Paul Such

CISA Announced Vulnrichment : Project to Enrich CVE Records: The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has announced a new initiative called “Vulnrichment” aimed at enriching Common Vulnerabilities and Exposures (CVE) records with additional metadata to help organizations better prioritize vulnerability remediation efforts. The Vulnrichment project, hosted in a public GitHub repository, will focus on adding key data points to CVE records, including: […] The post CISA Announced Vulnrichment : Project to Enrich CVE Records appeared first on Cyber Security News. #CyberSecurity #InfoSec

2

➡️ Based on some of the phishing kits harvested by StalkPhish.io last week, here are 5️⃣ new PhishingKit Yara Rules: Rules for detection of #phishing kits targeting customers of: ✅ Kraken Digital Asset Exchange ✅ Société Générale ✅ ANTAI - Agence nationale de traitement automatisé des infractions ✅ Telstra ✅ Microsoft Office365 👉 Use these rules for a better detection of #phishing threats targeting your brand. -- 📩 Contact and follow us if you need help fighting hashtag #phishing and #brand impersonation... we have tools, data and knowledge to help!

7

🎉 Exciting news! Unifying offensive and defensive AppSec has never been easier. Apiiro and Bugcrowd are working together to revolutionize AppSec risk management. The collaboration offers: 🚀 Accelerated MTTR with automated workflows and enriched risk context. 🔍 Holistic visibility across your entire AppSec program. 💡 Improved scope for bug bounty programs By combining Bugcrowd’s crowdsourced security expertise with Apiiro’s powerful ASPM platform, we’re empowering AppSec teams to: ✅ Break down silos between penetration testing and bug bounty insights. ✅ Prioritize critical vulnerabilities with a unified view of risks. ✅ Streamline remediation cycles with integrated workflows. ✅ Refine bug bounty and pen-testing scopes using deep code analysis. Ready to take your AppSec strategy to the next level? Learn more about how Apiiro and Bugcrowd can transform your security poster in our latest blog post: https://lnkd.in/dnZy9ifE #AppSec #CyberSecurity #ASPM #DevSecOps #BugBounty

40

3 Kommentare

The "ToxicPanda" attacks highlight a growing risk in our interconnected world - the targeting of mobile and cloud platforms by cyber adversaries. Corporations and financial institutions must adapt and develop robust security measures against evolving cyber threats. Here are some key strategies to resist such attacks: 1. Vigilance and Awareness: Regular training for employees to spot suspicious emails or messages can be the first line of defense against mobile trojans. 2. Regular Updates: Ensure all your devices, software, and applications are running on the latest versions. 3. Utilize Security Tools: Leverage robust dedicated security tools for mobile devices including secure browsers, antivirus, and VPN. Remember, security isn't static. As this botnet shows, the risk landscape is constantly shifting, requiring an agile, responsive approach to defense. #CyberSecurity #Botnet #CloudSecurity #MobileSecurity #BankingSecurity

1

🚨 Hot Off the Press! 🚨 The DOJ and CISA have just released a Notice of Proposed Rulemaking (NPRM) and Proposed Security Requirements for Restricted Transactions, each implementing Executive Order 14117. These new rules aim to regulate the processing of certain personal data and will impact various sectors. 🔒 Key Highlights: 🗺 Data Restrictions: The proposed rules will limit the transfer of personal data—such as protected health information, financial data, government employee data, biometrics, and bulk data (over 100,000 individuals)—to specific countries. 🗺 Ownership Matters: Restrictions apply to entities more than 50% owned by citizens (both real and corporate) of these countries. It won't be enough to just avoid doing business in a given country. 💡 Why It Matters💡 If you’re building apps or solutions that process personal data for over 10,000 individuals or any government employees, brace yourself for mandatory technical controls and restrictions on outsourcing development and operations. Original Sources: https://lnkd.in/drJ3wgKq https://lnkd.in/dR-iVzzc Stay informed and prepared to adapt your strategies! #DataPrivacy #Cybersecurity #ExecutiveOrder #DOJ #CISA #Compliance #TechDevelopment

1

🚨 High Risk Vulnerability Alert 🚨 Shilpi Client Dashboard has a No Rate Limiting vulnerability (CVE-2024-47654) that could lead to OTP bombing. This is a prime example of why API security is so important. #Shilpi #APIsecurity #OWASP #CVE202447654 #InsecureDesign https://lnkd.in/ez2wgXav

3

📢 NEW SIEGECAST 📢 "The API Pentesting Guide" June 25th at 3pm ET. Join Senior Security Consultant Douglas Berdeaux and Security Consultant Stuart Rorer as they dive into the world of API penetration testing. 🌐🔍 Link: https://lnkd.in/effzXSiF 🔑 Key Takeaways: 🔸 Understanding APIs: Learn why securing APIs is vital for modern technology. 🔸 Pentesting Essentials: Get to know the OWASP API Top 10 and our approach to penetration testing. 🔸 Client Preparation: Gain insights on the documentation and prep needed for a successful API assessment. 🔸 Tools of the Trade: Discover the top tools and techniques for effective API pentesting. Tune in for an in-depth discussion on API vulnerabilities, practical pentesting tips, and the methodologies that keep your web applications secure. Don't miss out! #infosec #pentesting #cybersecurity #hacking

15

New Research on Cyber Vulnerabilities reveals 40 average vulnerabilities per month with occasional spikes     Full Report =  https://lnkd.in/eEiiCviS     Bravo all to VulnCheck including Jacob Baines & Patrick Garrity 👾🛹💙 for their great work on #CyberSecurity

3

The #Cybersecurity Maturity Model Certification (#CMMC) final rule is finally here – and its complexity warrants extra attention. Read our highlights. https://brnw.ch/21wOSvt

23

Remote acquisition can be challenging whether it is because of the remote host goes offline or if the available bandwidth is limited. On May 8, join us for a webinar where Jean-François Brouillette will explore different #RemoteAcquisition scenarios based on real-world cases: https://ow.ly/52VI50Rytjl #DFIR

26

Sibylity: Empowering FCR with Centralized Strategy, Distributed Action 🎯🔄 Federated Cyber-Risk Management (FCR) isn't just about distributing responsibility—it's about aligning the entire organization towards common security goals. Here's how Sibylity makes it happen: 🏛️ Centralized Security Model: * Security team curates a comprehensive strategy * Sets organizational priorities and standards * Provides a unified framework for all teams 👥 Distributed Risk Management: * Cross-functional teams manage risks across the organization * Aligned with centralized strategy * Focused on relevant, prioritized security objectives 🧠 Meet Thia: Sibylity's AI-Powered Cybersecurity Intelligence * Interprets centralized security settings * Provides tailored recommendations to each team * Ensures consistency with organizational priorities 🛡️ Guardrails for Effective Risk Management: * Centralized configuration sets boundaries * Teams operate with guided autonomy * Maintain alignment while allowing for contextual decisions Benefits of this approach: ✅ Consistent security posture across the organization ✅ Empowered teams with clear direction ✅ Efficient resource allocation based on priorities ✅ Adaptable to unique needs of different departments Sibylity doesn't just enable FCR—it optimizes it, ensuring that every team contributes effectively to your organization's overall security goals. Ready to align your entire organization towards common security objectives? Let's explore how Sibylity can transform your approach to cyber risk management. #FCR #CybersecurityStrategy #DistributedRiskManagement #Sibylity

1

🚀TIP: "Regularly Auditing Security Practices" 👩‍💻 In today's highly digital era, one of the essential elements to maintain robust software security is through conducting regular security audits. An audit proactively identifies potential vulnerabilities within systems and assesses the effectiveness of the existing security controls in place. Periodic security audits enable organizations to: 🛡️ Ensure that their data security policies are being followed. 💼 Measure the effectiveness of their security measures. 🌐 Identify weaknesses before they can be exploited by malicious actors. 📊 Provide quality assurance for stakeholders. Therefore, remember to include regular security audits in your cybersecurity roadmap! When was the last time you conducted a security audit in your organization? Let us know in the comments below! #CyberSecurity #SecurityAudit #DataSecurity #SoftwareSecurity #WebSecurity #TechnologyManagers #CEOs #OperationsManagers #DevelopmentTeams #TipOfTheWeek

2

🛡️ The best defense (for devs) is a strong offense (mindset)! 🛡️ Want to code more secure apps? Think like a hacker. Find out how to better anticipate, prevent, and mitigate potential security threats at #codetalks24 with Matthias Held, #CISO at Bugscrowd. Whether you’re a developer, tech lead, or security specialist, learn how to view your app through the eyes of an attacker—and protect it in the process. 🔓 Join Matthias to: 🚨 Simulate real-world attacks on your systems and applications 🕵️‍♀️ Explore case studies on common security pitfalls and successful hacks 🧩 Discover frameworks for threat modeling ✍️ Get practical tips for integrating security into your code review process 👥 Build a culture of security awareness within your development team This talk will transform how you think about coding and security, making secure coding practices a natural part of your development process. Join us at #codetalks24 (19-20 September)

26