Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

In a guest blog post, Aaron Jewitt, Principal Detection Engineer at Elastic, walks us through a Tines workflow he built to improve the efficiency of his team's automated alert triage processes. He recently shared how his InfoSec team uses Tines to automate alert triage over on Elastic's blog, which makes a great companion piece to this post.

The platform approach in cybersecurity is gaining traction. However, it’s becoming clear that two very different models of platformization are in play. In this piece, we’ll talk about platformization in cybersecurity, the two major approaches to security platforms, and what it all means for the future of cybersecurity.

Developers simply want to write code without interruption, while operations wish to build as fast as possible and deploy without restrictions. On the other hand, security professionals want to protect every step of the software supply chain from any potential security threats and vulnerabilities. In software development, every piece of code can potentially introduce vulnerabilities into the software supply chain.

Remote work and bring-your-own-device (BYOD) culture have made mobile devices a permanent part of our work lives. In today’s professional world, mobile devices can do basically everything a laptop or desktop can do — including get phished. Mobile devices are increasingly the starting point of the modern kill chain, and mobile phishing plays an important role in the process. Understanding how threat actors attack mobile devices is the first step to keeping data and devices secure. ‍

Cloud breaches continue to rise unabated as organizations adopt hybrid cloud strategies. Many organizations have tried to simply extend their preexisting on-premises security into the cloud, but the cloud is a fundamentally different environment for security. It’s faster, more complex, and more dynamic, with an ever-increasing attack surface. Striking first means adversaries have a head start by default, leaving organizations only a fraction of time to investigate and initiate a response.

With cybercrime costs projected to hit $10.5 trillion by 2025, securing digital assets is more critical than ever. Black box testing in security has become a key strategy for organizations to identify vulnerabilities in software and systems proactively. This blog delves into the essential role of black box security testing in mitigating risks along with its various types and techniques.

To qualify for cybersecurity insurance, organizations must implement strong access controls, have an incident response plan, use Multi-Factor Authentication (MFA), provide employees with security training, regularly perform penetration tests and use encryption to protect sensitive data. Continue reading to learn more about the six cyber insurance requirements and how your organization can meet them.

Over the years, several security defense architectures have merged into a single solution. Endpoint detection tools can perform sophisticated detections and correlations that used to require a Network Intrusion Detection System (NIDS), Web Proxy, and SIEM. Application Firewalls often provide features like Proxy, antivirus, and NIDS, and now we have Secure Access Service Edge (SASE), which promises to be the next multi-tool security solution. Let’s give SASE a closer look.

Summer is a time for relaxation, travel, and spending quality moments with family and friends. However, it is also peak season for cybercriminals who exploit the vulnerabilities that arise during this period. Cyberattacks surge during the summer holiday season as businesses and individuals let their guard down. Many companies operate with reduced staff as employees take time off, leaving fewer eyes on critical systems and security measures.

Security incidents and data breaches are the cybersecurity version of the definition of squares and rectangles in geometry. While all data breaches are security incidents, not all security incidents are data breaches. Before investigating an incident, many security teams know whether the alert will relate to a minor incident or a large-scale breach.