October 1st marks the start of Security Awareness Month. A global campaign launched two decades ago to improve cyber security awareness and equip people with the knowledge and resources they need to be secure online. But what impact has this campaign truly had in the workplace? Yes, it spotlights the issue and boosts high-level awareness of threats like phishing.

Most people know what a chief information security officer (CISO) is and how they’re essential to improving an organization’s security posture. The problem is that many organizations have limited hiring resources and it makes little sense to appoint an in-house CISO without tangible ROI. ‍ A virtual CISO or vCISO becomes an excellent solution for organizations that need to enhance their security framework within resource constraints.

In recent weeks, reports have surfaced regarding a significant breach involving Cisco, exposing sensitive data from various organizations. This blog post delves into the details of the breach, the compromised data, the implicated companies, and the methods used by attackers to gain access to such critical information.

In the context of cloud security posture management (CSPM), custom controls are policies or rules that give security teams the flexibility to create and enforce policies. These are needed to manage posture, tailor compliance measures, and detect misconfigurations across infrastructures like Kubernetes, containers, and the cloud.

We’ve all been there—staring at code, hoping no hidden traps are waiting to cause chaos down the line. That’s where secure code reviews come in. Think of them as your last chance to catch those pesky bugs and vulnerabilities before they wreak havoc. And here’s a little reality check—those cutting-edge LLMs? They suggest insecure code 30% of the time. So, even with AI on our side, we still need to stay sharp.

In the ever-evolving landscape of cybersecurity, IT practitioners stand as the first line of defense against an increasingly sophisticated array of threats. Their role in safeguarding critical assets, data, and infrastructure has never been more crucial. But as the complexity and frequency of cyber attacks escalate, these professionals often find themselves overwhelmed by an ever-growing list of responsibilities and tasks.

Context switching can be security’s worst enemy. Today’s security practices require developer buy-in, and when security teams require developers to deviate from their established workflows to address issues, adoption becomes far less likely. To truly empower developers to find and fix vulnerabilities within their code, security teams must shift security even further left. It’s not enough to simply provide user-friendly tools and training around them.

This malicious tactic enables cybercriminals to sneak into an organization’s email network or other systems without the payloads typically associated with harmful software. The payloadless method leverages harder-to-detect malware delivery techniques and psychological manipulation to execute attacks. It reflects the ingenuity of threat actors and emphasizes the need for organizations to never stop revamping their security strategies.

API security is a critical concern for industries that are undergoing digital transformation. Financial services and insurance sectors are particularly vulnerable due to the increasing number of APIs they need to manage. As early adopters of digitalization, these sectors face unique challenges requiring a customized API security approach.

Most computer systems and applications use passwords as a common authentication method. The simplest way to implement authentication is to store a list of all valid passwords for each user. The downside of this method is that if the list is compromised, the attacker will know all the user passwords. A more common approach is to store the cryptographic hash value of the password phrase.