Explore

FactFableFactFable
Why Common SNMP Security Pitfalls Look Different in Production

Why Common SNMP Security Pitfalls Look Different in Production

Learn why textbook SNMP security issues like default community strings become far more dangerous in a live, complex production IT environment.
FactFableFactFable
Why a Threat Intel Analyst Matters More in Cloud Environments

Why a Threat Intel Analyst Matters More in Cloud Environments

As businesses move to the cloud, the security playbook changes. Here is why a threat intelligence analyst is essential for navigating the new landscape.
FactFableFactFable
What Defending Against MFA Bombing Actually Looks Like in a Real Incident

What Defending Against MFA Bombing Actually Looks Like in a Real Incident

A real-world look at how security teams respond when attackers weaponize multi-factor authentication with a flood of push notifications.
FactFableFactFable
Why Most Teams Misread CISA, NSA, and FBI Cyber Roles

Why Most Teams Misread CISA, NSA, and FBI Cyber Roles

Confused about whether to call CISA, the FBI, or the NSA after a cyber attack? This guide clarifies their distinct roles and why getting it right matters.
Rapid ReadRapid Read
CISA's CDM Program Prioritizes Speed and Unification to Combat Evolving Cyber Threats

CISA's CDM Program Prioritizes Speed and Unification to Combat Evolving Cyber Threats

The Cybersecurity and Infrastructure Security Agency (CISA) is emphasizing the need for its Continuous Diagnostics and Mitigation (CDM) program to become significantly faster and more unified in providing cybersecurity tools and capabilities to federal agencies. Richard Grabowski, acting branch chief of service delivery and deputy program manager for the CDM program, stated that current collaboration methods are insufficient for past threats and will be even less effective for future ones. The program's core goals are velocity, unification, and data-driven risk management. Velocity involves pushing responsible automation to allow experts to focus on novel threats, while unification aims to connect deployments meaningfully to stimulate reusable lessons learned. Data-driven risk management ensures agencies have timely, accurate data for first response during crisis-level events. The CDM program has been evolving since the SolarWinds breach, which compromised at least nine federal agencies, highlighting the n...
Rapid ReadRapid Read
CISA to Finalize Cyber Incident Reporting Rule for Critical Infrastructure in September

CISA to Finalize Cyber Incident Reporting Rule for Critical Infrastructure in September

The Cybersecurity and Infrastructure Security Agency (CISA) is set to release its final rule for the Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) this September. This forthcoming regulation will mandate that companies operating across 16 critical infrastructure sectors report covered cyber incidents within 72 hours and ransomware payments within 24 hours. The rule is expected to apply to a significant number of entities, potentially over 300,000, based on sector categories and Small Business Administration size thresholds. CISA held virtual town halls in June where industry stakeholders raised concerns regarding the broad definition of 'covered entity,' what constitutes a 'substantial cyber incident,' the amount of information CISA might request, and how these new rules will overlap with existing reporting obligations. The agency emphasizes the importance of prompt notice, evidence preservation, and cooperation with managed security providers, forensic vendors, and outside cybersecurit...
FactFableFactFable
The Hidden Vulnerability Behind Identity Management for a Retail Chain

The Hidden Vulnerability Behind Identity Management for a Retail Chain

For large retailers, the biggest security threat isn't always a direct attack, but a slow, quiet decay of internal digital access controls.
FactFableFactFable
Why Most Teams Misread What an Incident Responder Should Know

Why Most Teams Misread What an Incident Responder Should Know

Discover the critical, often overlooked skills that define an elite incident responder, moving beyond just technical expertise to business impact.
Rapid ReadRapid Read
AI-Powered Cyberattack Breaches European IT Firm in Under 10 Hours, Highlighting Evolving Threat Landscape

AI-Powered Cyberattack Breaches European IT Firm in Under 10 Hours, Highlighting Evolving Threat Landscape

A European IT and software company was breached by a hacker utilizing frontier AI models in less than 10 hours, a process that typically takes human hackers approximately two weeks. This incident, defended by Palo Alto Networks, involved a human attacker directing AI agents to conduct reconnaissance, exploit a public API endpoint, and then perform internal reconnaissance to identify vulnerable systems. The AI agents subsequently extracted credentials, including passwords and tokens, from code repositories. These stolen logins were then used to access the company's software build and deployment system, ultimately granting the hackers access to cloud accounts. This technique, known as 'living off the land,' allowed the attackers to use the victim's own AI tools for their operation, making detection more challenging. The attack culminated in an extortion attempt, though Palo Alto Networks successfully intervened before the hackers achieved full success. An 80-page technical report detailing the company's vuln...
FactFableFactFable
How Employee Training for a State Government Quietly Shapes Modern Security Architecture

How Employee Training for a State Government Quietly Shapes Modern Security Architecture

Discover how mandatory cybersecurity training for state government employees is quietly driving a fundamental shift toward new security models like Zero Trust.
Rapid ReadRapid Read
CISO Shares Lessons from LockBit Ransomware Attack on University

CISO Shares Lessons from LockBit Ransomware Attack on University

Zach Lewis, CISO at the University of Health Science and Pharmacy (UHSP) in St. Louis, shared insights from a LockBit ransomware attack that hit the institution in summer 2023. The university successfully recovered without paying the ransom, a process that involved significant challenges. The attack began with an outage, followed by the discovery of the ransomware note after files were encrypted. Lewis emphasized the importance of having a strong rapport with the executive team, which had previously participated in a ransomware tabletop exercise, enabling them to trust his leadership during the crisis. Post-incident, UHSP bolstered its security by migrating applications and infrastructure to cloud and SaaS platforms and centralizing identity and user access control through an enterprise browser.
ReutersReuters
UK, US and Netherlands issue advisory on Iran-linked spyware

UK, US and Netherlands issue advisory on Iran-linked spyware

LONDON, Sept 15 (Reuters) - Britain, the United States and the Netherlands on Tuesday issued a joint cybersecurity advisory detailing spyware they say is used by Iranian state-linked actors to target dissidents, activists and journalists.