NVD slowdown leaves thousands of vulnerabilities without analysis data

March 22^nd 2024 at 13:45

Security world reacts as NIST does a lot less of oft criticized, 'almost always thankless' work

Opinion The United States National Institute of Standards and Technology (NIST) has almost completely stopped adding analysis to Common Vulnerabilities and Exposures (CVEs) listed in the National Vulnerability Database. That means big headaches for anyone using CVEs to maintain their security. …

Security world reacts as NIST does a lot less of oft criticized, 'almost always thankless' work

The device that makes it possible is required in all American big rigs, and has poor security

You better watch out, you better not cry, better not pout, they're telling you why

Redmond says it does what it's told, but still thinks users are better off

At least we can all agree on something

MarineMax may be in choppy waters after 'stolen data' given million-dollar price tag

Security experts insist ransomware is involved but Leicester zips its lips

Operators pack twenty phones into a chassis – then rack 'em and stack 'em ready to do evil

New infostealer may indicate a shift in tactics – and maybe targets too, beyond Asia

Phishing season started early with crims intent on the hooking early filers

From a trickle to a flood, threats now seen as too great to ignore

First: Not being able buy a meat pie with a credit card. Now this

Robert Purbeck even went as far as threatening a dentist with the sale of his child’s data

At least 31,031 people affected last year

Unless you want to be the next Change Healthcare, that is

Also down under, researchers find security-cleared workers leaking details of their gigs

Plus potential links to I-Soon, researchers say

Latest figures paint grim picture of how viciously the elderly are targeted

Innovative Ethereum feature exploited as victims say goodbye to assets

Ailing tech integrator takes a hard hit... share price down by up to 20% this morning

Warning: Poorly configured Google Cloud databases spill billing info, plaintext credentials

Sneaky software slips past shields, spurring scramble

A huge attack surface for a vulnerability with various PoCs available

Telco reckons data is old, isn't from its systems

Virtual gunslingers forcibly became cheaters via mystery means

But failing to recover from incidents is unforgivable because 'adrenalin does not scale'

875 workers liberated after falling for promises of lucrative work, nine arrested

As ransomware becomes more sophisticated, detection tools should be upgraded to cover every site and location

Also: Roblox-themed infostealer on the prowl, telco insider pleads guilty to swapping SIMs, and some crit vulns

Supply-chain attacks are definitely possible and could lead to data theft, system hijacking, and more

Wave of Okta attacks mark what researchers are calling the biggest security trend of the year

Made public highly sensitive data on complaints about Metropolitan Police Service

Uncle Sam can use this snooping tool, too, but that's beside the point

Imagine trying to trick folks into buying $500 of unnecessary repairs – and they turn out to be federal agents

Canadian-Russian said to have turned to a life of cybercrime during pandemic, now must pay the price – literally

Rare occasion when you do want Big Tech to make a hash of it

Zut alors! Department for registering and helping unemployed people broken into

Will the WEF experiment work?

Services slowly coming back online but providers still struggling

Bill proposes to do to China what China already does to the US – make life hard for foreign social networks

Akira ransomware crooks brag of swiping thousands of ID documents during break-in

A $2M drop from previous year. So … things are more secure?

Bitcoin Fog washed hundreds of millions for criminals

Automated AI helper intended to make security more manageable

27,000 individuals had data stolen, which for some included names and social security numbers

Why creating a layered defensive strategy that includes security by design can help address cloud challenges

Infosec folk aren’t thrilled that if you poke APIs enough, you learn AI's secrets

Critical bugs galore among 61 Microsoft fixes, 56 from Adobe, a dozen from SAP, and a fistful from Fortinet

Exec accused of using own work PC to swipe confidential AI and staffing docs for stealth cloud startup

Plus almost $1.5b for health-care cybersecurity

War of words wages on between vendors divided

Targeting recovery this week, officials still trying to 'dentify the nature of the incident'

Russia and Sudan top the list of suspects

US senator calls cyber attack 'inexcusable,' calls for mandatory security rules

Don't worry, we have a strong suspicion Putin's still gonna win

Five months in and the mammoth post-ransomware recovery has barely begun

And does it count as consent?

PLUS: NSA shares cloud security tips; Infosec training for Jordanian women; Critical vulnerabilities

Plus: CISA pulls plug on couple of systems feared compromised

Still 'no evidence' of any compromised customer-facing systems, we're told