Using InsightVM Remediation Projects To Ensure Accountability

One benefit of InsightVM reporting is that it enables security teams to build accountability into remediation projects. There are a number of ways this can be accomplished and the approach you take will be dictated by your organization’s specific structure and needs. In this blog, we’ll look at t...

PT-2023-21726 · Directus · Directus

Name of the Vulnerable Software and Affected Versions: Directus versions prior to 9.23.3 Description: The issue concerns the improper redaction of the directus refresh token from log outputs, allowing it to be used to impersonate users without their permission. This can lead to issues with...

Executive Webinar: Confronting Security Fears to Control Cyber Risk, Part Two

Part two of Confronting Security Fears to Control Cyber Risk was presented live on March 9th for EMEA and will be delivered on March 16th for APAC. The 40-minute session focuses on the importance of developing cybersecurity elasticity. In the session, Jason Hart, Rapid7’s Chief Technology Officer...

4 Things You May Not Know About Performance Analytics Technology

By Owais Sultan Managers are aware that they are being held accountable for their teams performance. How well their teams do… This is a post from HackRead.com Read the original post: 4 Things You May Not Know About Performance Analytics Technology...

White House National Cybersecurity Strategy: Software Firms Liable for Breaches

By Waqas Under the new National cybersecurity strategy, critical infrastructure firms and software companies will face federal accountability for security… This is a post from HackRead.com Read the original post: White House National Cybersecurity Strategy: Software Firms Liable for Breaches...

Executive Webinar: Confronting Security Fears to Control Cyber Risk

Last week, Rapid7 presented part one of a webinar called “Confronting Security Fears to Control Cyber Risk”. The webinar, which is available on demand, focused on cybersecurity simplicity and why everyone associated with your organization must develop a cybersecurity mindset. To do so, CISOs must...

Ease Your Cybersecurity Maturity Model Certification Journey With Qualys

The Cybersecurity Maturity Model Certification CMMC is a cybersecurity training, certification, and assessment program from the United States Department of Defense DoD. CMMC is designed to provide increased assurance to the DoD that a contractor can adequately protect controlled unclassified...

White House unveils Blueprint for an AI Bill of Rights

On Tuesday, the Biden-Harris Administration's Office of Science and Technology Policy OSTP unveiled a new Blueprint for an AI Bill of Rights, which lists five principles to guide the design, use, and development of intelligence-based automated systems "to protect the American public in the age of...

Data governance: 5 tips for holistic data protection

Your data is a strategic asset. To benefit your business, data requires strict controls around structure, access, and lifecycle. However, most security leaders have doubts about data security—nearly 70 percent of chief information security officers CISOs expect to have their data compromised in a...

Why Cybersecurity Needs to be a Part of Your ESG

What is an ESG? Environmental, social, and corporate governance ESG documentation is a way to visualize and evaluate how an organization is working for the betterment of social goals and how that organization is responding to the cry for greener, more aware, and more responsible, sustainable...

Building Cybersecurity KPIs for Business Leaders and Stakeholders

In the final part of our “Hackers 're Gonna Hack” series, we’re discussing how to bring together parts one and two of operationalising cybersecurity together into an overall strategy for your organisation, measured by key performance indicators KPIs. In part one, we spoke about the problem, which...

‘Unpacking’ technical attribution and challenges for ensuring stability in cyberspace

Introduction When reports of a cyberattack appear in the headlines, questions abound regarding who launched it and why. Even if an attacker has what are to it perfectly rational reasons for conducting such an attack, these reasons are often known only to them. The rest of the world, including the...

Executor and miner collusion and gas price

Lines of code Vulnerability details Impact The MATCHEXECUTOR can choose tx.gasprice and take the gas cost from a buyer. An executor can make a overly costly tx mined by a friendly miner and take extra profits. Proof of Concept and similar functions... Recommended Mitigation Steps There's no...

Governing the organization

Security is the biggest risk to business today. Managing security has become one of the hardest jobs in the enterprise, and failing to do so effectively can create opportunities for severe operational disruption. One of the keystone conclusions from Coalfires Cloud Advisory Boards the Smartest Pa...

US senators introduce the Kids Online Safety Act (KOSA)

US Senators Richard Blumenthal of Connecticut and Marsha Blackburn of Tennessee have introduced the Kids Online Safety Act KOSA, legislation that aims to enhance childrens safety online. This follows the The Wall Street Journal WSJs reporting on the harm Instagram can inflict on teens, which was...

Time to Build Accountability Back into Cybersecurity

In the age of remote work — where hybrid teams work out of offices, houses and coffee shops using a multitude of devices — presents challenges in terms of understanding who’s responsible for ensuring proper cyber-hygiene across the perimeter-less footprint. Suffice it to say that cybersecurity ha...

Code Injection in namelessmc/nameless

✍️ Description Code Injection is the general term for attack types which consist of injecting code that is then interpreted/executed by the application. This type of attack exploits poor handling of untrusted data. These types of attacks are usually made possible due to a lack of proper...

Apple Patches Actively Exploited Zero-Day in iOS, MacOS

Apple patched a zero-day flaw on Monday, found in both its iOS and macOS platforms that’s being actively exploited in the wild and can allow attackers to take over an affected system. The memory-corruption flaw, tracked as CVE-2021-30807, is found in the IOMobileFrameBuffer extension which exists...

How to leverage accountability to ensure sustainable enterprise data security

As post-pandemic economic recovery continues to drive rapid acceleration in digital transformation, documented data breaches and service disruptions caused by cybercriminal activity have become an unwelcome part of our daily news feed. In spite of the regulations and compliance requirements that...

Feds Told to Better Manage Facial Recognition, Amid Privacy Concerns

Though the federal government widely uses facial recognition for various uses from criminal investigations to collecting traveler data, this use is largely unmonitored and unmanaged — a scenario that must change to protect people’s privacy and avoid inaccurate identification of perpetrators, a...