In cybersecurity, vulnerability assessment and penetration testing are often discussed together, but they serve distinct purposes in securing a network. Organizations looking to strengthen their cybersecurity defenses must understand the differences between the two, as well as when and how to use each. This blog explores the difference between vulnerability assessment and penetration testing, and why a combined approach can be essential in achieving the most robust security strategy.

Have you ever received a text from someone you do not know? Did you become alarmed by the message? Did the message contain information about you and the people you know? Pretexting continues to become part of the global hacker's arsenal of tricks to manipulate their victims. This hack includes clicking on malicious links that can lead to identity threats, financial fraud, and extortion. Preventing pretexting starts security awareness training for users.

Supply chain attacks are a growing concern, particularly within the financial sector, with attackers increasingly using key technology suppliers as a ‘jumpbox’ to pivot into their intended target organisation. Last year’s MOVEit breach for instance saw a single ICT supplier ultimately cause ~2,356 organisations to be compromised, with primary victims predominantly in the financial sector.

Work from home (WFH) remains a common practice for many businesses worldwide. This working model has enabled companies to hire top talent across borders, boost revenue, and improve employees work-life balance. A new report by Tata Consultancy Services (TCS) claims that, by 2025, 40% of employees around the world will work from home. However, this growing trend also brings about a range of cybersecurity risks that could impact businesses significantly.

There are lots of hurdles to jump when trying to set up and maintain a SIEM. Preparing infrastructure and installing the software components, getting logs ingested into the system, parsing and normalizing those log messages properly, configuring alerts for detection, etc. These are all large tasks that require thoughtful planning and a lot of work to get right. But let’s say you’ve managed to clear all those hurdles…in that case, great job!!

Most organizations today are heavily reliant on technology, regardless of the product or service they provide. This expands their data exposure points and potential attack surface, which is why there is a significant need to monitor the risks and vulnerabilities in the cybersecurity landscape. ‍ Cyber Essentials certification is a comprehensive cybersecurity strategy involving vigilance over various scattered technologies, policies, and controls.

If you wish to fortify your organization’s cybersecurity posture, obtaining a Cyber Essentials certification is a good idea. It enables IT managers to be more aware of the cybersecurity risks in their environment and take actionable steps to mitigate them. Before you pursue it, though, you should decide between two certification levels: Cyber Essentials and Cyber Essentials Plus. ‍ While both are cybersecurity assurance schemes, Cyber Essentials Plus offers a greater level of assurance.

In the wide world of information security, there are many different frameworks, standards, and systems in use to help assume a secure stance against threats. Two commonly seen frameworks are SOC 2 and ISO 27001. How do these two stand in comparison to each other, and which one do you need for your business? Let’s discuss.

CVE-2023-2163 is a critical vulnerability in the Linux Kernel, specifically affecting kernel versions 5.4 and above (excluding 6.3). This vulnerability arises from incorrect verifier pruning in the Berkeley Packet Filter (BPF), leading to unsafe code paths being incorrectly marked as safe. The vulnerability has a CVSS v3.1 Base Score of 8.8, indicating its high severity. The consequences are arbitrary read/write in kernel memory, lateral privilege escalation and container escape.