Imperva’s Comprehensive Data Security Platform for Cloud, Explained

Imperva recently introduced the industry’s first database-agnostic security platform specifically built for cloud. The Data Security solution unifies security management for organizations’ entire data environment, supporting databases wherever they’re hosted, including managed database services...

DevOps Teams Can Prove ISO Compliance with Automation

Learn the ISO standards for security and cloud compliance as well as the automated mechanisms to ensure those standards...

How the Work-From-Home Shift Impacts SaaS Security

The data is in. According to IBM Security's 2020 Cost of a Data Breach Report, there is a 50% increase in cloud usage for enterprises across all industries. The number of threats targeting cloud services, predominantly collaboration services like Office 365, has increased 630%. Moreover, 75% of...

A Quick Look Into Cloud Security Posture Management (CSPM)

The cloud security solutions market is growing rapidly, and there are many types of solutions to support your specific business needs. But figuring out the right tool—let alone the right type of tool—can be difficult. Gartner has five security archetypes that fall under the broader cloud security...

Information Disclosure

jetty-server is vulnerable to information disclosure. The URI normalisation in default compliance mode does not escape % encoded characters in the request metadata by common Servlet implementations, allowing access to sensitive resources within the WEB-INF directory via the use of URI with %2e or...

CVE-2021-28164

In Jetty the default compliance mode allows requests with URIs that contain %2e or %2e%2e segments to access protected resources within the WEB-INF directory. An attacker can use this vulnerability to reveal sensitive information regarding the implementation of a web application...

Assessing Mainframe Compliance While Minimizing Operational Impact

While many in the industry consider mainframes to be inherently secure systems that dont require additional hardening, this is not the case, according to recent Forrester surveys which reveal that security incidents are commonplace in mainframes. Mainframes are the backbone of many businesses and...

DEBIAN-CVE-2021-28164

In Eclipse Jetty 9.4.37.v20210219 to 9.4.38.v20210224, the default compliance mode allows requests with URIs that contain %2e or %2e%2e segments to access protected resources within the WEB-INF directory. For example a request to /context/%2e/WEB-INF/web.xml can retrieve the web.xml file. This ca...

Design/Logic Flaw

In Eclipse Jetty 9.4.37.v20210219 to 9.4.38.v20210224, the default compliance mode allows requests with URIs that contain %2e or %2e%2e segments to access protected resources within the WEB-INF directory. For example a request to /context/%2e/WEB-INF/web.xml can retrieve the web.xml file. This ca...

COVID-19 and HIPAA Enforcement Discretion Leaves Healthcare Organizations Vulnerable to Ransomware Attacks

Patient engagement is a term that has been discussed in healthcare for years. But now, its an urgent priority as providers work to vaccinate millions of Americans. The COVID-19 pandemic has put increased pressure on healthcare providers to ramp up digital communications with patients regarding...

Extending your FedRAMP Program to Container Infrastructure with the Qualys Cloud Platform

Following the recent release of the FedRAMP Vulnerability Scanning Requirements for Containers, FedRAMP-authorized systems that make use of containers have one month from March 16, 2021 to submit a plan for compliance with the new requirements. Organizations with a need to certify their services...

KICS - Find Security Vulnerabilities, Compliance Issues, And Infrastructure Misconfigurations Early In The Development Cycle Of Your Infrastructure-As-Code

Find security vulnerabilities, compliance issues, and infrastructure misconfigurations early in the development cycle of your infrastructure-as-code with KICS by Checkmarx. KICS stands for K eeping I nfrastructure as C ode S ecure, it is open source and is a must-have for any cloud native project...

[SECURITY] Fedora 32 Update: firefox-87.0-2.fc32

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance and portability...

CentOS: Security Advisory for firefox (CESA-2021:0992)

The remote host is missing an update for the Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Maintain File Security during Compliance Scanning

Learn how to integrate security into the build process to protect downstream workflows from risk...

Securing Containers and Kubernetes-Orchestrated Environments

In a recent Black Hat webcast, “Securing Containers and Kubernetes-Orchestrated Environments,” sponsored by VMware Carbon Black, guest speakers Sheila A. Berta, Offensive Security Specialist, Dreamlab Technologies and Haim Helman, CTO, VMware Carbon Black App Security, VMware Security Business...

Out of cyber class. Maritime compliance.

Ships classification societies have a key role to play in the International Maritime Organisations cyber security requirements. Based on our experience to date, there are some significant issues coming that maritime insurers need to be aware of before writing cover for any vessel that includes...

SYS.2.3.A6

Wechsellaufwerke SOLLTEN NICHT automatisch eingebunden werden. Die Einbindung von Wechsellaufwerken SOLLTE so konfiguriert sein, dass alle Dateien als nicht ausfuehrbar markiert sind Mountoption SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced...

Anatomy of a Security Super Bowl Dynasty, Part 3: Special Teams and Coaching

Imperva Directors of Technology in the Office of the CTO, Brian Anderson and Craig Burlingame, recently conducted an informal education session titled, Creating a Security Super Bowl Dynasty. In this presentation, they illustrated the ways American football teams create consistent, sustainable...

SYS.1.3.A8

Um eine verschluesselte und authentisierte, interaktive Verbindung zwischen zwei IT-Systemen aufzubauen, SOLLTE ausschliesslich Secure Shell SSH verwendet werden. Alle anderen Protokolle, deren Funktionalitaet durch Secure Shell abgedeckt wird, SOLLTEN vollstaendig abgeschaltet werden. Fuer die...