Beyond manual forensics: Booking.com's approach to orchestrating incident response

Sep 24, 2025 By Tines In Tines
Browser history can play a critical role in incident response, from helping analysts reconstruct user activity and validating alerts, to uncovering malicious behavior. But retrieving raw artifacts from endpoints is often slow, manual, and inconsistent. In this technical session, Ahmad Aziz, Security Engineer II at Booking.com, will share his winning entry from the 2024 “You Did WHAT?! With Tines” (YDWWT) competition: a fully automated workflow that pulls raw browser history artifacts from devices using CrowdStrike and prepares them for offline forensic analysis.
View Video
Trustwave

US Secret Service Blocks Massive Telecom Attack in New York

Sep 24, 2025 By Karl Sigler In Trustwave
The Secret Service’s takedown in New York shines a light on a type of threat that is technically fascinating and deeply concerning for national security: large-scale cellular interception networks leveraging cell-site simulators (CSS), also known as IMSI catchers or Stingrays. The news comes as New York City hosts the annual United Nations General Assembly, gathering heads of state from around the world and creating an incredibly target-rich environment for attackers.
Read Post
graylog

Compliance vs Security: The Business Value of Alignment

Sep 24, 2025 By Jeff Darrington In Graylog
Compliance is not, nor has it ever been, security. Compliance is the spellcheck of the security world. Security is the work that people do every day to implement, enforce, and monitor the controls that protect systems, networks, applications, devices, users, and data. Compliance is the process of reviewing security work to ensure that it functions as intended. Compliance is an important component of an organization’s security posture.
Read Post
cyberark

Sandworm in the supply chain: Lessons from the Shai-Hulud npm attack on developer and machine identities

Sep 24, 2025 By Andy Thompson In CyberArk
Do you know why Shai-Hulud should raise your hackles? Unless you’ve spent time on Arrakis in Frank Herbert’s Dune or the npm ecosystem this month, the name Shai-Hulud might not ring a bell. In Herbert’s world, Shai-Hulud is the colossal sandworm of Arrakis—feared, powerful, and destructive. In our world, I guess you could say the same thing. Shai-Hulud surfaced as a malware worm that tore through the npm software registry on Sept. 16–17, 2025.
Read Post
WatchGuard

Is your hybrid work as protected as you think?

Sep 24, 2025 By Iratxe Vazquez In WatchGuard
The hybrid working model has blurred the traditional limit of corporate networks. With users accessing critical resources from remote locations, unmanaged networks and personal devices, attack surfaces have increased exponentially. This demands a cutting-edge, comprehensive and adaptive approach to security. A recent example in January 2025 makes this clear: a vulnerability in SimpleHelp - a remote access tool - let attackers compromise corporate endpoints and move laterally across the network.
Read Post
appknox

Exposing iOS Local Storage Flaws: A Guide to Securing Sensitive Data

Sep 24, 2025 By Prudhvi Chaitanya Depuru In Appknox
Mobile apps often handle sensitive data daily, such as credentials, tokens, health records, financial information, and personal identifiers that attackers seek to exploit. On iOS, developers sometimes assume local data storage is inherently secure because of sandboxing and built-in Apple protections. This assumption is flawed. Poorly implemented storage practices can expose critical data, leading to severe privacy and security incidents. This article examines.
Read Post
nightfall

AI, Risk, and Enterprise Security: Highlights from a Discussion with Enrique Salem

Sep 24, 2025 By Chris Martinez In Nightfall
Key insights from a fireside chat between Nightfall CEO Rohan Sathe and cybersecurity veteran Enrique Salem, Partner at BCV and Nightfall investor Twenty years ago, enterprise security teams scrambled to address shadow IT as employees brought consumer applications into the workplace. Today, we're witnessing the same phenomenon with AI tools—what we now call shadow AI. The fundamental question remains unchanged: What happens to our data?
Read Post

When Firewalls Age Out: What the Akira Attack Can Teach Us About Lifecycle Security

Sep 24, 2025 By WatchGuard Technologies In WatchGuard
Cyberattacks evolve faster than aging infrastructure can keep up, and expired hardware is one of the biggest blind spots organizations face today. The recent Akira ransomware campaign targeting SonicWall VPNs is a powerful reminder of what happens when devices slip out of support.
View Video
Subscribe to Security

Copyright © 2026 OpsMatters™. All rights reserved.