Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

miniorange

Data Protection Officer Under the DPDP Act: Who Needs One and What They Do

Sep 21, 2026 By Saloni Walimbe In miniOrange
Not every organization that processes personal data has to appoint a Data Protection Officer. Under India's Digital Personal Data Protection Act, 2023, this duty applies only to Significant Data Fiduciaries (SDFs), a category the government assigns based on the scale and sensitivity of the data an entity handles. So before you assume your business needs a data protection officer, it helps to know exactly where this obligation begins and ends.
Read Post
miniorange

Passwordless Authentication and Passkeys: How FIDO2 Enables Secure Login

Sep 21, 2026 By Minal Purwar In miniOrange
Password-based authentication is slowly disappearing from the login experience in 2026. Instead, users increasingly authenticate with a fingerprint, device PIN, or security key without typing a password. This is where passwordless authentication and passkeys come in. Built on FIDO2 and WebAuthn, passkeys use cryptographic credentials to make passwordless login simpler for users while reducing exposure to phishing and credential theft. But passkeys are only one part of the picture.
Read Post
miniorange

What Is a Security Token? How Does It Work?

Sep 21, 2026 By Stutee Raja In miniOrange
A security token is a physical device, digital object, or software credential that helps verify a user's identity before granting access to a system, application, network, or account. Depending on the type, it can generate a one-time password (OTP), store cryptographic credentials, or work with an authentication system to prove that the person requesting access possesses the authorized token.
Read Post
Tines

"Better than the tools we were quoted six figures for": How Tines' finance team built a custom billing app for <$1,000

Sep 21, 2026 By Tines In Tines
At Tines, Salesforce and NetSuite form our core finance and billing stack. But anyone using these tools will be familiar with the issues this set-up presents — it requires manual, time-consuming work to connect data across the two platforms. Over the years, my team evaluated a bunch of solutions to this problem, including third-party tools and NetSuite’s own native offering.
Read Post

One Image to Root Them All - The 443 Podcast - Episode 388

Sep 21, 2026 By WatchGuard Technologies In WatchGuard
This week on the podcast, we break down how a heap overflow in an image-decoding library nobody thinks about became a pull request inside OpenAI's internal monorepo. Three researchers chained it with an OpenAI single sign-on flaw to hijack employee ChatGPT and Codex accounts in under 72 hours; and had an AI write the exploit for them. Before that, we cover the actively exploited maximum-severity authentication bypass in Cisco's Identity Services Engine. Then we close with RatHat, a new Android malware that enables Wireless Debugging, reads its own pairing code from the screen, and asks a commercial AI assistant where to tap.
View Video
opti9

RTO vs RPO: What They Mean and How to Set Them Honestly

Sep 21, 2026 By Mark Mazza In Opti9
Recovery time objective (RTO) is how long a system can be down before the impact becomes unacceptable. Recovery point objective (RPO) is how much data the business can afford to lose, measured as a window of time before the incident. RTO looks forward from the moment things break. RPO looks backward from it. That distinction takes a paragraph to explain and years to get right, because the difficult part was never the definition.
Read Post
knowbe4

Millions of Phishing Emails Use ASCII Smuggling to Bypass Security Filters

Sep 21, 2026 By KnowBe4 Team In KnowBe4
A massive phishing campaign is using invisible Unicode tag characters to evade security filters, according to researchers at Microsoft. This technique, known as “ASCII smuggling,” has grown popular over the past year for launching AI prompt injection attacks, but the same tactic can hide suspicious text in emails.
Read Post
kovrr

The New Agent Control Standard Names the Controls, Not Their Value

Sep 21, 2026 By Kovrr In Kovrr
The OWASP GenAI Security Project unveiled an Agent Control Standard in early September, donated to the project and aimed at runtime enforcement for agentic systems. It sets out that agents should be inspectable, traceable and instrumentable, with declarative hooks and policy enforcement across frameworks. ‍ It answers which controls belong around an agent.
Read Post

Copyright © 2026 OpsMatters™. All rights reserved.