Last week, a researcher from the Alibaba Cloud Security Team dropped a zero-day remote code execution exploit on Twitter, targeting the extremely popular log4j logging framework for Java (specifically, the 2.x branch called Log4j2). The vulnerability was originally discovered and reported to Apache by the Alibaba cloud security team on November 24th. MITRE assigned CVE-2021-44228 to this vulnerability, which has since been dubbed Log4Shell by security researchers.

Five worthy reads is a regular column on five noteworthy items we’ve discovered while researching trending and timeless topics. In this edition, we’ll learn about social engineering, its types, its evolution, and how to avoid falling victim to a social engineering attack. Kevin David Mitnick is considered one of the most famous social engineers among the IT community. Kevin is now a top cybersecurity speaker and a best-selling author.

Supplier due diligence is an action taken by an organisation to identify and understand the credibility and suitability of a prospective partner or vendor. Conducting supplier due diligence can help guide decision-making when choosing the right vendor, detect risks with potential suppliers and protect customer data in the process. It's also considered good business practice and can help mitigate future financial and reputational damage caused by a data breach.

In the last 18 months, many people have learned a lot about themselves. The solitude of lockdowns, isolation, remote work, and seemingly endless video meetings have taxed everyone’s mental health. One would think that cybersecurity would have been unaffected by these shifts in working environments and habits. After all, many of us are introverted by nature, which is one of the reasons often cited as why we gravitated towards technology as our chosen path.

There's little question that you've already heard about the recently discovered security flaw related to Log4j, a widely used Java library for logging error messages in applications. The vulnerability enables a threat actor to remotely execute commands via remote code execution (RCE) on nearly any machine using Log4j. But it's also important to cut through all of the noise to truly understand the implications of the Log4j and what organizations can do to combat it.

Web browsers are indispensable tools for navigating the internet, but you should think twice before entrusting your secrets to them.