Intel reportedly remediated all of the issues identified by Google

Read More

Leading cybersecurity response firms Accenture, IBM, and Mandiant have joined the Elite Cyber Defenders Program – a new, collaborative initiative designed to help secure critical infrastructure. Led by Nozomi Networks, the program aims to provide global industrial and government customers access to strong cybersecurity defense tools, incident response teams, and threat intelligence.

The Elite Cyber Defenders Program was announced during RSA Conference in San Francisco and comes as the cyberthreats posed to global critical infrastructure remain high. This week, it was revealed that the group responsible for the supply chain attack against VoIP company 3CX also breached two critical infrastructure organizations in the energy sector. Last week, the UK National Cyber Security Centre (NCSC) warned of a new class of Russian cyber adversary threatening critical infrastructure organizations.

To read this article in full, please click here

Read More

Eurocontrol, the European air traffic control agency, has revealed that it has been under cyber attack for the last week, and says that pro-Russian hackers have claimed responsibility for the disruption.

When you first see the headline in the likes of the Wall Street Journal, it’s a scary thing to read.

But dig a little deeper, and you realise that the err.. sky is not falling.

Read more in my article on the Hot for Security blog.

Read More

Cloud-based email security provider Abnormal Security has announced three new capabilities focusing on threat detection for Slack, Microsoft Teams, and Zoom.

The company — focused on protecting enterprises from targeted email attacks, such as phishing, social engineering, and business email compromise — is also adding data ingestion from new sources to better its AI model, which maps user identity behavior.

To read this article in full, please click here

Read More

The DoJ’s Lisa Monaco urges organizations to work with the federal government following cyber-incidents

Read More

Amazon Web Services (AWS) has added three new capabilities to its threat detection service Amazon GuardDuty. The new features expand GuardDuty protection to container runtime behavior, as well as database and serverless environments, strengthening customer security through enhanced coverage, AWS said.

GuardDuty is part of a broad set of AWS security services that help customers identify potential security risks. It uses machine learning and integrated threat intelligence to detect suspicious data access, potential Amazon Elastic Compute Cloud (Amazon EC2) compromise, and malware.

The three new capabilities are EKS Runtime Monitoring, RDS Protection, and Lambda Protection. These have been added to the hundreds of features already available within GuardDuty and can be enabled with no other requirements or prerequisites, according to AWS.

To read this article in full, please click here

Read More

Cybersecurity company Circle Security has emerged from stealth with the release of a new platform “purpose-built” to protect against credential-driven threats and cloud attacks. Powered by a decentralized architecture, Circle is available as a device-native service, a mobile app, a browser-based solution, and via a developer-focused API, according to the firm.

Circle Security boasts an impressive advisory board featuring several high-profile cybersecurity thought leaders including Bruce Schneier, Lucia Milica, global CISO of Proofpoint, and Eric Liebowitz, CISO of Thales Group.

Credential-driven data breaches are the biggest threat vector for most companies. Cybercriminals are prioritizing stolen credentials for use in attacks, with weak credentials significant contributors to cloud security risks. Meanwhile, access brokers – criminal groups that sell stolen access credentials – have become a key component of the eCrime threat landscape.

To read this article in full, please click here

Read More

Researchers have found thousands of publicly exposed and misconfigured container registries and artifact repositories belonging to businesses that could give attackers access to access tokens, encryption keys, and other sensitive information about internal systems. This information can allow attackers to plan and execute attacks against production and development systems, and in some cases even inject malicious code into repositories.

“In many cases artifact management systems and container registries are connected to the internet deliberately and by design allowing anonymous users to connect to various areas in the registry or even to the entire registry,” researchers from cloud security firm Aqua Security said in a report. “This design allows global teams, customers, and other stakeholders access to open-source software that is shared across the company or with outside users. In some cases, however, restricted environments are accidentally shared with anonymous users; in other cases teams accidentally publish sensitive information to public areas.”

To read this article in full, please click here

Read More