Protecting Your Cyber World With Real World Solutions

frontbottom

This is a test

Trending
Current
CSO
Did you Know?

Sophos MDR for Microsoft Defender: Gaining momentum with Microsoft-specific service enhancements

Sophos Managed Detection and Response (MDR) delivers robust defenses and maximizes your Microsoft technology investments. [...]

Unlocking cyber insurance savings to fund MDR

Redirecting risk reduction spend from cyber insurance to MDR services is a win-win, resulting in better protection and lower cost coverage. [...]

Sophos Firewall v20 MR2 is now available

Sophos Firewall OS v20 MR2 is a free upgrade for all licensed Sophos Firewall customers. [...]

CrowdStrike global outage: Sophos guidance

Our take on what happened and answers to key questions from Sophos customers and partners. [...]

Sophos Germany Team Saddles Up for a Volunteering Day at Horse Therapy Farm

Sophos Employee Volunteering Program supports local equine-assisted therapy initiative. [...]

Strengthen Your Cybersecurity: Understanding the NIS 2 Directive

Key insights into the NIS 2 Directive in this essential guide to new cybersecurity compliance for 2024. [...]

Student Loan Breach Exposes 2.5M Records

2.5 million people were affected, in a breach that could spell more trouble down the line. [...]

Watering Hole Attacks Push ScanBox Keylogger

Researchers uncover a watering hole attack likely carried out by APT TA423, which attempts to plant the ScanBox JavaScript-based reconnaissance tool. [...]

Tentacles of ‘0ktapus’ Threat Group Victimize 130 Firms

Over 130 companies tangled in sprawling phishing campaign that spoofed a multi-factor authentication system. [...]

Ransomware Attacks are on the Rise

Lockbit is by far this summer’s most prolific ransomware group, trailed by two offshoots of the Conti group. [...]

Cybercriminals Are Selling Access to Chinese Surveillance Cameras

Tens of thousands of cameras have failed to patch a critical, 11-month-old CVE, leaving thousands of organizations exposed. [...]

Twitter Whistleblower Complaint: The TL;DR Version

Twitter is blasted for security and privacy lapses by the company’s former head of security who alleges the social media giant’s actions amount to a national security risk. [...]

Secure Boot no more? Leaked key, faulty practices put 900 PC/server models in jeopardy

Security researchers warn that some PC and server manufacturers are using insecure cryptographic keys as the root of trust for Secure Boot, an important security feature in modern computers that prevents malware from injecting itself early into the boot process. One of those keys has been leaked accidentally, potentially breaking Secure Boot guarantees for hundreds of computer models from seven manufacturers. However, almost 900 models produced over the past 12 years are using keys that were likely generated for testing purposes and should have never been used in production, according to a report from security firm Binarly, which dubbed this… [...]

Counting the cost of CrowdStrike: the bug that bit billions

As eye-popping estimates emerge for the cost to enterprises of dealing with aftermath of last week’s CrowdStrike-induced outages, it’s crucial to break down the sources of these expenses and understand how much of the financial burden will be absorbed by cyber insurance. Parametrix, known for its cloud monitoring and insurance solutions, has pegged the total loss for the 25% of Fortune 500 companies affected (excluding Microsoft) at a staggering $5.4 billion. They’ll be covering most of that bill themselves, Parametrix said: “The portion of the loss covered under cyber insurance policies is likely to be no more than 10% to… [...]

Download the unified endpoint management (UEM) platform enterprise buyer’s guide

From the editors of our sister publication Computerworld, this enterprise buyer’s guide helps IT staff understand what the various unified endpoint management (UEM) platforms can do for their organizations and how to choose the right solution. [...]

What CISOs can do to bridge their cyber talent gap

Empirical evidence shows that global cyber threats have increased twofold in the past few years. The IMF study, “Rising Cyber Threats Pose Serious Concerns for Financial Stability” (the title itself is ominous), outlined $12 billion dollars of losses from 20,000 malicious cyber incidents against the financial sector alone in the past 20 years. Unfortunately, this rising cyber threat environment coincides with a well-documented cyber talent gap. The World Economic Forum, for example, estimates that collectively we are nearly 4 million cyber professionals short for global requirements. The ISC2 also quotes this 4 million number in its 2023 Cybersecurity Workforce Study,… [...]

DNSSEC explained: Why you might want to implement it on your domain

What is DNSSEC? The Domain Name System Security Extensions (DNSSEC) is a set of specifications that extend the Domain Name System (DNS) protocol by adding cryptographic authentication for responses received from authoritative DNS servers. Its goal is to defend against attack techniques such as DNS spoofing and hijacking attacks that direct computers to rogue websites and servers. Although DNSSEC has already been deployed for many generic and country-level top-level domains (TLDs), adoption at the individual domain level and end-user level has lagged. What is the Domain Name System? The DNS protocol acts like a phone book for the internet. It… [...]

Docker re-fixes a critical authorization bypass vulnerability

Open source containerization platform Docker has urged users to patch a critical vulnerability affecting certain versions of the Docker Engine that allows privilege escalation using specially crafted API requests. Tagged as CVE-2024-41110, the vulnerability was first discovered in 2018 and was assigned a CVSS score of 10/10. Although the flaw was fixed by Docker shortly, later versions did not receive the patch, according to a Docker security advisory. “In 2018, a security issue was discovered where an attacker could bypass authorization plugins (AuthZ),” said Docker’s Gabriela Georgia in a blog post. “Although this issue was fixed in Docker Engine v18.09.1… [...]

China's APT40 gang is ready to attack vulns within hours or days of public release

China's APT40 gang is ready to attack vulns within hours or days of public release l33tdawg Tue, 07/09/2024 - 02:53 [...]

AI-Powered Super Soldiers Are More Than Just a Pipe Dream

AI-Powered Super Soldiers Are More Than Just a Pipe Dream l33tdawg Tue, 07/09/2024 - 02:53 [...]

The president ordered a board to probe a massive Russian cyberattack. It never did.

The president ordered a board to probe a massive Russian cyberattack. It never did. l33tdawg Tue, 07/09/2024 - 02:53 [...]

Massive car dealer ransom attack is mostly over after 2 weeks of work-arounds

Massive car dealer ransom attack is mostly over after 2 weeks of work-arounds l33tdawg Tue, 07/09/2024 - 02:53 [...]

“RegreSSHion” vulnerability in OpenSSH gives attackers root on Linux

“RegreSSHion” vulnerability in OpenSSH gives attackers root on Linux l33tdawg Wed, 07/03/2024 - 02:38 [...]

Two of the German military’s new spy satellites appear to have failed in orbit

Two of the German military’s new spy satellites appear to have failed in orbit l33tdawg Wed, 07/03/2024 - 02:38 [...]