In November 2023, Sumo Logic experienced a security incident. While no one wants to be a victim of a cyberattack, and we certainly learned a lot about things that we can do better in the future, our team was lauded by customers and media alike for how we handled the situation underscoring the importance of a good incident response plan. One of the core values at Sumo Logic is that we’re in it with our customers. But more broadly speaking, we’re in it with the InfoSec community.

Not long ago, most company resources were located within a defined perimeter and users worked in the office using company-owned devices. In that world, access-centric security policies were enough to safeguard sensitive data. But most organizations have now adopted a host of cloud applications, and users work from anywhere on any device and network. To secure sensitive data in this new setup, organizations must transition from an access-centric approach to a data-centric security approach.

While shifting security left has been a hot topic for around a decade, many organizations still face issues trying to make it a reality. There are many misconceptions about what shift left means and what it looks like for development teams to take ownership of security without derailing their existing workflows.

Fireblocks has launched support for zkSync, aimed to significantly boost the scalability and security of blockchain solutions for enterprises and institutions. The integration also enables Fireblocks customers to build and deploy their own hyperchains on zkSync.

While AI has created exciting new opportunities for business, it has created urgent questions around ethics, responsible use, development, and management. AI also introduces a new, and often nebulous, element of organizational risk. With the introduction of two frameworks, ISO 42001 and NIST AI RMF, companies can now implement, demonstrate, track, and build their responsibility and trust around AI. TrustCloud is very pleased to announce that we support both ISO 42001 and NIST AI RMF.

For many fresh out of college, the drive to land that first professional role is a top priority. Yet, new graduates can be exposed to sophisticated scams that can jeopardize not just their finances but also their identities. Imagine receiving an email that mentions your former school dean or a professor, claiming they've personally recommended you for a fantastic job opportunity.

Security teams require complete visibility into their hosts, containers, and functions in order to detect, prioritize, and remediate their most pressing security risks. The Datadog Agent helps you achieve this visibility by collecting deep insights in your environment through logs, distributed traces, infrastructure metrics, and other key telemetry.

This blog was co-written by Javvad Malik and Erich Kron. Let’s dive into the cautionary world of phishing simulations gone wrong. You know, those attempts to train users not to fall for phishing that somehow end up setting off more alarms than a Hawaiian missile alert system. Let's explore why we need to phish our users, but more importantly, how not to phish them. We turn to two of our trusted security awareness advocates Javvad Malik (JM) and Erich Kron (EK) to shed some light on the matter.

The digital supply chain refers to the chain of third-party digital tools, services and infrastructure that is depended on for a particular first-party service (such as your website or SaaS platform). In an ever-changing digital landscape, supply chains can be brittle with many unseen risks. The nature of supply chain risk is transitive; any part of the often long and complicated digital supply chain can be compromised, causing all components downstream of it to also be compromised.

As adversaries become faster and stealthier, they relentlessly search for vulnerable assets to exploit. Meanwhile, your digital footprint is expanding, making it increasingly challenging to keep track of all of your assets. It’s no wonder 76% of breaches in 2023 were due to unknown and unmanaged internet-facing assets. Against this backdrop, it’s more critical than ever for organizations to maintain a continuous and comprehensive understanding of their entire attack surface.