4647 matches found
EMC RSA Archer GRC Platform User Enumeration Vulnerability
EMC RSA Archer GRC Platform is an enterprise IT governance and compliance governance product from EMC Corporation USA. The product enables the development of eGRC programs for managing enterprise risk, automating business processes, and more. A user enumeration vulnerability exists in the API fil...
DFARS 7012 Compliance
At Coalfire, we field a lot of questions from government contractors about compliance with National Institute of Science and Technology NIST Special Publication SP 800-171. We also address requests for help with "DFARS 7012," which is a commonly used shorthand for Defense Acquisition Regulation...
itooza.com XSS vulnerability
Open Bug Bounty ID: OBB-573235 Description| Value ---|--- Affected Website:| itooza.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...
Securing Healthcare Data and Applications
The healthcare industry is quickly growing as a sweet spot for hackers to steal large amounts of patient records for profit. The US Department of Health and Human Services breach tool reports over 340 data breaches in 2017 impacting more than 3 million individuals, and 176.5 million individuals...
Apple Moves iCloud Data and Encryption Keys for Chinese Users to China
Apple has finally agreed to open a new Chinese data center next month to comply with the country's latest controversial data protection law. Apple will now move the cryptographic keys of its Chinese iCloud users in data centers run by a state-owned company called Cloud Big Data Industrial...
NIST SP 800-171: What U.S. Government Contractors Need to Know
In December 2016, NIST released Special Publication 800-171, Revision 1: Protecting Controlled Unclassified Information in Nonfederal Systems. Since that publication, I have worked with dozens of government contractors to help them understand this publication and determine if and how it applies t...
Open-Source Whistleblowing Framework: GlobaLeaks
GlobaLeaks is an open-source, free software intended to enable secure and anonymous whistleblowing initiatives developed by the Hermes Center for Transparency and Digital Human Rights . It is an Open Whistleblowing Framework that can be used in many different usage scenarios that may require very...
How to build an incident response program: GDPR guidelines
In today’s computing world, it is not a matter of “if” an organization will get compromised, but “when.” That’s why, in addition to the European Union’s General Data Protection Regulation GDPR going into effect this May, many organizations need to have a robust incident response program to ensure...
[SECURITY] Fedora 27 Update: firefox-58.0.2-1.fc27
Mozilla Firefox is an open-source web browser, designed for standards compliance, performance and portability...
Lynis 2.6.2 - Security Auditing Tool for Unix/Linux Systems
We are excited to announce this major release of auditing tool Lynis. Several big changes have been made to core functions of Lynis. These changes are the next of simplification improvements we made. There is a risk of breaking your existing configuration. Lynis is an open source security auditin...
The Fifth Question(s) Today’s CEOs Should Ask (& Know the Answers To)
In a previous blog, we discussed Commander’s Intent for CEOs and introduced 10 questions CEOs should be asking their teams. In this blog series, I am taking a deeper dive into each question and breaking them down one at a time. We will discuss why CEOs should care about each question and the type...
Excerpts from Risk & Response: Defending Financial Institutions with Cb Response
Carbon Black recently published a guide on combating the most advanced threats that financial institutions are facing today using the marketing-leading endpoint detection and response solution, Cb Response. For more information on securing large-scale financial enterprises, including how to...
CVE-2012-0941
Multiple cross-site scripting XSS vulnerabilities in Fortinet FortiGate UTM WAF appliances with FortiOS 4.3.x before 4.3.6 allow remote attackers to inject arbitrary web script or HTML via vectors involving the 1 Endpoint Monitor, 2 Dialup List, or 3 Log&Report Display modules, or the...
One GRC Manager’s Practical Approach to GDPR Readiness
With about four months to go before the GDPR becomes effective many companies are still struggling with where to start. You’re not alone. According to this survey, the majority of companies are slow off the mark. On top of that, companies require resources and budget to prepare for and comply wit...
TLS and SHA2 Support with Citrix Receivers
This article is intended for Citrix administrators and technical teams only. Non-admin users must contact their company's Help Desk/IT support team and can refer to CTX297149 for more information. To use TLS encryption for Citrix Receiver Communications, following table describes the minimum Citr...
If You Think File Integrity Monitoring is Boring, Think Again
You’ll be hard pressed to find file integrity monitoring on any list of cool, emerging, cutting-edge cybersecurity technologies. But if you choose to ignore this mature, foundational technology, it’ll be at great risk. File integrity monitoring, or FIM, plays a key role in critical security and...
Countdown to GDPR: For GDPR Compliance, Web App Security Is a Must
With web and mobile apps becoming a preferred vector for data breaches, organizations must include application security in their plans for complying with the EU's General Data Protection Regulation GDPR. First discussed in the 1990s and turned into law in 2016, GDPR goes into effect in May of thi...
Excerpts from Risk & Response: Defending Financial Institutions with Cb Response
Carbon Black recently published a guide on combating the most advanced threats that financial institutions are facing today using the marketing-leading endpoint detection and response solution, Cb Response. For more information on securing large-scale financial enterprises, including how to...