Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Rego, the policy language of the Open Policy Agent (OPA), is known for its flexibility and power in policy enforcement across various systems. Its declarative syntax and data-centric approach make it versatile for application authorization, infrastructure as code (IaC) authorization, and network policies. To fully appreciate OPA/Rego’s capabilities, it’s helpful to compare it with other policy languages and frameworks like AWS’s Cedar and Google’s Zanzibar.

Data security is evolving. This evolution is making the need to understand what is going on with your data more critical. Teams need to be able to answer questions like, where is data being stored? Which vendor or team is using it? When is sensitive data being used? Where is data being sent?

Mergers and acquisitions often sound amazing to the Board, but they can become an operational nightmare for the infrastructure, networking, and security teams. In recent years, I’ve worked with a fair few highly acquisitive organisations and so I have seen firsthand that the practical steps to onboard new users can become hugely challenging–especially when the two organisations are running different technologies.

With our new connect flows you can create credentials with less friction. As you build, easily connect flows for 50+ products (with more being added all the time). We also added some neat ways to restrict credentials by URL path or send email action. Login and see →

The content of this post is solely the responsibility of the author. LevelBlue does not adopt or endorse any of the views, positions, or information provided by the author in this article. As the world becomes increasingly digital, our online lives have become an extension of our physical selves. We share our thoughts and experiences through social media, communicate through messaging apps, keep our money online, and store precious memories and documents in the cloud.

The definition of Artificial Intelligence (AI) has been thrown around whilst it has risen to the top of the tech agenda over the past couple of years. Security professionals have determined AI to be a risk to businesses, and also an opportunity. But could it also be a way to better defend your network against attacks? For many years, AI and Machine Learning have gone hand in hand; with AI used to better determine defensive decisions and cut down on the human element in more basic functions.

Two positive steps were taken last month to limit the damage caused by phishing and Business Email Compromise (BEC) attacks when a joint action by UK and EU law enforcement agencies compromised the infrastructure of the phishing-as-a-service operation LabHost and a major BEC operator was convicted in US Federal Court. While law enforcement operations are integral to defeating cybercrime, disrupting one or two adversary groups does not minimize the threat.

Last week’s release of OpenAI’s GPT-4o, along with the story around Slack’s AI training policy, goes to show that AI innovation is happening at a rate where, for most companies, security simply can’t keep up.

Access control in backend Node.js applications is fundamental to web applications built with the Express web framework. It ensures users can access only the data and functionality they're authorized to use. However, when access control is compromised, users can access data that they shouldn't be able to. This is especially problematic if attackers attempt to manipulate or steal private data.

As a security professional, you know that the ability to swiftly and effectively respond to threats is crucial. In this post, we’ll explore how LimaCharlie, a SecOps Cloud Platform, can help automate comprehensive Incident Response (IR) workflows, including forensic triage acquisition, evidence processing, and forensic timeline generation.