Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

In my previous blog, I covered the essentials of data sovereignty as a data protection concern for security professionals across domains. Data protection and digital trust will be paramount in the future due to data sovereignty and regulatory compliance mandates. As the Internet of Things (IoT) expands exponentially, the resultant security and privacy risk nexus further requires a holistic approach to data protection centered on both personal and enterprise data protection strategies.

The California Consumer Privacy Act (CCPA) is the first comprehensive California data privacy law granting consumers control over how their personal information is collected, used, and shared. It was enacted in 2018 and took effect on January 1, 2020, signaling a national shift in privacy regulations. With increasing emphasis on transparency and accountability, businesses must now adhere to a new standard in consumer data protection California.

On April 24, 2025, watchTowr published technical details and a proof-of-concept (PoC) exploit for a critical vulnerability in Commvault Command Center, CVE-2025-34028, which had been disclosed earlier in April. Commvault Command Center is a web-based interface used to manage data protection, backup, and recovery operations across enterprise environments.

A new report from Valimail has found that 50% of organizations lack effective protection against email spoofing. Specifically, many organizations have lenient DMARC policies that don’t actually prevent spoofing. DMARC (Domain-based Message Authentication, Reporting and Conformance) is an email authentication protocol that helps prevent attackers from spoofing organizations that have the protocol in place.

Recently, I received an email at work from a company with whom I've had previous interactions. The email lacked context and contained an attachment, immediately raising suspicion. I reported it to our infosec team using the Phish Alert Button (PAB). A short while later, our team confirmed it was indeed a malicious email. Subsequently, the sender organization informed us that they had been compromised, and phishing emails had been distributed from their account.