Week in review: PoC for Windows Print Spooler flaw leaked, conquering synthetic identity fraud
Here’s an overview of some of last week’s most interesting news and articles:
PoC for critical Windows Print Spooler flaw leaked
Microsoft has confirmed that the so-called PrintNightmare vulnerability (CVE-2021-34527) is not the same flaw as the previously patched CVE-2021-1675, and that the leaked PoC exploits can be used to exploit this RCE zero-day.
Cisco security devices targeted with CVE-2020-3580 PoC exploit
Attackers and bug hunters are leveraging an exploit for CVE-2020-3580 to compromise vulnerable security devices running Cisco ASA or FTD software.
Navigating the complexity of ransomware negotiations
Most ransomware attacks are opportunistic, and at the end of the day, cybercriminals do not discriminate. Nobody plans to fall victim, but the fact is any company with an internet presence, regardless of size, is at risk.
XDR: Security’s new frontier
Enabling enterprises to go above and beyond typical security functionality, extended detection and response (XDR) provides a much simpler, single pane of glass view that seamlessly integrates multiple security products into one system.
Unstructured data still overshared inside and outside organizations
The number of overshared files rose 450 percent compared to the same quarter in 2020, highlighting the significant impact of the pandemic and remote work on data security.
How IoT is keeping businesses connected in an expanding network
IoT is advancing the technical lives of millions, with the network of connected devices becoming more populated with each passing year. From toothbrushes to toasters, IoT has reached new heights in terms of consumer devices. Look past these however, and it is clear that IoT is indeed a serious proposition for enterprises and an essential ingredient for successful business transformation.
New security measures to keep Google Play safe
Google is announcing two new security measures aimed at minimizing the number of malicious / potentially unwanted apps available for download from the Google Play Store: additional Android developer identification requirements and 2-step verification.
USB threats could critically impact business operations
According to a report released by Honeywell, USB threats that can severely impact business operations increased significantly during a disruptive year when the usage of removable media and network connectivity also grew.
A closer look at Google Workspace privacy and data security
Google recently unveiled the next evolution of Google Workspace, including new security and privacy capabilities to help users take advantage of trusted, cloud-native collaboration.
Consumers neglecting mobile security despite growing number of threats
A new McAfee report reveals that 49% of U.S. consumers do not use mobile security software to protect their sensitive data, thus leaving them vulnerable to these increasingly advanced cyberattacks.
Zero day malware reached an all-time high of 74% in Q1 2021
74% of threats detected in Q1 2021 were zero day malware – or those for which a signature-based antivirus solution did not detect at the time of the malware release – capable of circumventing conventional antivirus solutions, according to WatchGuard.
Regula: Open source policy engine for IaC security
Fugue announced Regula 1.0, an open source policy engine for infrastructure as code (IaC) security. Available at GitHub, the tool includes support for common IaC tools such as Terraform and AWS CloudFormation, prebuilt libraries with hundreds of policies that validate AWS, Microsoft Azure, and Google Cloud resources, and new developer tooling to support custom rules development and testing with Open Policy Agent.
Major threats to cloud infrastructure security include a lack of visibility and inadequate IAM
98% of companies had experienced at least one cloud data breach in the past 18 months compared to 79% last year, according to an IDC survey. Meanwhile, 67% reported three or more such breaches, and 63% said they had sensitive data exposed.
Protecting your organizations against BEC and other email attacks
Business Email Compromise (BEC) attacks are skyrocketing as organizations rely on decades-old email protocols and standards, and bad actors perfect social engineering.
How do I select a big data solution for my business?
To select a suitable big data solution for your business, you need to think about a variety of factors. We’ve talked to several industry professionals to get their insight on the topic.
Technical certifications demand growing, most IT employees have at least one
Technical certifications are increasingly in demand with 87% of IT employees possessing at least one and 40% pursuing their next. According to Questionmark, certification bodies must ensure they can quickly deliver, and robustly assess, their programs to meet new levels of demand.
How to conquer synthetic identity fraud
Synthetic fraud is today’s fastest-growing type of financial crime. To make matters worse, up to 95% goes undetected by regular fraud models, as these actors behave, act and look like regular customers that neither the human eye nor highly complex computer vision methods would have detected.
Resilience by design: What security pros need to know about microlearning
Microlearning delivers digestible bits of information specifically designed for the learner to retain in a short period of time. Common microlearning content includes videos, simulations, quizzes and more. Sounds simple enough, right?
Threat modeling needs a reset
Organizations need to rethink their approach to threat modeling or risk losing its value as a key defense in their cybersecurity arsenals.
Download: The CISO’s Guide to Third-Party Security Management
In this comprehensive guide, we provide the direction you need to make your organization’s third-party security program efficient and scalable.