According to Norton’s Cyber Safety Pulse Report, India faced over 18 million cyber threats in only Q1 2022, roughly 200,000 threats every day. Of the bulk, 60,000 were phishing attempts, and 30,000 were tech support scams. For perspective, phishing attempts around the world during the same period counted for approximately 16 million. CERT-In also reported over 2.12 lakh (~0.1 million) cybersecurity incidents until February 2022.

A Readiness Assessment in general is an evaluation process that suggests whether or not an organization is compliant with a specific standard/regulation. The assessment helps determine gaps in security controls and demonstrates the effectiveness of controls to achieve compliance. The assessment works as a guide to identify and address the potential gaps in controls. The readiness assessment basically works as a test run for organizations looking to achieve compliance.

IAM (identity access management) involves numerous IT practices to enforce identity authentication and verification. But Web3 could change how we use the internet by simplifying data protection and IAM procedures. Two factors contribute to the need for authentication practices that are both fast and accurate. One, rising cyber threat activity, and two, infrastructure changes and complexity. Now, IT teams need new ways to authorize identity credentials to adapt to an evolving environment.

The rapidly expanding attack surface often requires security teams to deep dive into their Internet-facing assets, such as root assets and associated subdomains. Conducting these reviews can be time-consuming for security experts, particularly if they have a large attack surface made up of hundreds – or even thousands! – of subdomains. We’ve now made it possible for users to filter their attack surface by a root asset.

A selection of this week’s more interesting vulnerability disclosures and cyber security news. For a daily selection see our twitter feed at #ionCube24. Not restricted to NPM, Python for example has had many issues lately, but no matter which language you use that has an online code repository, careful selection is becoming critically important.

During the recent Rootedcon conference in Spain, we delivered a talk about ransomware, and this blog post serves as a commentary of the insights presented about Ransomware as a Service (RaaS): how it really works; how the threat actors operate these attacks; and how organizations can analyze the attacks and take preemptive measures in the event of future attacks.

Selling to the Department of Defence or dealing with Export Controlled material? Discover how to manage the information security and compliance of ITAR and other regulated data.

Organizations that develop mobile apps need to be aware of the potential cyber security threats. These threats can lead to the loss of users' private data, which can have serious repercussions for industries like fintech, healthcare, ecommerce, etc. In order to prevent these malicious practices, Dynamic Application Security Testing (DAST), a security testing tool, has been introduced. It helps to weed out specific vulnerabilities in web applications whenever they run in the production phase.

Find out what our audit services team unearthed in the 2,400+ codebases we reviewed in 2021. Spoiler alert: In 2021, audits found open source in 100% of our customer engagements. Regular readers know that Synopsys recently published the seventh edition of the “Open Source Security and Risk Assessment” (OSSRA) report. We think it provides the best information available about usage of open source in the wild, and the frequency of open source risks.

Before we dive into the details of this vulnerability, we want to make it clear that there’s no need for panic. Many systems permit the use of various types of code in configuration files, and there are legitimate use cases to include string and variable interpolation in the configuration of applications and systems. This is not Log4Shell all over again. This is simple configuration manipulation.