Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Browser extensions are a classic shadow IT concern. Assessing the reputation and security of a browser extension is crucial before installing it on a company computer, as extensions often have wide-ranging permissions that could be abused for data theft or other malicious activities. In an open environment style company, extensions generate significant shadow IT risk that needs to be managed and addressed.

Ivanti released a patch for a critical vulnerability discovered in Ivanti Endpoint Manager (EPM) that could allow for remote code execution (RCE). This vulnerability is being tracked as CVE-2023-39336 with a CVSS score of 9.6 (Critical), which is not yet actively exploited. All versions of Ivanti EPM prior to Service Update 5 are impacted. Ivanti credits security researcher hir0t for the responsible disclosure.

On January 4, 2024, Ivanti published a security advisory regarding a SQL injection vulnerability in their Endpoint Manager (EPM) solution, CVE-2023-39336. The vulnerability was rated with a CVSS of 9.6, as an attacker with access to the internal network can exploit this vulnerability to execute arbitrary SQL queries without authentication.

As the United States gears up for the 2024 election, the significance of cybersecurity for state and local governments cannot be overstated. In an era where digital threats are increasingly sophisticated, robust cybersecurity measures are essential to protect both the critical election infrastructure and the integrity of elections itself.

The Federal Risk and Authorization Management Program (FedRAMP®) authorization has, for years, been seen as an arduous undertaking only for companies that want to do business with government agencies and their contractors. However, with growing cybersecurity risks, coupled with tightening data privacy regulations across industries, FedRAMP’s fundamental security requirements are becoming best practices for all organizations handling sensitive data.

The Internet has become an integral part of everyday life. Every day, we exchange information, make purchases, and communicate with friends and colleagues via messages, email, and phone calls. However, we often do not think about how much information we provide about ourselves online when we make publications on social networks or simply search for a necessary video clip. According to Statista, as of April 2023, there were 5.18 billion Internet users worldwide.

“Not another AI tool!” Yes, we hear you. Nevertheless, AI is here to stay and generative AI coding tools, in particular, are causing a headache for security leaders. We discussed why recently in our Why you need a security companion for AI-generated code post. Purchasing a new security tool to secure generative AI code is a weighty consideration. It needs to serve both the needs of your security team and those of your developers, and it needs to have a roadmap to avoid obsolescence.

A SIEM’s price can be a bit of a shock. As we’ve covered in another blog, the price of a security information and event management (SIEM) solution is never just about licensing (or whatever you initially agree to pay a vendor for data processing). Even though SIEM licensing costs can easily be tens of thousands of pounds for a small organisation with less than 20 GB of monthly data flow.

The OSPF (Open Shortest Path First) protocol belongs to a category of IP Routing protocols and serves as an Interior Gateway Protocol (IGP) designed for the Internet. It is employed to disseminate IP routing details across a solitary Autonomous System (AS) within an IP network.

As we all know, data security is a constantly evolving field, and it’s essential to keep up with the latest standards and requirements. And mark your calendars, because the current PCI DSS v3.2.1 is set to retire on March 31st, 2024. That’s right, the PCI Security Standards Council (SSC) has announced the release of the new and improved PCI DSS v4.0, and compliance with this updated version is mandatory for organizations to maintain data security.