Let’s catch up on the more interesting vulnerability disclosures and cyber security news gathered from articles across the web this week. This is what we have been reading about on our coffee break! Ah, so you’ve seen those random shops that pop up on unrelated domains?

On May 6, 2024, Bishop Fox publicly disclosed a vulnerability along with a proof of concept (PoC) exploit in Citrix NetScaler ADC and Gateway, identified as an unauthenticated out-of-bounds memory read issue in the components used for Authentication, Authorization, and Auditing (AAA).

If you need to reach PCI DSS 4.0 compliance, GitGuardian has solutions that can help.

On May 8, 2024, Ascension Healthcare notified business partners of suspicious activity detected within their systems. They have launched investigations and are actively working on remediation efforts. Consequently, some systems will experience interruptions during this process, such as clinical operations. Ascension is currently working with Mandiant to investigate the compromise and whether sensitive data was affected, if at all.

The highly competitive digital setting that we have today requires modern software applications to serve as the foundation of business operations, communication, and service innovation. However, this agility has some risks since outsourcing part of application development to external tools and libraries implies that the organization can unintentionally introduce vulnerabilities that cybercriminals can use against them.

Why have forty-four percent of enterprises been fined by regulators due to API security incidents? Regulators are beginning to see what attackers already know: exposed or misconfigured APIs are prevalent, easy to compromise, and often unprotected. Every time a customer, partner, or vendor engages with your business digitally, there’s an API behind the scenes facilitating a rapid exchange of data, often sensitive.

Privilege escalation in AWS refers to the unauthorized elevation of user privileges within the AWS environment, allowing users to access resources and perform actions beyond their intended level of permissions. This security risk would arise in case the attackers utilize the vulnerabilities or misconfigurations in AWS services, IAM policies, or access controls to take up privileges above the current level.

Trust and transparency are key to winning customers today. Customers and prospects of all sizes need to know how you’ll protect their data before they can do business with you — which often leads to lengthy questionnaires, long security reviews, and stretched sales cycles as they work to understand your security posture.

The massive increase in cloud adoption has driven adversaries to focus their efforts on cloud environments — a shift that led to cloud intrusions increasing by 75% in 2023, emphasizing the need for stronger cloud security. Larger scale leads to larger risk. As organizations increase their quantity of cloud assets, their attack surface grows. Each asset brings its own set of security concerns.

Device Authority, an award-winning and recognized global leader in Identity and Access Management (IAM) for Enterprise IoT ecosystems has appointed Richard Seward as Vice President of Product Management to drive forward the company’s growing portfolio of innovative products under its KeyScaler platform.