Week in review: TLS 1.3, full-time bug hunting, vulnerable MS Exchange servers abound
Here’s an overview of some of last week’s most interesting news, articles and podcasts:
TLS 1.3: Slow adoption of stronger web encryption is empowering the bad guys
TLS provides secure communication between web browsers, end-user facing applications and servers by encrypting the transmitted information, preventing eavesdropping or tampering attacks.
Video conferencing for teams and consumers: What is the right choice for you?
Though some claim that this forced “work from home” situation has shown that many of the discussions that previously required office meetings can actually be expedited simply by exchanging a few emails, there’s no doubt that, for some tasks, face-to-face meetings – even if over the internet – are a must.
Actively exploited MS Exchange flaw present on 80% of exposed servers
Attackers aiming to exploit CVE-2020-0688, a critical Microsoft Exchange flaw patched by Microsoft in February 2020, don’t have to look hard to find a server they can attack.
Two critical Firefox vulnerabilities exploited by attackers, patch now!
Mozilla has released critical security updates for Firefox and Firefox ESR, patching two vulnerabilities that are being actively exploited by attackers.
Full-time bug hunting: Pros and cons of an emerging career
Being a bug hunter who discloses their discoveries to vendors (as opposed to selling the information to the highest bidder) has been and is an ambition of many ethical hackers.
Threat detection and the evolution of AI-powered security solutions
Ashvin Kamaraju, CTO and VP of Engineering for Thales Cloud Protection & Licensing, discusses automation, artificial intelligence, machine learning and the challenges related to detecting evolving threats.
APT attacks targeting Linux, Windows and Android remained undetected for nearly a decade
Five related APT groups operating in the interest of the Chinese government have systematically targeted Linux servers, Windows systems and mobile devices running Android while remaining undetected for nearly a decade, according to BlackBerry.
April 2020 Patch Tuesday forecast: Uncertainty reigns, but patching endures through pandemic
COVID-19 has been not only a threat in a physical sense, but also generated one of the larger cybersecurity threats in recent memory. Attackers have built on the public’s need for the latest, global COVID-19 information by creating widespread phishing attacks.
5 questions about website and brand security every business owner should ask
Adding security to the overall business strategy should initiate five key questions to ensure you are making informed decisions for the safety of your brand and your customers.
A client-side perspective on web security
The web security community has long recognized the need to deploy functional controls to safeguard the server-side vulnerability of web servers delivering content and capability to client browsers. Too little attention, however, has been placed on this client-side vulnerability, which is attractive to attackers and largely ignored by today’s security infrastructure.
Radio frequency: An invisible espionage threat to enterprises
Foreign governments, competitors and cyber criminals are all conducting radio-based attacks on enterprises.
Know thy enemy: The evolving behaviors of today’s cybercriminals
Organizations in the energy/utilities, government, manufacturing, and healthcare sectors have witnessed an increase in cyberattacks over the past year. As these industries evolve and become more digitized, attackers have the opportunity to access more data than ever before.
10 considerations in order to ensure business continuity for PKI
At the core of enterprise IT, PKI is a fundamental tool used to protect sensitive data and secure connections across multiple business-critical applications. In fact, the average PKI today supports more than eight different applications, from customer-facing websites and services to private network and VPN access. If PKI is mishandled, though, it can create significant disruption and application downtime.
Qualys VMDR: Discover, prioritize, and patch critical vulnerabilities in real time
In this podcast, Prateek Bhajanka, VP of Product Management, Vulnerability Management, Detection and Response at Qualys, discusses how you can significantly accelerate an organization’s ability to respond to threats.
On-demand webinar: Securing your remote workforce
Join Wes Hutcherson, Director of Product Marketing, and Mark Sangster, VP and Industry Security Strategist, as they explore risks associated with remote workers and the security strategies, controls and services you can quickly deploy to reduce risk.
Given the extent of the COVID-19 virus diffusion around the globe and the repercussions it has had on our private and working lives, we have inevitably covered a variety of new threats and security implications related to it:
What do CISOs want from cybersecurity vendors right now?
As COVID-19 spreads across the globe, what challenges are CISOs and other cybersecurity executives dealing with and what things they don’t want to be dealing with at the moment?
Cybersecurity during the pandemic: Try these security solutions for free!
In order to help global organizations of all sizes address cybersecurity during the COVID-19 pandemic, a number of vendors provide free (time-limited) access to their solutions.
Beware of fake COVID-19-themed emails from President Trump
Researchers with anti-phishing startup Inky have spotted two phishing emails purportedly coming from the White House, “signed” by President Trump.
Spotting and blacklisting malicious COVID-19-themed sites
Since last December, over 136,000 new COVID-19-themed domains have popped up and, while many host legitimate websites, others have been set up to serve malware, phishing pages, or to scam visitors.
Cybercrime and disinformation during the pandemic
Cybercrime is evolving since criminals have been quick to seize opportunities to exploit the pandemic by adapting their tactics and engaging in new criminal activities.
Cybercriminals capitalize on COVID-19 fears, push shady websites, pharmaceuticals
NormShield researchers looked for websites using the names of 10 commonly discussed drugs over the last several months. They found a dramatic spike in the number of sites generated to get the attention of scared shoppers looking for coronavirus cures.