Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Security Bulletin: AnyDesk Production Systems Breach

On February 2nd, 2024, AnyDesk disclosed that their production systems had been compromised and that private code signing keys and source code were stolen, while an unknown number of user accounts had their passwords reset. This is a significant concern, as it would allow a malicious attacker to generate malicious versions of AnyDesk software with compromised code that appears to be legitimate. It is assessed that approximately 18,000 credentials are available for sale on the Dark Web as a result.

Friday Flows Episode 20: Regularly Update Insecure AWS EC2 Security Groups

Launching an AWS EC2 instance can be done in seconds, but are they being set up securely for success? In today's Friday Flows, Michael Tolan helps us celebrate the 700th Tines Story Library addition with a look at a customer submitted workflow to audit and remediate default security groups for virtual machines in AWS.

Generative AI Used to Launch Phishing Attacks

Criminal threat actors are increasingly utilizing generative AI tools like ChatGPT to launch social engineering attacks, according to researchers at Check Point. “Malicious spam is one of the oldest illicit services found on underground cybercrime forums,” the researchers write. “Spam is the most common initial vector for various attack scenario objectives such as phishing and credential harvesting, malware distribution, scams/fraud, etc.

Synthetic Data: The New Frontier in Cyber Extortion

Organizations are increasingly facing cyber attacks resulting in data breaches, and part of their post-incident responsibilities includes adhering to mandatory reporting requirements. Notably, the infamous BlackCat ransomware group has been exploiting these requirements for their benefit. They apply pressure on victims by threatening to inform the Securities and Exchange Commission (SEC) about the company's supposed failure to report significant data breaches.

How Do You Use a Passkey?

To use a passkey on an online account or application, you first need to generate the passkey using your device or password manager. Once your passkey is generated, you can use it to sign in to the online account or application it’s for without having to enter a password. Continue reading to learn more about how to start using passkeys and why you should use them over passwords.

Secure Spatial Computing With Keeper and Apple Vision Pro

The launch of the Apple Vision Pro has brought a new era to computing along with an exciting and fresh approach to how people interact with technology and the world around them. Keeper® is excited to be a part of this by providing a seamless, secure and encrypted login experience through our Apple Vision Pro-compatible app.

Redefining PAM to Secure OT and IoT Devices

Left to their own devices, your organization’s devices can be a significant source of risk. Consider operational technology (OT), which is crucial for organizations but is not engineered and operated with a security-first mindset. Often, OT systems are beyond the purview of CISOs and are focused on meeting key objectives for system uptime and efficiency – leaving them vulnerable.

What is IaC? Infrastructure as code explained in 60 seconds

IaC or infrastructure as code is the codifying of our infrastructure. it takes the manual tasks that a sys admin would have done and it makes it repeatable and scalable. IaC can be declarative or descriptive and uses lots of different tools like Terraform Ansible and Puppet to name a few. This video explains what IaC is and how it works in 60 seconds.