DevSecOps is the key to achieving effective IT security in software development. By taking a proactive approach to security and building it into the process from the start, DevSecOps ensures improved application security. It also allows organizations to rapidly develop application security with fewer bottlenecks and setbacks. Some critical aspects of the DevSecOps approach and best practices can help organizations get started implementing this development strategy.

The aviation industry is both vast and complex. More than 45,000 flights and 2.9 million passengers travel through U.S. airspace every day, requiring high-tech tools and extensive communications networks. All of that data and complexity makes the sector a prime target for cybercriminals. Worryingly, only 49% of non-governmental organizations have fully adopted NIST security standards.

The PCI Council aims at minimizing the risk of cardholder data by securing sensitive cardholder data including Sensitive Authentication Data (SAD). For these reasons, PCI DSS Standards are strictly enforced in the payment card industry. According to the PCI DSS Security Standard Requirement, organizations dealing with sensitive card data are required to maintain maximum security and implement measures that ensure the confidentiality, privacy, and security of the cardholder data.

According to Norton’s Cyber Safety Pulse Report, India faced over 18 million cyber threats in only Q1 2022, roughly 200,000 threats every day. Of the bulk, 60,000 were phishing attempts, and 30,000 were tech support scams. For perspective, phishing attempts around the world during the same period counted for approximately 16 million. CERT-In also reported over 2.12 lakh (~0.1 million) cybersecurity incidents until February 2022.

A Readiness Assessment in general is an evaluation process that suggests whether or not an organization is compliant with a specific standard/regulation. The assessment helps determine gaps in security controls and demonstrates the effectiveness of controls to achieve compliance. The assessment works as a guide to identify and address the potential gaps in controls. The readiness assessment basically works as a test run for organizations looking to achieve compliance.

IAM (identity access management) involves numerous IT practices to enforce identity authentication and verification. But Web3 could change how we use the internet by simplifying data protection and IAM procedures. Two factors contribute to the need for authentication practices that are both fast and accurate. One, rising cyber threat activity, and two, infrastructure changes and complexity. Now, IT teams need new ways to authorize identity credentials to adapt to an evolving environment.

The rapidly expanding attack surface often requires security teams to deep dive into their Internet-facing assets, such as root assets and associated subdomains. Conducting these reviews can be time-consuming for security experts, particularly if they have a large attack surface made up of hundreds – or even thousands! – of subdomains. We’ve now made it possible for users to filter their attack surface by a root asset.

A selection of this week’s more interesting vulnerability disclosures and cyber security news. For a daily selection see our twitter feed at #ionCube24. Not restricted to NPM, Python for example has had many issues lately, but no matter which language you use that has an online code repository, careful selection is becoming critically important.

During the recent Rootedcon conference in Spain, we delivered a talk about ransomware, and this blog post serves as a commentary of the insights presented about Ransomware as a Service (RaaS): how it really works; how the threat actors operate these attacks; and how organizations can analyze the attacks and take preemptive measures in the event of future attacks.