FreshRSS

🔒
❌ About FreshRSS
☷
△ 🔃
There are new available articles, click to refresh the page.
Before yesterdaySecurity

CISA Alert: Oracle E-Business Suite and SugarCRM Vulnerabilities Under Attack

By Ravie Lakshmanan
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on February 2 added two security flaws to its Known Exploited Vulnerabilities (KEV) Catalog, citing evidence of active exploitation. The first of the two vulnerabilities is CVE-2022-21587 (CVSS score: 9.8), a critical issue impacting versions 12.2.3 to 12.2.11 of the Oracle Web Applications Desktop Integrator product. "Oracle

Former Ubiquiti dev pleads guilty in data theft and extortion case

Nickolas Sharp now faces up to 35 years in prison

A former Ubiquiti Networks employee accused of hatching an elaborate plot to first steal nearly $2 million from his employer, extort more, then later orchestrating a smear campaign against the company pleaded guilty to multiple felony charges Thursday.…

  • February 3rd 2023 at 01:30
  • ↗

Weekly Update 333

By Troy Hunt
Weekly Update 333

Getting everything out nice and early today so we can get out there in hit the wake park in the balmy "well over 30C" weather (the radio is talking about "severe heatwave weather" as I write this). But hey, we're surrounded by water and a beer delivery is due today so no crisis 😎 There's also a heap more data breach news and I'll be putting that connected BBQ to use for the first time today, stay tuned for epic pics on all of the above over the coming hours!

Weekly Update 333
Weekly Update 333
Weekly Update 333
Weekly Update 333

References

  1. HTTPS still doesn't equal trust, it never did, it never will and Aussie Broadband were way off the mark to imply otherwise (they did later recant on that position, but the messaging still isn't completely right)
  2. Namesco in the UK sent out messaging to customers which shows they have absolutely no idea about some of the most basic, fundamental tents of how SSL works (hoping we get a follow-up on this, it's inexcusable in this day and age)
  3. Planet Ice in the UK was breached (240k people with 82% of them already in HIBP)
  4. Pitt Meadows School District in British Columbia was breached (only 0.1% of accounts were already in HIBP)
  5. I'm getting seriously sick of the lack of proper disclosure from many organisations (it really isn't this hard - it shouldn't be this hard)
  6. I bought a connected BBQ! (stay tuned for deliciousness 🤤)
  7. Sponsored by: CrowdSec - Gain crowd-sourced protection against malicious IPs and benefit from the most accurate CTI in the world. Get started for free.

Netflix’s US Password-Sharing Crackdown Isn’t Happening—Yet

By Lily Hay Newman
Accidental revisions to a US Help Center page sparked confusion about the streamer's next moves. But restrictions on account sharing are still coming soon.

Korelock Launches IOT Smart Lock Technology Company

Denver-based business secures Series A Funding through partnerships with Iron Gate Capital and Kozo Keikaku Engineering.
  • February 2nd 2023 at 21:05
  • ↗

Cyberattack on Fintech Firm Disrupts Derivatives Trading Globally

By Robert Lemos, Contributing Writer, Dark Reading
The Russia-linked LockBit ransomware group claims to be behind the attack that fouled automated transactions for dozens of clients of financial technology firm ION Group.

  • February 2nd 2023 at 20:53
  • ↗

Malvertising attacks are distributing .NET malware loaders

The campaign illustrates another option for miscreants who had relied on Microsoft macros

Malvertising attacks are being used to distribute virtualized .NET loaders that are highly obfuscated and dropping info-stealer malware.…

  • February 2nd 2023 at 19:27
  • ↗

6 Examples of the Evolution of a Scam Site

By Ericka Chickowski, Contributing Writer, Dark Reading
Examining some key examples of recently found fraud sites that target the lucrative retail shoe industry helps us understand how brand impersonation sites evolve.

  • February 2nd 2023 at 19:01
  • ↗

Rising 'Firebrick Ostrich' BEC Group Launches Industrial-Scale Cyberattacks

By Nate Nelson, Contributing Writer, Dark Reading
The group's wanton attacks demonstrate that business email compromise is everything a hacker can want in one package: low risk, high reward, quick, easy, and low effort.

  • February 2nd 2023 at 18:23
  • ↗

Patch Critical Bug Now: QNAP NAS Devices Ripe for the Slaughter

By Dark Reading Staff, Dark Reading
QNAP NAS devices are vulnerable to CVE-2022-27596, which allows unauthenticated, remote SQL code injection.

  • February 2nd 2023 at 16:08
  • ↗

Managing the Governance Model for Software Development in a No-Code Ecosystem

By Katherine Kostereva, CEO, Creatio
Forward-leading business and technology leaders are seeing the value of the "do-It-yourself" approach.

  • February 2nd 2023 at 15:00
  • ↗

AppSec Playbook 2023: Study of 829M Attacks on 1,400 Websites

The total number of 61,000 open vulnerabilities, including 1,700 critical ones that have been open for 180+ days, exposes businesses to potential attacks.

  • February 2nd 2023 at 15:00
  • ↗

Cybersecurity Leaders Launch First Attack Matrix for Software Supply Chain Security

Current and former cybersecurity leaders from Microsoft, Google, GitLab, Check Point, OWASP, Fortinet and others have already joined the open framework initiative, which is being led by OX Security.
  • February 2nd 2023 at 14:50
  • ↗

Are online surveys legit and safe? Watch out for survey scams

By Phil Muncaster

“Can I tell a legitimate survey apart from a fake one?” is the single most important question you need to answer for yourself before taking any surveys online

The post Are online surveys legit and safe? Watch out for survey scams appeared first on WeLiveSecurity

Clarity and Transparency: How to Build Trust for Zero Trust

By Sandy Hawke

Be impeccable with your words. It’s the first of the Four Agreements – a set of universal life principles outlined in the bestselling book by Don Miguel Ruiz. ‘Being impeccable with your words’ is my favorite, and it’s no surprise. As a product marketer, I spend most of my daily existence casting about for the perfect word to use in web copy, a webinar, or video script.

Words can connect us, as well as divide us. In helping to develop the message that Cisco takes to the market about zero trust, I try to be as impeccable as I can with each word. After all, cybersecurity is too important to be cavalier about what is possible – within a particular use case, product, or service.

Clarifying what zero trust means to you comes first. The zero trust principles reflect another of the four agreements: ‘Don’t make assumptions’. Don’t assume that a user or device is trusted based on their presence on the network, their type of device, or any other aspect of the connection request. Instead, verify it.

At the same time, don’t assume that everyone in your organization is in accord with, or clear on the goals of a zero trust initiative. Confirm goals and clearly communicate them. Over the past year, I’ve met with several customers keen to embark on zero trust and generally those goals involve one or more of the following:

  • Modernizing user access – secure remote access for users to SaaS-based, and private, on-premises apps
  • Assessing and validating device health– increase visibility into device posture and using this data to make a policy decision (e.g., prompt users to self-remediate before getting access)
  • Accelerating cloud migration – accurately enforce micro-segmentation across your entire application landscape – at scale
  • Orchestrating SOC workflows – gain actionable insights to automate threat response across networks, cloud, endpoints, email, and applications
  • Securing mixed environments consistently apply a “never trust, always verify, least-privilege policy” across OT and IT networks, public and private clouds, managed and unmanaged devices, and employees and contractors.

The phrase zero trust does not inspire trust, clarity, or transparency. No name is perfect, but the challenge with calling an architecture that is consistent with a ‘never assume trust, always verify it, and enforce the principle of least-privilege’ policy ‘zero trust’ is that it sends the message that ‘one cannot ever be trusted’.

Changing the mindset of anyone is already a complex undertaking, but
starting off with a lack of trust (even if it’s only a word) doesn’t help.

Essential cultural accelerators to Zero Trust: Relationships drive Zero Trust

Zero trust is simply good security. Zero trust is a conversation about the totality of the security stack, and how to bring it to bear in ways that allow teams to…

  • consistently and continually verify user and device trust;
  • enforce trust-level access based on least privilege access;
  • and respond to change in trust to protect data and recover quickly from incidents.

Simply put, make sure that one only has access to resources they need and that any violations of this policy are investigated.

So… how do we build the trust necessary for zero trust adoption?

Relationships build trust – an essential ingredient for zero trust momentum. In the Harvard Business Review’s “Begin with Trust”, Frances Frei and Anne Morriss describe three key drivers for trust: authenticity, logic, and empathy. Perhaps we can apply these drivers within the context of zero trust security:

  • Authenticity – are we truly aligned on the goals of a zero trust rollout? Have we clearly communicated our intentions and progress to our users, business leaders, and other stakeholders?
    • How to cultivate: Be as transparent as possible. For example, share lessons learned – including mistakes – during each phase of the initiative. Publish dashboards and other reports on milestones and metrics (e.g., # of users enrolled, # of apps protected, etc.).
  • Logic – have we clearly explained the rationale behind the change in policy, user workflows, as well as the benefits of adopting zero trust?
    • How to cultivate: Appeal to everyone’s bottom line: saving money and making your job easier. Zero trust can save money (refer to our TEI studies and ROI blog article from CIO’s office) and done right, can simplify IT management and empower users to fix issues on their own.
  • Empathy – have we considered the impact on our users and how a move towards zero trust security can vastly improve the user experience?
    • How to cultivate: Remember a very simple yet essential concept. Whatever our role in the organization, we’re all users. The easier we make security controls – in other words, the less they get in the way of getting our work done, the better for all of us.

Next Steps

  • Listen to the conversation Wolfgang Goerlich, Advisory CISO, and I had during this on-demand webinar entitled “The Skeptic and the Data: How to Build Trust for Zero Trust”.
  • Explore Cisco’s rollout of zero trust using Duo for our 100,000+ users in more than 95 countries.
  • Download Cisco’s Guide to Zero Trust Maturity to see how teams with mature implementations of zero trust found quick wins and built organizational trust.

 

We’d love to hear what you think. Ask a Question, Comment Below, and Stay Connected with Cisco Secure on social!

Cisco Secure Social Channels

Instagram
Facebook
Twitter
LinkedIn

Building a secure and scalable multi-cloud environment with Cisco Secure Firewall Threat Defense on Alkira Cloud

By Anubhav Swami

In today’s security climate, NetOps and SecOps teams are witnessing increased attack surface area as applications and workloads move far beyond the boundaries of their data center. These applications/workloads move to, and reside in multi-cloud architecture, adding complexity to connectivity, visibility, and control. In the multi-cloud world, the SecOps teams use a distributed security model that is expensive, difficult to deploy, and complex to manage.

Cisco has partnered with Alkira to help secure your multi-cloud environment. Combining Alkira’s simplified cloud connection through their cloud network-as-a-service platform (SaaS-like model) with Cisco’s industry-leading security controls, we can deliver a centralized security model for multi-cloud architecture that is easy to deploy, manage, and increases visibility and control.

Cisco Secure Firewall Threat Defense Virtual provides unmatched security controls such as stateful firewalling, Snort3 IPS, URL filtering, malware defense, application visibility and control, and more. Additionally, with the purchase of Secure Firewall Threat Defense Virtual, you will receive license entitlement to Cisco SecureX, our open XDR and orchestration platform, helping you accelerate threat detection, investigation, and remediation.

Cisco Secure Firewall Management Center (FMC) is required for managing Secure Firewall Threat Defense Virtual, helping administrators enforce consistent access policies, rapidly troubleshoot security events, and view summarized reports across the deployment.

Secure Firewall Threat Defense Virtual is available on Alkira’s service marketplace through Bring-Your-Own-License (BYOL) and Pay-As-You-Go licensing options. Customers can seamlessly deploy and insert Secure Firewall in their Alkira Cloud Exchange Points (CXP).

Benefits of this integrated architecture include:

  • Simplified network and security architecture: Leverage fully automated insertion and service-chaining of Secure Firewall in a centralized security model for a streamlined network and security architecture.
  • Deeper visibility and control in multi-cloud environments: Enjoy simplified firewall insertion in a centralized security model to achieve both north-south and east-west traffic inspection capability for multi-cloud environments.
  • Unified security policy: Uniformly enforce firewall security policy across on-premises, cloud, and multi-cloud environments.
  • Greater visibility: Cloud-agnostic security controls offer deeper visibility and control across all platforms
  • Auto-scale: Cisco Secure Firewall provides a flexible architecture that can automatically scale with the network load to meet demand. The auto-scaled firewall instance receives the configuration and licenses automatically (Cisco Secure Firewall Threat Defense auto-scale coming in Q2CY23).

The Cisco Secure Firewall Threat Defense brings the following capabilities to the environment:

  • Stateful Firewall Inspection
  • Application Visibility & Control
  • Next-Generation Intrusion Prevention System (IPS)
  • URL Filtering
  • Malware Defense
  • Encrypted Traffic Visibility

Figure 1: Multi-cloud security architecture in Alkira Cloud Exchange Point with Cisco Secure Firewall

Figure 1 shows a multi-cloud environment inter-connected using Alkira Cloud Exhange Platform (CXP). In the above architecture, Cisco provides seamless insertion of security controls and enables the following use cases for firewall insertion:

  • Multicloud Security: Cisco Secure Firewall Threat Defense provides a centralized security model that enables better security controls, visibility, and network segmentation. This deployment offers north-south (N/S) and east-west (E/W) traffic inspection models.
  • Branch Security: Alkira Cloud Exchange Platform (CXP) connects branches and Cisco Secure Firewall Threat Defense protects N/S and E/W branch traffic.
  • Secure Internet Edge: Deployment of Cisco Secure Firewall inside CXP enables secure Internet edge for inbound and outbound Internet traffic.
  • Cloud DMZ: Enforce ingress firewall security policy for application traffic between remote users and Internet-facing applications deployed in the on-premises data centers or cloud environments.
  • Shared Application Services: Enforce firewall security policy for cross-segment application traffic in cases of business partner integration, mergers, acquisitions, and divestitures.

Firewall Insertion made easy

Using Alkira’s customer portal, Cisco Secure Firewall Threat Defense Virtual can be easily inserted in the traffic path within minutes. Figure 2 shows how automation & orchestration eliminates additional configuration required in the legacy insertion model.

Figure 2: Cisco Secure Firewall Threat Defense Virtual insertion

Management Options

Cisco Secure Firewall Threat Defense Virtual is managed using Cisco Secure Firewall Management Center (FMC). Customers can use on-premises FMC or build a virtual FMC instance in the cloud. Cisco and Alkira support both models of deployment.

Insertion models

Cisco Secure Firewall Threat Defense Virtual protects the following traffic flows in Alkira CXP:

  • Cloud to cloud (intra & Inter-cloud)
  • Cloud to on-premises
  • Cloud to Internet
  • On-premises to cloud
  • On-premises to Internet
  • Internet to on-premises
  • Branch to branch
  • Branch to Internet
  • Internet to branch

Alkira and Cisco’s partnership simplifies the deployment of enterprise-grade security in the cloud while enabling multi-cloud visibility and end-to-end threat defense for customers.

Additional Resources:

Cisco Secure Firewall Threat Defense

Cisco Secure Firewall Data Sheet

Cisco Secure Firewall Management Center

Alkira

Alkira Service Marketplace

Alkira blog on Cisco Secure Firewall Threat Defense

We’d love to hear what you think. Ask a Question, Comment Below, and Stay Connected with Cisco Secure on social!

Cisco Secure Social Channels

Instagram
Facebook
Twitter
LinkedIn

New Russian-Backed Gamaredon's Spyware Variants Targeting Ukrainian Authorities

By Ravie Lakshmanan
The State Cyber Protection Centre (SCPC) of Ukraine has called out the Russian state-sponsored threat actor known as Gamaredon for its targeted cyber attacks on public authorities and critical information infrastructure in the country. The advanced persistent threat, also known as Actinium, Armageddon, Iron Tilden, Primitive Bear, Shuckworm, Trident Ursa, and UAC-0010, has a track record of 

Super Bock says 'cyber' nasty 'disrupting computer services'

Portugal's biggest exporter of beer warns of restrictions to supply chain

Super Bock Group, Portugal's largest beverage biz, is warning of potential interruption to supplies as it manages the fallout from cybercrooks attacking its tech infrastructure.…

  • February 2nd 2023 at 11:15
  • ↗

Discrepancies Discovered in Vulnerability Severity Ratings

By Jai Vijayan, Contributing Writer, Dark Reading
Differences in how the National Vulnerability Database (NVD) and vendors score bugs can make patch prioritization harder, study says.

  • February 2nd 2023 at 11:01
  • ↗

Cybersecurity Budgets Are Going Up. So Why Aren't Breaches Going Down?

By The Hacker News
Over the past few years, cybersecurity has become a major concern for businesses around the globe. With the total cost of cybercrime in 2023 forecasted to reach $8 Trillion – with a T, not a B – it’s no wonder that cybersecurity is top of mind for leaders across all industries and regions. However, despite growing attention and budgets for cybersecurity in recent years, attacks have only become

North Korean Hackers Exploit Unpatched Zimbra Devices in 'No Pineapple' Campaign

By Ravie Lakshmanan
A new intelligence gathering campaign linked to the prolific North Korean state-sponsored Lazarus Group leveraged known security flaws in unpatched Zimbra devices to compromise victim systems. That's according to Finnish cybersecurity company WithSecure (formerly F-Secure), which codenamed the incident No Pineapple in reference to an error message that's used in one of the backdoors. Targets of

Lazarus Group Rises Again, to Gather Intelligence on Energy, Healthcare Firms

By Ericka Chickowski, Contributing Writer, Dark Reading
An OpSec slip from the North Korean threat group helps researchers attribute what was first suspected as a ransomware attack to nation-state espionage.

  • February 2nd 2023 at 09:00
  • ↗

New Threat: Stealthy HeadCrab Malware Compromised Over 1,200 Redis Servers

By Ravie Lakshmanan
At least 1,200 Redis database servers worldwide have been corralled into a botnet using an "elusive and severe threat" dubbed HeadCrab since early September 2021. "This advanced threat actor utilizes a state-of-the-art, custom-made malware that is undetectable by agentless and traditional anti-virus solutions to compromise a large number of Redis servers," Aqua security researcher Asaf Eitani 

Why CISOs Should Care About Brand Impersonation Scam Sites

By Ericka Chickowski, Contributing Writer, Dark Reading
Enterprises often don't know whose responsibility it is to monitor for spoofed brand sites and scams that steal customers' trust, money, and personally identifiable information.

  • February 1st 2023 at 23:36
  • ↗

Google boosts bounties for open source flaws found via fuzzing

Max reward per project integration is now $30k

Google sweetened the potential pot to $30,000 for bug hunters in its open source OSS-Fuzz code testing project.…

  • February 1st 2023 at 23:01
  • ↗

Nearly All Firms Have Ties With Breached Third Parties

By Robert Lemos, Contributing Writer, Dark Reading
The average organization does business with 11 third parties, and 98% of organizations do business with a third party who has suffered a breach, an analysis finds.

  • February 1st 2023 at 22:12
  • ↗

CISA to Open Supply Chain Risk Management Office

By Dark Reading Staff, Dark Reading
A new supply chain risk management office aims to help public and private sectors implement recent CISA policies and guidance.

  • February 1st 2023 at 21:31
  • ↗

Greater Incident Complexity, Shift in How Threat Actors Use Stolen Data, Will Drive the Cyber Threat Landscape in 2023, Says Beazley Report

Noting 13% year-over-year growth in fraudulent instruction as a cause of loss, report predicts organizations must get smarter about educating employees to spot fraudulent tactics.
  • February 1st 2023 at 20:58
  • ↗

Radiant Logic Signs Definitive Agreement to Acquire Brainwave GRC

Move will strengthen position as a leader in the identity governance and analytics market.
  • February 1st 2023 at 20:32
  • ↗

Inside Killnet: Pro-Russia Hacktivist Group's Support and Influence Grows

By Jai Vijayan, Contributing Writer, Dark Reading
Killnet is building its profile, inspiring jewelry sales and rap anthems. But the impact of its DDoS attacks, like the ones that targeted 14 major US hospitals this week, remain largely questionable.

  • February 1st 2023 at 20:20
  • ↗

Researchers Uncover New Bugs in Popular ImageMagick Image Processing Utility

By Ravie Lakshmanan
Cybersecurity researchers have disclosed details of two security flaws in the open source ImageMagick software that could potentially lead to a denial-of-service (DoS) and information disclosure. The two issues, which were identified by Latin American cybersecurity firm Metabase Q in version 7.1.0-49, were addressed in ImageMagick version 7.1.0-52, released in November 2022. <!--adsense--> A

Password-stealing “vulnerability” reported in KeePass – bug or feature?

By Paul Ducklin
Is it a vulnerability if someone with control over your account can mess with files that your account is allowed to access anyway?

Microsoft sweeps up after breaking .NET with December security updates

XPS doc display issues fixed – until the next patch, at least

Microsoft this week rolled out fixes to issues caused by security updates released in December 2022 that botched how XPS documents are displayed in various versions of .NET and .NET Framework.…

  • February 1st 2023 at 18:59
  • ↗

Beating the Odds: 3 Challenges Women Face in the Cybersecurity Industry

By Shikha Kothari, Senior Security Adviser, Eden Data
Companies need to be aware of the work culture they foster. Diversity and inclusion aren't just buzzwords. Increasing female visibility and improving female mentoring to help women enter and advance within the cybersecurity industry are key steps forward.

  • February 1st 2023 at 18:00
  • ↗
❌