Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Two Zero-Day Vulnerabilities Impacting Ivanti Connect Secure and Policy Secure Gateways

Note: These vulnerabilities remain under active exploitation, and Kroll experts are investigating. If further details are uncovered by our team, updates will be made to the Kroll Cyber Risk blog. Two zero-day vulnerabilities have been discovered in Ivanti Connect Secure (ICS), formerly known as Pulse Connect Secure and Ivanti Policy Secure gateways.

Expert Insight for Securing Your Critical Infrastructure

At Tripwire's recent Energy and NERC Compliance Working Group, we had the opportunity to speak with the Manager of Gas Measurement, Controls, & Cybersecurity at a large energy company. More specifically, we focused on SCADA and field assets of gas Operational Technology. The experience at the management level of such an organization provided a wealth of knowledge for the attendees.

Critical flaw found in WordPress plugin used on over 300,000 websites

A WordPress plugin used on over 300,000 websites has been found to contain vulnerabilities that could allow hackers to seize control. Security researchers at Wordfence found two critical flaws in the POST SMTP Mailer plugin. The first flaw made it possible for attackers to reset the plugin's authentication API key and view sensitive logs (including password reset emails) on the affected website. A malicious hacker exploiting the flaw could access the key after triggering a password reset.

Security Key as the Only 2FA Method

Two-Factor Authentication or “2FA” provides an extra layer of security when logging into your Keeper Vault. While support for hardware security keys for 2FA is not new to Keeper, historically, users were required to have a backup method in addition to a security key. Keeper Administrators now have the ability to enforce the use of a hardware-based security key as the only two-factor method via a role enforcement policy setting.

What Is Cyber Extortion?

Cyber extortion is a category of cybercrime that involves digitally threatening or coercing someone to do something against their will. Cyber extortion typically disables an organization’s operations or exposes an entity’s valuable assets such as confidential data, intellectual property or infrastructure systems. A cybercriminal will then threaten organizations or individuals to pay a ransom to prevent further cyber attacks or regain access to their sensitive files or operations.

Australia's Six Cyber Shields and One Strategy to Rule Them All

The newly unveiled 2023-2030 Australian Cyber Security Strategy (the Strategy) lays out six cyber shields to achieve the Australian Government’s goal of becoming a world leader in cyber security by 2030. It aims to substantially improve the country’s overall cyber security posture, the ability to manage cyber risks and respond to cyberattacks quickly.

Analysis of Phishing Emails Shows High Likelihood They Were Written By AI

It’s no longer theoretical; phishing attacks and email scams are leveraging AI-generated content based on testing with anti-AI content solutions. I’ve been telling you since the advent of ChatGPT’s public availability that we’d see AI’s misuse to craft compelling and business-level email content.

Introducing the Cyber Resilience Scorecard

This week at the World Economic Forum Annual Meeting, SecurityScorecard published the first Cyber Resilience Scorecard, offering leaders and decision-makers a comprehensive and global view of global cyber risk. SecurityScorecard identified a strong correlation between a country’s cyber risk exposure and GDP, which underscores that a nation’s economic prosperity is deeply intertwined with its ability to navigate the complex landscape of cyber threats.