A cyber incident response retainer can help businesses to better manage both the financial and security risks posed by constantly evolving threats. This article outlines the benefits of the retainer model and also covers what organisations should look for in a potential provider.

By James Rees, MD, Razorthorn Security In the rapidly evolving world of cybersecurity, artificial intelligence (AI) and large language models (LLMs), have become buzzwords that seem to promise revolutionary solutions. However, as with any emerging technology, it’s crucial to separate hype from reality.

One of the more common forms of fileless malware that’s making the rounds across organizations cloud environments, is something called PyLoose. In rotation since 2014, this specific strain of malware targets the cloud workloads and enters environments through an open-source Python code execution application.

On September 24, 2024, Hewlett Packard Enterprise (HPE), the parent company of Aruba Networks, released a security bulletin addressing three critical command injection vulnerabilities affecting Aruba Networking Access Points. These vulnerabilities, identified as CVE-2024-42505, CVE-2024-42506, and CVE-2024-42507, could allow remote unauthenticated attackers to execute code with privileged access.

Palo Alto Networks acquired IBM QRadar SaaS assets, leaving several organizations in limbo and uncertain about the future of their security information and event management (SIEM). Security teams grapple with a complex and potentially disruptive transition as Palo Alto Networks pushes and even mandates migration to its relatively new XSIAM platform.

Cloud attackers are swift and sophisticated, requiring robust threat detection and response programs that can keep pace with these malicious actors born in the cloud. They exploit the automation and scale of the cloud, along with new techniques, to accelerate all stages of an attack and inflict damage within minutes.

The European Union (EU) is leading the development of comprehensive cybersecurity regulations. These frameworks shape secure digital environments and protect businesses and citizens from cyber threats. For industry leaders and cybersecurity practitioners, especially those focused on cloud technologies, understanding and navigating these frameworks is key to maintaining compliance and gaining a competitive edge.

DCRat (also known as Dark Crystal RAT) is a modular remote access Trojan (RAT) which is offered as malware-as-a-service (MaaS) and has been around since 2018. It is written in C# and has typical RAT and information stealing capabilities, such as executing shell commands, logging keystrokes, exfiltrating files and credentials, among others.

Running a business is no easy feat, and it's made that much harder by the threat of natural disasters, data breaches, or cyberattacks that can happen at any given moment. Such cases can lead to delayed business operations, financial or legal problems, or even business shutting down. So, how can businesses prepare for the worst? The answer lies in implementing a Business Continuity and Disaster Recovery (BCDR) plan.

The US Cybersecurity and Infrastructure Security Agency (CISA) has warned that malicious hackers continue to be capable of compromising industrial control systems (ICS) and other operational technology (OT) using "unsophisticated methods" - suggesting that much more still needs to be done to secure them properly.