Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

SIEMs play a crucial role in the modern SOC: They allow you to collect, correlate and analyze log data and alerts for security and compliance. Yet, despite their value, SIEMs have struggled to keep up with today’s logging performance and scalability requirements. Given that adversaries are operating faster than ever, organizations must prioritize the capabilities that help them identify and respond to threats quickly.

Arctic Wolf’s The State of Cybersecurity: 2023 Trends report revealed a painful, yet unsurprising statistic: 68% of organizations identified staffing-related issues as their number one threat to achieving their security objectives. Breaking that down further, 32% of organizations are having difficulty with hiring and retaining staff. The remaining 36% feel their existing security team lacks the necessary expertise.

On June 23, 2023, Fortinet disclosed a critical Remote Code Execution (RCE) vulnerability (CVE-2023-33299) affecting FortiNAC, a network access control solution utilized by organizations to manage network access policies and compliance. This vulnerability is the result of the deserialization of untrusted data. Deserialization vulnerabilities such as this one are dangerous because a threat actor can insert a modified serialized object into the system which leads to unauthenticated RCE.

Open source Velero is a popular choice amongst Kubernetes community for backup of their application. Along with scheduling regular backups for your Kubernetes clusters, monitoring Velero and getting automated alerts for failed Velero backups is also important. When your most important backup fails, you want to know about it immediately and make sure your application notifies you.

Recently, a critical vulnerability tracked as CVE-2023-27997 was identified in Fortinet Fortigate appliances. Fortinet makes some of the most popular firewall and VPN devices on the market, which makes them an attractive target for threat actors. This vulnerability has been exploited by the Chinese APT group Volt Typhoon, among others, targeting governments and organizations worldwide. As a result, Fortinet has released an urgent patch for affected systems.

Cybercriminals make use of sophisticated tactics to craft convincing spear phishing attacks, and consequently, organizations need a solid understanding of the evolving cyber threat landscape to combat them. Spear phishing is a form of phishing where cybercriminals use highly targeted emails to deceive individuals into revealing sensitive data or transferring funds. 65% of all known hacking groups use spear phishing, making it the most popular form of attack.

Mobile phones have become an indispensable tool in all our lives. Ensuring their security and protecting sensitive information becomes paramount, especially when you have all your work-related apps and data synced. Every 39 seconds, a new assault occurs on the internet, and 24,000 malicious mobile apps are typically blocked everyday.

As the cybercrime industry continues to provide us with new Malware as a Service (MaaS) products, we have become used to seeing the operators advertising and developing the panels underground. Over the past year, an allegedly legitimate software company named Venom Control Software emerged, offering a Remote-Access-Tool (RAT) for “hackers and pen-testers”.

A selection of this week’s more interesting vulnerability disclosures and cyber security news. For a daily selection see our twitter feed at #ionCube24. More woe for Reddit. Which side is telling the truth? I’m sure it all be revealed in time.

In a recent poll we conducted, two thirds of respondents shared they were unaware of the MITRE ATT&CK Framework or were only beginning to understand what it can provide. When used correctly, MITRE ATT&CK can significantly help organizations bolster their security posture. In this blog post, we explain how security teams can leverage MITRE ATT&CK and how Cato Networks’ SASE can help.