Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

A Traveller's Guide to Staying Cyber safe

With the massive increase in mobile device sales worldwide, it is easy to imagine that the number of people using the internet while travelling has also increased significantly in recent years. With this growth in online activity comes a greater risk of becoming a victim of cybercrime. There are a number of steps that travellers can take to protect themselves from becoming targets of cybercrime. Here are 10 tips for staying cyber safe while travelling.

5 Ways Tech Companies Can Prevent Data Breaches

The technology industry has unlocked innovation across all sectors as an enabler of digital transformation. Most organizations are now outsourcing critical operations to tech companies, such as cloud providers. Tech vendors are now left to manage an ever-growing volume of sensitive data, which they must secure effectively to prevent large-scale data breaches. IBM and Ponemon Institute’s 2022 Cost of a Data Breach Report found a record high average breach cost of US$4.35 million.

Directory Sharing in a Web-Based RDP Client Using the File System Access API

Remote Desktop Protocol (RDP) is a protocol developed by Microsoft which at its core is designed to give users a graphical interface to a remote Windows computer over a network connection. The remote Windows machine runs an RDP server, while the local computer accessing it runs an RDP client. Windows comes bundled with Microsoft's Remote Desktop Connection to easily access Windows hosts over RDP.

ZAPESCAPE: Organization-wide control over Code by Zapier

In the middle of March 2022, Zenity research team discovered a sandbox-escape vulnerability in Code by Zapier, a service used by Zapier to execute custom code as part of a Zap. Exploiting this vulnerability, any user could take full control over the execution environment of their entire account allowing them to manipulate results and steal sensitive data. For example, a Zapier user could take control over the admin’s custom code execution environment.

Analysis and Remediation Guidance of CSRF Vulnerability in Csurf Express.js Middleware

On 28th of August fortbridge.co.uk reported a vulnerability in csurf middleware – expressjs supporting library that enables CSRF protection in expressjs. As of 13th of September csurf library has been deprecated with no plans to fix the vulnerabilities. There is no viable alternative for csurf middleware now.

Find threats: Cloud credential theft on Windows endpoints

In today’s hybrid, multi-cloud environments, users and administrators connect to various cloud services using Command Line Interface (CLI) tools and web browsers. This post highlights the risks associated with unprotected and unmonitored cloud credentials which are found on endpoints, in file shares and in browser cookies. Get actionable and direct guidance around: In order to alert on and hunt for this malicious activity. Business workloads are increasingly undergoing a migration to the cloud.

What is Windows Code Signing Certificate [ A Detailed Guide]

A Windows code signing certificate is crucial for a developer as well as a user. This is because these certificates add a layer of security to a digital solution. Feeling that the software is secure to use, the consumer engages with it easily. On the other hand, for a developer or development company reinforcing their software with a signing certificate means good business.

What is the NIST CSF? - Sedara Whiteboard Series

Welcome back to the Sedara Whiteboard series. In this episode, we will discuss frequently asked questions about NIST CSF. The NIST Cybersecurity Framework, developed by the National Institute of Standards and Technology, integrates industry standards and bast practices to help organizations manage their cybersecurity risks. It is widely used across schools, government organizations, and businesses across the globe. Sedara uses the NIST CSF as a basis for testing the posture of an organization’s security.

Top Phishing and Social Media Threats: Key Findings from the Quarterly Threat Trends & Intelligence Report

In today’s online landscape, it is crucial for organizations to stay on top of the threats that put their enterprises at risk. Agari and PhishLabs have put together their Quarterly Threat Trends & Intelligence Report detailing their analysis of phishing and social media attacks this quarter. The report presents statistics regarding the volume of attacks, the tactics used by cybercriminals, and the main targets of these attacks, documenting the changes since last quarter.