Tue.Aug 27, 2019

article thumbnail

Countering Spoofing Attacks

Data Breach Today

Sal Stolfo of Allure Security on the Role of Deception Technology Deception technology, adversary intelligence and early detection can help counter spoofing and phishing attacks, says Sal Stolfo, the founder and CTO of Allure Security.

Phishing 241
article thumbnail

Cybersecurity Firm Imperva Discloses Breach

Krebs on Security

Imperva , a leading provider of Internet firewall services that help Web sites block malicious cyberattacks, alerted customers on Tuesday that a recent data breach exposed email addresses, scrambled passwords, API keys and SSL certificates for a subset of its firewall users. Redwood Shores, Calif.-based Imperva sells technology and services designed to detect and block various types of malicious Web traffic, from denial-of-service attacks to digital probes aimed at undermining the security of We

Insiders

Sign Up for our Newsletter

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

article thumbnail

Election Security Program Aims to Mitigate Ransomware Risks

Data Breach Today

Department of Homeland Security to Help With Database Protections Within a month, the U.S. Department of Homeland Security hopes to launch a program to help states protect voter registration databases and systems in advance of the 2020 presidential election. Security experts say that in light of recent ransomware attacks against units of government, the effort is overdue.

article thumbnail

Kaspersky found malware in popular CamScanner app. Remove it now from your phone!

Security Affairs

Security experts from Kaspersky spotted a malware in the free version of the popular PDF creator application CamScanner app. CamScanner is a very popular Phone PDF creator app with more than 100 million downloads on Google Play Store. Experts from Kaspersky have discovered malware in the free Android version of the CamScanner app that could be used by attackers to remotely hack Android devices and steal targets’ data.

IT 102
article thumbnail

Get Better Network Graphs & Save Analysts Time

Many organizations today are unlocking the power of their data by using graph databases to feed downstream analytics, enahance visualizations, and more. Yet, when different graph nodes represent the same entity, graphs get messy. Watch this essential video with Senzing CEO Jeff Jonas on how adding entity resolution to a graph database condenses network graphs to improve analytics and save your analysts time.

article thumbnail

Cyber Insurance Changes as Threats Evolve

Data Breach Today

Ken Suh of Beazley on Assessing the Options In light of emerging cyberthreats, including ransomware, organizations must change how they assess their cyber insurance options, says Ken Suh of Beazley.

Insurance 222

More Trending

article thumbnail

Third-Party Risk Management Essentials

Data Breach Today

Mark Sangster of eSentire Shares Lessons Learned Third-party vendor risk continues to pose a security challenge to organizations. Despite many having formal policies for managing third-party risk, almost half of organizations say they've suffered a data breach that traces to a third-party vendor, says Mark Sangster of eSentire.

Risk 212
article thumbnail

WannaCry Remains No. 1 Ransomware Weapon

Dark Reading

Of all of the ransomware variants spotted targeting victims in the first half of 2019, the infamous WannaCry was by far the most prevalent, according to Trend Micro's detection data.

article thumbnail

Apple Patches Reintroduced Flaw That Enabled Jailbreaking

Data Breach Today

Block Update to Keep Jailbreaking - But Do So At Your Peril, Expert Warns Apple released a patch on Monday that fixes a bug it accidentally reintroduced in a previous patch update. The flaw allowed iOS enthusiasts to jailbreak their up-to-date devices, but also could have been put to malicious use by hackers.

IT 193
article thumbnail

Lyceum APT made the headlines with attacks in Middle East

Security Affairs

A recently reported APT group dubbed Lyceum group targets Oil and Gas organizations in the Middle East with simple techniques. The activity of the Lyceum APT group was first documents earlier of August by researchers at ICS security firm Dragos that tracked it as Hexane. Security experts at Dragos Inc. reported that Hexane is targeting organizations in the oil and gas industry and telecommunication providers.

article thumbnail

Peak Performance: Continuous Testing & Evaluation of LLM-Based Applications

Speaker: Aarushi Kansal, AI Leader & Author and Tony Karrer, Founder & CTO at Aggregage

Software leaders who are building applications based on Large Language Models (LLMs) often find it a challenge to achieve reliability. It’s no surprise given the non-deterministic nature of LLMs. To effectively create reliable LLM-based (often with RAG) applications, extensive testing and evaluation processes are crucial. This often ends up involving meticulous adjustments to prompts.

article thumbnail

Patch Management as a Risk Management Strategy

Data Breach Today

Chris Hallenbeck of Tanium Discusses Good Security Hygiene Significant security events have many techniques in common, says Chris Hallenbeck of Tanium, who describes why security hygiene improvement, especially patch management, is so essential.

Risk 193
article thumbnail

Code Execution and DoS flaw addressed in QEMU

Security Affairs

The open-source emulator QEMU is affected by a flaw that could be exploited to trigger a ( DoS ) condition or gain arbitrary code execution. QEMU (short for Quick Emulator ) is a free and open-source emulator that performs hardware virtualization. It emulates the machine’s processor through dynamic binary translation and provides a set of different hardware and device models for the machine, enabling it to run a variety of guest operating systems.

article thumbnail

Identity: The New Enterprise Perimeter

Data Breach Today

Okta's Clare Cunniffe on How the Cloud Accelerates the Focus on Identities The decline of the network perimeter as the cornerstone of enterprise cybersecurity means that CIOs and CISOs are increasingly focusing on identity to ensure that only the right people connect to systems, says Okta's Clare Cunniffe.

Cloud 185
article thumbnail

Experts uncovered an advanced phishing campaign delivering the Quasar RAT

Security Affairs

Researchers at Cofense uncovered an advanced phishing campaign delivering Quasar RAT via fake resumes. Experts at security firm Cofense observed an advanced phishing campaign delivering Quasar RAT via fake resumes. The use of multiple anti- analysis methods to camouflage the attack vectors is the main characteristic of this campaign. Quasar RAT is available as an open-source tool on several public repositories, attackers use to avoid detection leveraging methods such as password protection and e

article thumbnail

How and Why Should You Be Tracking Geopolitical Risk?

Geopolitical risk is now at the top of the agenda for CEOs. But tracking it can be difficult. The world is more interconnected than ever, whether in terms of economics and supply chains or technology and communication. Geopolitically, however, it is becoming increasingly fragmented – threatening the operations, financial well-being, and security of globally connected companies.

article thumbnail

Creating a 'Defensible' Cybersecurity Program

Data Breach Today

Tom Scholtz of Gartner Says Flexible, Executive-Endorsed Programs Succeed Organizations need to create a "defensible" cybersecurity program that has a mandate and executive endorsement, says Gartner's Tom Scholtz. I. Here are some points to keep in mind when drafting a program.

article thumbnail

Imperva Customer Database Exposed

Dark Reading

A subset of customers for the company's Incapsula web application firewall had their email addresses, hashed/salted passwords, and more open to unauthorized access, Imperva announced.

article thumbnail

Access and Identity: With 'Zero Trust,' Less Is More

Data Breach Today

Marku Rossi of SSH Communications Security on Delivering Right Access Privileges at Right Time More organizations are applying a highly automated "zero trust" model to ensure that they only give the right amount of privilege to the right user for the right amount of time, says Markku Rossi, CTO of SSH Communications Security.

Access 157
article thumbnail

6 Ways Airlines and Hotels Can Keep Their Networks Secure

Dark Reading

As recent news can attest, travel and hospitality companies are prime targets for cybercriminals. Here are six privacy and security tips that can help lock down privacy and security.

article thumbnail

7 Pitfalls for Apache Cassandra in Production

Apache Cassandra is an open-source distributed database that boasts an architecture that delivers high scalability, near 100% availability, and powerful read-and-write performance required for many data-heavy use cases. However, many developers and administrators who are new to this NoSQL database often encounter several challenges that can impact its performance.

article thumbnail

IAM: Balancing Security With Employees' Needs

Data Breach Today

John Bennett of LastPass by LogMeIn on Crafting an Effective IAM Strategy When crafting an identity and access management strategy, organizations need to balance the need for improved security with giving employees the freedom they need to do their jobs, says John Bennett of LastPass by LogMeIn.

Security 138
article thumbnail

FTC’s Authority to Obtain Monetary Relief is in Doubt

Data Matters

The U.S. Court of Appeals for the Seventh Circuit has struck a major blow to Federal Trade Commission (FTC) enforcement authority, holding that the agency cannot seek its preferred remedy of monetary restitution in federal court. In recent years, the FTC has used Section 13(b) of the Federal Trade Commission Act (FTC Act) 1 as its preferred enforcement mechanism, and it has done so to great effect.

Privacy 68
article thumbnail

New Agency's Role in Protecting Critical Infrastructure

Data Breach Today

Brian Harrell of CISA Addresses the Need for Collaboration With new threats targeting the nation's critical infrastructure, partnerships among government and private-sector security professionals are more critical than ever, says Brian Harrell of the new U.S. Cybersecurity and Infrastructure Security Agency.

article thumbnail

The Threat of Fake Academic Research

Schneier on Security

Interesting analysis of the possibility, feasibility, and efficacy of deliberately fake scientific research, something I had previously speculated about.

83
article thumbnail

Reimagined: Building Products with Generative AI

“Reimagined: Building Products with Generative AI” is an extensive guide for integrating generative AI into product strategy and careers featuring over 150 real-world examples, 30 case studies, and 20+ frameworks, and endorsed by over 20 leading AI and product executives, inventors, entrepreneurs, and researchers.

article thumbnail

Employers Beware: Microsoft Word ‘Resume’ Phish Delivers Quasar RAT

Threatpost

A round of phishing emails purports to be from job seekers - but actually uses a slew of detection evasion tactics to download malware on victim systems.

article thumbnail

Jamf/Microsoft partnership pays off big for bol.com

Jamf

Thanks to a Jamf/Microsoft partnership, one of the Netherland's largest eCommerce platforms: bol.com, now has an automated compliance management solution for Mac devices accessing applications set up with Azure Active Directory authentication.

article thumbnail

The Right to Be Patched: How Sentient Robots Will Change InfoSec Management

Dark Reading

It won't be long before we consider embodied AI as a form of "life" - and that will have a variety of paradigm-shifting, somewhat irritating, and potentially hilarious impacts on the daily lives of cybersecurity and privacy professionals.

Privacy 71
article thumbnail

Jamf/Microsoft partnership pays off big for bol.com

Jamf

Thanks to a Jamf/Microsoft partnership, one of The Netherland's largest eCommerce platforms: bol.com, now has an automated compliance management solution for Mac devices accessing applications set up with Azure Active Directory authentication.

article thumbnail

How to Migrate From DataStax Enterprise to Instaclustr Managed Apache Cassandra

If you’re considering migrating from DataStax Enterprise (DSE) to open source Apache Cassandra®, our comprehensive guide is tailored for architects, engineers, and IT directors. Whether you’re motivated by cost savings, avoiding vendor lock-in, or embracing the vibrant open-source community, Apache Cassandra offers robust value. Transition seamlessly to Instaclustr Managed Cassandra with our expert insights, ensuring zero downtime during migration.

article thumbnail

Hackers Could Steal a Tesla Model S by Cloning Its Key Fob—Again

WIRED Threat Level

The same researchers who figured out how to clone a Tesla Model S key fob have done it again, cracking the replacement that was meant to fix the problem.

IT 72
article thumbnail

Oil and Gas Firms Targeted By New LYCEUM Threat Group

Threatpost

A new threat group has been discovered targeting Middle Eastern critical infrastructure firms with spearphishing emails laced with malware.

76
article thumbnail

Using data across a hybrid environment to train machine learning models

IBM Big Data Hub

Machine learning (ML) is rapidly helping businesses derive better insight and optimize their day-to-day operations. Yet an ML model is only as good as the data used to train and continually improve it. With the majority of enterprise companies already using a hybrid cloud, accessing domain-specific data you need can be challenging.

Cloud 63