GPS Modernization Stalls as Pentagon Faces Chip Shortages

Chris Riotta • September 12, 2024

The Space Force is suffering from years of delays, setbacks and shortcomings in its Global Positioning System modernization program, according to a Government Accountability Office report, which found major deficiencies and testing issues that could hinder the United States competitiveness in space.

Cybercrime

Researchers Thrust a Virtual Stick Into the Bike Spokes

Latest

Governance & Risk Management

Remote Access Tool Sprawl Increases OT Risks

Prajeet Nair • September 13, 2024

Excessive deployment of remote access tools in operational technology environments expands attack surfaces and creates operational challenges, warn security researchers from Claroty. Remote access tools are essential, but they introduce numerous potential vulnerabilities that threat actors exploit.

Next-Generation Technologies & Secure Development

Mastercard Buys Threat Intel Firm Recorded Future for $2.65B

Michael Novinson • September 12, 2024

Mastercard plans to buy threat intelligence firm Recorded Future for $2.65 billion to enhance cyber resilience and offer greater protection and trust around digital transactions. The deal will enhance Mastercard's identity, fraud prevention services by helping businesses identify and mitigate risk.

Governance & Risk Management

Bashing Windows Bugs, Take 2: Microsoft Restores Nixed Fixes

Mathew J. Schwartz • September 11, 2024

Microsoft has issued a slew of software updates to patch numerous flaws, including three zero-day vulnerabilities that are already being exploited via in-the-wild attacks. Another fix addresses a prior update that inadvertently reintroduced vulnerable components to Windows 10.

Governance & Risk Management

ColorTokens Strengthens Zero Trust With PureID Acquisition

Michael Novinson • September 11, 2024

ColorTokens purchased PureID, expanding its zero trust framework with identity-based segmentation for cloud and hybrid environments. The acquisition focuses on securing cloud applications, microservices and APIs through advanced identity-based authentication.

Governance & Risk Management

Progress Software Fixes Critical LoadMaster Vulnerability

Prajeet Nair • September 9, 2024

Progress Software released an urgent patch Thursday to fix a critical vulnerability that hackers could exploit to launch remote attacks. The company is no stranger to urgent patching. It was at the center of a Memorial Day 2023 mass hacking incident.

Endpoint Detection & Response (EDR)

After CrowdStrike Outage: Time to Rebuild Microsoft Windows?

Mathew J. Schwartz • September 6, 2024

The global disruption caused by a faulty CrowdStrike software triggering a kernel panic and computer meltdowns has led government agencies, experts and vendors to call for rethinking Windows operating system resiliency, including the deep-level OS access security tools now require.

CrowdStrike Outage Updates

CrowdStrike Debuts Safeguards, Seeks to Blunt Outage Impact

Michael Novinson • August 29, 2024

CEO George Kurtz said CrowdStrike has blunted the business impact from the massive July 19 outage and is implementing changes to prevent a repeat occurrence. CrowdStrike is boosting the resilience of its Falcon platform through improved content visibility and control and enhanced quality assurance.

Anti-Phishing, DMARC

Seeking a Job in Cybersecurity? Protect Yourself From Scams

Brandy Harris • August 28, 2024

The demand for skilled cybersecurity professionals, coupled with the rise in remote work, has led to an increase in fraudulent job postings targeting tech-savvy individuals. Learn why this is so and how to protect yourself from deceptive schemes as you pursue a job in cybersecurity.

DEF CON

The Auto Industry's Achilles Heel: Cybersecurity

Michael Novinson • August 26, 2024

Centralized architecture in the automotive industry streamlines cybersecurity and supply chain operations by reducing hardware components and enabling quicker fixes. But that centralization also poses major cybersecurity challenges, said Thomas Sermpinis, technical director at Auxilium Pentest Labs.

Fraud Management & Cybercrime

ISMG Editors: CISO Disclosure Rules Changing Post-SolarWinds

Anna Delaney • August 23, 2024

In the latest weekly update, ISMG editors discussed the evolving disclosure responsibilities of CISOs, yet another ransomware attack targeting the healthcare sector, and Mimecast's latest strategic acquisition as part of its broader expansion efforts.

Governance & Risk Management

How to Mitigate Downgrade Attacks Against Windows Systems

Michael Novinson • August 22, 2024

SafeBreach security researcher Alon Leviev discusses how downgrade attacks expose vulnerabilities in Windows systems. He shares insights into how attackers manipulate Windows Update processes and stresses the importance of monitoring and securing critical system components to prevent exploitation.

Cybercrime

How SSH Flaws Expose Vulnerabilities, Endanger Enterprises

Aseem Jakhar • August 22, 2024

SSH is designed for secure communications, but common misconfigurations significantly expose systems to threats, according to Rob King, director of security research at runZero. King discusses the implications of these vulnerabilities, citing real-world breaches and best practices for SSH security.