Protecting Your Cyber World With Real World Solutions

Inspect Commercial

Trending
Current
CSO
Did you Know?

Showcasing Artwork by Max for Autism Awareness Month

New pop-up art display honors Autism Awareness Month at Sophos UK. [...]

Malware campaign attempts abuse of defender binaries

Command-and-control wares try to sneak onto systems disguised as various vendors; payloads vary, but Sophos customers are protected [...]

Earth Day 2024: Sophos Supports this Year’s Planet vs. Plastics Campaign

To mark Earth Day on April 22, and its theme of Planet vs. Plastics, Sophos employees are being encouraged to use their Sophos Volunteering hours to take part in practical opportunities to join the fight against plastic pollution, as well as take part in a series of wellbeing webinars focused on sustainability and climate anxiety. [...]

‘Junk gun’ ransomware: Peashooters can still pack a punch

A Sophos X-Ops investigation finds that a wave of crude, cheap ransomware could spell trouble for small businesses and individuals – but also provide insights into threat actor career development and the wider threat landscape [...]

Sophos Guidance on the Digital Operational Resilience Act (DORA)

Guidance to support financial entities in the EU impacted by the Digital Operational Resilience Act (DORA). [...]

A tumultuous, titanic Patch Tuesday as Microsoft makes some changes

The largest CVE count in recent history rolls out [...]

Student Loan Breach Exposes 2.5M Records

2.5 million people were affected, in a breach that could spell more trouble down the line. [...]

Watering Hole Attacks Push ScanBox Keylogger

Researchers uncover a watering hole attack likely carried out by APT TA423, which attempts to plant the ScanBox JavaScript-based reconnaissance tool. [...]

Tentacles of ‘0ktapus’ Threat Group Victimize 130 Firms

Over 130 companies tangled in sprawling phishing campaign that spoofed a multi-factor authentication system. [...]

Ransomware Attacks are on the Rise

Lockbit is by far this summer’s most prolific ransomware group, trailed by two offshoots of the Conti group. [...]

Cybercriminals Are Selling Access to Chinese Surveillance Cameras

Tens of thousands of cameras have failed to patch a critical, 11-month-old CVE, leaving thousands of organizations exposed. [...]

Twitter Whistleblower Complaint: The TL;DR Version

Twitter is blasted for security and privacy lapses by the company’s former head of security who alleges the social media giant’s actions amount to a national security risk. [...]

The biggest data breach fines, penalties, and settlements so far

Sizable fines assessed for data breaches in recent years suggest that regulators are getting more serious about cracking down on organizations that don’t properly protect consumer data. Hit with a $ 1.3 billion fine for unlawfully transferring personal data from the European Union to the US, Meta tops the list of recent big-ticket sanctions, with one other ten figure fine being levied against the Chinese firm Didi Global for violating that nation’s data protection laws. The third largest penalty was the $877 million fine against Amazon in 2021 for running afoul of the General Data Protection Regulation (GDPR) in Europe.… [...]

New CISO appointments 2024

The upper ranks of corporate security are seeing a high rate of change as companies try to adapt to the evolving threat landscape. Many companies are hiring a chief security officer (CSO) or chief information security officer (CISO) for the first time to support a deeper commitment to information security. Follow this column to keep up with new appointments to senior-level security roles and perhaps gain a little insight into hiring trends. If you have an announcement of your own that you would like us to include here, contact Andrew Flynn, regional executive editor, at aflynn@foundryco.com. New CISO appointments, April 2024… [...]

Top cybersecurity product news of the week

Amplifier launches copilot to guide teams through security protocols April 24: Amplifier Security is coming into the market and has announced a product that promises to connect the dots between an organization’s security stack and their staff. Copilot Ampy is designed to engage with employees, guiding them through security protocols based on real-time insights. Ampy is part of the company’s automation platform, which integrates into many corporate security products deployed within the company like identity security (Okta, Google, Microsoft Entra), endpoint security (Crowdstrike, SentinelOne), vulnerability scanning and management (Tenable, Rapid7), endpoint management (Jamf, Intune, Kandji), SIEM (Splunk, Sumologic), security training… [...]

Looking outside: How to protect against non-Windows network vulnerabilities

Because of its ubiquity as a network platform, Windows all too often gets blamed as the source of a host of network security vulnerabilities. But recent events have shown the truth — that all sorts of network components have flaws and that there are many nefarious means attackers can use to enter and take control. With every day that passes, security professionals have blindly relied on false concepts such as Apple’s ecosystem being closed (and therefore not as susceptible to attack) and the conceit that many eyeballs mean vulnerabilities will be found and neutralized. It’s naive at best and potentially… [...]

Cloud security teams: What to know as M&A activity rebounds in 2024

As we near the halfway point of the year, organizations are under tremendous pressure to grow businesses across all industries. It’s no secret: bottom lines must rise and 2024 has been earmarked as a pivotal year to revert to growth mode. Many organizations will find an uphill battle here; the previous few years have taken a significant toll. From supply chain issues, layoffs, delayed pipelines, and stalled progress due to pulled focus, we are due for a burst of innovation. Of course, there are a multitude of paths businesses can take to achieve this, all afforded by an increased focus… [...]

Salt Security adds defense against OAuth attacks

Salt Security has added a new OAuth security offering to its API protection platform to help organizations detect attempts to exploit OAuth and fix vulnerabilities associated with the protocol. OAuth is an open-standard authorization protocol or framework, that describes how unrelated servers and services can safely allow authenticated access to their assets without actually sharing the initial, related, single logon credential. “Our new OAuth protection package comes in two parts,” said Eric Schwake, director of cybersecurity strategy at Salt Security. “The first is to strengthen our industry-first API Posture Governance engine. We do this by providing specific posture rules to help… [...]

Cisco urges immediate software upgrade after state-sponsored attack

Cisco urges immediate software upgrade after state-sponsored attack l33tdawg Fri, 04/26/2024 - 01:28 [...]

Haunted by repeated breaches, Microsoft is ‘putting security above all else,’ vows CEO Satya Nadella

Haunted by repeated breaches, Microsoft is ‘putting security above all else,’ vows CEO Satya Nadella l33tdawg Fri, 04/26/2024 - 01:28 [...]

Meta’s Open Source Llama 3 Is Already Nipping at OpenAI’s Heels

Meta’s Open Source Llama 3 Is Already Nipping at OpenAI’s Heels l33tdawg Fri, 04/26/2024 - 01:24 [...]

Millions of IPs remain infected by USB worm years after its creators left it for dead

Millions of IPs remain infected by USB worm years after its creators left it for dead l33tdawg Fri, 04/26/2024 - 01:24 [...]

Apple releases eight small AI language models aimed at on-device use

Apple releases eight small AI language models aimed at on-device use l33tdawg Fri, 04/26/2024 - 01:24 [...]

Tech brands are forcing AI into your gadgets—whether you asked for it or not

Tech brands are forcing AI into your gadgets—whether you asked for it or not l33tdawg Fri, 04/26/2024 - 01:24 [...]