OpenSSL.org has announced that an updated version of its OpenSSL software package (version 3.0.7) will be released on November 1, 2022. This update contains a fix for a yet-to-be-disclosed security issue with a severity rating of “critical” that affects OpenSSL versions above 3.0.0 and below the patched version of 3.0.7, as well as applications with an affected OpenSSL library embedded.

You and your board have the same goal: to drive your organization in the right direction. That makes everything easy, right? Well, not always. Whereas the problem used to be an overall lack of security awareness, boards now are very much aware of the business risk less-than-robust cybersecurity poses. Today, it’s all about communicating effectively and fluently, especially when introducing cybersecurity solutions.

OpenSSL is the most popular implementation of the TLS protocol (Transport Layer Security) which is essentially the de-facto security protocol of the internet today. The OpenSSL team announced critical security updates of versions above version 3.0 (OpenSSL 3.0 was released on September 7, 2021). The myriad of projects and software depending on OpenSSL must update and release a new version to enable end users to start patching their systems.

Fuzzing is a software security testing technique that automatically provides invalid and random input to an application to expose bugs. The goal of fuzzing is to stress the application to cause unexpected behavior, crashes, or resource leaks. It allows us, as developers, to understand the behavior and vulnerability of applications more comprehensively. We use fuzzing tools, referred to as fuzzers, to perform this kind of testing.

A report published by Cybersecurity Ventures predicts that by 2031, ransomware will attack a business, individual, or device every two seconds. The consequences of such an attack extend beyond the leak of sensitive information and financial losses; customers and clients don’t want to do business with organizations that neglect security of customer data. You can’t simply hope an attack will never happen.

Attack surface management (ASM) software is a set of automated tools that monitor and manage external digital assets that contain, transmit, or process sensitive data. ASM software identifies misconfigurations and vulnerabilities that cybercriminals could exploit for malicious purposes that result in data breaches or other serious security incidents.

Cybercriminals exploit vulnerabilities and misconfigurations across an organization’s attack surface to gain unauthorized access to sensitive data. The prevalence of digital transformation and outsourcing in the current threat landscape means an organization’s attack vectors can easily increase by millions each day. This ever-growing number makes it hard to identify cyber threats and prioritize remediation before a data breach occurs.

The average cost of a data breach will continue to rise, which means companies need to start planning accordingly. To protect your business, you need to invest in cybersecurity. Here are 11 areas you should focus on.

The Guacamaya group is a fairly new hacktivist group based in Latin America. The group was first seen around March 2022 as they released sensitive data of several companies based in Chile, Ecuador, Brazil and Colombia. As mentioned, the group is mainly focusing on LATAM but dabbles every now and then with campaigns in Russia. The group is defined as a data leakage threat group, which means they do not encrypt but only leak the stolen data, often they do it for free.

Following Trustwave SpiderLabs’ blog on social media-themed phishing on Facebook, comes another flavor of ‘infringement’ phishing. In this case, the targets, still under the umbrella of Meta, are Instagram users. This theme is not new, and we have seen it from time to time over the last year. It’s the same copyright infringement trickery again, but this time, the attackers gain more personal information from their victims and use evasion techniques to hide phishing URLs.