Here’s an overview of some of last week’s most interesting news, articles, interviews and videos:
September 2022 Patch Tuesday forecast: No sign of cooling off
September is here, and for most of us in the northern hemisphere, cooler temperatures are on the way. Unfortunately, the need to maintain and update our computer systems remains hot.
DeadBolt is hitting QNAP NAS devices via zero-day bug, what to do?
A few days ago – and smack in the middle of the weekend preceding Labor Day (as celebrated in the U.S.) – Taiwan-based QNAP Systems has warned about the latest round of DeadBolt ransomware attacks targeting users of its QNAP network-attached storage (NAS) devices.
7 free online cybersecurity courses you can take right now
The talent shortage and a variety of specialized fields within cybersecurity have inspired many to reskill and join the industry. One way to get more knowledge is to take advantage of online learning opportunities. Here you can find a list of free online cybersecurity courses that can help further your career.
High-risk ConnectWise Automate vulnerability fixed, admins urged to patch ASAP
ConnectWise has fixed a vulnerability in ConnectWise Automate, a popular remote monitoring and management tool, which could allow attackers to compromise confidential data or other processing resources.
You should know that most websites share your in-site search queries with third parties
If you are using a website’s internal search function, chances are good that your search terms are being leaked to third parties in some form, researchers with NortonLifeLock have found.
Your vendors are likely your biggest cybersecurity risk
As speed of business increases, more and more organizations are looking to either buy companies or outsource more services to gain market advantage. With organizations expanding their vendor base, there is a critical need for holistic third-party risk management (TPRM) and comprehensive cybersecurity measures to assess how much risk vendors pose.
Ransomware attacks on Linux to surge
Trend Micro predicted that ransomware groups will increasingly target Linux servers and embedded systems over the coming years. It recorded a double-digit year-on-year (YoY) increase in attacks on these systems in 1H 2022.
Apple strengthens security and privacy in iOS 16
Apple announced additional security and privacy updates for its newest mobile operating system. In this Help Net Security video, you’ll learn more about the latest privacy and security features in the iOS 16.
Government guide for supply chain security: The good, the bad and the ugly
Just as developers and security teams were getting ready to take a breather and fire up the BBQ for the holiday weekend, the U.S.’s most prestigious security agencies (NSA, CISA, and ODNI) dropped a 60+ page recommended practice guide, Securing the Software Supply Chain for Developers.
Supply chain risk is a top security priority as confidence in partners wanes
As cyber attackers increasingly look to capitalize on accelerating digitalization that has seen many enterprises significantly increase their reliance on cloud-based solutions and services as well as third-party service providers, software supply chain risk has become a major concern of organizations.
Defeat social engineering attacks by growing your cyber resilience
In this Help Net Security video, Grayson Milbourne, Security Intelligence Director at OpenText Security Solutions, discusses the innovation behind social engineering campaigns and illustrates how cyber resilience can help mitigate this evolving threat.
What’s polluting your data lake?
A data lake is a large system of files and unstructured data collected from many, untrusted sources, stored and dispensed for business services, and is susceptible to malware pollution. As enterprises continue to produce, collect, and store more data, there is greater potential for costly cyber risks.
Nmap 7.93, the 25th anniversary edition, has been released
Nmap is a widely used free and open-source network scanner. It’s used for network inventorying, port scanning, managing service upgrade schedules, monitoring host or service uptime, etc. It works on most operating systems: Linux, Windows, macOS, Solaris, and BSD.
The top apps for malware downloads
In this video for Help Net Security, Raymond Canzanese, Threat Research Director at Netskope, talks about the top apps for malware downloads.
Go-Ahead cyberattack might derail UK public transport services
One of the UK’s largest public transport operators, Go-Ahead Group, has fallen victim to a cyberattack. The Go-Ahead Group, which connects people across its bus and rail networks, reported it was “managing a cyber security incident” after “unauthorized activity” was detected on its network.
62% of consumers see fraud as an inevitable risk of online shopping
59% of consumers are more concerned about becoming a victim of fraud now than they were in 2021, according to a research released by Paysafe. Consumers across North America, Latin America and Europe are prioritising security over convenience when making online purchases, as the impact of rising inflation and energy prices continues to fuel financial worries.
The challenges of achieving ISO 27001
In this Help Net Security video, Nicky Whiting, Director of Consultancy, Defense.com, talks about the challenges of achieving ISO 27001, a widely-known international standard.
There is no secure critical infrastructure without identity-based access
Organizational security strategy has long been defined by an internal perimeter enclosing all a company’s information in a single secure location. Designed to keep external threats out through firewalls and other intrusion prevention systems, this security model permits trusted insiders virtually unrestricted access to corporate IT assets and resources. Practically speaking, this means any user who has access to the network could also access proprietary and sensitive information, regardless of their job title or requirements.
EvilProxy phishing-as-a-service with MFA bypass emerged on the dark web
Following the recent Twilio hack leading to the leakage of 2FA (OTP) codes, cybercriminals continue to upgrade their attack arsenal to orchestrate advanced phishing campaigns targeting users worldwide. Resecurity has recently identified a new Phishing-as-a-Service (PhaaS) called EvilProxy advertised in the Dark Web. On some sources the alternative name is Moloch, which has some connection to a phishing-kit developed by several notable underground actors who targeted the financial institutions and e-commerce sector before.
With cyber insurance costs increasing, can smaller firms avoid getting priced out?
Cyber insurance is quickly becoming an unavoidable part of doing business as more organizations accept the inevitability of cyber risk. There is a growing awareness of the need to be prepared for the impact of devastating security incidents such as those caused by ransomware, just as a firm invests in coverage for potential physical threats such as fire or criminal damage.
Researchers publish post-quantum upgrade to the Signal protocol
PQShield published a white paper that lays out the quantum threat to secure end-to-end messaging and explains how post-quantum cryptography (PQC) can be added to the Signal secure messaging protocol to protect it from quantum attacks.
Better than a fix: Tightening backup and restore helps financial services companies innovate
We all know the risks out there. Ransomware is a huge threat, and critical transactional data is constantly under attack. Meanwhile, financial services organizations are being squeezed on all sides, as regulators are tightening legislation, from SOX to CCPA, GDPR and global data privacy laws like PIPL. In this firestorm, it’s never been more important for financial services organizations to level up their data protection and risk mitigation strategies.
Most IT leaders think partners, customers make their business a ransomware target
Global organizations are increasingly at risk of ransomware compromise via their extensive supply chains. During May and June 2022 Sapio Research polled 2,958 IT decision-makers across 26 countries. The research revealed that 79% of global IT leaders believe their partners and customers are making their own organization a more attractive ransomware target.
Coding session: Introduction to JavaScript fuzzing
JavaScript is widely used in backend and frontend applications that rely on trust and good user experience, including e-commerce platforms, and consumer-apps. Fuzz testing helps secure these applications against bugs and vulnerabilities that cause downtime and other security issues, such as crashes, DoS and uncaught exceptions.
eBook: 4 cybersecurity trends to watch in 2022
With the rapid acceleration of cloud usage and digitized systems, a host of new security concerns are likely to emerge in the new year. Growing threats around network defense, data protection and multicloud strategies are dominating the security conversation, while cybercriminals have become faster, smarter and more discreet than ever before. It’s crucial that businesses, government agencies, schools and other organizations stay mindful of the latest predictions.
