Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Are we sure that SOAR is at a crossroads?

I recently had the opportunity to discuss state-of-the-art technologies to support security operations with industry analysts. I asked questions and confirmed that the current view of SOAR (security orchestration, automation and response) and SIEM (security information and event management) goes well beyond the security operation center (SOC).

Improvements to boost the attack surface view, ports & more

The attack surface is inevitably going to grow. That’s why we believe it’s crucial for customers to not only know what assets they are exposing online but knowing to what extent assets are exposed. Users can now toggle the view of their attack surface by active and inactive assets. When toggled on, users will see all active assets present on their attack surface in the last 14 calendar days making it easier to discern what may no longer be on the attack surface.

Weekly Cyber Security News 29/04/2022

A selection of this week’s more interesting vulnerability disclosures and cyber security news. For a daily selection see our twitter feed at #ionCube24. I’ve heard a few friends over the years mention things discussed at home suddenly appearing in ads when on the Internet. Yes, some of that might be due to doing web searches, but what if…

Thoughts on diversity and inclusion in cybersecurity

Our other blogs and articles are primarily security-focused – this is non-technical yet relevant, one of the issues that I felt and intended to explore personally. It’s pretty hard to admit when you are in privilege, and it’s even harder to change the status quo when you are comfortable. This is a write-up on how I see diversity and inclusion currently in the cybersecurity industry, mainly a beginner’s understanding of the subject.

Potential Abuse of Self-Signed Certificate IP Attribution Leads to Malicious Score Drop

In 2020, SecurityScorecard uncovered a case in which self-signed certificates caused misattributions for CDN IPs, and IPs shared by many websites. At the time, we mitigated this issue by labeling CDNs (e.g. Cloudflare, Akamai, Fastly, etc.), so that customers could easily determine if their scoring problems were related to shared IPs.

4 Reasons Companies Are Adopting a Vendor Consolidation Strategy

According to Gartner, by 2025, 80% of enterprises will have adopted a strategy to unify web, Cloud services and private application access from a single vendor’s security service edge (SSE). We know that cybersecurity is a top priority for IT funding. Business owners and CISOs need to invest in security technologies in a way that will drive resilience and promote productivity among their – probably largely digital – businesses.

Unify endpoint and network evidence

Unmanaged endpoints, vendor security appliances, cloud instances, and IoT devices often lack endpoint protection, creating hiding places that attackers exploit. Using Humio to correlate Falcon endpoint data with Corelight network evidence improves detection capabilities for all of your devices, and makes investigators and hunters faster.

What does XDR mean for your organization?

As one of the hottest new buzzwords in the infosec space, XDR means many things to many people. This talk will discuss all of the possible components of an XDR solution through the lens of SOC operations, laying out the pros and cons of various approaches such as SaaS vs on-premise, specialized vs general tooling, etc. for organizations of different size, funding, and maturity levels. Best practice suggestions will be provided throughout, from general principles to specific integration code.