Vulnerability management (VM) is an essential process through which organizations can reduce risk in their environments. But myths and misconceptions surrounding VM abound. For instance, organizations commonly approach vulnerability management in the same way as they do patch management. Others are guilty of believing that all attacks rely on vulnerabilities, while others still are under the false impression that all software patches will work without a hitch.

A selection of this week’s more interesting vulnerability disclosures and cyber security news. Here we are again, another week and another S3 leak. I really don’t understand how this keeps happening. Either its sloppy admin or people with no technical (or security) understanding is being let loose on a complex cloud service – both are not great. You would hope that when you call in experts to help with a problem, you are dealing with someone responsible.

Would you sit back in your chair and do nothing while your systems are under attack? You may be, without even realizing it. Businesses are increasingly finding themselves under cyberattacks carried out by hackers or criminals. However, many of them fail to recognize that they have been attacked until it is too late to do anything. That is why timing is the most essential component of cyber security. Fighting attacks proactively instead of reactively can save your systems and networks.

As I talk to organizations in the AT&T Executive Briefing Center and learn more about the different types of business and enterprise security goals, one of the resonating themes across different industry verticals today is Digital Trust. The goal is to build trust in the system between the consumers of your services and the enterprise. To achieve this goal, it is about going to the foundational aspects of information protection.

When NIST (https://nvd.nist.go) announces a new CVE (Common Vulnerability and Exposure) that impacts Kubernetes, kube administrators and IT Security teams need to quickly understand the impact of the vulnerability and protect their Kubernetes clusters. Often, no patches are yet available, so in addition to understanding the impact, DevOps teams have to decide whether or not to create a custom fix to mitigate the risk of that CVE without bringing down the entire app or system.

European police have arrested six people as part of an investigation into a theft which saw €24 million (US $27 million) stolen from users of cryptocurrency exchange. In a press release, Europol described how five men and one woman were simultaneously arrested on Tuesday morning at the homes of the suspects in Charlcombe, Lower Weston and Staverton (UK) and Amsterdam and Rotterdam (the Netherlands).

Today marked the first ever AWS re:Inforce security conference, and Styra was well represented. Paavan Mistry from AWS took the stage to walk through an EKS Security session with Synamedia, wherein they talked about the great responsibility organizations have over their Kubernetes environments.

Cybercriminals have learnt something very valuable in the last couple of weeks: in order to regain access to their data, cities in Florida are prepared to pay out huge Bitcoin ransoms to hackers. Less than a week after the city of Riviera Beach, 80 miles from Miami, unanimously voted to pay US $600,000 worth of Bitcoins to an extortionist who had locked their IT systems with ransomware, a second city has come to the same decision.

The life sciences industry is responsible for the discovery, development, and commercialization of new medicines to treat disease. Over the past 20 years, the discipline has undergone massive changes.

Log data collection and management in IT have proved their importance in the past. Log collection and log correlation have become essential for security, internal control or compliance purposes. The average IT environment, though, consists of numerous components like software and hardware, and the logs can easily grow into hundreds of thousands in a blink of an eye. Logs contain essential pieces of network and device intelligence: What are user up to? What data is being viewed? By whom?