HackerOne, a bug bounty platform provider, offered a blueprint for greater corporate security responsibility and called for a shift from secrecy to transparency when dealing with vulnerabilities in a report released Thursday.

Organizations are increasingly scrutinizing the practices of their suppliers, basing procurement decisions on security credentials and switching suppliers should the company have experienced a security incident, the report noted. Demonstrating secure best practices is now a competitive differentiator.

To read this article in full, please click here

Read More

The dangerous Linux privilege escalation flaw dubbed Dirty Pipe that was recently disclosed could also impact applications and systems that use containerization through tools such as Docker, researchers warn. This follows a different privilege escalation vulnerability that was patched last week and could lead to container escapes.

Dirty Pipe “could enable an attacker to effectively modify containers that are running against a shared image, or to poison an image on a host so that new containers would receive modified files,” researcher Rory McCune from cloud security firm Aqua Security said in a blog post.

To read this article in full, please click here

Read More

It has been interesting to notice how unimportant and ineffective cyber operations have been in the Russia-Ukraine war. Russia launched a wiper against Ukraine at the beginning, but it was found and neutered. Near as I can tell, the only thing that worked was the disabling of regional KA-SAT SATCOM terminals.

It’s probably too early to reach any conclusions, but people are starting to write about this, with varying theories.

I want to write about this, too, but I’m waiting for things to progress more.

Read More

The research indicates that MSPs are becoming more of a primary target for cyber-criminals than their customers

Read More

As bombs fly in Ukraine, datacenter owners are urged to take action

Read More

Report dives into recent leak of internal data on ransomware group

Read More

The Ukraine-Russia conflict has raised the question of whether organizations should stop using Russian-made security and tech products and the risks of continuing to do so in the current situation. CSO spoke with security leaders, researchers, and analysts about this significant issue and the implications for CISOs, businesses, and the wider sector.

Ending use of Russian security and tech products

“From a moral standpoint, CISOs should absolutely stop using Russian-made security and technology products. However, from a security-related standpoint, it’s much murkier,” says Shawn Smith, researcher and director of infrastructure at nVisium. “There is always conflict in the world, and while you should always evaluate backups in situations like this, the products created by Russians aren’t any less secure now than they were a month ago.”

To read this article in full, please click here

Read More

As a mother and 20-year veteran of the cybersecurity industry, I know firsthand the uphill battle women in cybersecurity face.

Shortly before I gave birth to my daughter, a well-known industry leader excitedly encouraged me to teach security courses, promising that I could easily move up the ranks if only I taught some regional classes, which ultimately would qualify me to travel to bigger conferences where I could teach to a wider audience and make the big bucks.

He didn’t realize how insane this all sounded.

Spend weeks teaching at security conferences? Who would watch my baby? Where would I breastfeed?  Would I make enough money to pay a sitter to stay overnight with my children? Even if I did, how would my baby/toddler fare with me being on the road? It wasn’t a realistic career choice for me then. Judging by how few women there are among the ranks of cybersecurity instructors today, it remains unrealistic career choice for many of us. This is not a coincidence, but a result of the skewed selection process and a work model that doesn’t enable primary caregivers to participate. This gender gap extends throughout our profession.

To read this article in full, please click here

Read More

Researcher finds pro-Ukraine hacktivists are having an impact

Read More