Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

On June 17, 2024, VMware disclosed two critical vulnerabilities (CVE-2024-37079 & CVE-2024-37080) affecting vCenter Server and Cloud Foundation. These vulnerabilities stem from a heap-overflow issue in the implementation of the DCERPC protocol which can be exploited by remote threat actors. By sending specially crafted network packets, threat actors could exploit CVE-2024-37079 and CVE-2024-37080 to achieve Remote Code Execution (RCE) on both vCenter Server and Cloud Foundation systems.

On June 19, 2024, CDK Global notified customers that a cyber incident had led to a shutdown of its systems, significantly impacting car dealerships across the United States. CDK Global serves nearly 15,000 dealership locations, and the incident caused substantial disruption, forcing car dealerships to halt operations and revert to manual processes. Dealerships were initially notified about the incident around 2AM Eastern time on June 19, 2024, with an update at 8AM confirming the incident.

‍Determining and disclosing impactful events has been a longstanding practice for organizations operating within the US market. As early as 1933, with the Securities Act, publicly traded businesses were required to disclose “material information” regarding their security environment, allowing shareholders to make more informed investment decisions.

The create symbolic links user right determines the users ability to create a symbolic link within Windows from the device they’re logged on to. These links point to other files or folders, just like regular shortcuts, but works in a more advanced way. Symbolic links help maintain organization and flexibility while minimizing potential security risks by giving the ability to create a link in one folder that points to a file in a different folder, making it seem like the file exists in both places.

Enterprises are racing to adopt AI copilots and low-code/no-code platforms to innovate and maximize efficiency by placing powerful technology and development tools in the hands of all business users. While the productivity gains are enormous, so are the security risks, as the nature of these copilots and low-code platforms results in a surge of new business apps being created at the enterprise.

Your passwords should be at least 16 characters long. The longer your password is, the more secure it is. This is because of something known as password entropy which refers to how the combination of the characters that make up a password determines the strength of it. Password entropy considers the length and character variation of a password to calculate how difficult it would be for cybercriminals to crack or guess it.

Phishing is the weapon of choice for many adversaries. And it’s easy to understand why: Users fall victim to attacks in under 60 seconds on average, novice cybercriminals can launch effective phishing campaigns thanks to off-the-shelf phishing kits and generative AI, and above all, it works — 71% of organizations reported at least one successful attack in 2023.

Adversaries are increasingly attacking cloud environments, as evidenced by a 75% surge in cloud intrusions year-over-year in 2023. They are also getting faster: The fastest breakout time was clocked at just over 2 minutes, according to the CrowdStrike 2024 Global Threat Report. Today’s adversaries are outpacing legacy security approaches. Disjointed point solutions can’t scale or provide visibility into a rapidly growing attack surface.

In 2016, the Large Hadron Collider in Switzerland fell prey to a vicious and devastating attack.

(A thought from The Matrix: Neo likely used a SIEM before he took the red pill and could see the matrix without one...) One of the best ways to monitor security-related activities for your organization is to collect audit logs from every network device and analyze those logs for activities which violate acceptable behavior. This is precisely the role of a SIEM or Security Information and Event Manager. Let me simplify your life by providing some best practice suggestions for deploying and using a SIEM.