Phishers leveraged fake automated messages from collaborative platform Sharepoint as a means to target users’ Office 365 credentials. Abnormal Security found that the phishing campaign began with an attack email that appeared to be an automated message from Sharepoint. To add legitimacy to this ruse, the attackers used spoofing techniques to disguise the sender as Sharepoint. They also didn’t address the email to a single employee but included multiple mentions of the targeted company.

The COVID-19 pandemic revealed flaws in the American healthcare system that were always there. The only difference now is that those flaws have been brought to light. In the wake of the pandemic, a new host of cyberattacks occurred within the healthcare sector. Malicious hackers aimed to take advantage of the crisis with a combination of misinformation campaigns and ransomware.

In the world of CVEs, we have seen a few interesting ones released in the last couple of weeks since our last risk based vulnerability management blog, including the recent big news SIGRed. Read on for more information on how to prioritize these vulnerabilities for patching to mitigate risk.

As we are all currently confined to a life at home during the pandemic, it has become more important than ever that our favorite web applications stay fast and reliable. Many modern web applications use web caches to keep up with these demands. While this works wonders from a performance perspective, it also opens up new attack vectors. One of these new attack vectors is called Web Cache Poisoning.

Stateful packet inspection is also known as the dynamic packet filtering and it aims to provide an additional layer of network security. Keep reading to learn more! In business environments, we use network technologies very often. They allow us to share resources and files, set communication protocols and such. As much as they streamline and accelerate our business processes, they can also pose a serious vulnerability for our cyber security.

Risk assessment is an essential component of risk management. It enables you to determine potential hazards that may negatively affect specific projects or result from certain decisions. This article explains how to calculate your cybersecurity risk using the concept of annual loss expectancy: There are two types of risk analysis — quantitative and qualitative: Both forms of risk analysis are valuable tools in risk management.

Someone in my Twitter timeline wrote a post that resonated with me. Instead of advocating the idea of our firms mandating what we can and cannot do in our homes as working from home (WFH) standards, she said how gracious it was for us to let the firms into our home environments where we had already made investments in how and where we wanted to work in our personal space. So much of what we do daily in our personal ecosphere requires authentication.

The issue of unsecured databases is growing. In 2019, 17 percent of all data breaches were caused by human error — twice as many as just a year before. And the IBM/Ponemon 2019 report found that the estimated probability of a company having repeated data breaches within two years grew by 31 percent between 2014 and 2019. Why is this happening?

The world has seen more unprecedented events in the first six months of 2020 than some see in a lifetime. From a pandemic threatening the health and lives of people worldwide and triggering unprecedented social isolation to recent devastating events catalyzing global civil unrest, this year almost feels apocalyptic. As always, in times of disruption and uncertainty, vulnerabilities are exposed, and opportunities are opened for the selfish few to capitalize on others’ misfortune.

Focusing on these five essential workflows for secure DevOps will help you get started implementing monitoring, security, and compliance for containers and Kubernetes. You might be starting to adopt DevOps and find that it dramatically simplifies deploying applications in containers and Kubernetes. However, you probably also found that it adds a new set of complexities for managing, securing, and troubleshooting applications.