Dateline
Ukraine at D+419: GRU cyber ops scrutinized. (CyberWire) Much dissection of current Russian cyber operations, even as Ukraine receives essential weapons and prepares its (kinetic) counteroffensive.
Russia 'preparing to retreat' from parts of Kherson (The Telegraph) Russia appears to be preparing a retreat from some areas of Kherson, a Ukraine military spokeswoman said on Tuesday.
‘It was scary’: acts of resistance in Russian-occupied Kherson (the Guardian) Risky actions of Ukraine’s secretive grassroots Yellow Ribbon movement recalled in Brussels exhibition
Ukraine official: We will launch counteroffensive when ready (AP NEWS) A top Ukrainian official says that Ukraine will launch its counteroffensive against Russian troops when the country is ready. The secretary of Ukraine’s National Security and Defense Council told The Associated Press in an interview in Kyiv on Monday that it’s only a matter of time before Ukraine achieves the necessary level of military preparedness to do so. Oleksiy Danilov also expressed frustration that sometimes officials from allied countries “promise one thing and do a completely different one.” He didn't elaborate.
Ukraine awaits Patriot air defense systems as deadly Russian strikes continue (PBS NewsHour) The death toll from Russian missile strikes on eastern Ukraine's city of Sloviansk rose to 11 Saturday as rescue crews tried to reach people trapped in the rubble of an apartment building, Ukrainian authorities said.
Russia-Ukraine war live: Kyiv receives Patriot missile systems from US and Germany (the Guardian) Ukraine defence minister said he had first lobbied for the Patriots in August 2021, before the invasion
Former senior diplomats urge west to ‘go all in’ on military support for Ukraine (the Guardian) Group also made up of former high-level military advisers say ‘actions still fail to match the rhetoric’
Two Russians claiming to be former Wagner commanders admit killing children and civilians in Ukraine (CNN) Two Russian men who claim to be former Wagner Group commanders have told a human rights activist that they killed children and civilians during their time in Ukraine.
‘I do not regret a thing’: Wagner fighter admits torturing Ukrainian troops and PoWs (the Guardian) Former convict tells of torturing troops and says he does ‘not regret a single thing’
Russia’s Ukraine invasion is the latest stage in the unfinished Soviet collapse (Atlantic Council) Vladimir Putin's full-scale invasion of Ukraine is best understood as the latest stage in the unfinished collapse of the Soviet Union and as part of Russia's historic retreat from empire, argues Richard Cashman.
Don’t Dismiss Non-Western Efforts to End the War in Ukraine (World Politics Review) While in China, Brazilian President Lula talked up the idea of a non-Western coalition leading peace talks to end the Russia-Ukraine War.
Air Force unit in document leaks case loses intel mission (AP NEWS) The Air Force says it is investigating how a lone airman could access and distribute possibly hundreds of highly classified documents, and in the meantime has taken away the intelligence mission from the unit where the leaks took place. Air Force Secretary Frank Kendall told a congressional panel he directed the Air Force inspector general to go look at the Massachusetts Air National Guard base where Airman 1st Class Jack Teixeira served and determine what went wrong to allow such highly classified secrets to be leaked onto an online chat forum popular with gamers.
Pentagon Details Review of Policies for Handling Classified Information (New York Times) The Air Force also announced actions focused on security protocols following the arrest of an Air National Guardsman accused of posting classified documents online.
Kendall Promises ‘Full-Court Press’ Security Review After Intel Leak (Air & Space Forces Magazine) Air Force Secretary Frank Kendall said the department will conduct a security review after an intel leak allegedly involving an Airman.
Air Force Launches Investigation of Teixeira's Guard Unit After Leak Arrest (Military.com) The Department of the Air Force's review is in addition to the one the Pentagon announced following Teixeira's arrest
Russia tests secretive weapon to target SpaceX’s Starlink in Ukraine (Washington Post) THE DISCORD LEAKS | Moscow’s bid to sever Ukrainian forces’ internet access is more sophisticated than previously known, leaked document shows
Russia-Tied Hackers Target Key UK Sectors, Top Official Warns (Bloomberg) UK official to call for tougher cyber rules for key sectors. Hackers tied to Russia have been targeting UK businesses.
Russia-linked cyber attack groups want to 'destroy' UK, minister warns (Sky News) Firms have urged to beef up their cyber security to protect the country from "ideologically motivated, rather than financially motivated" enemies who have started to target the UK.
NCSC-UK, NSA, and Partners Advise about APT28 Exploitation of Cisco Routers (National Security Agency/Central Security Service) The National Security Agency (NSA) has partnered with the UK’s National Cyber Security Centre (NCSC), the Federal Bureau of Investigation (FBI), and the Cybersecurity and Infrastructure Security
APT28 exploits known vulnerability to carry out reconnaissance and deploy malware on Cisco routers (NCSC) APT28 accesses poorly maintained Cisco routers and deploys malware on unpatched devices using CVE-2017-6742.
State-sponsored campaigns target global network infrastructure (Cisco Talos Blog) This campaign, dubbed "Jaguar Tooth," is an example of a much broader trend of sophisticated adversaries targeting networking infrastructure to advance espionage objectives or pre-position for future destructive activity.
US, UK warn of govt hackers using custom malware on Cisco routers (BleepingComputer) The US, UK, and Cisco are warning of Russian state-sponsored APT28 hackers deploying a custom malware named 'Jaguar Tooth' on Cisco IOS routers, allowing unauthenticated access to the device.
Patched holes in Cisco routers have been used by Russians for years: Report (IT World Canada) Russian government attackers have been exploiting unpatched and badly-configured Cisco Systems routers since 2021, according to an alert from U.S. and U.K. cybersecurity agencies. The vulnerabilities, which were publicized and patched in 2017, are in the Simple Network Management Protocol (SNMP) subsystem of Cisco's IOS and IOS XE Software. They could allow an authenticated remote
Cisco warns of attacks on network routers, firewalls (Network World) Cisco's Talos intelligence group's warning follows a UK notice about increasing exploits against perimeter-based networking equipment.
Ukraine remains Russia’s biggest cyber focus in 2023 (Google) Google's Threat Analysis Group shares first quarter cyber updates on the threat landscape from the war in Ukraine.
Fog of War: How the Ukraine Conflict Transformed the Cyber Threat Landscape (Google Threat Analysis Group) One year after the Russian invasion of Ukraine, Google TAG, Mandiant, and Trust & Safety provide insights into changes in the cyber threat landscape triggered by the war.
M-Trends 2023: Cybersecurity Insights From the Frontlines (Mandiant) We are excited to release M-Trends 2023, our comprehensive report from the frontlines of incident response.
Faltering against Ukraine, Russian hackers resort to ransomware: Researchers (Breaking Defense) Both the quantity and quality of Russian attacks appear to be falling off, and the global cybersecurity picture is looking brighter, reports Google Cloud’s Mandiant branch.
Putin threatens Europe with fresh gas crisis (The Telegraph) Fears over a new surge in prices as Russia's Gazprom warns over winter supplies
Ukrainian victory “could help ensure Europe’s future energy security” (Atlantic Council) Ukraine has massive potential to increase domestic energy production and could eventually replace Russian energy exports to the European Union in the post-war era, says Naftogaz CEO Oleksiy Chernyshov.
Vladimir Kara-Murza’s 25-year sentence is a verdict against all Russians (Atlantic Council) Vladimir Kara-Murza's 25-year prison sentence for speaking the truth about the invasion of Ukraine is a major milestone in modern Russia's descent into Stalinism, says former Ukrainian PM Arseniy Yatsenyuk.
Attacks, Threats, and Vulnerabilities
Chinese group Vixen Panda suspected of recent cyberattack on Slovenian Foreign Ministry (teiss) Chinese hacker group Vixen Panda (also known as APT15 group), one of the most active and skilled cyber espionage groups, is suspected of the recent cyberattack on Slovenian Foreign Ministry.
Deceptive ‘Vibranced’ npm Package Discovered Masquerading as Popular ‘Colors’ Package (Mend) A new malicious package named 'Vibranced' has been detected on the Node Package Manager (npm) repository and poses a significant threat to users who may unknowingly install it. The package has been carefully crafted to mimic the popular ‘colors’ package.
LockBit for Mac | How Real is the Risk of macOS Ransomware? (SentinelOne) Discovery of a macOS variant of LockBit has caused alarm, but how serious a threat is it? We explore the malware and the threat of ransomware on Apple Macs.
What Makes Invalid Printer Loader so Stealthy? (Morphisec Breach Prevention Blog) The Aurora stealer is a notorious Golang-based information stealer that's been gaining popularity from the end of 2022 through the first quarter of 2023. The Morphisec Threat Labs team has been tracing its activities using our prevention telemetry...
YouTube Videos Distributing Aurora Stealer Malware via Highly Evasive Loader (The Hacker News) A new report has revealed the advanced techniques used by threat actors to deliver the Aurora information stealer malware through the in2al5d p3in4er
Detecting the Use of Stolen AWS Lambda Credentials (Secureworks) Secureworks® Counter Threat Unit™ (CTU) researchers have developed a technique using AWS CloudTrail to detect the use of stolen credentials.
#BrokenSesame: Accidental ‘write’ permissions to private registry allowed potential RCE to Alibaba Cloud Database Services (Wiz Blog) A container escape vulnerability, combined with accidental 'write' permissions to a private registry, opened a backdoor for Wiz Research to access Alibaba Cloud databases and potentially compromise its services through a supply-chain attack
Giving a Face to the Malware Proxy Service ‘Faceless’ (KrebsOnSecurity) For the past seven years, a malware-based proxy service known as "Faceless" has sold anonymity to countless cybercriminals. For less than a dollar per day, Faceless customers can route their malicious traffic through tens of thousands of compromised systems advertised…
NSO hacked iPhones without user clicks in 3 new ways, researchers say (Washington Post) Examination of phones from Mexico led to the discoveries
Discarded, not destroyed: Old routers reveal corporate secrets | WeLiveSecurity (WeLiveSecurity) Secondary market core routers are often not wiped clean and are replete with sensitive, even confidential, data, according to ESET research.
Used Routers Often Come Loaded With Corporate Secrets (WIRED) More than half of the enterprise routers researchers bought secondhand hadn’t been wiped, exposing sensitive info like login credentials and customer data.
in2al5d p3in4er is Almost Completely Undetectable (Morphisec) in2al5d p3in4er is a highly evasive new loader that has a detection ratio of 0 on VirusTotal. We explain how it works, and how to prevent it.
Black Basta claims it's selling off stolen Capita data (Register) No worries, outsourcer only handles government tech contracts worth billions
Hundreds of Southwest Airlines flights are delayed after FAA lifts nationwide ground stop (CNN) Hundreds of Southwest Airlines flights were delayed after technical issues that prompted the airline to temporarily halt its operations on Tuesday morning.
Southeastern University Faces Questions About a Possible Data Breach Following Cybersecurity Incident | JD Supra (JD Supra) In February 2023, reports began to surface that Southeastern University (“Southeastern”) experienced a cybersecurity incident following comments made...
DC Health Link data breach blamed on human error (ABC News) The recent data breach of personal information for thousands of users of Washington, DC....
Personal info tied to 17 House members, 585 staffers leaked in D.C. health insurance breach (Axios) DC Health Link's executive director will tell a House committee that a misconfigured cloud server is to blame.
Scammer targets state employees with phony attorney general emails (NorthJersey.com) Workers were targeted by a phishing scam that used emails cleverly disguised with a domain name matching that of the Attorney General's Office.
Cyber Attack Closes Down Gateway’s 14 Ontario Casinos (VegasSlotsOnline News) After a cyber attack, 14 Gateway casinos in Ontario, including those in London and Thunder Bay, will remain closed for some days.
No evidence found of Little Rock School District data use (Arkansas Online) The Little Rock School District, a victim of a 2022 data security attack, is telling its past and present employees, student families and vendors that there is no evidence that their personal data has been "viewed, used or misused."
Data breach concerns ahead of Gloucester cyber attack report (BBC News) Hackers linked to Russia are understood to be responsible for the attack on Gloucester City Council.
Trends
KnowBe4 Phishing Test Results Reveal IT and Online Services Emails Drive Dangerous Attack Trend (KnowBe4) KnowBe4 Phishing Test Results Reveal IT and Online Services Emails Drive Dangerous Attack Trend
60% Increase in Ransomware Attacks: March 2023 Sees Highest Victim Count in Two Years (Corvus Insurance) Ransomware is up 60% from this time last year, and 141% from two years ago. Here's what you need to know.
Aryaka Network Transformation Report: The Age of SASE and Network-as-a-Service is Upon Us (PR Newswire) Aryaka®, the leader in Unified SASE solutions, today released its annual Enterprise Network Transformation report, outlining key trends in the...
Netwrix Annual Security Survey: 68% of Organizations Experienced a Cyberattack within the Last 12 Months (Netwrix) The most common consequences were unplanned expenses, loss of competitive edge, and decreased sales.
2023 Hybrid Security Trends Report (Netwrix) To track the evolution of IT security both on premises and in the cloud, Netwrix surveyed 1,610 IT pros, and compared the results to its reports from 2022, 2020 and 2019.
2023 Thales Data Threat Report Reveals Increase in Ransomware Attacks and Human Error as Main Cause of Cloud Data Breaches (Business Wire) 48% of IT professionals reported an increase in ransomware attacks with 22% of organisations experienced a ransomware attack in past 12 months
Report: Security teams take an average of 6 days to resolve alerts (VentureBeat) A report released by Palo Alto Networks reveals that cybersecurity teams take 145 hours, approximately 6 days, to resolve alerts.
Censys Releases 2023 State of the Internet Report Evaluating the State of Security on the Modern Internet (PR Newswire) Today, Censys, the leading internet intelligence platform for threat hunting and exposure management, announced its 2023 State of the Internet...
The 2023 State of the Internet Report | Censys (Censys) In the second annual State of the Internet Report, the Censys Research Team is back with fresh insights into the state of internet security – and what they mean for security teams.
2023 Threat Intelligence Report (Deepwatch) Get the 2023 Deepwatch Threat Intelligence Report highlighting 2022 observations and metrics, and forecasting the threat landscape for 2023.
Legacy Tech Poses a Challenge to Zero Trust Adoption, While Risk Management Needs Continue to Drive its Advancement (PR Newswire) C-suite and other executives at organizations adopting Zero Trust say complexity and compatibility issues with legacy systems and environments...
Deloitte Poll: Legacy Tech Poses a Challenge to Zero Trust Adoption (SlideShare iOS) C-suite and other executives at organizations adopting Zero Trust say complexity and compatibility issues with legacy systems and environments pose the greates…
As Economy Slows, Headcount and Resource Cuts Harm Security Teams’ Ability to Combat Threats (HackerOne) HackerOne Research Reveals Cybersecurity Budget Reductions and Team Layoffs Continue as Vulnerabilities Rise, Potentially Leaving Organizations More Vulnerable to Attack
Marketplace
Akamai Technologies To Acquire API Security Company Neosec (Akamai) Combined solutions expected to deliver complete API visibility and security coverage across all of the OWASP API top 10 attacks
NightDragon Acquires vArmour, Appoints Matt Gyde as CEO to Capitalize on Growing Global Cloud Application Security Opportunity (PR Newswire) NightDragon and vArmour today together announced that NightDragon, a dedicated cybersecurity, safety, security and privacy investment firm, has...
Saket Modi-founded cyber-risk mitigation firm Safe Security raises $50 million (The Economic Times) Returning investors in this round include Fidelity Investments venture capital arm Eight Roads, Telstra Ventures and WTI, said a statement by Safe Security.
Dasera Raises $12 Million Series A Funding to Pioneer a New Era of Data Security and Governance Risk Management (Business WIre) Dasera's automated data security and governance controls streamlines risk management, ensuring cloud security and privacy for organizations throughout the data lifecycle
Safe Security Raises $50M to Bring ML to Risk Quantification (Bank Info Security) A cyber risk quantification startup backed by ex-Cisco CEO John Chambers has raised $50 million to apply ML technology and build more API adapters. The money will
Coro Raises an Additional $75M Bringing the Total Raised to $155M in 12 Months (Business Wire) New funding to drive aggressive growth of industry’s only cybersecurity platform that brings enterprise grade cybersecurity to the mid-market; 300% year-over-year growth projected for 5th year in a row
19 startups to check out at RSA Conference 2023 (CSO Online) Young vendors of identity and access management, application security, and third-party risk solutions dominate the list of startups exhibiting at RSA.
What’s hot at RSA Conference 2023: 6 must-see malware analysis and threat hunting talks (Security Boulevard) The RSA Conference is happening next week in San Francisco and bringing some of the top minds in information security together to meet, mingle, deal — and also learn. The event started more than 30 years ago as a confab for cryptographers. These days, it doesn’t have the “zero-day cachet” of conferences like Black Hat, DEF CON or CanSecWest with its Pwn2Own competition. But it makes up for that with a steady and impressive parade of executives, top-shelf policy makers and subject matter experts.
Fortinet Joins the Joint Cyber Defense Collaborative (JCDC) to Continue Strengthening U.S. Cybersecurity Resiliency (GlobeNewswire News Room) JCDC will benefit from Fortinet’s in-depth cybersecurity expertise and industry-leading threat intelligence from FortiGuard Labs...
Darwinium Enters US Market, Expands Leadership Team and Announces Platform to Disrupt Digital Fraud Protection Market (PR Newswire) Darwinium, with global offices in London and Sydney, today announced its expansion into the U.S. market, with a bolstered U.S.-based leadership...
ThreatModeler Achieves 50% Customer Growth in FY2023 as it Increases Automated Attack Surface and Threat Discovery, Reducing Threat Modeling Friction in DevSecOps (News Direct) Achievements Accelerate Substantial Momentum in Addressing Compounding Regulatory Mandates for Complex Multi-Cloud Environments
Contrast Security Appoints Former Splunk Executive Rick Fitz as New CEO (PR Newswire) Contrast Security (Contrast), the code security platform built for developers and trusted by security, today announced the appointment of Rick...
Open letter to customers and partners from Contrast Security CEO Rick Fitz (Contrast Security) Learn more about Contrast Security's new CEO, Rick Fitz, in his open letter to customers and partners.
Splunk Appoints Yamini Rangan to Its Board of Directors (Business Wire) Splunk Inc. (NASDAQ: SPLK), the cybersecurity and observability leader, today announced that Yamini Rangan has joined the company’s Board of Directors.
Gigamon Promotes Kristi Thiele to Vice President of Worldwide Sales Engineering (Business Wire) Thiele to lead global SE team dedicated to helping customers enhance business agility, ensure cloud security, and contain hybrid cloud cost and complexity
Marlinspike adds Charles Carmakal to its Advisory Board (StreetInsider.com) Marlinspike Partners, a venture capital investment firm focusing on disruptive dual-use technology companies advancing national security and commercial interests of the United States, today announced that Charles Carmakal has joined its Advisory Board.
SentinelOne Appoints Sally Jenkins as Chief Marketing Officer (SentinelOne) Former Elastic, Informatica, VMware and Symantec marketing leader brings over 30 years of experience amplifying brand and demand at hyper growth companies SentinelOne (NYSE: S), a global leader in autonomous security, today announced the appointment of Sally Jenkins as Chief Marketing Officer.
Products, Services, and Solutions
Nozomi Networks Works with AWS to Deliver Advanced OT and IoT Cybersecurity and Analytics on the Cloud (Nozomi Networks) Nozomi Networks Works with AWS to Deliver Advanced OT and IoT Cybersecurity and Analytics on the Cloud – press release from Nozomi Networks
Darwinium Launches Platform to Deliver Fraud Prevention at the Edge, Without Compromising Customer Security or Privacy (PR Newswire) Darwinium today announced the launch of its Continuous Customer Protection platform, an evolutionary next step for security and fraud...
Aqua Security Incorporates CIS Kubernetes Benchmarks Scanning into Open Source Trivy (GlobeNewswire News Room) Rich, comprehensive reports deliver results and recommendations for improving the security of infrastructure and workloads...
GitLab and Oracle Expand Strategic Collaboration With AI/ML Offering (GlobeNewswire News Room) New offering enables developers to bolster AI/ML practices to speed up model training and inference, delivering software faster and more cost-effectively...
Data Breakthrough Awards Names Symmetry Systems' DataGuard "Data Solution of the Year for Security" (PR Newswire) Symmetry Systems, the industry's leading data-centric security company, today announced that its AI-powered, data security posture management...
Illumio Announces Incident Response Partner Program and New Product Features to Fight Ransomware - Illumio News | Illumio (Illumio) Illumio Zero Trust Segmentation Dashboards Make it Easy to Improve Ransomware Resilience as Proven Incident Response Partner Program Empowers DFIR Providers with ZTS
Sumo Logic Helps Control the Chaos by Enhancing Predictive Analytics for Observability (Sumo Logic) KubeCon + CloudNativeCon Europe 2023 – Sumo Logic today announced Predict for Metrics. When combined with existing capabilities in Sumo Logic, Predict for Metrics provides a comprehensive way to harness observability analytics to better predict variable applications, cloud and infrastructure usage…
Sumo Logic Marks Milestone in OpenTelemetry Posture Removing Complexity in Collection for Faster Time to Insights (Sumo Logic) KubeCon + CloudNativeCon Europe 2023 – Sumo Logic today announced it has taken steps to remove complexity from data collection, improved normalization of data, and consolidated collection agents with OpenTelemetry.
Swimlane Partners with AWS for Most Cost Effective Security Cloud (Low-Code Security Automation & SOAR Platform | Swimlane) Turbine becomes the industry’s only full-stack cloud-native security automation platform, enabling AWS customers to extend their security cloud beyond the SOC.
Inside-Out Defense Launches with Industry's First Platform to Provide Real-Time Detection and Remediation to Privilege Access Abuse (ACCESSWIRE News Room) Start-Up Funded by Bain & Company Delivers Holistic Approach to Solving Privilege Access Abuse PALO ALTO, CA / ACCESSWIRE / April 12, 2023 / Inside-Out Defense, the cybersecurity industry's first platform to solve privilege access abuse, emerged today from stealth funded by Bain & Company to provide real-time detection and remediation to today's most prolific attack vector - privilege access abuse. 99% of all cyber breaches are due to
Armis Enhances its Cyber Asset Attack Surface Management (CAASM) Solution (Armis) New functionality will enable organizations to better identify gaps in security controls, prepare compliance reporting and audits, identify technical debt and enhance their CMDBs
Normalyze Expands Its Data-first Cloud Security Platform to Analyze Lineage and Track Data Flows Across Structured and Unstructured Datastores (GlobeNewswire News Room) New 2.0 capabilities with dynamic data visualization lets security teams analyze sensitive data in motion and extract lineage to accelerate the remediation...
Versa Extends Zero Trust Network Access Beyond Remote Workers to Workers in Campus and Branch Offices (Versa Networks) Versa Zero Trust Everywhere™ Combines Integrated Zero Trust Security with Software-Defined LAN to Ensure Best User-to-Application Experience for Onsite, Remote and Hybrid Workers
Industry leading Email Signature Software Firm Crossware Achieves Vital Cyber Security Milestone with SOC 2 Compliance (Benzinga) AUCKLAND, New Zealand, April 18, 2023 /PRNewswire/ -- security milestone. Crossware has
CrowdStrike Delivers Cyber Resilience for the Airline Industry to Meet New TSA Requirements (CrowdStrike) The CrowdStrike Falcon platform together with CrowdStrike Services can deliver a solution needed to address the new cybersecurity requirements issued by TSA.
Forcepoint Launches Global Managed Security Service Provider Program for Forcepoint ONE SSE (Business Wire) Managed service offerings based on Forcepoint ONE SSE platform simplifies Zero Trust security, provides a fast ramp to Data-first SASE for partners
DoControl SaaS Security Platform Now Offered Through GuidePoint Security (PR Newswire) DoControl, the no-code Software as a Service (SaaS) security company, is proud to announce its partnership with GuidePoint Security, a leading...
LogRhythm Announces Partnership with Zscaler to Address Cloud Access Security Challenges Faced by the Modern SOC (Business Wire) New integration streamlines website access control with LogRhythm’s centralized data collection and automation
Lookout Launches Mobile Endpoint Detection and Response for MSSPs to Close the Mobile Security Gap for Customers (Lookout News) Lookout, Inc. today announced the availability of Lookout Mobile Endpoint Security, the industry’s most advanced mobile EDR offering for MSSPs.
IRONSCALES Unveils New BEC Capabilities Ahead of RSA (IRONSCALES) IRONSCALES unveils a suite of new capabilities that combines AI and human insights to aid in the fight against business email compromise ahead of RSA.
Picus Security Announces New Attack Surface Management and Cloud Security Posture Management Capabilities (PR Newswire) Picus Security, the pioneer of Breach and Attack Simulation (BAS), today announced the expansion of its continuous threat exposure management...
Talon Cyber Security Collaborates with Microsoft to Bring Enterprise-Grade ChatGPT Service to Modern Organizations (Business Wire) Integration of Talon’s Enterprise Browser and Microsoft Azure OpenAI Service Boosts Employee Productivity, Improves Security for Customers
Salt Security Accelerates API Threat Detection with New Investigation Capabilities (PR Newswire) Salt Security, the leading API security company, today announced the addition of new advanced threat detection capabilities and improved API...
Enveil Recognized in 2023 Gartner® Market Guide for AI Trust, Risk and Security Management (Business Wire) Enveil, the pioneering Privacy Enhancing Technology company protecting Data in Use, today announced it was named a Representative Vendor in the 2023 Gartner Market Guide for AI Trust, Risk and Security Management.
Securonix Redefines the Future of SIEM with Launch of Industry’s First Unified Defense SIEM Platform (Securonix) 365 Days of ‘Hot’ Search, Powered by Snowflake, Best-in-Class Threat Defense and Unified TDIR Experience on a Single Platform
Sevco Security Launches World’s Most Accurate CAASM Platform Powered by Proprietary Four-Dimensional Cybersecurity Asset Intelligence Correlation and Visualization Engine (Business Wire) Company Receives Multiple Patent Allowances for Core Platform Technology That Enables True Understanding, Coverage and Context of Devices, Users and Applications on a Continuous, Real-time Basis
CrowdStrike Announces Managed XDR: Closing the Cybersecurity Skills Gap (CrowdStrike) CrowdStrike announces the introduction of Falcon Complete XDR, a new managed eXtended Detection and Response (MXDR) service.
Venafi Launches Venafi Firefly to Deliver Machine Identities for Modern, Cloud Native Workloads (Business Wire) Enables Organizations to Strengthen Security Posture While Accelerating Application Development
Lumu Launches New SecOps Tool to Combat Growing Cybersecurity Threats (ACCESSWIRE News Room) Lumu for SecOps provides rapid detection and response to today's top threats such as ransomware MIAMI, FL / ACCESSWIRE / April 19, 2023 / Lumu Technologies, creators of the Continuous Compromise Assessment cybersecurity model that empowers organizations to measure compromise in real time, will debut Lumu for SecOps, at the RSA Conference 2023. Lumu for SecOps is built to enable security teams to efficiently operate cybersecurity by dynamically
Barracuda makes it easy to secure websites, applications, and APIs with comprehensive enterprise-grade protection (PR Newswire) Barracuda Networks, Inc., a trusted partner and leading provider of cloud-first security solutions, today introduced new Application Protection...
CybeReady Unveils Advanced Data-Driven Analytics to Revolutionize Cybersecurity Awareness Training (ITSecurityWire) CybeReady, announced a major enhancement to the company's award-winning cybersecurity awareness training solution.
Aryaka and Check Point Software Technologies Extend Partnership for Global Managed SASE (PR Newswire) Aryaka®, the leader in Unified SASE solutions, today announced that it is expanding its partnership with Check Point Software Technologies,...
Axiad Expands International Footprint With Canadian Hosting Capabilities (PR Newswire) Axiad, a leading provider of organization-wide passwordless orchestration, today announced it has further expanded internationally, delivering...
SPHERE and BigID Join Forces to Remediate Identity Hygiene Risks (PR Newswire) SPHERE, provider of innovative solutions for identity hygiene and access governance, and BigID, the leading platform for data security,...
Protect Your Mid-Market Organization with Protect+ (Cofense) Equip your mid-market organization with the right tools to protect against cyber threats and identify phishing emails faster! Learn more about Cofense Protect+
Lacework Prioritizes Cloud Security Risks with New Vulnerability Risk Management Technology (PR Newswire) Leading up to RSA Conference 2023, Lacework®, the data-driven cloud security company, today announced the expansion of its cloud-native...
Technologies, Techniques, and Standards
FS-ISAC Leads Financial Sector in Live-Fire Cyber Exercise Locked Shields (GlobeNewswire News Room) Exercise to prepare against unprecedented, worst-case scenario financial meltdown...
Avoiding attacks (Control Engineering Europe) Suzanne Gill posed the following question to a variety of cybersecurity experts: 'What is the best piece of advice you can offer end-users keen to ensure that their connected OT devices do not offer a potential attack surface for bad actors?'
OpenSSF Announces SLSA Version 1.0 Release - Open Source Security Foundation (Open Source Security Foundation) The Open Source Security Foundation (OpenSSF) is proud to announce the release of version 1.0 of Supply-chain Levels for Software Artifacts (SLSA). SLSA is an OpenSSF project that provides specifications for software supply chain security, established by community expert consensus. The stable release of the SLSA 1.0 Build Track lowers the barrier of entry for improvements, helps you focus efforts on improving your build, and reduces the chances of tampering across a large swath of the supply chain.
Design and Innovation
OpenAI’s hunger for data is coming back to bite it (MIT Technology Review) The company’s AI services may be breaking data protection laws, and there is no resolution in sight.
Dell Technologies Builds Ecosystem to Speed Zero Trust Adoption | Dell (Dell) Dell brings together more than 30 leading technology and security companies to create a unified Zero Trust solution.
Legislation, Policy, and Regulation
Cyber: towards stronger EU capabilities for effective operational cooperation, solidarity and resilience (European Commission) Today, the Commission has adopted a proposal for the EU Cyber Solidarity Act to strengthen cybersecurity capacities in the EU. It will support detection and awareness of cybersecurity threats and incidents, bolster preparedness of critical entities, as well as reinforce solidarity, concerted crisis management and response capabilities across Member States.
WhatsApp and other messaging apps oppose 'surveillance' (BBC News) WhatsApp and messaging apps unite to urge the UK government to rethink the Online Safety Bill.
Proposed UK moves to break encryption draw anger of IT world (Register) Plus: Signal, WhatsApp, and Viber also write online protest over Online Safety Bill back door
‘Shut it off immediately’: The health industry responds to data privacy crackdown (POLITICO) Biden administration enforcement actions have chilled advertising spending and cut into bottom lines.
Litigation, Investigation, and Law Enforcement
How Mexico Became the Biggest User of the World’s Most Notorious Spy Tool (New York Times) A Times investigation reveals the story behind how Mexico became the first and most prolific user of Pegasus. It’s still using it, despite promising to stop.
Legal challenge to EPA rule poses obstacle to Biden's cyber agenda (Washington Post) Republican AGs try to block EPA water cyber protections, citing federal intrusion on states' authority
DOD General Counsel Remarks at U.S. Cyber Command Legal Conference Remarks By Hon. Caroline Krass (U.S. Department of Defense) The DOD General Counsel delivered remarks at the U.S. Cyber Command Legal Conference.
Chinese Cops Ran Troll Farm and Secret NY Police Station, US Says (WIRED) Three criminal cases detail China's alleged attempts to extend its security forces' influence online—and around the globe.
US charges 4 Americans, 3 Russians in election discord case (AP NEWS) Four Americans affiliated with a Black empowerment and political organization have been charged along with three Russians with conspiring to covertly sow discord in U.S. society, spread Russian propaganda and interfere in U.S. elections. An indictment unsealed Tuesday adds the new defendants to an existing case in Tampa, Florida, federal court involving Aleksandr Ionov, described by prosecutors as the founder of a Moscow-based organization funded by the Russian government to carry out an influence campaign in the U.S. The four Americans are all part of the African People’s Socialist Party and Uhuru Movement, which has locations in St. Petersburg, Florida, and St. Louis.
U.S. charges four Americans with aiding Kremlin efforts (Washington Post) Charges are the latest Justice Department effort against secret foreign propaganda networks on U.S. soil
US citizens charged with pushing pro-Kremlin disinformation (Register) Also a bunch of Russians plus someone giving free trips to the Motherland
Ex-CEO of breached pyschotherapy clinic gets prison sentence for bad data security (Naked Security) Did the sentence fit the crime? Read the backstory, and then have your say in our comments! (You may post anonymously.)
Brit cops rapped over app that recorded 200k phone calls (Register) Officers didn't know software was saving personal data and neither did people on other end
Crooks’ Mistaken Bet on Encrypted Phones (The New Yorker) Drug syndicates and other criminal groups bought into the idea that a new kind of phone network couldn’t be infiltrated by cops. They were wrong—big time.
Patient Seeks to Force Hospital Network to Pay Hackers Ransom to Remove Naked Photos Online (Wall Street Journal) Jane Doe lawsuit asks judge to compel Lehigh Valley Health Network to pay hackers more than $5 million in a bid to have stolen photos removed from the internet.