Speed and security. Old-fashioned thinking contended that the two were incompatible; that high-velocity development and deployment of apps and software services invariably introduced higher levels of risk. However, it has become increasingly apparent that speed is a necessary aspect of security. The stakes are sky-high, with some estimates projecting that the annual cost of cybercrime losses and damage will reach $6 trillion by 2021.
According to Google, Ryuk is ‘a fictional character in the manga series Death Note’. I have no idea what this is, but I imagine it’s significantly less interesting than the Ryuk ransomware campaign that’s currently hitting businesses right across the world. The UK’s NSCS is investigating such campaigns and has recently published an advisory on it, and we’re no strangers to Ryuk at Bulletproof either.
A selection of this week’s more interesting vulnerability disclosures and cyber security news. Well, I hope everyone’s recovered from the annoying network outages this week. I’m not going to talk about that, instead here is something to bring other annoyances: How UI done badly can be really bad… People are people, and while there are often oversights in locking down systems, they often still fall prey to moments of madness which starts a chain towards disaster.
An industry that is worth more than $2 billion, SIEM keeps growing and evolving. The first instances of SIEMs appeared as descendants of numerous security technologies: LSM, SIM, SLM/SEM, SEC and such. The earliest versions were so limited that they were barely able to scale across large companies and were rather slow. They also needed huge teams to manage thus raising the costs ever-higher. However, SIEMs have changed greatly since.
Identity verification has progressed drastically with the infusion of technology over a period of time. Currently, identity verification depends on physical and digital proof managed by a central authority which includes verification of valid documents like passport, driver’s license, OTP etc. However, the processes and identity parameters vary from country to country making it extremely difficult to standardise the verification process.
If you are a security practitioner, then you may have noticed that much of the security industry exists because of vulnerabilities. Regardless of what job position you occupy, vulnerabilities are oftentimes the reason why you wake up every morning and ultimately engage infosec from within your cutting-edge working environment. Vulnerabilities will continue to arise; this is a fact of the environmental change that goes with any business or organization.
The results are in, and once again AT&T’s Cybersecurity is recognized as an industry leader by securing its third consecutive ranking of “very strong” in Global Data’s annual product report. AT&T is the only company to achieve this hat-trick rating in all of Global Data’s seven categories of assessment. AT&T’s bold acquisition of AlienVault has reaffirmed its position as the cybersecurity leader with both competitive and qualitative edges.
Xavier Blasco (a.k.a Lerhan) is a 23-year old security researcher on the Detectify Crowdsource Platform. He’s passionate about security and found a way in through bug bounty programs. As an ethical hacker, he is naturally curious in security testing vendors which he is buying from and this time it led to bypassing IDOR protection using URL shorteners. In the following guest blog, he describes this security flaw that led him to access new client contracts on Jazztel’s platform.
There are Red Sox, White Sox, and Fox in Socks. At the turn of the century, a new SOX entered our lexicon: The Sarbanes-Oxley Act of 2002. This financial regulation was a response to large corporate misdeeds at the time, most notably Enron misleading its board through poor accounting practices and insufficient financial oversight. The regulation seeks to ensure accurate and reliable financial reporting for public companies in the United States.
Vulnerability management is one of the core responsibilities of a security team. It covers assessing, reporting and if needed, mitigating on an organization’s security vulnerabilities. Yet vulnerabilities can be tackled with if and if only they are known to the IT security team. In order to find out vulnerabilities of a system or software, vulnerability scanning is conducted. It is a security technique whose purpose is identifying security weaknesses in a system.
