When it comes to securing the manufacturing sector, the consensus is that these organizations should focus on securing their operational technology (OT) from cyberattacks, but this isn’t the full picture. Trustwave SpiderLabs researchers found that the average cybercriminal group would rather target conventional IT environments in manufacturing.
The dark web, often shrouded in mystery and intrigue, is a realm of the internet that exists beyond the reach of traditional search engines. While the Dark Web does harbor a certain notoriety for hosting illegal activities, it also contains valuable information and resources that can be beneficial for professionals involved in cybersecurity, threat intelligence, and investigations.
For starters, it’s no surprise that the findings revealed that organizations’ most prominent threats during 2023 are vulnerabilities not covered by common disclosure processes, like CVEs. Detectify CEO Rickard Carlsson has been talking about this for some time – his article on the trouble with CVEs and vulnerability management in modern tech stacks demonstrates the risks associated with an overly reliant approach to established methods.
Earlier this year, the SEC proposed a new set of rules on cybersecurity governance, which would require public companies to make appropriate disclosures of cyber risks and management procedures. Although the amendments target the financial sector, it is one more evidence of the fact that cybersecurity is no longer a backburner component of business operations. It is a critical factor that can determine the destiny of all kinds of organizations, large or small.
Applications frequently need to provide authentication credentials to gain access to cloud services and other resources. However, these credentials present a security risk because they are notoriously difficult to keep out of code. According to a GitGuardian report, 10 million credentials were publicly committed to GitHub in 2022. Leaked credentials such as these are a major cause of data breaches and account takeovers.
No matter the size of your business, there are assets and data you have on your premises that you need to keep secure from people outside of your organisation. Whether it’s hard copies of personnel data, server rooms, or safety-critical infrastructure, that information, or how to gain access to that information will likely have some value to bad actors willing to use or exploit it.
At Pentest People, we're committed to providing a seamless, efficient, and effective platform for managing your penetration test results. We continually strive to improve upon our offerings, and in this vein, we're excited to announce some significant changes to how reports on SecurePortal are presented and how data can be exported.
IT pros need local admin rights on corporate devices to install software, modify configuration settings, perform troubleshooting and so on. But all too often, business users are also routinely granted local admin rights on their computers.
