Week in review: API security risks, Office 365 security pain points
Here’s an overview of some of last week’s most interesting news and articles:
Sessions, events and seminars to check out at RSA Conference 2020
RSA Conference 2020 takes place next week in San Francisco. Here’s a brief overview of what to check out while you’re at the conference.
US gas pipeline shut down due to ransomware
An unnamed US gas pipeline operator has falled victim to ransomware, which managed to encrypt data both on its IT (information technology) and operational technology (OT) networks and led to a shutdown of the affected natural gas compression facility, the Cybersecurity and Infrastructure Security Agency (CISA) has revealed.
Researchers observed a 125% increase in malware targeting Windows 7
For the 2020 Webroot Threat Report, researchers analyzed samples from more than 37 billion URLs, 842 million domains, 4 billion IP addresses, 31 million active mobile apps, and 36 billion file behavior records.
10 hot industry newcomers to watch at RSA Conference 2020
The RSA Conference 2020 Early Stage Expo is an innovation space dedicated to promoting emerging talent in the industry. Here are some of the most exciting companies exhibiting innovative products and solutions, which you can see in person in the San Francisco Ballroom, Moscone South, Level 2.
Take your SOC to the next level of effectiveness
Organizations are turning to Breach and Attack Simulation (BAS) integration with the SOC. BAS integration with SIEM and SOAR solutions enables SOC teams to continually evaluate the effectiveness of their security controls and improve the company’s security posture with real-time, accurate metrics.
Free trojanized WordPress themes lead to widespread compromise of web servers
Over 20,000 web servers (and who knows how many websites) have been compromised via trojanized WordPress themes to deliver malware through malicious ads, Prevailion researchers have discovered.
A third of all vulnerabilities in 2019 had a CVSS v2 score of 7.0 and above
Risk Based Security’s VulnDB team aggregated 22,316 newly-disclosed vulnerabilities during 2019, finding that 37.26% had available exploit code or a Proof of Concept and that 33.43% of all vulnerabilities in 2019 had a CVSS v2 score of 7.0 and above.
What is flowing through your enterprise network?
According to SophosLabs, nearly one-third of malware and unwanted applications enter the enterprise network through TLS-encrypted flows.
SecOps teams face challenges in understanding how security tools work
Security professionals are overconfident in their tools with 50% reporting that they have experienced a security breach because one or more of their security products was not working as expected, according to Keysight.
Test CISSP knowledge with interactive flash cards
Study for the CISSP exam anytime, anywhere using Official (ISC)² CISSP flash cards. This free interactive self-study tool tests knowledge across all eight CISSP domains and gives you immediate feedback to reinforce learning.
Looking at the future of identity access management (IAM)
While some of the wildest technology expectations from the big and small screen may not have come to fruition, the last decade of identity and access management development didn’t let us down.
Three API security risks in the wake of the Facebook breach
Facebook recently pledged to improve its security following a lawsuit that resulted from a 2018 data breach. The breach, which was left open for more than 20 months, resulted in the theft of 30 million authentication tokens and almost as much personally identifiable information.
The challenges of cyber research and vulnerability disclosure for connected healthcare devices
As Head of Research at CyberMDX, Elad Luz gathers and analyzes information on a variety of connected healthcare devices in order to improve the techniques used to protect them and/or report about their security issues to vendors. The research includes analyzing protocols, reverse engineering software, and conducting vulnerability tests.
Focus on cyber resilience increasing sharply as oil companies seek to protect their assets
Cybersecurity has emerged as the top focus of upstream oil and gas companies’ digital investments, according to a report from Accenture.
The top four Office 365 security pain points
Many novice Office 365 (O365) shops do not know where platform-specific security vulnerabilities lie, or even that they exist. The threats that you are unaware exist do not cause pain until they rise up and bite – then the agony is fierce.
Most credential abuse attacks against the financial sector targeted APIs
From May 2019 and continuing on until the end of the year, there was a dramatic shift by criminals who started targeting APIs, in an effort to bypass security controls. According to data from Akamai, up to 75% of all credential abuse attacks against the financial services industry targeted APIs directly.
Jon Callas: Encryption is a technology that rearranges power
In anticipation of his keynote at HITB Security Conference 2020 in Amsterdam, we talked to Jon Callas, a world-renowned cryptographer, software engineer, UX designer, and entrepreneur.
Are CISOs ready for zero trust architectures?
A true full-scale transition to a zero trust architecture will require more than just changes to network, application and supporting technologies – it will also need to drive large scale security and general IT policies or be driven by a large scale transformation program. And as usual, training will play a big role.
Factbook: Healthcare IT practices and cyber preparedness
In 2019, at least 10 hospitals turned away patients due to a compromised ability to deliver care following cyber attacks. Less dramatically, in 2019 the industry suffered a record 40-plus million breached medical records. That’s close to 3X as many breached records as were tallied in 2018, which itself represented a 3X increase over 2017.