Adversaries often exploit legacy protocols like Windows NTLM that unfortunately remain widely deployed despite known vulnerabilities. Previous CrowdStrike blog posts have covered critical vulnerabilities in NTLM that allow remote code execution and other NTLM attacks where attackers could exploit vulnerabilities to bypass MIC (Message Integrity Code) protection, session signing and EPA (Enhanced Protection for Authentication).

As cyber attacks and security breaches have increased in recent years, managing digital supply chain risks is becoming more difficult. Cybercriminals exploit vulnerabilities in the ecosystem of less secure suppliers and third-party vendors to gain access to larger institutions. These institutions need to look beyond their own cybersecurity maturity to be successful; cyber risks need to be identified across the ecosystem.

It has been a long time coming and definitely slower than we would have liked but we’re almost at the point of release for ionCube Encoder 12 which will support PHP 8.1. The estimate we have been working towards for quite a while now has been ‘around the end of June’ and it looks like that estimate isn’t far off with major testing progressing well.

This guide has been created to explain the importance of firewalls, whitelisting and blacklisting as part of your IT security protocols in order to protect your system and improve your understanding of this topic as an IT professional. In this resource, we will also cover the key differences between using whitelists and blacklists, as well as why it is important that your security monitoring system includes ways to internally whitelist/blacklist IPs.

Controlling your Windows PC remotely can open a world of possibilities; remote work, remote assistance, remote system diagnosis and network troubleshooting are just some of the advantages of using Remote Desktop Protocol or RDP. Developed by Microsoft, RDP allows you to remotely connect to another computer over a network, giving you full access to and control over the computer’s software, data and resources.

Automation workflows add a lot of value to an organization’s day-to-day operations. At a minimum, they streamline the execution of complex, multi-step processes, thereby allowing people to focus on higher-value tasks. On top of that, automation workflows can provide valuable insights through the metrics that they gather – including the number of requests, the date and time they were requested, the time it took to complete each request, who made the request, and much more.

As we continue our review of the 12 Requirements of PCI DSS version 4.0, one has to stop and consider, is it possible to have a favorite section of a standard? After all, most guidance documents, as well as regulations are seen as tedious distractions from the importance of getting the job done. However, depending on a person’s position and function in an organization, it is possible to “geek out” on some of the information in these official papers.

Headline grabbing vulnerabilities, like SolarWinds and Log4Shell, target management software and end hosts, but if you search for “most exploited vulnerabilities” on Google, you will quickly learn that some of them directly target network and security devices as well as server load balancers. These are the 3 most exploited CVEs in the last couple of years: Would you be surprised to learn that network device operating systems can be vulnerable to security flaws like any other software?

A common question we receive is: should security orchestration, automation and response (SOAR) replace security information and event management (SIEM)? While the two technologies share some common components, they serve different purposes. As security teams look to modernize their security operations center (SOC) to meet the demands of cloud environments, automation is the key priority. To that end, it’s vital to understand the roles of both SIEM and SOAR.

The terms "IT security network" and "cyber security network" are often used interchangeably, but there is a big difference between the two. An IT security network is focused on protecting your organization's computer systems and data from unauthorized access, while a cyber security network is designed to protect your entire organization from cyber attacks, including those that target your physical infrastructure.