Switching from a “Just in Time” delivery system should include planning ahead

As it becomes clear that some things will never again be the same after the global coronavirus pandemic, it is time to prepare for the future. The cybersecurity implications of upcoming changes will be most noticeable in organizations that rely on security models like the software defined...

Qualys Cloud Platform 10.1.0 New Features

The upcoming release of the Qualys Cloud Platform VM, PC, version 10.1.0, includes several new features and enhancements in Qualys Cloud Platform and Qualys Policy Compliance. This release will also add support for new technologies in Qualys Policy Compliance for OCA. 10.1.0 is scheduled to go li...

perimeterinstitute.ca Cross Site Scripting vulnerability

Security Researcher kun-fly Helped patch 589 vulnerabilities Received 7 Coordinated Disclosure badges Received 40 recommendations , a holder of 7 badges for responsible and coordinated disclosure, found a security vulnerability affecting perimeterinstitute.ca website and its users. Following...

Why Minimizing Human Error is the Only Viable Defense Against Spear Phishing

Phishing attacks have become one of the business world's top cybersecurity concerns. These social engineering attacks have been rising over the years, with the most recent report from the Anti-Phishing Working Group coalition identifying over 266,000 active spoofed websites, which is nearly doubl...

perimeterinstitute.ca Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1101789 Security Researcher KhanJanny Helped patch 3070 vulnerabilities Received 9 Coordinated Disclosure badges Received 38 recommendations , a holder of 9 badges for responsible and coordinated disclosure, found a security vulnerability affecting perimeterinstitute.ca...

Kubernetes: Half-Blind SSRF found in kube/cloud-controller-manager can be upgraded to complete SSRF (fully crafted HTTP requests) in vendor managed k8s service.

Hello, Who we are : We’re two French security researchers and our respective names are Brice Augras and Christophe Hauquiert, we worked and found the vulnerability together. Brice Augras from https://www.groupe-asten.fr/ company - https://hackerone.com/reeverzax Christophe Hauquiert -...

A Practical Guide to Zero-Trust Security

Employees are demanding that employers enable flexible workstyles. Apps are moving to the cloud. A company’s device and application mix are increasingly heterogeneous. All of these factors are breaking down the enterprise security perimeter, rendering traditional security approaches obsolete, and...

Juniper Junos CVE-2020-1608 Multiple Denial of Service Vulnerabilities

Description Juniper Junos is prone to multiple denial-of-service vulnerabilities. An attacker may exploit these issues to cause denial-of-service conditions. Technologies Affected Juniper Junos 17.2R2-S6 Juniper Junos 17.2R2-S7 Juniper Junos 17.2R2-S8 Juniper Junos 17.2R3 Juniper Junos 17.2R3-S1...

The Zero Trust Approach to Data Security – 2020 Trend #2

As 2019 comes to an end, our security experts are looking ahead to the new year to predict cybersecurity trends that will shape the landscape in 2020. Imperva CTO Kunal Anand blogged about his “Top 5 Cybersecurity Trends to Prepare for in 2020,” last week. This week, we’re digging deeper into his...

Qualys Cloud Platform 8.22 New Features (VM, PC)

Update December 11, 2019: See additional details about this release. The 8.22.0 release adds several new features in Qualys Cloud Platform, adds a new API in Policy Compliance and support for 2 new technologies for OCA. Feature Highlights Qualys Cloud Platform Support for DNS tracking – You can n...

Cisco Email Security Appliance CVE-2019-15988 Remote Security Bypass Vulnerability

Description Cisco Email Security Appliance is prone to a remote security-bypass vulnerability. An attacker can exploit this issue to bypass security restrictions and perform unauthorized actions. This may aid in further attacks. This issue is being tracked by Cisco Bug ID CSCvq09347. Technologies...

Cisco Wireless LAN Controller CVE-2019-15276 Denial of Service Vulnerability

Description Cisco Wireless LAN Controller is prone to a remote denial-of-service vulnerability. Attackers can exploit this issue to cause a restart to the device, resulting in denial-of-service conditions. This issue is being tracked by Cisco Bug ID CSCvp92098. Technologies Affected Cisco Wireles...

Qualys Cloud Platform 8.21.6 New Features

Update Nov 19, 2019: This blog post was updated with additional detail about the new features in 8.21.6. The 8.21.6 release adds several new features in Qualys Cloud Platform, Policy Compliance, and Vulnerability Management. Apart from various other new features, this release adds support for App...

Perimeter Breaches: The attack front you’re losing

Everything is data. Defining your perimeter is nearly impossible, which makes securing it even more tricky. Old strategies are obsolete. How do we navigate and protect our boundaries in an increasingly digital world? The post Perimeter Breaches: The attack front you're losing appeared first on...

Traditional perimeter-based network defense is obsolete—transform to a Zero Trust model

Digital transformation has made the traditional perimeter-based network defense obsolete. Your employees and partners expect to be able to collaborate and access organizational resources from anywhere, on virtually any device, without impacting their productivity. Customers expect personalized...

Cisco Identity Services Engine CVE-2019-15282 Information Disclosure Vulnerability

Description Cisco Identity Services Engine is prone to an information disclosure vulnerability. An attacker can exploit this issue to obtain sensitive information that may aid in further attacks. This issue is being tracked by Cisco bug ID CSCvq52402. Technologies Affected Cisco Identity Services...

Juniper Junos CVE-2019-0056 Denial of Service Vulnerability

Description Juniper Junos is prone to a denial-of-service vulnerability. An attacker may exploit this issue to cause denial-of-service conditions. Technologies Affected Juniper Junos 18.1 Juniper Junos 18.1R1 Juniper Junos 18.1R2 Juniper Junos 18.1R2-S1 Juniper Junos 18.1R2-S2 Juniper Junos...

Juniper Junos CVE-2019-0068 Denial of Service Vulnerability

Description Juniper Junos is prone to a denial-of-service vulnerability. An attacker may exploit this issue to cause denial-of-service conditions. Technologies Affected Juniper Junos 12.3X48 Juniper Junos 12.3X48-D10 Juniper Junos 12.3X48-D15 Juniper Junos 12.3X48-D20 Juniper Junos 12.3X48-D25...

Multiple Cisco Products CVE-2019-12676 Denial of Service Vulnerability

Description Multiple Cisco Products are prone to a denial-of-service vulnerability. An attacker can exploit this issue to cause a reload to the affected device; denying service to legitimate users. This issue is being tracked by Cisco Bug ID CSCvp49790. Technologies Affected Cisco Adaptive Securi...

Phish Uses Google's URL Decoding to Swim Past Defenses

A phishing campaign that takes advantage of Google’s ability to decode non-ASCII URL data on the fly is making the rounds – looking to fool the unsavvy by effectively hiding the website address of the campaign’s phishing page. The campaign makes use of what’s called percentage-based URL encoding ...