As AI adoptions become increasingly integral to all aspects of society worldwide, there is a heightened global race to establish artificial intelligence governance frameworks that ensure their safe, private, and ethical use. Nations and regions are actively developing policies and guidelines to manage AI’s expansive influence and mitigate associated risks. This global effort reflects a recognition of the profound impact that AI has on everything from consumer rights to national security.

“The best part of RSA is all the amazing people in the community trying to make the world a safer place. It’s also very exciting to see all the innovation to make adversaries’ lives harder – competition and collaboration make us better.” – CEO & Co-Founder Dr. Aleksandr Yampolskiy The SecurityScorecard team has just returned from an incredible week in San Francisco at RSA Conference 2024!

Failure to archive a completed Trial Master File (TMF) is, to put it simply, non-compliant. Despite this fact, pharmaceutical and biotech companies are often known to drag their feet on this process. Why would such organizations expose themselves to that risk? Unfortunately, there are several common hurdles that teams face when it comes to TMF archival. In this post, we’ll walk through what those hurdles are and how to overcome them.

CVE-2021-30476 affects HashiCorp's Terraform Vault Provider and involves incorrect configuration of bound labels for GCP (Google Cloud Platform) authentication. This issue permits unauthorized users to potentially bypass authentication mechanisms. The vulnerability stems from the Vault provider not correctly configuring the bound labels within the GCP authentication method, which could lead to improper access control.

You can’t secure what you can’t see goes the saying in cybersecurity. That’s why holistic visibility is so crucial for organizations tasked with staying safe in the evolving threat landscape, as it gives you full visibility into your environment. But there’s another adage that matters even more, because without access to log sources and the proper ingestion of their data, you can’t see the forest for the trees. But what are log sources? What does proper ingestion look like?

System hardening is the process of configuring a system to a more secure state. Many technology solutions are not securely configured by default, so system administrators must harden systems while retaining their desired functionality. Thankfully, system administrators do not have to figure out system hardening on their own. Instead, they can reference security benchmarks which describe recommended secure configurations for a system.

The 2024 RSA Conference has officially wrapped, and this year’s event served as the perfect backdrop for us to make our re-introduction to the industry.

On May10th, Federal Bureau of Investigation (FBI), Cybersecurity and Infrastructure Security Agency (CISA), Department of Health and Human Services (HHS), and Multi-State Information Sharing and Analysis Center (MS-ISAC) issued an urgent advisory about malicious threat activity involving the Black Basta ransomware variant. Detailed information about these threats and the associated IOCs and TTPs can be seen on #StopRansomware: Black Basta.

“Your entire company network was compromised, all through a single login.” That’s the reality of an employee single sign-on (SSO) breach nightmare. Hackers create fake SSO login pages in order to steal employee credentials, which can literally give them “the keys to the kingdom” – access to the most sensitive data of the organization. From a disgruntled ex-employee to a compromised user, it can become a devastating security hole. It happens more than you think.

Banks are one of the most heavily regulated business sectors, with stiff regulatory compliance obligations and close scrutiny from regulators. As such, managing regulatory compliance has become challenging for banks in recent years. Compliance failures can result in significant fines, reputational damage, bad publicity, and even lawsuits. It’s vital for banks to conduct regular compliance risk assessments to identify, evaluate and mitigate emerging risks.