CyberSecure Specialist

28 Jun

School’s out for summer, but it’s not time to let your cyber guard down

Information

The beginning of the summer break is the perfect time for parents to remind their children about the importance of safe online habits The sun’s out, and so is school. But despite our best efforts, the chances are that our children will spend the coming summer holiday period glued to their devices. Depending on their age, protecting them can a difficult balancing act between respecting their privacy and independence and ensuring they heed our warnings.…

Read More
27 Jun

U.K. Cyber Thug “PlugwalkJoe” Gets 5 Years in Prison

Information, Insights

Joseph James “PlugwalkJoe” O’Connor, a 24-year-old from the United Kingdom who earned his 15 minutes of fame by participating in the July 2020 hack of Twitter, has been sentenced to five years in a U.S. prison. That may seem like harsh punishment for a brief and very public cyber joy ride. But O’Connor also pleaded guilty in a separate investigation involving a years-long spree of cyberstalking and cryptocurrency theft enabled by “SIM swapping,” a crime…

Read More
27 Jun

SEC notice to SolarWinds CISO and CFO roils cybersecurity industry

Data Breaches, Malware, Social Engineering

The US Securities and Exchange Commission has roiled the cybersecurity industry by putting executives of SolarWind on notice that it may pursue legal action for violations of federal law in connection with their response to the 2020 attack on the company’s infrastructure that affected thousands of customers in government agencies and companies globally. Current and former employees and officers of the company, including the chief financial officer (CFO) and chief information security officer (CISO), have…

Read More
27 Jun

HashiCorp Buys BluBracket for Secrets Scanning Tech

Information, News

Cloud infrastructure software firm HashiCorp on Tuesday announced a deal to acquire BluBracket, an early stage startup building technology to help businesses scan for secrets hidden in source code. Financial terms of the acquisition were not released.  BluBracket, based in Silicon Valley, raised $18.5 million in venture capital funding from Evolution Equity Partners, Unusual Ventures, Point72 Ventures, SignalFire and Firebolt Ventures.  In a statement announcing the acquisition, HashiCorp said BluBracket’s code scanning will complement HashiCorp…

Read More
27 Jun

Bionic integrations offer context-based vulnerability management

Data Breaches, Malware, Social Engineering

Application security posture management (ASPM) company Bionic has added two new capabilities — Bionic Signals and Bionic Business Risk Scoring — to its namesake cybersecurity platform to help its customers detect, prioritize and remediate vulnerabilities and threats in their applications. The idea is to collate signals from multiple threat intelligence platforms and add business context to identify critical risks in customer applications and help prioritize them based on the level of risks involved. “The surge…

Read More
27 Jun

Fortanix adds confidential data search for encrypted enterprise data

Data Breaches, Malware, Social Engineering

Cloud data security company Fortanix has announced Fortanix Confidential Data Search, a search offering for encrypted databases within enterprise cloud workflows. “Confidential Data Search allows data analysts to use off-the-shelf, unmodified databases in a standard, unrestricted SQL environment,” said Richard Searle, vice president of Confidential Computing, Fortanix. “Users do not need to convert their datasets to new complex proprietary database formats or deploy proprietary agents.” The search capability, Fortanix claims, doesn’t compromise data security or…

Read More
27 Jun

CISA Releases SCuBA TRA and eVRF Guidance Documents

Attacks, Insights, Malware

CISA has released several documents as part of the Secure Cloud Business Applications (SCuBA) project: The Technical Reference Architecture (TRA) document, previously released for public comment on April 19, 2022, is the final version of a security guide that agencies can use to adopt technology for cloud deployment, adaptable solutions, secure architecture, and zero trust frameworks.  The extensible Visibility Reference Framework (eVRF) guidebook provides an overview of the eVRF framework, which enables organizations to identify visibility…

Read More
27 Jun

UK hacker busted in Spain gets 5 years over Twitter hack and more

Information

by Naked Security writer Some hacks become so notorious that they acquire a definite article, even if the word THE ends up attached to a very general technical term. For example, you can probably trot out the names of dozens of well-known internet worms amongst the millions that exist in the zoos maintained by malware collectors. NotPetya, Wannacry, Stuxnet, Conficker, Slammer, Blaster, CodeRed and Happy99 are just a few from the past couple of decades.…

Read More
26 Jun

Critical flaw in VMware Aria Operations for Networks sees mass exploitation

Data Breaches, Malware, Social Engineering

Researchers warn that a vulnerability patched this month in VMware Aria Operations for Networks, formerly known as vRealize Network Insight, is now seeing exploitation en masse. The flaw allows for remote code execution through command injection and is rated with critical severity. “New data from Akamai shows the scale of active scanning for sites vulnerable to CVE-2023-20887 is much greater than originally reported,” researchers from Akamai told CSO via email. “There have been 695,072 total…

Read More
26 Jun

Latest MOVEit exploit hits thousands of NYC school students and staff

Data Breaches, Malware, Social Engineering

Personal data of over 45,000 public school students was compromised in a breach involving the file-transfer software MOVEit, according to a community letter sent to families and staff by the New York City Department of Education. “DOE used MOVEit to transfer documents and data internally as well as to and from vendors, including third party special education service providers,” the letter said.   The breach is the latest expoit of a SQL injection vulnerability found…

Read More