Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

May 2024

Level Up Your MSP Game

Attending industry events is quite possibly one of the most important requirements of running a successful managed service provider (MSP) business. Why? On the one hand, a few days away from the day-to-day grind of running your MSP to instead network with your peers and enjoy some MSP swag seems like the perfect opportunity to unwind while staying connected. On the other (equally as important!) hand is all the great learning going on.

Rakuten Drive: Secure, but Private File Transfer and Cloud Storage?

Are you looking to try a new service to transfer large files of up to 50GB? Then there’s a new player in the file-sharing market that may interest you — Rakuten Drive. In February 2024, Rakuten announced the commercial launch of Rakuten Drive, a file storage cloud service based in Japan. Rakuten Drive allows individuals and enterprises to send large files with customized access controls, store, and edit Microsoft documents.

Cloudflare acquires BastionZero to extend Zero Trust access to IT infrastructure

We’re excited to announce that BastionZero, a Zero Trust infrastructure access platform, has joined Cloudflare. This acquisition extends our Zero Trust Network Access (ZTNA) flows with native access management for infrastructure like servers, Kubernetes clusters, and databases.

Next-Gen Container Security: Why Cloud Context Matters

Container security has experienced significant transformation over the past decade. From the emergence of foundational tools like Docker to the maturation of orchestration platforms such as Kubernetes, the container security landscape looks different than it did even a few years ago. With Gartner predicting 95% of organizations will be running containerized applications in production by 2028, it’s clear that container security is going to be a key priority for most organizations moving forward.

What's going on? The power of normalization in Cloud SIEM

Many of us in the information security sphere have sat in front of a console and furiously executed various queries while either mumbling internally or externally, with varying levels of stress and frustration: what is going on? When investigating a particular system, an odd event, or a declared incident, we are all attempting to answer this question in one way or another. Detections, documented threat hunts and security operations procedures do not manifest out of thin air.

Opti9's AWS Disaster Recovery: Your Path to Unmatched Cloud Resilience

Businesses today rely heavily on the cloud infrastructure provided by Amazon Web Services (AWS) to drive innovation, enhance scalability, and streamline operations. However, with this reliance comes the imperative need to safeguard against potential disruptions that compromise business continuity and an organization’s reputation. This is where Disaster Recovery (DR) steps in as a critical component of any organization’s AWS strategy.

JumpCloud and Google: Even Better Together

It’s been just over a year since JumpCloud and Google announced a strategic partnership to seamlessly manage your Google Workspace identities, the access they need, from any device leveraging one platform. You may be wondering what’s new, how it’s going for our customers and partners, and what benefits they’re getting from the joint solution? This article provides a condensed set of resources that make it simpler to get started with a demo or simulations.

How Are SMEs Approaching AI?

Have you heard about AI yet? Just kidding. We know you have. Recently, AI’s popularity has skyrocketed among businesses and consumers alike. This surge was driven by a combination of technological advancements (e.g., machine learning, natural language processing, and data analytics) with an increase in tool accessibility and user-friendliness.

Cloud Sprawl: How to Tidy It Up

Cloud computing offers indisputable benefits, but with the caveat that it can quickly become a disorganized jumble unless adequately managed. It’s common for the average organization to use dozens of cloud instances, solutions, and resources scattered across multiple platforms. Such off-premises services quickly accumulate to accommodate the company’s ever-growing needs. This uncurbed growth, known as cloud sprawl, creates significant economic and security challenges.

Fast and Secure Hosting Solutions for Your Digital Needs

When it comes to a website's performance, security, reliability, and total maintenance costs, everyone needs good web hosting. However, choosing the best web host can be quite challenging, because there are so many possibilities and you may not be aware which one is the best. Luckily, this article will help you choose the best web host by explaining the various options, their benefits and drawbacks, and how to begin.

Why Embrace a Cloud Operating Model?

Taking on the concept of a cloud operating model is not just for people who want to be fashionable; it's a clever tactic that any business can use if they desire efficient scaling and better service delivery. This method uses the benefits of cloud computing to make operations simpler, more flexible and less costly.

What is Azure Identity Protection and 7 Steps to a Seamless Setup

Protecting credentials has become increasingly critical in recent years, with everyday employees using more passwords, devices, and systems than ever before. Remote work has significantly increased the risk of identity attacks. 55% of remote workers say they receive more phishing emails than they used to while working in the office and attempted password attacks are up tenfold. In 2023, Microsoft detected 156,000 business email compromise (BEC) attacks every day over twelve months.

Teamwork for Internet security: Rapid response & compliance

Host João Tomé is joined by two guests. First, we have Ranee Bray, Chief of Staff of our Security Team, discussing how we managed programmatically what we called Code Red — several teams were put together to focus in 30 days on strengthening, validating, and remediating a security incident. Credential management, software hardening, vulnerability management, additional alerting, and other areas were also a part of the “Code Red” effort.

Teaser. Half a Century of Connectivity: Celebrating 50 Years of TCP

In May 1974, 50 years ago, Vint Cerf and Bob Kahn made history with their paper on TCP (Transmission Control Protocol) published by @IEEEorg. Here is a teaser of a longer video (and "This Week in Net" episode) coming soon from our protocol experts, Mark Nottingham (Australia), and Lucas Pardue (UK).

Comparing OPA/Rego to AWS Cedar and Google Zanzibar

Rego, the policy language of the Open Policy Agent (OPA), is known for its flexibility and power in policy enforcement across various systems. Its declarative syntax and data-centric approach make it versatile for application authorization, infrastructure as code (IaC) authorization, and network policies. To fully appreciate OPA/Rego’s capabilities, it’s helpful to compare it with other policy languages and frameworks like AWS’s Cedar and Google’s Zanzibar.

Cloud Unfiltered with Andre Zayarni - Exploring AI and Vector Databases - Episode 13

Join your host Michael Chenetz as he interviews André Zayarni, the CTO of Qdrant, a leader in AI innovation with their cutting-edge vector database technology. This conversation is essential listening for anyone interested in the integration of advanced search technologies and AI in modern applications.

How to Leverage Video Technology for Comprehensive Security Solutions

Video technology in security protocols has come a long way since the old days of black-and-white footage. Those changes transformed video surveillance from a simple observer to an active participant in strengthening business security solutions. With innovations that range from high-resolution images to cloud storage and advanced analytics, organizations are equipped with a reliable tool to aid in privacy control and safety.

Learning from cloud transformation as we move to AI

Development teams of all sizes are embracing the excitement and possibility of using AI tools to build software. Coding assistants like Google Gemini and Github Copilot have the potential to accelerate development like never before, and developers are adopting these tools — whether or not leadership has officially approved them. As your team considers the best ways to adopt this new technology, this transition might feel like déjà vu.

Understanding the Difference Between BDRSuite and BDRCloud

When it comes to backup and disaster recovery, Vembu offers two robust solutions: BDRSuite and BDRCloud. While both are designed to deliver comprehensive protection for your data, they cater for different deployment preferences. BDRSuite and BDRCloud are cost-effective and comprehensive backup and disaster recovery solution offering.

Highlights from RSA Conference: Secure by Design, AI Insights, and Global Collaboration

RSA Conference 2024 brought together industry experts, practitioners, and policymakers to discuss the latest trends and challenges in cybersecurity. We showcased our commitment to CISA's Secure by Design, explored the potential of AI in risk management, and emphasized the significance of global collaboration. Here are some highlights from our time at RSA Conference, providing insights into the discussions and announcements that shape the future of cybersecurity.

How to Protect Your Cloud Assets from Being Cryptojacked

Cryptojacking attacks have become the most prevalent type of attack on cloud native infrastructures. For example, in 2022, there were 139M cryptojacking attacks, but the following year there were over 1 billion! That translates to nearly 3M cryptojacking attacks every day, on average in 2023.

Inside RSA Conference & jam.dev (a bug-fixing tool powered by Cloudflare)

This week, host João Tomé heads to San Francisco for the cybersecurity RSA Conference (May 6-9, 2024). First, we gather insights from attendees, ranging from a cybersecurity student on the brink of graduation to seasoned managers and experts. We also feature Cloudflare’s Chief Privacy Officer discussing the nexus of security and privacy. Plus, insights from Carlos Alberto Silva, a Portuguese venture capitalist with extensive experience in cybersecurity investments.

Cloud Security and Compliance: A Smarter Approach to Keeping Your Head Above Water

When it comes to cloud security and compliance, it’s easy to feel like you’re drowning in a sea of regulations and requirements. But don’t worry; we’re all in the same boat! That’s why we’re thrilled to share our latest point-of-view (POV) paper, “Practical Cloud Security in the Era of Cybersecurity Regulation,” which is crafted with our deep industry expertise and experience.

How to stay ahead of AWS Lambda costs

Severless is excellent, right? Faster development and less infrastructure hassle – but those AWS Lambda costs can sneak up on you. Over 70% of AWS customers are using serverless now. Seems like everyone’s jumping on the serverless bandwagon – and for good reason. It speeds up development and cuts down on the nitty-gritty infrastructure stuff. All this is a developer’s dream in a lot of ways.

Dani Grant (Jam.dev) | Fixing Bugs, Building a Company, and the Future of the Web

Dani Grant, co-founder of Jam.dev, talks about her company, how they are trying to fix the bug process for developers, and also discusses how Jam.dev uses Cloudflare. We also go over what a better internet for the future looks like, and the challenges and opportunities in the AI era.

Enhancing AWS Security: Comprehensive Strategies for Robust Cyber Protection

With the rapid expansion of cloud computing, Amazon Web Services (AWS) has become a cornerstone for businesses seeking scalable and flexible IT solutions. However, this increased reliance on AWS has made it a prime target for cyber threats. Ensuring robust security measures within AWS environments is paramount to safeguarding sensitive data and maintaining business continuity.

UniSuper's $125 Billion Cloud Catastrophe: Google's Accidental Deletion Reinforced the Importance of Backup Solution

The recent data loss incident involving UniSuper, a major financial player and Google Cloud serves as a reminder of the importance of implementing robust backup and disaster recovery solutions. Let’s delve into the details of the incident and explore why backups are essential for safeguarding against data disasters.

The Future of Work: Ensuring Holistic Security in Hybrid Environments

In today's rapidly evolving work culture, the shift towards hybrid environments demands a revolutionary approach to security. At Brivo, we're at the forefront of integrating cutting-edge technology to create not just safer, but smarter workspaces. Dive into our latest video where Mary Clark, a leading voice in security solutions, unveils the importance of a holistic, data-driven strategy to safeguard your hybrid workspace. From access control to employee well-being, discover how Brivo's innovative solutions are shaping the future of work.

Cloud Unfiltered with Sathish Balakrishnan - Exploring the Future of AI and Automation - Episode 12

Join host Michael Chenetz on this enlightening episode of Cloud Unfiltered as we dive deep into the realms of AI and automation with special guest Sathish Balakrishnan from Red Hat. Sathish, who leads the Ansible Automation Platform business, shares his valuable insights on how AI is enhancing automation technologies and the critical role of automation in leveraging AI effectively across industries.

Google Cloud affected by CVE-2021-30476

CVE-2021-30476 affects HashiCorp's Terraform Vault Provider and involves incorrect configuration of bound labels for GCP (Google Cloud Platform) authentication. This issue permits unauthorized users to potentially bypass authentication mechanisms. The vulnerability stems from the Vault provider not correctly configuring the bound labels within the GCP authentication method, which could lead to improper access control.

An Offensive Security Perspective on Hacking the Cloud: Five AWS and Azure Cloud Security Threats to Focus On

According to Gartner, the global market for cloud infrastructure services increased by 30% in 2022, exceeding $100 billion for the first time. AWS and Azure account for almost two-thirds of this figure. While many organizations benefit from these platforms, the popularity of the cloud can also present significant security challenges.

What is Privilege Escalation in AWS? Recommendations to Prevent the Risk of Privilege Escalation on AWS

Privilege escalation in AWS refers to the unauthorized elevation of user privileges within the AWS environment, allowing users to access resources and perform actions beyond their intended level of permissions. This security risk would arise in case the attackers utilize the vulnerabilities or misconfigurations in AWS services, IAM policies, or access controls to take up privileges above the current level.

Hey, You. Get Off of My Cloud

The Rolling Stones wanted to protect their space; we, as security practitioners, need to protect ours. Data 'castles' in the cloud are out there, and they're constantly under siege. By drawing inspiration from a band that embodied personal freedom, we can draw some – okay, very stretched - parallels to modern cloud security. Nonetheless, they work. And we all knew this blog was coming. And if you read the blog backward you can hear the name of the latest malware family... Maybe.

Mobility Made Simple: Exploring the AWS Snow Family

The AWS Snow Family is a service offering designed to assist customers in leveraging Amazon Web Services (AWS) closer to where their data is generated, primarily in sites where internet connection may not be viable. When used, clients can run applications with minimal delay and comply with data storage location requirements. The Snow Family includes Snowball Edge and Snowcone, which are designed for two main purposes: running applications in harsh conditions and moving data from remote places to AWS.

Indusface Recognized as a 2024 Gartner Peer Insights Customers' Choice for Cloud WAAP

We’re excited to announce that Indusface has once again been recognized as a 2024 Gartner® Peer Insights™ Customers’ Choice for Cloud Web Application and API Protection (WAAP) for three consecutive years. What’s more, with a rating of 4.9, Indusface is the highest-rated WAAP and the only vendor to achieve a 100% customer recommendation rating, as reviewed by 102 large enterprises and midsize businesses worldwide.

Falcon Cloud Security Cloud Detection and Response

Discover how CrowdStrike Falcon Cloud Security tackles cloud misconfigurations and vulnerabilities in this concise demo. Witness our Cloud Detection and Response in action as we identify and mitigate a sophisticated attack by FANCY BEAR, providing clear visibility and critical insights into your multi-cloud deployments. Learn how our integrated threat intelligence and rapid response capabilities help enforce compliance and secure your cloud environment.

What's an Identity Provider (IdP)?

You could have the strongest firewalls, encryption, anti-malware, vulnerability scanners, and risk management tools in the world and still leave one critical gap in your cybersecurity infrastructure — insider threats. And most of those threats come from poor identity management. But what, exactly, is good identity management? How do you pick the right identity provider for your organization?

Smart Cloud Detection and Response: Detecting attacks in real-time with Panoptica

Modern technology continues to assist, enhance, and shape every aspect of our lives—in our work, our homes, and even our vehicles. Home security video cameras and car dashcams are prevalent ways to ensure our personal safety and security. A popular electric vehicle has a “sentry mode” that is a perfect example of a system that monitors and captures events happening around the vehicle, providing information about incidents to vehicle owners.

Netskope and Wiz Integration

In cloud security, staying ahead of potential threats is crucial. As organizations continue to embrace cloud technologies, ensuring robust security measures becomes increasingly complex. To address this challenge, Netskope is proud to announce our integration with Wiz, empowering users to proactively safeguard their resources across hyperscaler environments like never before. This collaboration enables customers to leverage real-time insights from Wiz's comprehensive cloud security platform directly within Netskope.

CrowdStrike Cloud Security Defines the Future of an Evolving Market

Today’s businesses are building their future in the cloud. They rely on cloud infrastructure and services to operate, develop new products and deliver greater value to their customers. The cloud is the catalyst for digital transformation among organizations of all sizes and industries. But while the cloud powers immeasurable speed, growth and innovation, it also presents risk.

Elastic and AWS deliver on AI-driven security analytics

Amazon Bedrock and Elastic’s Attack Discovery automate security analyst workflows As cyber threats grow increasingly sophisticated, the need for highly effective security measures becomes imperative. Traditional SIEMs aren’t equipped to address threats fast enough because they rely on too many manual and labor-intensive tasks. AI-driven security analytics from Elastic’s Search AI platform solves these challenges.

Succeeding at Cloud Vulnerability Management

Many organizations are migrating to cloud infrastructures. The cloud presents new levels of flexibility and scalability in the way organizations operate. But as with any new opportunity, it also creates new forms of risk. How can organizations succeed at identifying and remediating these security risks?

5 Cybersecurity Lessons We Can Learn from Star Wars

A long time ago in a movie theater far, far away, a little film by the name of “Star Wars” took the world by storm and changed the course of sci-fi, cinema, and pop culture for decades to come. But believe it or not, this intergalactic tale of droids and lightsaber duels can actually teach us a lot about the importance of cybersecurity. As it turns out, if the bad guys had been a little more security-savvy, the film might have ended quite differently.

Internet disruptions from cable failures in Africa to technical issues (and an RSA teaser)

"This Week in NET". Episode #59 Host João Tomé (based in Lisbon, Portugal) is joined by our Head of Data Insights, David Belson, based in Boston. We discuss our recent Q1 2024 Internet disruption summary blog post. There were submarine cable failures that impacted 13 countries in Africa. We also address technical issues with RPKI, DNS, and DNSSEC that disrupted connectivity for subscribers across multiple network providers.

Unleash Your Startup's Potential with Microsoft Azure Cloud Computing

In the modern world with an intense digital culture, businesses of the newly created startup type face tremendous pressure to innovate fast and provide customers with innovative goods and services. Infrastructure construction and management is a time-consuming and expensive task. Microsoft Azure answers the trial by fire, providing a versatile cloud approximation platform targeted at startups’ peculiarities.

Top 5 SaaS misconfigurations to avoid and why

Cloud storage services and SaaS apps like Google Drive and Microsoft OneDrive provide convenient, scalable solutions for managing documents, photos, and more—making them indispensable for modern work and personal life. However, misconfigured settings and permissions can lead to serious security breaches, noncompliance, and even the loss of customer trust. Let’s explore the 5 most common misconfiguration issues with real-world examples.