Global digital transformation is rapidly changing the way businesses operate. This has led to a significant increase in the attack surface, which organizations must protect. However, this can be a daunting task for organizations that are still using traditional vulnerability management tools and processes. In this article, we will discuss the impact of digital transformation on vulnerability management and explore what a modern and automated vulnerability management solution looks like.

Welcome to the Nucleus Product Update 3.9. As we approach Thanksgiving, we’d like to start by expressing our appreciation for you and the rest of the Nucleus family. Thank you for being a part of our community and contributing to our collective growth and success. We have so much to be thankful for this year, especially YOU! We hope you have a wonderful holiday celebrating all there is to be grateful for and enjoying a great meal with the people you love most.

Top tips is a weekly column where we highlight what’s trending in the tech world and list ways to explore these trends. This week we’re identifying the risks and vulnerabilities associated with mobile apps and discuss strategies to mitigate them. In our digitally connected world, mobile apps have become an integral part of our daily lives. We depend on them for communication, productivity, entertainment, and much more.

This blog post series offers a gentle introduction to Rego, the policy language from the creators of the Open Policy Agent (OPA) engine. If you’re a beginner and want to get started with writing Rego policy as code, you’re in the right place. In this three-part series, we’ll go over the following: As a reminder, Rego is a declarative query language from the makers of the Open Policy Agent (OPA) framework.

We are thrilled to announce that Snyk, a leading provider of cloud native application security solutions, has achieved the prestigious AWS Security Competency status. The AWS Security Competency validates Snyk's deep security expertise and commitment to delivering a comprehensive application security solution for modern organizations building and running their applications on the Amazon Web Services (AWS).

You have kicked-off your annual application security assessment, but by the time the final report comes in, so have a bunch of new features from your developers. Since your pen test report can’t keep-up with your modern development cycles, it is now (and always) obsolete. You can check-off your compliance checkbox, but you’re not anymore secure than you were before. If this sounds familiar, it is clearly time for an update.

The modern application landscape is rapidly evolving, creating new tools, technologies, and processes that allow organizations to deploy production code faster. But risks to application security have also changed significantly, requiring the security discipline to evolve in order to adapt to new types of attacks.

Using anonymized data from three years of tests conducted on commercial software systems and applications, the recently published 2023 Software Vulnerability Snapshot report from Synopsys focuses on exposing persistent vulnerabilities that are significant challenges to web and software application security, including the top three vulnerability types related to.

On November 6, 2023, Veeam published security hotfixes for two critical-severity vulnerabilities impacting Veeam ONE. At this time, Arctic Wolf has not identified active exploitation of either vulnerability, nor a published proof of concept (PoC) exploit. Although threat actors have not historically targeted Veeam ONE products, obtaining RCE on the monitoring and analytics platform will likely increase the potential for threat actors to create a working PoC exploit and attempt exploitation.

On November 4, 2023, QNAP published security advisories for two critical command injection vulnerabilities impacting multiple versions of QNAP operating systems and applications related to the vendor’s network-attached storage (NAS) devices. Both vulnerabilities have been given critical CVSS scores (CVE-2023-23368: 9.8, CVE-2023-23369: 9.0) and both can lead to unauthenticated, remote threat actors executing commands if successfully exploited.