CyberSecurity Updates

14 Dec

Lacework adds new capabilities to its CSPM solution

Data Breaches, Malware, Social Engineering

Lacework on Wednesday released new cloud security posture management (CSPM) capabilities, designed to help organizations create custom policies for AWS, Google Cloud, and Azure to secure their cloud infrastructure.  The new CSPM solution offers three key enhancements. First, it allows organizations to customize policies and ensure configurations align with an organization’s specific needs. Second, it helps organizations build custom cross-account reports to measure hygiene. Finally, the new CSPM will now be compliant with the latest…

Read More
14 Dec

High-Severity Memory Safety Bugs Patched With Latest Chrome 108 Update

Information, News

Google this week announced a Chrome update that resolves eight vulnerabilities in the popular browser, including five reported by external researchers. All five security defects are use-after-free flaws, a type of memory safety bug that has been prevalent in Chrome over the past years, and which Google has long-battled to eliminate. According to Google’s advisory, four of these issues are high-severity bugs, impacting components such as Blink Media, Mojo IPC, Blink Frames, and Aura. The…

Read More
14 Dec

Wiz debuts PEACH tenant isolation framework for cloud applications

Data Breaches, Malware, Social Engineering

Cloud security vendor Wiz has announced PEACH, a tenant isolation framework for cloud applications designed to evaluate security posture and outline areas of improvement. The firm stated that the framework has been developed on the back of its cloud vulnerability research to tackle security challenges impacting tenant isolation. Security boundaries, incohesion, transparency impacting tenant isolation in cloud applications In a blog post, Wiz wrote that there have been several cross-tenant vulnerabilities in various multi-tenant cloud…

Read More
14 Dec

New Royal ransomware group evades detection with partial encryption

Data Breaches, Malware, Social Engineering

A new ransomware group dubbed Royal that formed earlier this year has significantly ramped up its operations over the past few months and developed its own custom ransomware program that allows attackers to perform flexible and fast file encryption. “The Royal ransomware group emerged in early 2022 and has gained momentum since the middle of the year,” researchers from security firm Cybereason said in a new report. “Its ransomware, which the group deploys through different…

Read More
14 Dec

International Engagement Blog: Singapore International Cyber Week, the Regional Initiative for Cybersecurity Education and Training, and More

Insights

NIST has continued to collaborate into the fall season with partners throughout the world on the Cybersecurity Framework 2.0 update.  International engagement and alignment with international standards are important themes for the 2.0 update and will drive changes to ensure global relevance.  As part of this ongoing international engagement, NIST welcomed visitors to the NCCoE and NIST headquarters to discuss various cybersecurity topics and explore areas for mutual collaboration.  In the past few weeks, NIST…

Read More
14 Dec

Report highlights serious cybersecurity issues with US defense contractors

Data Breaches, Malware, Social Engineering

When a company engages in business with a government, especially with the defense sector of that government, one should expect that security surrounding the engagement would be a serious endeavor. A recent report offered up by CyberSheath throws cold water on that assumption—indeed, DEFENSELESS – A statistical report on the state of cybersecurity maturity across the defense industrial base (DIB) should embarrass the sector and begs the question: why are some companies still allowed to…

Read More
14 Dec

How acceptable is your acceptable use policy?

Data Breaches, Malware, Social Engineering

In a world before smartphones, social media, and hybrid workplaces, an acceptable use policy was a lot easier to write—and to enforce. These days, it’s a lot more complicated. Work can take place almost anywhere, on any number of devices. An employee can accept a job and then never physically set foot in the office, working from home (or the Caribbean) on their personal laptop. That’s why an acceptable use policy, or AUP, is more…

Read More
13 Dec

FBI’s Vetted Info Sharing Network ‘InfraGard’ Hacked

Data Breaches, Information, Insights

InfraGard, a program run by the U.S. Federal Bureau of Investigation (FBI) to build cyber and physical threat information sharing partnerships with the private sector, this week saw its database of contact information on more than 80,000 members go up for sale on an English-language cybercrime forum. Meanwhile, the hackers responsible are communicating directly with members through the InfraGard portal online — using a new account under the assumed identity of a financial industry CEO…

Read More
13 Dec

Palo Alto Networks flags top cyberthreats, offers new zero-day protections

Data Breaches, Malware, Social Engineering

Firewall and security software vendor Palo Alto Network’s annual Ignite conference kicked off Tuesday, highlighted by several product announcements, which were unveiled alongside the company’s latest threat report. Palo Alto’s “What’s Next in Cyber” report named ransomware and business email compromise as the most common attacks faced by businesses worldwide, with supply chain threats, malicious insiders and DDoS attacks rounding out the top five. Over the course of the past year, 96% of respondents to…

Read More
13 Dec

Microsoft Releases December 2022 Security Updates

Attacks, Insights, Malware

Original release date: December 13, 2022 Microsoft has released updates to address multiple vulnerabilities in Microsoft software. An attacker can exploit some of these vulnerabilities to take control of an affected system. CISA encourages users and administrators to review Microsoft’s December 2022 Security Update Guide and Deployment Information and apply the necessary updates. This product is provided subject to this Notification and this Privacy & Use policy.

Read More