Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Out of the over 350 brands regularly impersonated in phishing attacks, Microsoft continues to stand out because they provide attackers with one unique advantage over other brands. The whole idea behind impersonation is to establish the illusion of legitimacy for a phishing email. This lowers the “defenses” of the email recipient, allowing social engineering tactics to take effect and to get the victim to interact with the email.

Establishing urgency through a false need to “upgrade” or lose services, this new attack takes advantage of the widespread use of the popular accounting app to attract victims. Impersonation in phishing attacks only works if the target has an established rapport or relationship with the sender.

The United States FBI, NSA, and CISA have released a joint report outlining the various social engineering threats posed by deepfakes. “Threats from synthetic media, such as deepfakes, present a growing challenge for all users of modern technology and communications, including National Security Systems (NSS), the Department of Defense (DoD), the Defense Industrial Base (DIB), and national critical infrastructure owners and operators,” the report says.

A malwareless and linkless phishing attack uses sextortion and the threat of legal action to get the attention of potential victims and get them to respond. Usually, the intent of a phishing attack is evident. For example, if the attack is pretending to be Microsoft and sends you to a spoofed login page, the whole point of the attack is to harvest the victim’s Microsoft 365 credentials.

A new report takes an exhaustive look at how cybersecurity professionals see the current and future state of attacks, and how well vendors are keeping up. The role of artificial intelligence (AI) in cyber attacks and cyber defenses can be pretty confusing.

The Top 250 MSSPs honorees were announced in a live webcast on September 14. Key findings include: Sedara was ranked among among the Top 250 MSSPs for 2023.

The Security Operations Center (SOC) plays a critical role in reducing cyber risk. Successful management of a SOC, however, is a team effort that requires the combined expertise of entry-level (tier 1), mid-level (tier 2), and senior-level (tier 3) analysts. In this piece, we break down the key differences of the three analyst tiers, offer tips for each tier, and provide universal advice to help you succeed in your SOC career.

India’s new Digital Personal Data Protection Act, 2023 (DPDP Act) was given assent by the President of India on August 11, 2023, marking a significant development in data protection legislation. This Act, which supersedes Section 43A of the IT Act, 2000 and the SPDI Rules, 2011, brings about considerable changes to the norms of data protection. The DPDP Act is lean and principle-based, with details around implementation to be set out in future rules.

Latest cloud security statistics reveal that 91% of all organizations have some portion of their IT environment hosted in cloud platforms. While cloud computing comes with many benefits, companies have trouble scaling up the security to meet the data and privacy challenges posed by it.

Modern web applications are complex, often loading JavaScript libraries from tens of different sources and submitting data to just as many. This leads to a vast attack surface area and many attack types that hackers may leverage to target the user browser directly. Magecart, a category of supply chain attack, is a good example.