HackerOne, a bug bounty platform provider, offered a blueprint for greater corporate security responsibility and called for a shift from secrecy to transparency when dealing with vulnerabilities in a report released Thursday.

Organizations are increasingly scrutinizing the practices of their suppliers, basing procurement decisions on security credentials and switching suppliers should the company have experienced a security incident, the report noted. Demonstrating secure best practices is now a competitive differentiator.

To read this article in full, please click here

Read More

The dangerous Linux privilege escalation flaw dubbed Dirty Pipe that was recently disclosed could also impact applications and systems that use containerization through tools such as Docker, researchers warn. This follows a different privilege escalation vulnerability that was patched last week and could lead to container escapes.

Dirty Pipe “could enable an attacker to effectively modify containers that are running against a shared image, or to poison an image on a host so that new containers would receive modified files,” researcher Rory McCune from cloud security firm Aqua Security said in a blog post.

To read this article in full, please click here

Read More

It has been interesting to notice how unimportant and ineffective cyber operations have been in the Russia-Ukraine war. Russia launched a wiper against Ukraine at the beginning, but it was found and neutered. Near as I can tell, the only thing that worked was the disabling of regional KA-SAT SATCOM terminals.

It’s probably too early to reach any conclusions, but people are starting to write about this, with varying theories.

I want to write about this, too, but I’m waiting for things to progress more.

Read More

The research indicates that MSPs are becoming more of a primary target for cyber-criminals than their customers

Read More

As bombs fly in Ukraine, datacenter owners are urged to take action

Read More

Report dives into recent leak of internal data on ransomware group

Read More

The Ukraine-Russia conflict has raised the question of whether organizations should stop using Russian-made security and tech products and the risks of continuing to do so in the current situation. CSO spoke with security leaders, researchers, and analysts about this significant issue and the implications for CISOs, businesses, and the wider sector.

Ending use of Russian security and tech products

“From a moral standpoint, CISOs should absolutely stop using Russian-made security and technology products. However, from a security-related standpoint, it’s much murkier,” says Shawn Smith, researcher and director of infrastructure at nVisium. “There is always conflict in the world, and while you should always evaluate backups in situations like this, the products created by Russians aren’t any less secure now than they were a month ago.”

To read this article in full, please click here

Read More