Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Why is the US DoD taking a Zero Trust Approach?

Recently the US Department of Defense (DoD) cyber-perimeter had been breached by state-sponsored and individual hackers. Vulnerabilities exposed by data breaches inside and outside the DoD demonstrate the need for a more robust cybersecurity framework that facilitates risk-based protection. In October 2022, it released the “DoD Zero Trust Strategy” and road map.

The Seven Types of Non-human Identities to Secure

Non-humans are everywhere these days. Sure, you’ve seen the much-deserved hype about how AI-powered tools like ChatGPT are going to change everything. But there are plenty of more mundane non-human entities that you interact with in your daily life: the smart thermostat program that knows to cool down your house at a certain time every day, the application on your phone that suggests directions to a place you’ve searched for, and many others.

Snyk and ServiceNow collaborate on new SBOM solution

ServiceNow’s biggest event of the year — Knowledge 2023 — is here, and Snyk is excited to be a part of it with some big news! Back in January, we announced Snyk Security for Application Vulnerability Response to bring Snyk Open Source software composition analysis to ServiceNow Security Operations.

API5:2019 Broken Function Level Authorization: The What, Impact, Sample Exploit, and Prevention Methods

APIs are great for accessing specific functions and features, but what happens when they allow unauthorized access? Imagine a social media platform where users can share posts. To enable users to access posts, the platform provides an API that allows GET requests to retrieve posts by specifying the user ID and post ID. GET/api/v2.1/user/1438/posts?id=40. The API will return the 40th post for user id 1438. As these are public forums, any user can submit GET requests to access posts.

Millions of Toyota Owners Have Their Locations Exposed for the Last 10 Years

Toyota is a worldwide car manufacturer based in Toyota City, Japan. This automaker produces millions of vehicles each year, and many of those vehicles had their locations publicly available for as long as ten years. If you drive a Toyota vehicle, your location may have been available to anyone interested in seeing it, all because of a cloud configuration mistake. This mistake compromised the privacy of over 2 million Toyota car owners and is a serious hit to Toyota's name and reputation.

Updated Cato DLP Engine Brings Customization, Sensitivity Labels, and More

Last year, we launched Cato DLP to great success. It was the first DLP engine that could protect data across all enterprise applications without the need for complex, cumbersome DLP rules. Since then, we have been improving the DLP engine and adding key capabilities, including user-defined data types for increased control and integration with Microsoft Information Protection (MIP) to immediately apply sensitivity labels to your DLP policy. Let’s take a closer look.

Abusing Time-Of-Check Time-Of-Use (TOCTOU) Race Condition Vulnerabilities in Games, Harry Potter Style

I feel I need to clarify, for legal reasons, that this is nothing to do with any Harry Potter game. The reference is made because we are dealing with spells and magic, and I mean magic in the literal sense, not a reference to application security – although on some/most days it feels like magic. Time-Of-Check Time-Of-Use (TOCTOU) and Race Conditions? What’s it all about?

KnowBe4 Celebrates Success of 60,000-Customer Milestone

We are thrilled to announce we have reached a milestone of 60,000 customer organizations globally, consisting of tens of millions of end users. KnowBe4 is a customer-driven organization. I truly believe that without excellent customer service, we do not exist, which is why I regularly emphasize the importance of fantastic customer service in our daily, organization-wide meetings.

The Number of Phishing Attacks Continues to Grow at a Rate of 150% Per Year

The latest Phishing Activity Trends Report from the Anti-Phishing Working Group (APWG) shows an unrelenting upward trend in the number of phishing attacks per quarter. Despite the alarm that the growth in the number of phishing attacks should generate, this report sheds some light on what seems to be working for cybercriminals if you dig a little deeper. According to the report.

Close the Cybersecurity Skills Gap by Investing in the Future

We hear a lot about the cybersecurity skills gap, which the latest research puts at 770,000 open positions in the U.S. and 3.4 million globally. There are lots of reasons why organizations find themselves dealing with a skills deficit – from an actual dearth of qualified talent to internal factors including turnover, lack of budget/competitive wages, limited opportunities for growth and promotion, and lack of training.