Attackers are targeting unpatched SAP applications, and the exploits could lead to the hijacking of the vulnerable systems, data theft and ransomware attacks, SAP and Onapsis Research Labs report. They note that patches for most of the flaws have been available for several years.
To deliver a secure "infrastructure-as-code" service, development teams must adopt a "shift left" strategy to bring all the applications and security under one umbrella to provide faster and continuous delivery of the fully automated code, according to Ori Bendet and Igor Markov of Checkmarx.
Cyberattacks can cause devastating
business disruptions and lead to
financial losses reaching hundreds
of millions of dollars.
The World Economic Forum’s 2020 Global Risk Report ranked
cyberattacks causing disruption to operations and critical infrastructure
among the top five increasing global risks....
French cybersecurity authorities are warning that widely used, open-source IT monitoring software called Centreon appears to have been hit by Russian hackers. But unlike the SolarWinds supply chain attack, in this campaign, attackers appear to have hacked outdated, unpatched versions of the software.
Our apps and services are expected to work quickly and seamlessly on any number of devices, from different kinds of networks and in different locations around the globe. Monitoring the infrastructure that supports those experiences - layers of interconnected technologies that become more complex every year - is key to...
Machine data is one of the most underused and undervalued assets of any organization, yet it contains powerful business and operational insights that can help you quickly diagnose service problems, detect advanced security threats and uncover the fingerprints of fraud.
Download this whitepaper to learn about:...
Independent bug hunters who find flaws in products and services often struggle to hand off their vulnerability report to someone in a position to get it fixed, says longtime security researcher Daniel Cuthbert. He describes steps organizations must take to be able to receive - and act on - bug reports.
A security researcher says voting equipment in the U.S. is still riddled with security flaws that opportunistic foreign adversaries could use to pose a threat to the November election. Meanwhile, the director of CISA calls Russian ransomware attacks one of the biggest threats to the election.
CISA is warning that threat actors are actively exploiting a remote code execution vulnerability in F5's BIG-IP network products that can lead to data exfiltration and other security issues. Earlier, researchers and F5 had urged users to patch the flaw.
Trend Micro says it has seen increasing attempts to infect home routers for use as proxies and for DDoS attacks. The battle is primarily being fought by three bot families - Mirai, Qbot and Kaiten - that enable low-level fraudsters to hide their activity.
Several U.S. energy providers have been targeted by a spear-phishing campaign attempting to spread a recently discovered Trojan called FlowCloud, according to Proofpoint research. The analysts have found connections between these attacks and another campaign using malware called LookBack.
Kevin Schwarz of Zscaler discusses the security implications of the "new normal" of employees working from home, including the role of a "zero trust" strategy.
In an interview with Information Security Media Group's Nick Holland, Schwarz discusses:
What work and cybersecurity may look like after the COVID-19...