As outlined in a previous post, OpenTelemetry and Splunk Observability Cloud can provide great visibility when security teams investigate activity in modern environments. In this post, we look at another aspect of this visibility: how you can use traces to see directly into the workings of an application to find a potential threat. Let’s imagine we’re the security analyst, and a message comes across from the Security Operations Center (SOC).

In 2016, a house in Middle, Ohio, went up in flames. The owner of the home, Ross Compton, claimed he was asleep when the fire broke out, waking just in time to hastily pack a suitcase, smash his bedroom window, and make an escape. However, the very technology keeping Compton alive unraveled his alibi and led to his arrest. Compton had a pacemaker, and the police, suspicious of his account, secured a warrant to access its data.

The latest CVE-2024-38077 Remote Code Execution vulnerability (RCE) and coined MadLicense has been rated as absolutely critical with a CVSS 3.1 score of 9.8. The Windows Remote Desktop Licensing (RDL) service has a vulnerability that enables network attacks with low complexity, affecting all versions of Windows Server from 2000 to 2025 (all Windows Servers).

At this developmental stage, it’s time to start trusting that all of the work you put into teaching kids about good online behavior will pay off.

On August 12, 2024, Ivanti announced a critical authentication bypass vulnerability in its Virtual Traffic Manager (vTM), identified as CVE-2024-7593. Ivanti Virtual Traffic Manager (vTM) is a software-based application delivery controller that manages traffic flow to ensure high performance, availability, and security for web applications.

On July 19, 2024, organizations around the world began to experience the “blue screen of death” in what would soon be considered one of the largest IT outages in history. Early rumors of a mass cyberattack were quickly squashed: it seemed a minor software update was to blame for countless shopping excursions cut short, airline flights grounded and critical surgeries postponed.

It’s that time of year. Back to school preparation is in full swing, from last minute shopping lists and school supplies to pick-up schedules and extracurricular activities.

No executive wants to be blindsided by risks that should have been reasonably anticipated, especially the CEO, CFO, and board members. In the CISO Desk Reference Guide, Gary Hayslip, Bill Bonney, and I wrote extensively about how CISOs play a critical role in contextualizing digital and cyber risks to the organization’s broader enterprise risk management practices.

At RSA Conference 2024, Cato Networks introduced Cato CTRL (Cyber Threats Research Lab), which is our cyber threat intelligence (CTI) team. Cato CTRL protects organizations by collecting, analyzing and reporting on external and internal threats, utilizing the data lake underlying the Cato SASE Cloud Platform. For 2024, Cato CTRL is publishing quarterly threat reports that provide an overview of the threat landscape.