Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Silicon Valley Bank (SVB) experienced a rapid implosion last week after a historic bank run. While many are discussing the immediate financial impacts to the bank accounts — which were largely held by venture capitalists, investors, and technology business owners — and the larger impact on banking in general, it’s important to note that there will be a secondary impact. Hackers and scammers are going to take advantage of the confusion to launch a barrage of social engineering attacks.

When cybersecurity experts speak about a cyber attack, they often refer to actions taken “left of boom” and “right of boom.” In this analogy, the boom is the breach, and the actions organizations take in the aftermath, such as utilizing their incident response plan or working with their cyber insurance company on a claim, are what happens “right of boom.” But it’s the things that happen “left of boom” that can make the difference between proactive and

On Friday, March 10, 2023, California state regulators took possession of Silicon Valley Bank (SVB) and appointed The Federal Deposit Insurance Corporation (FDIC) as receivers. SVB was a 40-year-old commercial bank that was an important lender for the tech and venture capital sector. It’s estimated that half of US venture-backed start-ups were customers of the bank.

On Tuesday, March 7, 2023, Fortinet published a security advisory detailing an unauthenticated remote code execution vulnerability affecting FortiOS and FortiProxy (CVE-2023-25610). The vulnerability was internally discovered by Fortinet, and exploitation has not been observed in the wild at this time. A proof of concept (PoC) exploit has not been published publicly for this vulnerability at this time.

As cybercrime continues to grow and organizations digitize, understanding cybersecurity and how to improve one’s security posture becomes paramount. Unfortunately, the firewall has dissolved and tools alone, though helpful, can’t protect environments when public sector organizations are understaffed, underfunded, and struggling to maintain compliance.

On February 14, 2023, Microsoft released a security advisory for CVE-2023-21716, a critical remote code execution vulnerability in Microsoft Word. While CVE-2023-21716 was deemed to be of critical severity, Microsoft assessed at the time of publication that the vulnerability was “less likely” to be exploited, and no proof-of-concept exploit was available. Microsoft also noted that the vulnerability may be exploited through the Preview Pane in Microsoft Outlook.

It’s been three years since the California Consumer Privacy Act (CCPA) came into effect, marking improved security and data privacy for individuals both inside and outside of California. However, just because the law has been in effect, it doesn’t mean that all organizations are actively complying with the statutes.

It may be the shortest month, but February brought no shortage of bad behavior by cybercriminals. In our latest cyber attack roundup of the ever-thriving world of cybercrime, we look at a disturbing theft from one of the United States’ most secretive government organizations, a long-running ransomware tie-up for a major media company, a never-ending nightmare for a security-minded internet company, and the latest of many breaches for one of the backbones of the modern web.

$11.5 trillion. That’s the amount predicted global cybercrime will cost in 2023. As cyber attacks continue to evolve, becoming more damaging and more devious, organizations are desperate for comprehensive, proactive solutions. For many, that means a security operations center (SOC).

On Wednesday, March 1, 2023, Cisco published an advisory of a critical severity vulnerability impacting 6800, 7800, and 8800 series IP phones. The vulnerability allows for unauthenticated execution of arbitrary code. The vulnerability was responsibly disclosed to Cisco by a security researcher, and security patches are available to remediate the vulnerability.