The Evolution of the Qualys Cloud Platform

The global pandemic has upended everything, and in the cyber security world in particular it has highlighted the need for organizations to have a cloud-based security and compliance platform, Qualys President and Chief Product Officer Sumedh Thakar said during his keynote Monday at Qualys Securit...

Pen Testing By Numbers: Tracking Pen Testing Trends and Challenges

Over the years, penetration testing has had to change and adapt alongside the IT environments and technology that need to be assessed. Broad cybersecurity issues often influence the strategy and growth of pen-testing. In such a fast-paced field, organizations get real value from learning about...

Pen Testing By Numbers: Tracking Pen Testing Trends and Challenges

Over the years, penetration testing has had to change and adapt alongside the IT environments and technology that need to be assessed. Broad cybersecurity issues often influence the strategy and growth of pen-testing. In such a fast-paced field, organizations get real value from learning about...

Missing Link in a 'Zero Trust' Security Model—The Device You're Connecting With!

Like it or not, 2020 was the year that proved that teams could work from literally anywhere. While terms like "flex work" and "WFH" were thrown around before COVID-19 came around, thanks to the pandemic, remote working has become the defacto way people work nowadays. Today, digital-based work...

How IT leaders are securing identities with Zero Trust

The past twelve months have been a remarkable time of digital transformation as organizations, and especially digital security teams, adapt to working remotely and shifting business operations. IT leaders everywhere turned to Zero Trust approaches to alleviate the challenges of enabling and...

How IT leaders are securing identities with Zero Trust

The past twelve months have been a remarkable time of digital transformation as organizations, and especially digital security teams, adapt to working remotely and shifting business operations. IT leaders everywhere turned to Zero Trust approaches to alleviate the challenges of enabling and...

Cloud Attacks Are Bypassing MFA, Feds Warn

The Feds are warning that cybercriminals are bypassing multi-factor authentication MFA and successfully attacking cloud services at various U.S. organizations. According to an alert issued Wednesday by the Cybersecurity and Infrastructure Security Agency CISA, there have been “several recent...

PAN-OS: Configuration secrets for log forwarding may be logged in system logs

An information exposure through log file vulnerability exists in Palo Alto Networks PAN-OS software where configuration secrets for the “http”, “email”, and “snmptrap” v3 log forwarding server profiles can be logged to the logrcvr.log system log. Logged information may include up to 1024 bytes of...

A Look Ahead at 2021: SolarWinds Fallout and Shifting CISO Budgets

The new year started off with a bang, with the SolarWinds hack revealed in late December acting as a jarring reminder to companies and U.S. government departments alike that cybercriminals continue to successfully exploit security lapses in technology. But beyond the SolarWinds supply-chain...

How COVID-19 Reinforced the Need for Mobile Device Management

How many of you got that call at the beginning of the pandemic to make your company’s workforce 100% capable for remote work? How many of you had no idea how to make that happen, seemingly and sometimes literally overnight? How many of you were already prepared for such an event? Remote workforce...

SolarWinds Web Help Desk 注入漏洞

SolarWinds Web Help Desk is a web-based help desk work order and IT asset management software. An HTML injection vulnerability exists in SolarWinds Web Help Desk 12.7.0. The vulnerability can be exploited to conduct an HTML injection attack via a Comment in a Help Request work order...

VPN usage is increasing, says December 2020 survey

I won’t reveal my mom’s exact age, but she’s in her late 60s. Other than her phone, my mom doesn’t own or use a computer—but she knows what Zoom is. Not since “Kleenex” has a brand become so pervasive that people use the brand name as a generic term for the product. For my mom, any kind of video...

Directory Traversal Vulnerability in Psychological Work Platform of Shanghai North Star Software Co.

Ltd. is a manufacturer and supplier of psychometric software. A directory traversal vulnerability exists in the Psychological Work Platform of Shanghai Northstar Software Co. An attacker can exploit the vulnerability to obtain sensitive information...

2021 Cybersecurity Trends: Bigger Budgets, Endpoint Emphasis and Cloud

After shrinking in 2020, cybersecurity budgets in 2021 climb higher than pre-pandemic limits. Authentication, cloud data protection and application monitoring will top the list of CISO budget and cybersecurity priorities. According to experts, these are just a few of the themes to dominate the ye...

Predicting the Unpredictable: What Will the Cybersecurity Space Look Like in 2021?

Not to start off another blog post about how insane this year has been, but let’s just take a moment to appreciate HOW INSANE THIS YEAR HAS BEEN. As I sat down to write this blog post, I took a look at last year’s predictions post and was amused to see how little we knew about what was coming. An...

Evaluating Our Core Principles

Reflecting on the past year led me to put together this post about how I believe this incredibly challenging year has had an irreversible effect on the way the workforce will collaborate, innovate, and do business in the future. The COVID-19 pandemic emerged at the beginning of 2020 and led to ne...

Most-Wanted Threatpost Stories of 2020

As 2020 draws to a close, it’s clear that work-from-home security, ransomware, COVID-19-themed social engineering and attacks by nation-states will go down as defining topics for the cybersecurity world for the year. Threatpost also took a retrospective view on what readers were most interested...

2020 Work-for-Home Shift: What We Learned

Goodbye, 2020 — and good riddance, right? Most of us don’t want to take too much from this year into the next — but let’s make an exception for what we learned about security in the wake of the COVID-19 pandemic. In 2021 after all, more enterprises will permanently downsize their physical spaces...

Zammad Improper Access Control Vulnerability

Zammad is a Web-based open source helpdesk/customer support system. An improper access control vulnerability exists in Zammad versions prior to 3.4.1. An attacker could exploit the vulnerability to access work orders...

Zammad 安全漏洞

Zammad is a Web-based open source helpdesk/customer support system. An improper access control vulnerability exists in Zammad versions prior to 3.4.1. An attacker could exploit the vulnerability to access work orders...