Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Gift cards or data theft? Ensuring safe online shopping this festive season

Gift cards have become a go-to Christmas present for many people, but their dramatic rise in popularity has also unfortunately made them a prime target for hackers. The reason why gift cards are such a popular present is because of how practical they are to use. When you’re not sure what to buy someone, gift cards present an easy and accessible way to show someone how much you appreciate them.

NIST NCCoE Publishes Cybersecurity Framework Profile for Hybrid Satellite Networks

In late September 2023, the US-based National Institute of Standards and Technology (NIST) published its Cybersecurity Framework Profile for Hybrid Satellite Networks, otherwise known as NIST IR 8441. This blog will explore the reasons behind NIST developing the framework, outline its intentions, and summarize its key points.

Guarding the Grid: Navigating the Current and Future Landscape of Utility Cybersecurity

Tripwire recently held its annual Energy and NERC Compliance Working Group. This year's attendees included more than 200 Tripwire customer utility personnel representing over 80 different registered entities from all across the US and Canada. The company sizes ranged from public utility districts and city municipalities to medium and larger-sized investor-owned utilities, including many of the Fortune 500 and 1000 power entities.

How to Create an Effective Vendor Onboarding Policy

Forming partnerships with new vendors can be a complicated and risk-intensive process for any organization. The best way to manage the risks associated with new partnerships and establish successful vendor management practices is to create an effective vendor onboarding policy. Organizations create vendor onboarding policies to standardize the onboarding process, streamline vendor evaluation, and manage vendor risk and vendor compliance.

LDAP Cybersecurity Risks and Prevention Techniques

LDAP, which stands for Lightweight Directory Access Protocol, provides an open-source, vendor-neutral application protocol for distributed directory services and user authentication. This article provides a brief overview of LDAP uses, followed by a description of LDAP exposure risks and cybersecurity protection strategies.

CVE-2023-43177: Critical Unauthenticated RCE Vulnerability in CrushFTP

On August 10, 2023, CrushFTP released an advisory regarding a vulnerability affecting versions of CrushFTP lower than 10.5.1. Since then, the vulnerability has been tracked as CVE-2023-43177 and the security researchers at Converge published a blog sharing their findings on November 16. CVE-2023-43177 is a mass assignment vulnerability related to how CrushFTP parses request headers for the AS2 protocol. Successful exploitation could lead to unauthenticated, remote code execution (RCE).

North Korea-Linked Threat Actor, Diamond Sleet, Distributes Modified CyberLink Installer in Supply Chain Compromise

Beginning on at least October 20, 2023, a North Korea-linked threat actor, tracked as Diamond Sleet by Microsoft, leveraged a modified CyberLink installer to compromise victim assets. CyberLink Corp. is a Taiwan-based multimedia software company that develops media editing and recording software.

STEP Program with Bright Security: DAST Solutions and API Testing

We’re all in this together, which is why awareness about APIs and connecting with one another is crucial to cyber security. Salt Security has recently announced our Salt Technical Ecosystem Partner Program which can help demonstrate the role of application security testing when it comes to API security and where it fits in a good API security program.