Matt Lawrence, Head of Defensive Security, and Dan Green, Head of Solutions, write about why compromise is inevitable – and the practical steps that organisations can take to build a security operating model capable of weathering the storm of cyber threats today.
Vanta’s mission is to secure the internet and protect consumer data. An important step to making this a reality is ensuring that every company can prove its own security to customers and prospects—creating a virtuous cycle where good security is good business. Today, we're thrilled to announce the next move in achieving our mission with Vanta's acquisition of Trustpage to reimagine the future of trust together.
Recently, Amazon accidentally exposed information on Amazon Prime Video viewing habits to the public. In addition, Thomson Reuters news and media company admitted that their servers had compromised 3TB of data by public-facing ElasticSearch databases. Well, these are the type of news we often see on the front page of cybersecurity forums. But if you dig a bit deeper, you will find that these data leaks are caused by misconfiguration, not cyber attacks.
Telephony fraud is a significant challenge. Companies of all sizes and industries are subjected to the malicious usage of voice and SMS with the intent of committing financial fraud, identity theft, denial-of-service, and a variety of other attacks. Businesses that fall victim to fraud can incur significant financial losses, irreparable damage to their reputation, and legal implications.
The Fourth Industrial Revolution, with its accelerating pace of digitization and automation, means that organizations are becoming more dependent on data processing and connectivity to deliver value to their customers and stakeholders. Threat actors exploit this growing attack surface to achieve their aims: fraud, extortion, harassment, espionage, and other harms. They are smart, adaptive, and ruthless—and getting rich as a result.
Banks have invested countless millions in Know Your Client and Know Your Customer verification, but they haven’t been able to use this knowledge beyond regulatory “check the box” procedures that can irritate clients and even cause some of them to switch banks. However, things don’t have to be this way.
If you’ve been in the realm of penetration (“pen”) testing in any capacity for any length of time, you’ve probably experienced the conversations around inconsistent pen testing results across teams or vendors. This isn’t anything new in the pen testing world. The conversations probably ranged from friendly internal team banter to more serious discussions with external vendors on pen testing program success metrics. Is this a case of mistaken identity?
Trustwave is relaunching its Advanced Continual Threat Hunt (ACTH) platform with a new patent-pending methodology that enables Trustwave researchers to conduct significantly more human-led threat hunts, resulting in a 3x increase in behavior-based threat findings. These discoveries might otherwise go undetected by current EDR tools.
In a watering hole attack, threat actors usually have to follow a series of steps. First, they need to research the target and make sure they know the type of website the potential victim frequents. Then, they attempt to infect it with malicious code so that when the victim visits it, the website exploits a vulnerability in the browser or convinces them to download a file that compromises the user device.
