Daily Briefing for 09.18.24

Attacks, Threats, and Vulnerabilities

Cato CTRL Threat Research: CVE-2023-49559 – gqlparser Directive Overload DoS Vulnerability  (Cato Networks) The Cato CTRL and Cato AppSec Research teams have discovered a directive overload DoS vulnerability in gqlparser, which is a crucial component in the development and running of GraphQL applications.

Problems in the Parking Lot: Threat Actors Use IRL Quishing to Target Travelers | Netcraft (Netcraft) This article explores Netcraft’s research into the recent surge in QR code parking scams in the UK and around the globe. Insights include:  At least tw ...

Spam With A Political Twist: Fraudsters Are Exploiting The Election Season (Trustwave) The US election is near and threat actors are crafting malicious spam that uses candidate names and political themes to convince recipients to open their emails.

Trends

Orca State of AI Security Report Reveals Majority of Companies are Deploying AI Without Regard for Security (Orca Security) Study Indicates 56% of Companies are Using AI to Build Custom Applications with Broad Exposure to API Keys, Excessive Access Permissions, Misconfigurations and More PORTLAND, Ore., September 18, 2024 – Orca Security, the leading provider of agentless cloud security, today released the inaugural 2024 State of AI Security Report, providing insights into current AI utilization […]

Products, Services, and Solutions

Splunk Cloud Platform Attains FedRAMP High Authorization (BusinessWire) FedRAMP's Highest Level of Authorization Accelerates Agency Modernization Initiatives For All Federal Agencies and Partners

LevelBlue Announces Managed Threat Detection and Response Service for U.S. Government Entities (BusinessWire) New 24/7 managed security service protects highly sensitive data while adhering to increased government regulations, bolstering cyber resilience among government agencies

Halcyon Partners with BlackLake Security to Defeat Ransomware (BusinessWire) Joint Solution Disrupts Ransomware Payloads and Insulates Companies from the Threat of Extortion Campaigns

Financial Services Unlocks Seamless Falcon Access (CrowdStrike) CrowdStrike's financing solutions accelerate the adoption of the AI-native Falcon platform by removing procurement complexity. Learn more.

Varonis Expands Salesforce Security Offering With New Automated Remediation Capabilities September 17, 2024 (Varonis) Customers can now reduce data security risk with one of the leading SSPM solutions

Legislation, Policy, and Regulation

Deterrence in cyberspace is possible — and ‘urgent’ — amid ‘alarming’ hybrid attacks, State cyber ambassador says (CyberScoop) In an interview with CyberScoop, Nate Fick also discussed the structure of his office and regions of emphasis.

For a complete running list of events, please visit the Event Tracker.

Events

SecureWorld Detroit (Novi, Michigan, USA, Sep 18, 2024) Join your regional cybersecurity community for high-quality, affordable training and collaboration. Earn 6-12 CPE credits through 15+ educational sessions learning from local and nationally recognized industry leaders. Attend featured keynotes, panel discussions, breakout sessions, and solution vendor displays—all while networking with peers in InfoSec.

SecureWorld St. Louis (Clayton, Missouri, USA, Sep 26, 2024) Join your regional cybersecurity community for high-quality, affordable training and collaboration. Earn 6-12 CPE credits through 15+ educational sessions learning from local and nationally recognized industry leaders. Attend featured keynotes, panel discussions, breakout sessions, and solution vendor displays—all while networking with peers in InfoSec.

2024 DataTribe Challenge Submission Deadline (Fulton and Virtual, Maryland, USA, Sep 27, 2024) As founders ourselves, we have never liked the feeling of being the entertainment that comes with participating in most pitch competitions. So, in creating the DataTribe Challenge, we have centered it on the North Star of creating a platform that is a valuable use of time for the founders participating. Submit your startup to potentially be selected to be part of a startup competition like no other. The DataTribe Challenge is a unique program to accelerate your cybersecurity startup. Workshop your messaging and meet potential investors and customers. We will pick five finalists to join the program, receive coaching from our team of startup veterans, present at the live event, and benefit from free promotion and press coverage. Finalists share $25,000 in prizes and all will receive the title of DataTribe Challenge Finalist.

Uniting Women in Cyber 2024 (Arlington, Virginia, USA, Oct 1, 2024) The premier networking event to advance diversity in cybersecurity! Join renowned cyber leaders and experts from all walks of life. Uniting Women in Cyber (UWIC) event convenes a powerful and diverse network of cyber leaders and experts to discuss emerging global trends, technological advancements, and workforce development. UWIC is the premier event for professionals, aspiring practitioners and all who are interested in cybersecurity, to meet and network with national leaders in the field. Come and be a part of a vibrant, diverse community to learn, share ideas, and expand your professional network!

HITRUST® Collaborate 2024 (Frisco, Texas, USA, Oct 1 - 3, 2024) HITRUST Collaborate is the most comprehensive information protection and risk management conference for privacy, security, and compliance. The 2.5-day conference includes keynotes, panel discussions, and educational sessions for industry professionals.