Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Cloud storage misconfigurations continue to become more prevalent and problematic for organizations as they expand their cloud infrastructure, driving the importance of technologies such as cloud security posture management (CSPM) as crucial tools for protectors everywhere. Consider the recently reported public exposure of data associated with some Microsoft customers and prospects.

Multi-factor authentication adoption is booming. Regulatory pressures from different global initiatives, combined with companies making it a prerequisite to use their services and the rise in implementing the zero-trust model, have increased spending on this solution. The MFA market is estimated to be worth $12.9 billion and is expected to reach $26.7 billion by 2027, with an annual growth rate of 15.6% from 2022 to 2027.

Cybersecurity is at the forefront as technology sees increasing adoption across multiple industry verticals. Organizations must prevent and fight cyber crime, but it can take over 200 days to detect a breach for many. This time frame increases the possible consequences of the breach and gives cybercriminals an opportunity to move laterally to other systems and exfiltrate the information they need. Once stolen, they may sell it to other cybercriminals who can use it for more nefarious means.

During our recent webinar hosted by Device Authority’s Tyler Gannon and Imagination Technologies Marc Canel (Does new IoT security legislation make Zero Trust the only strategy?). We ran a poll asking attendees about their understanding of SBOM; one of the options was “SBOMs are a roadmap to the attacker”.

Many security engineers have woken up to dozens of Slack messages and emails telling them the day they dreaded is here: a vulnerability has been deployed, and now it must be fixed. Meetings and plans are abandoned while security engineers rush to fix the problem. It’s often a process failure that has led to the now-urgent issue. And these emergency issues can appear across a spectrum that includes all types of remediation efforts.

The awaited OpenSSL 3.0.7 patch was released on Nov. 1. The OpenSSL Project team announced two HIGH severity vulnerabilities (CVE-2022-3602, CVE-2022-3786), which affect all OpenSSL v3 versions up to 3.0.6. These vulnerabilities are remediated in version 3.0.7, which was released Nov. 1. The vulnerabilities fixed include two stack-based buffer overflows in the name constraint checking portion of X.509 certificate verification.

For far too long, the cybersecurity industry has subscribed to a flawed methodology — one that is based on the notion that organizations can avoid security threats through obscurity and secrecy. The assumption is that keeping security controls and processes covert makes products and data inherently more secure against cyber threats within the networks we defend. However, even the most sophisticated cybersecurity defenses are no match for well-funded, highly motivated adversaries.

Artificial Intelligence (AI) is a trending topic for many industries now. A variety of organizations currently employ AI mechanisms to support their operational functions. Automated tasks, natural language processing, deep learning, and problem-solving; such AI characteristics have made business tasks much easier. The factor of security in AI is largely overlooked, and with the increasing number of cyber threats and attacks, AI security serves as a crucial element that should be paid attention to.