676 matches found
BingBang: How a simple developer mistake could have led to Bing.com takeover
How a misconfiguration in a Microsoft Bing.com application allowed Wiz Research to modify Bing’s search results – and potentially compromise the private data of millions of Bing users...
BingBang: AAD misconfiguration led to Bing.com results manipulation and account takeover
How Wiz Research found a common misconfiguration in Azure Active Directory that compromised multiple Microsoft applications, including a Bing management portal...
Partnering and prioritization: Lessons learned when building security operations at hyperspeed
CISOs share their experiences ensuring security in fast-growth environments...
Everything you ❤ about Wiz, now deployed in a new Canadian data center
Wiz launches a new Canadian data center and adds support for CSE Information Technology Security Guidance ITSG 33 framework helping organizations simplify cloud security and compliance...
Detect critical application misconfiguration risks
Some application misconfigurations are equivalent to remote code execution or information disclosure vulnerabilities, but often go unnoticed. Wiz’s agentless capabilities detect these and correlate them to attack surface and business impact risks, highlighting the most critical misconfigurations...
Using Service Control Policies to protect security baselines
Service Control Policies SCPs can be a great way to prevent actions from happening in AWS accounts. In this post, we will illustrate a specific use case of SCPs that protects the security baseline, or landing zone, configuration you’ve created for accounts...
Shift left with Wiz Guardrails: New Wiz Admission Controller capabilities enable security policy checks at deployment time
Wiz CLI and Wiz Admission Controller enable developers to leverage a single security policy throughout the software pipeline for cloud-native environments...
Compliance made easy with Wiz
Stay compliant with Wiz’s 100+ compliance frameworks, generate quick compliance reports, and remediate issues faster with remediation guidance and auto-remediation...
CVE-2023-25610 a critical RCE vulnerability in FortiOS: everything you need to know
CVE-2023-25610 is a critical RCE vulnerability in FortiOS. This vulnerability is a buffer underwrite bug in the administrative interface which could allow a remote unauthenticated attacker to execute code using specially crafted requests. Affected customers should patch immediately...
From Pod Security Policies to Pod Security Standards – a Migration Guide
Pod Security Policies were removed in Kubernetes v1.25 — learn how to migrate from Pod Security Policies to Pod Security Standards...
Wiz enhances its industry leading data security solution with broader cloud data coverage and customizable platform capabilities
Wiz for DSPM, now generally available, helps customers reduce the time it takes to discover and fix cloud data exposure before it becomes a costly breach...
Wiz and SentinelOne announce exclusive partnership to deliver end to end cloud security
Leading cybersecurity companies partner to increase customer value and disrupt the enterprise security industry...
The benefits of a customer-centric cloud security mindset
Why a customer focus unlocks new levels of innovation and enables security team success...
Securing a successful merger: Insights from MGM Studios
Hear from John Visneski, CISO of MGM Studios about how the organization fosters collaboration and transparency across business units using Wiz...
What are the biggest cyberthreats heading our way in 2023?
Wiz and Procter & Gamble experts share their security insights and tips...
Redirection Roulette: Thousands of hijacked websites in East Asia redirecting visitors to other sites
Since early September 2022, tens of thousands of websites aimed at East Asian audiences have been hacked, redirecting hundreds of thousands of their users to adult-themed content...
Enhanced policy management with GitOps and Terraform
Wiz announces new GitOps workflows and Terraform provider, enabling customers to manage policies as code...
Wiz becomes the world’s largest cybersecurity unicorn
Just three years since its launch, Wiz becomes the world’s largest cyber unicorn and fastest SaaS company to reach a $10B valuation...
Lateral movement risks in the cloud and how to prevent them – Part 3: from compromised cloud resource to Kubernetes cluster takeover
In this third blog post, we will discuss lateral movement risks from the cloud to Kubernetes. We will explain attacker TTPs, and outline best practices for cloud builders and defenders to help secure their cloud environments and mitigate risk...
A Brief History of Wiz Socks
From the Big Bang to Leonardo da Vinci, these socks have protected the cloud throughout history...
Adapt to endure: navigating the current economic environment
Learn how CISOs are preparing for what’s ahead by embracing consolidation and continuing to invest in security...
Let it snow! Wiz and Snowflake join forces to power insights with actionable intelligence
Automatically push Wiz-identified cloud security issues to Snowflake to analyze and accurately report on your cloud security metrics...
Ransomware attacks targeting VMware ESXi servers: everything you need to know
Recent attacks leverage CVE-2021-21974 to install ransomware on VMWare ESXi servers. Security teams are advised to patch and stay vigilant for indicators of compromise...
The State of the Cloud 2023
Wiz's State of the Cloud 2023 report provides analysis of trends in cloud usage such as multi-cloud, use of managed services and more. In addition, the report highlights notable cloud risks based on insights from 30% of Fortune 100 enterprise cloud environments...
Getting started with Open Policy Agent (OPA) to improve your cloud security
Learn Rego basics from Wiz to express policy as code for your cloud security...
Wiz and AWS CloudTrail Lake: Cloud security and compliance posture audits made easy
Simplify and centralize security and compliance management by sending audit-worthy events from Wiz into AWS CloudTrail Lake...
Streamlining OS and Application Hardening: Revealing Misconfigurations with Wiz’s Agentless Custom Host Configuration Rules
Shell commands that once had to be run manually now can be coded into a custom rule and run daily using Wiz agentless workload scanning...
Enhancing Kubernetes security with user namespaces
Learn how to improve cluster security with user namespaces, a new feature introduced in Kubernetes v1.25...
Unleashing the Power of No-Code Automation for Cloud Security with Wiz and Tines
The Wiz and Tines partnership empowers organizations to protect their cloud infrastructure at scale with no-code automation...
CVE-2022-44877, critical RCE in CentOS Control Web Panel exploited in the wild: everything you need to know
Detect and mitigate CVE-2022-44877, a CentOS Control Web Panel CWP unauthenticated RCE exploited in the wild. Security teams are advised to patch urgently...
Hunting for signs of persistence in the cloud: an IR guide following the CircleCI incident
Learn how to detect malicious persistence techniques in AWS, GCP & Azure after potential initial compromise, like with the CircleCI incident...
Wiz launches Australia cloud data center further demonstrating commitment to ANZ and multinational organizations
Wiz announces availability of new regional data center and adds support for Essential Eight controls...
New Year’s Resolutions: Where CISOs plan to invest and scale back in 2023
Hear from security leaders about their plans, strategies, and priorities for the new year...
Lateral movement risks in the cloud and how to prevent them – Part 2: from compromised container to cloud takeover
In this second blog post, we will discuss lateral movement risks from Kubernetes to the cloud. We will explain attacker TTPs, and outline best practices for security practitioners and cloud builders to help secure their cloud environments and mitigate risk...
Malicious PyTorch dependency 'torchtriton' on PyPI: everything you need to know
The developers of PyTorch a popular machine-learning framework recently identified a malicious dependency confusion attack on the open-source project. Security teams are advised to check for infected resources and rotate any exposed keys...
CVE-2022-47939 critical vulnerability in Linux kernel `ksmbd` module: everything you need to know
Critical RCE vulnerability found in Linux kernel's ksmbd module: remote attackers can execute code without authentication. The module is not enabled by default on most operating systems...
OWASSRF, a new exploit for Exchange vulnerabilities, exploited in the wild: everything you need to know
A new exploit method targeting CVE-2022-41080 and CVE-2022-41082 vulnerabilities in Exchange servers, which can bypass previous workarounds, has been discovered and exploited in the wild. Organizations should patch urgently...
Automatically discover and secure your APIs with Wiz Dynamic Scanner
Wiz enhances its Dynamic Scanner to detect publicly exposed, unauthenticated APIs...
Wiz introduces Dangling Domain Detection to help you prevent subdomain takeovers
Easily detect dangling domains to reduce the risk of phishing campaigns and cookie harvesting of organization’s customers...
Wiz enhances dynamic scanner to analyze and validate external exposure
Wiz extends its cloud analysis with an external scanner, giving customers an attacker's view of their externally exposed resources to reduce noise...
Use cases for Delegated Administrator for AWS Organizations
Learn about how AWS's recently released Delegated Administrator for AWS Organization can be used to solve common problems at your company and the issues you might run into with it...
Introducing PEACH, a tenant isolation framework for cloud applications
A step-by-step framework for modeling and improving SaaS and PaaS tenant isolation by reducing your cloud applications’ attack surface...
CVE-2022-27518 exploited in the wild by APT5: everything you need to know
Detect and mitigate CVE-2022-27518, a Citrix ADC and Gateway unauthenticated RCE 0-day exploited in the wild by a nation state actor. Organizations should patch urgently...
Secret-based cloud supply-chain attacks: Case study and lessons for security teams
CI/CD pipelines, as an essential part of the software development process, are an attractive target to malicious actors. Based on our research of cloud environments, we share common misconfigurations and provide tips on how to remediate them in order to prevent supply-chain attacks...
Introducing Azure Least Privilege: Enforce least privilege access for Azure environments
Wiz extends its CIEM capabilities to enable least privilege access for Azure environments...
Top Security Talks from AWS re:Invent 2022
AWS re:Invent is the largest conference of the year for Amazon Web Services AWS with hundreds of talks. We picked our favorite cloud security talks that are available online...
Uncover what is really deployed in your environment with the enhanced Wiz inventory
Wiz adds full detection of cloud services for deeper visibility and control over shadow IT...
Navigating the road ahead for CISOs following the Uber verdict
Hear from industry experts to understand the challenges ahead and best practices CISOs can follow to avoid issues in the future...
Wiz introduces agentless solution for detecting host and application misconfigurations
Wiz extends its risk assessment to support host and application level misconfigurations, enabling customers to ensure security and compliance posture for applications...