Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Working in the Electric Utility sector of critical infrastructure gives a person a very unique perspective on how many of the pieces of the puzzle fit together to provide uninterrupted services to a broad population. My personal experience as a software engineer in the electrical industry introduced me to the nuances that the average person doesn’t consider when they flip on a light switch. When I moved into the cybersecurity space, an entirely new realm was opened up.

A data breach occurs when sensitive data is copied, transmitted, viewed, stolen, or accessed by an unauthorized individual. For a security incident to constitute a data breach, the exposure of sensitive data must be intentional. The presence of intent differentiates a data breach from a data leak, where exposure is accidental. A data leak occurs when data is accidentally exposed through a vulnerability, such as weak passwords.

The JFrog Security Research team is constantly looking for new and previously unknown software vulnerabilities in popular open-source projects to help improve their security posture. As part of this effort, we recently discovered a denial of service (DoS) vulnerability in Envoy Proxy, a widely used open-source edge and service proxy server, designed for cloud-native applications and high traffic websites.

Verizon’s Data Breach Investigation Report for 2022 (DBIR) was recently released and it has some good news and it has some bad news when it comes to the risk of insider attacks. First the good news, sort of. According to the DBIR, the vast majority of breaches continue to come from external actors (80% vs 18% of insiders). Hopefully we can be a little less suspicious of Bob who sits two offices down from you. However when an insider attack happens, it can be really, really destructive.

Whether you’re a compliance expert or a novice, adhering to data privacy laws confuses even the best of companies. One of the key points of confusion is the fact that you can’t possibly comply with current and future laws without knowing what data you collect, where it goes, and how it’s used and retained. It sounds simple, but it is not. In fact, it’s a challenge that applies to nearly every organization today.