Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

After our recent successes exploring WebSocket Hijacking vulnerabilities, we decided to expand this research project into other attacks that involve WebSockets. We started by looking at WebSocket smuggling attacks and expanded our scope to include HTTP response header injection attacks and potential novel impacts.

Throughout history, technology has been a catalyst for solving many civilizational problems. The advent of artificial intelligence (AI) presents an incredible opportunity to combat cybersecurity risks and bolster the defenses of organizational IT networks. The good news is that it’s already making an impact by reducing the average dwell time of cyber attacks by as much as 15%. But AI holds much more promise.

CodeSecDays provided an invaluable platform for the French AppSec community to come together, share insights, address challenges, and explore best practices for securing digital infrastructures. Here are the key highlights.

Vanta has helped auditors automate and simplify thousands of compliance audits, and we’re now making the process even easier. Today we’re excited to share that we’ve added new endpoints for auditor tools to the Vanta API, leading to a better collaboration experience for auditors and customers. ‍ With our new API endpoints, audit partners can integrate their tools with Vanta, allowing them to work in their preferred systems.

How safe is your business from an employee stealing data? Employee data theft refers to the unauthorized access, transfer, or misuse of a company’s confidential data by its employees. Whether driven by malice or negligence, this type of data theft poses a significant risk to your business’s security and reputation. As incidents of insider threats rise, it becomes crucial for companies to identify the warning signs and implement the necessary preventive measures.

Business owners are increasingly recognizing its positive impact on business growth. Many marketing and sales strategies use different accounts on a single platform. However, despite its effectiveness in business, not all platforms allow multi-accounting. That’s where residential proxy comes in as an effective solution for multi-accounting.

Traditional security measures often fall short of measuring the dynamic modern-day threats. This is where red teaming comes in, a powerful approach that simulates real-world attacks to identify and address security gaps before they can be exploited. Standard red teaming tools are crucial in mimicking real attackers’ actions and uncovering vulnerabilities.

Automated penetration testing, or automated pen testing, is a type of security assessment that uses specialist tools to uncover vulnerabilities. Although it can serve as part of a cohesive security strategy, it also presents some challenges. In this article, we outline the pros and cons of automated pen testing and compare it with manual pen testing.

In June 2010, Trustwave acquired Breach Security, which brought with it the popular Open-Source Web Application Firewall ModSecurity for Apache. At that time, Trustwave relicensed the code under the Apache license. This relicensing allowed more public participation in the project, and 2012 saw the release of an IIS port from Microsoft and a port for Nginx.

According to the CrowdStrike 2024 Global Threat Report, the fastest recorded eCrime breakout time was just 2 minutes and 7 seconds in 2023. This underscores the need to equip security analysts with modern tools that level the playing field and enable them to work more efficiently and effectively.