Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Nearly four years ago, the Department of Defense released the Cybersecurity Maturity Model Certification (CMMC). This was created as a complement to NIST SP 800-171, which focused on protecting Controlled Unclassified Information (CUI). If you are unfamiliar with what constitutes CUI, the simple way to think of it is to apply the broadest terms of privacy to any information that relates to any government relationship with a company.

On January 31st 2024, Snyk announced the discovery of four vulnerabilities in Kubernetes and Docker. For Kubernetes, the vulnerabilities are specific to the runc CRI. Successful exploitation allows an attacker to escape the container and gain access to the host operating system. To exploit these vulnerabilities, an attacker will need to control the Dockerfile when the containers are built.

A selection of this week’s more interesting vulnerability disclosures and cyber security news. Nasty local escalation flaw to patch…

The digital transformation of industrial landscapes has brought unprecedented advancements in efficiency and productivity for Operational Technology (OT) companies. But this surge in connectivity exposes critical infrastructure to heightened cybersecurity risks, such as: To address these risks, OT companies should adhere to the guidelines in the European Union’s Directive on Security of Network and Information Systems (NIS2).

Your one-stop shop for transparent cloud security information Elastic® knows that security and compliance requirements are mandatory for regulated and non-regulated customers alike. We strongly believe in providing clear and transparent information to earn your trust in Elastic as an organization and in the services we provide. Our Trust Center is a public one-stop shop for information on security, compliance, privacy, and resiliency for Elastic and the Elastic Cloud.

Many security vendors offer automated detection of cloud applications and services, classifying them into categories and exposing attributes such as security risk, compliance, company status etc. Users can then apply different security measures, including setting firewall, CASB and DLP policies, based on the apps categories and attributes. It makes sense to conclude that the more apps are classified, the merrier. However, such a conclusion must be taken with a grain of salt.

American college athletics is a foundational pillar of higher education institutions and a profitable business model for universities. The National Collegiate Athletic Association (NCAA), which regulates college athletics, reported that in 2020, Division I schools earned $15.7 billion in athletics revenue. In 2023, NCAA Division I school Ohio State University reported a record-breaking revenue of over $275 million from its athletic department alone.

Cybercriminals can spread malware through phishing attacks, man-in-the-middle attacks, exploit kits and drive-by downloads. Cybercriminals typically use social engineering tactics to trick people into downloading malware or exploit security vulnerabilities to install malware without the victim knowing. Continue reading to learn more about malware, how cybercriminals spread it, how to detect if your device is infected and how to stay protected against malware.

Trustwave MailMarshal is now listed on the Microsoft Azure Marketplace, an online store for solutions that are built on or built for Azure and intended for IT professionals and developers. Trustwave MailMarshal joins an illustrious list of IT software applications and services built by industry-leading technology companies.

Many people around the world right now are confused as to whether their organization is ready for Google and Yahoo’s new requirements for bulk senders. So don’t worry, you’re not alone. Back in October the announcement was made that there would be consequences for organizations sending more than 5,000 emails a day who didn’t have their email security in order. But what are the consequences? And who really needs to worry?