Latest

Governance & Risk Management

Global Cybersecurity Agencies Release OT Security Guidelines

Prajeet Nair  •  October 3, 2024

Don't pull data from an operational technology network: OT networks should push data out. Segment critical OT networks. Don't introduce cybersecurity systems into an OT network unless administrators can guarantee they won't hinder a restart after a complete loss of electricity.

Endpoint Security

Dragos Boosts OT Defense with Network Perception Acquisition

Michael Novinson  •  October 1, 2024

Dragos' acquisition of Network Perception will enrich its real-time network monitoring with robust visualization and configuration analysis tools. This transaction aims to bolster the security of operational technology networks and support customers in building more defensible architectures.

►

CISO Trainings

CyberEdBoard Profiles in Leadership: Shervin Evans

Anna Delaney  •  September 30, 2024

Shervin Evans began his career as a programmer but he always knew his future was in cybersecurity. Now, 20 years later as an information security officer, he evangelizes about cybersecurity to employees in his organization, his family and the broader community.

Security Operations

Linux Distros Patching Printer Hijacking Flaw

Prajeet Nair  •  September 27, 2024

Attackers can exploit a series of vulnerabilities in the OpenPrinting Common Unix Printing System utility to remotely execute arbitrary code on certain machines. Major Linux distributions reacted Friday by releasing patches. Exploitation requires a victim to attempt to print from a malicious device.

Identity & Access Management

NIST Calls for Major Overhaul in Typical Password Practices

Chris Riotta  •  September 26, 2024

The National Institute of Standards and Technology is calling for longer, randomized passwords instead of memorized phrases containing combinations of upper and lowercase letters in new guidance that aims to modernize current password practices across the public and private sectors.

Governance & Risk Management

Zero-Day Vulnerabilities in Automatic Tank Gauge Systems

Prajeet Nair  •  September 26, 2024

Industrial control systems made by different manufacturers for monitoring fuel storage tanks including those used in everyday gas stations contain critical zero-days that could convert them into targets for cyberattacks that cause physical damage.

Security Operations

Startup Torq Secures $70M to Advance Hyperautomation With AI

Michael Novinson  •  September 24, 2024

With $70 million in fresh capital, Torq is doubling down on its hyperautomation initiatives. The funding will enhance generative AI technologies that streamline security operations and provide autonomous threat investigation, alongside plans for broader U.S. and European market penetration.

Cybercrime

Telegram Pledges Closer Cooperation With Police

David Perera  •  September 23, 2024

Embattled Telegram CEO Pavel Durov signaled a more cooperative relationship with law enforcement, telling users Monday the messaging service will provide IP addresses and phone numbers "in response to valid legal requests." Durov faces criminal charges in France.

Governance & Risk Management

Rockwell Automation PLC Software Contains RCE Flaw

Prajeet Nair , David Perera  •  September 23, 2024

A severe vulnerability in Rockwell Automation software used to configure programmable logic controllers could allow attackers to remotely execute malicious code. The vulnerability is rated 8.8 on the CVSS v4 scale. The U.S. Cybersecurity and Infrastructure Security Agency advised immediate patching.

Endpoint Security

US Pushes Ban on Chinese, Russian Tech in Connected Vehicles

Chris Riotta  •  September 23, 2024

The White House is proposing new regulations on connected vehicles that would prohibit manufacturers from importing software or hardware from the People's Republic of China and Russia, citing an ever-increasing threat landscape and heightened national security risks.

Governance & Risk Management

US FTC Reveals Vast Surveillance by Social Media, Streaming

Chris Riotta  •  September 19, 2024

The U.S. Federal Trade Commission on Thursday published a report detailing how the largest social media and streaming services surveil both users and nonusers across the web while collecting vast troves of data, pointing to significant privacy concerns for children and teens.

3rd Party Risk Management

How Mega Attacks Are Spotlighting Critical 3rd-Party Risks

Marianne Kolbasuk McGee  •  September 18, 2024

Recent mega data breaches involving third-party vendors - such as the Change Healthcare cyberattack - are intensifying the spotlight on critical security risk management and governance issues for business associates and other suppliers, said regulatory attorney Rachel Rose.