exploit Allows Jailbreaking

Schneier on Security

A new iOS exploit allows jailbreaking of pretty much all version of the iPhone. This is a huge deal for Apple, but at least it doesn't allow someone to remotely hack people's phones. Some details : I wanted to learn how Checkm8 will shape the iPhone experience­ -- particularly as it relates to security­ -- so I spoke at length with axi0mX on Friday.

Access 84
article thumbnail

Peak Performance: Continuous Testing & Evaluation of LLM-Based Applications

Speaker: Aarushi Kansal, AI Leader & Author and Tony Karrer, Founder & CTO at Aggregage

Software leaders who are building applications based on Large Language Models (LLMs) often find it a challenge to achieve reliability. It’s no surprise given the non-deterministic nature of LLMs. To effectively create reliable LLM-based (often with RAG) applications, extensive testing and evaluation processes are crucial. This often ends up involving meticulous adjustments to prompts.

article thumbnail

Update: Internet Security Threat Report

Data Breach Today

Kevin Haley of Symantec Shares Key Findings Kevin Haley of Symantec shares key findings from the company's latest Internet Security Threat Report.

Security 171

More Trending

article thumbnail

DevSecOps: Overcoming Resistance

Data Breach Today

Johnathan Nicholson, Former Interac CISO, on How to Change the Culture How can organizations overcome resistance to implementing DevSecOps? Johnathan Nicholson, former CISO at Interac, the Canadian interbank network, provides insights.

153
153
article thumbnail

Developer hacked back Muhstik ransomware crew and released keys

Security Affairs

One of the victims of the Muhstik ransomware gang who initially paid the ransomware, decided to hack back the crooks and released their decryption keys. Tobias Frömel , is a German software developer, who was a victim of the Muhstik ransomware. Frömel initially paid the ransom to decrypt his files, but later decided to get his revenge on the crooks.

article thumbnail

Minimizing File Transfer Risk

Data Breach Today

Jeffrey Edwards of Progress Software on Ensuring Privacy File transfers are a significant factor in accidental insider risk. Jeffrey Edwards of Progress Software explains how secure file transfers can help ensure privacy and play a role in regulatory compliance.

Risk 153
article thumbnail

Experts found a link between a Magecart group and Cobalt Group

Security Affairs

Researchers from MalwareBytes and HYAS Threat Intelligence linked one of the hacking groups under the Magecart umbrella to the notorious Cobalt cybercrime Group. Hacker groups under the Magecart umbrella continue to target organizations worldwide to steal payment card data with so-called software skimmers. Security firms have monitored the activities of a dozen groups at least since 2010.

article thumbnail

How and Why Should You Be Tracking Geopolitical Risk?

Geopolitical risk is now at the top of the agenda for CEOs. But tracking it can be difficult. The world is more interconnected than ever, whether in terms of economics and supply chains or technology and communication. Geopolitically, however, it is becoming increasingly fragmented – threatening the operations, financial well-being, and security of globally connected companies.

article thumbnail

The Case Against a 'SOC in a Box'

Data Breach Today

John Matthews of Extrahop on Avoiding Homogeneity in Security Platforms Homogeneity in security platforms can be a problem, says John Matthews of Extrahop, who makes the case for avoiding implementing a "SOC in a box.

Security 147
article thumbnail

Can the Girl Scouts Save the Moon from Cyberattack?

Dark Reading

The Girl Scouts Cyber Challenge event, later this month, pledges to give middle and high-school girls a realistic, and fun, look at cybersecurity careers.

article thumbnail

Addressing Privacy Compliance Challenges

Data Breach Today

Fatima Khan of Okta on Going Beyond GDPR Compliance Compliance with the European Union's General Data Protection Regulation is no guarantee of compliance with other privacy regulations, says Fatima Khan of Okta, who discusses the challenges.

article thumbnail

Russia's Disinformation War Is Just Getting Started

WIRED Threat Level

The Internet Research Agency specifically targeted African Americans, and has not stopped trying to influence elections, a Senate intelligence report says.

article thumbnail

7 Pitfalls for Apache Cassandra in Production

Apache Cassandra is an open-source distributed database that boasts an architecture that delivers high scalability, near 100% availability, and powerful read-and-write performance required for many data-heavy use cases. However, many developers and administrators who are new to this NoSQL database often encounter several challenges that can impact its performance.

article thumbnail

Insider Threat Mitigation: Sanctions and Incentives

Data Breach Today

Michael Theis of CERT Insider Threat Center on Best Practices The battle against insider threats requires a balance of sanctions and incentives, says Michael Theis of the CERT Insider Threat Center.

127
127
article thumbnail

Utilities' Operational Networks Continue to Be Vulnerable

Dark Reading

More than half of utilities have suffered an outage or data loss in the last 12 months, but only a minority of organizations seem ready for an attack that could affect operations, a survey finds.

78
article thumbnail

The Security of Data in the Cloud is Your Responsibility Unveiling the 2019 Thales Cloud Security Study

Thales Cloud Protection & Licensing

Businesses are vigorously adopting digital transformation to provide higher quality services, operate more efficiently and deliver better customer experiences. The engine that is powering this transformation is the cloud and the vast array of on demand services it provides. In fact, according to the 2019 Thales Cloud Security Study , the average company uses 29 cloud services.

Cloud 63
article thumbnail

NSA Issues Advisory on VPN Vulnerability Trio

Dark Reading

Vulnerabilities with Pulse Secure, Fortinet, and Palo Alto Networks VPNs are called out in the advisory.

article thumbnail

Reimagined: Building Products with Generative AI

“Reimagined: Building Products with Generative AI” is an extensive guide for integrating generative AI into product strategy and careers featuring over 150 real-world examples, 30 case studies, and 20+ frameworks, and endorsed by over 20 leading AI and product executives, inventors, entrepreneurs, and researchers.

article thumbnail

Most organizations fall short of global data privacy requirements

Information Management Resources

A majority of organizations do not comply with current international data privacy regulations and are not prepared for new U.S. regulations rolling out in 2020.

article thumbnail

Iranian Cyberattack on US Presidential Campaign Could Be a Sign of Things to Come

Dark Reading

Political parties and election systems will be heavily targeted in the months leading up to the 2020 general elections, some security experts say.

article thumbnail

APT Groups Exploiting Flaws in Unpatched VPNs, Officials Warn

Threatpost

U.S. and U.K. agencies warn consumers to update VPN technologies from Fortinet, Pulse Secure and Palo Alto Networks.

article thumbnail

Business Email Compromise Attacks Spike 269%

Dark Reading

A new Mimecast report finds a significant uptick in BEC attacks, malware attachments, and spam landing in target inboxes.

85
article thumbnail

How to Migrate From DataStax Enterprise to Instaclustr Managed Apache Cassandra

If you’re considering migrating from DataStax Enterprise (DSE) to open source Apache Cassandra®, our comprehensive guide is tailored for architects, engineers, and IT directors. Whether you’re motivated by cost savings, avoiding vendor lock-in, or embracing the vibrant open-source community, Apache Cassandra offers robust value. Transition seamlessly to Instaclustr Managed Cassandra with our expert insights, ensuring zero downtime during migration.

article thumbnail

Day-zero Apple OS support with Jamf Pro 10.15

Jamf

We are proud to deliver new features and support for macOS Catalina, iOS 13, iPadOS 13 and tvOS 13. Get the details.

75
article thumbnail

Microsoft Issues 9 Critical Security Patches

Dark Reading

None of the total 59 patches were for previously known vulnerabilities nor are any under active attack, Microsoft reports.

article thumbnail

Tech firms know more about us than any spy agency – ex-GCHQ chief

The Guardian Data Protection

David Omand warns festival Cheltenham festival audience of threat to democracy from monetisation of data Big internet firms know more about the lives of private individuals than any intelligence agency ever has and that is a dangerous threat to democracy, the former head of the spy agency GCHQ has said. David Omand was at the centre of British intelligence for decades, beginning his career at GCHQ after he graduated from Cambridge in 1969 and becoming its director from 1996-97.

IT 57
article thumbnail

Beyond the Horde: The Uptick in Targeted Attacks (And How to Fight Back)

Dark Reading

We're seeing a dramatic rise in targeted attacks, but following these guidelines can help your enterprise stay safe.

74
article thumbnail

Entity Resolution Checklist: What to Consider When Evaluating Options

Are you trying to decide which entity resolution capabilities you need? It can be confusing to determine which features are most important for your project. And sometimes key features are overlooked. Get the Entity Resolution Evaluation Checklist to make sure you’ve thought of everything to make your project a success! The list was created by Senzing’s team of leading entity resolution experts, based on their real-world experience.

article thumbnail

Intimate Details on Healthcare Workers Exposed as Cloud Security Lags

Threatpost

Ponemon survey data shows that only a third of IT staff say they take a security-first approach to data storage in the cloud.

Cloud 70
article thumbnail

7 Considerations Before Adopting Security Standards

Dark Reading

Here's what to think through as you prepare your organization for standards compliance.

article thumbnail

MS October 2019 Patch Tuesday updates address 59 flaws

Security Affairs

Microsoft October 2019 Patch Tuesday addressed a total of 59 vulnerabilities. 9 of which are rated as critical and 49 as important. The tech giant released its October 2019 Patch Tuesday security updates to address a total of 59 vulnerabilities in Windows operating systems and other software, 9 of which are rated as ‘critical’, 49 are ‘important’, and one ‘moderate’ None of the vulnerabilities addressed by Microsoft was exploited by attackers in the wild or wa