Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

New data from cyber insurance underwriters shows what they think the biggest threats will be in 2024 and what organizations should do about it. Because insurance underwriters analyse lots of risk data to make decisions about insurance premiums and policies, it makes sense to hear their perspective on 2024’s outlook will be. According to insurer Woodruff Sawyer’s Cyber Looking Ahead Guide 2024, there’s some good news and some bad news.

Attackers are abusing Microsoft Teams to send phishing messages, according to researchers at AT&T Cybersecurity. “While most end users are well-acquainted with the dangers of traditional phishing attacks, such as those delivered via email or other media, a large proportion are likely unaware that Microsoft Teams chats could be a phishing vector,” the researchers write.

The emergence of innovative Financial Technology (FinTech) has spearheaded rapid growth in the digital payments sector. In recent years, global payment revenues exceeded valuations of $2.2 trillion, with a steady Compound Annual Growth Rate (CAGR) expected in the next five years. There is no denying the convenience benefits that the digital transformation of payments has brought consumers and businesses.

Nearly four years ago, the Department of Defense released the Cybersecurity Maturity Model Certification (CMMC). This was created as a complement to NIST SP 800-171, which focused on protecting Controlled Unclassified Information (CUI). If you are unfamiliar with what constitutes CUI, the simple way to think of it is to apply the broadest terms of privacy to any information that relates to any government relationship with a company.

On January 31st 2024, Snyk announced the discovery of four vulnerabilities in Kubernetes and Docker. For Kubernetes, the vulnerabilities are specific to the runc CRI. Successful exploitation allows an attacker to escape the container and gain access to the host operating system. To exploit these vulnerabilities, an attacker will need to control the Dockerfile when the containers are built.

A selection of this week’s more interesting vulnerability disclosures and cyber security news. Nasty local escalation flaw to patch…

The digital transformation of industrial landscapes has brought unprecedented advancements in efficiency and productivity for Operational Technology (OT) companies. But this surge in connectivity exposes critical infrastructure to heightened cybersecurity risks, such as: To address these risks, OT companies should adhere to the guidelines in the European Union’s Directive on Security of Network and Information Systems (NIS2).

Your one-stop shop for transparent cloud security information Elastic® knows that security and compliance requirements are mandatory for regulated and non-regulated customers alike. We strongly believe in providing clear and transparent information to earn your trust in Elastic as an organization and in the services we provide. Our Trust Center is a public one-stop shop for information on security, compliance, privacy, and resiliency for Elastic and the Elastic Cloud.

Many security vendors offer automated detection of cloud applications and services, classifying them into categories and exposing attributes such as security risk, compliance, company status etc. Users can then apply different security measures, including setting firewall, CASB and DLP policies, based on the apps categories and attributes. It makes sense to conclude that the more apps are classified, the merrier. However, such a conclusion must be taken with a grain of salt.

American college athletics is a foundational pillar of higher education institutions and a profitable business model for universities. The National Collegiate Athletic Association (NCAA), which regulates college athletics, reported that in 2020, Division I schools earned $15.7 billion in athletics revenue. In 2023, NCAA Division I school Ohio State University reported a record-breaking revenue of over $275 million from its athletic department alone.