Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

The explosive growth of cryptocurrencies was nothing short of extraordinary. Even the most doubtful among us couldn’t help but put a few dollars in to see what would happen. The phenomenon gave rise to many cryptocurrency management platforms, and PayPal put its hat in the ring as well. Unlike apps made for the explicit purpose of handling crypto, PayPal was an established platform with roughly 350 million users.

As more cybercriminal gangs continue to enter the game, the massive increase in unique types of malware means it will become increasingly difficult to identify and stop attacks. Blackberry just put out their Global Threat Intelligence Report in November, covering June through August of this year. According to the report, the number of attacks identified and stopped in the three-month period covered equates to an average of 26 attacks per minute.

During my first few years as a CISO at Avid Technology, I was able to install a robust cybersecurity program. (Avid is a software provider that equips digital content creators with innovative tools.) With the help of my security team, Avid had become more mature in their control measures. This maturity meant we were better armed to address cyber vulnerabilities. ‍ Unfortunately, on top of my regular duties, I also had to face an even greater challenge.

If you are used to managed MPLS services, transitioning to Internet last-mile access as part of SD-WAN or SASE might cause some concern. How can enterprises ensure they are getting a reliable network if they are not promised end-to-end SLAs? The answer: by dividing the enterprise backbone into the two last miles connected by a middle mile and then applying appropriate redundancy and failover systems and technologies in each section.

Two months ago, we made Cloudflare Turnstile generally available — giving website owners everywhere an easy way to fend off bots, without ever issuing a CAPTCHA. Turnstile allows any website owner to embed a frustration-free Cloudflare challenge on their website with a simple code snippet, making it easy to help ensure that only human traffic makes it through.

On December 13, 2023, threat actors began exploitation attempts against CVE-2023-50164, a critical-severity remote code execution (RCE) vulnerability impacting Apache Struts, an open-source framework used to create Java Web applications. Based on current intelligence, the threat actors are leveraging a publicly published proof of concept (PoC) exploit.

Amidst the ongoing surge in cyber threats, CISOs are encountering increasing challenges in their responsibilities. During a recent CISO Panel Discussion on Application Security hosted by our CEO, Ashish Tandan, CISOs Kiran Belsekar from Aegon Life and Manoj Srivastava from Future Generali expressed concerns about managing security postures and shared actionable strategies to tackle evolving threats.

On November 16, 2023, Google’s Threat Analysis Group revealed an alarming vulnerability in Zimbra Collaboration—a reflected cross-site scripting (XSS) vulnerability assigned CVE-2023-37580. The Zimbra Collaboration Suite (ZCS) is a software platform that combines email, calendar, contacts, file sharing, and other collaboration tools into a single integrated package. The CVE-2023-37580 allows an attacker to inject a malicious script directly into the URL parameter.