Explore

Quantum Computing Poses Long-Term Cybersecurity Risk for Community Banks, Requires Proactive Vendor Management

Quantum Computing Poses Long-Term Cybersecurity Risk for Community Banks, Requires Proactive Vendor Management

Quantum Computing Poses Long-Term Cybersecurity Risk for Community Banks, Requires Proactive Vendor Management

The Real Reason Security Engineers Disagree About CISOs

The Real Reason Security Engineers Disagree About CISOs

The friction between security engineers and CISOs isn't personal; it's a structural problem rooted in budgets, language, and risk perception.

Anthropic Launches AI-Powered Bug Reporting for Open Source and Critical Infrastructure Security Initiatives

Anthropic Launches AI-Powered Bug Reporting for Open Source and Critical Infrastructure Security Initiatives

Anthropic has introduced two new cybersecurity initiatives aimed at enhancing vulnerability detection and remediation. The first, OSS Scanner, is a free service that utilizes Anthropic's advanced AI models to periodically scan open-source projects for potential vulnerabilities. Maintainers who opt-in receive model-generated reports, including proof-of-concept exploits and suggested fixes, directly and without human review, to expedite the disclosure process. Anthropic anticipates a true-positive rate exceeding 90% for these reports. The second initiative, the Critical Infrastructure Defense Program (CIDP), focuses on operational technology (OT) security. This program partners Anthropic's frontier Claude models and on-site engineers with 11 founding firms, including Accenture, Booz Allen, and Deloitte, to address the unique challenges of securing critical infrastructure sectors like power, water, manufacturing, and transportation. These firms will leverage Anthropic's AI and threat research to help customer...

The Real Reason Security Engineers Disagree About an Incident Response Plan for a Manufacturing Plant

The Real Reason Security Engineers Disagree About an Incident Response Plan for a Manufacturing Plant

Security experts often clash over how to protect manufacturing plants. The reason isn't incompetence, but a deep divide between two different worlds.

What Identity Management for a State Government Actually Looks Like in a Real Incident

What Identity Management for a State Government Actually Looks Like in a Real Incident

A step-by-step look at how a state government's cybersecurity team responds when a digital identity is compromised and citizen data is at risk.

Anthropic Launches AI-Powered Cybersecurity Initiatives for Open Source and Critical Infrastructure

Anthropic Launches AI-Powered Cybersecurity Initiatives for Open Source and Critical Infrastructure

Anthropic has unveiled two new cybersecurity initiatives: the OSS Scanner and the Critical Infrastructure Defense Program (CIDP). The OSS Scanner is a free service that uses Anthropic's advanced Claude models to periodically scan open-source projects for vulnerabilities. These AI-generated reports are sent directly to maintainers without human review, aiming to fast-track the disclosure process, though Anthropic acknowledges potential inaccuracies in severity ratings. The company expects a true-positive rate above 90% and plans to improve it over time. The CIDP focuses on enhancing the security of operational technology (OT) providers for critical infrastructure sectors like power, water, manufacturing, and transportation. This program involves frontier Claude models, on-site engineers, and Anthropic's threat research, partnering with 11 firms including Accenture, Deloitte, and Palo Alto Networks, to address the challenge of patching OT systems that often cannot be taken offline for extended periods.

MRZ Verification Alone Insufficient for Proving Identity, Developers Advised to Integrate Multi-Layered Security

MRZ Verification Alone Insufficient for Proving Identity, Developers Advised to Integrate Multi-Layered Security

Machine-Readable Zone (MRZ) verification, a common method for validating identity documents like passports, only confirms the internal consistency of data, not the authenticity of the document itself. According to ComplyCube's Chief Technical Officer, Mohamed Alsalehi, MRZ verification does not indicate if a document is genuine, tampered with, or if the presenter is the rightful holder. MRZ codes, standardized by the International Civil Aviation Organization (ICAO) since 1980, facilitate automated data capture and accelerate identity checks by using mathematical check digits. However, the data within MRZ is unencrypted and the algorithm is publicly specified, making it susceptible to forgery. A successful checksum merely proves that the characters supplied to the algorithm have the correct mathematical relationship, not that the underlying identity document is real. Factors such as glare, blur, physical wear, or Optical Character Recognition (OCR) errors can cause genuine documents to fail an MRZ check. Co...

BlackRock Seeks Lead Directory Services Engineer, Vice President to Enhance Financial Technology Platform

BlackRock Seeks Lead Directory Services Engineer, Vice President to Enhance Financial Technology Platform

BlackRock Seeks Lead Directory Services Engineer, Vice President to Enhance Financial Technology Platform

IBM and Red Hat Remediate Over 400 Open Source Vulnerabilities, Launch Clearinghouse

IBM and Red Hat Remediate Over 400 Open Source Vulnerabilities, Launch Clearinghouse

IBM and Red Hat Remediate Over 400 Open Source Vulnerabilities, Launch Clearinghouse

Digitization of Marine Transportation Systems Introduces Cyber Vulnerabilities in Port Operations

Digitization of Marine Transportation Systems Introduces Cyber Vulnerabilities in Port Operations

The increasing digitization of marine transportation systems has introduced significant vulnerabilities, particularly within Terminal Operating Systems (ToS). A problem at the IT level, even if physical operational technology (OT) remains functional, can completely halt port operations, freezing logistics and billing. This systemic weakness is exacerbated by split accountability among port authorities, private terminal operators, and shipping lines, leading to gaps in cyber defense. Experts like Marco (Marc) Ayala, director at ABS Consulting, and Koyel Ghosh, a cybersecurity executive, emphasize that while cranes and gates might be operational, the absence or manipulation of information from the ToS can prevent cargo movement. The U.S. Maritime Transportation Security Act (MTSA) and Coast Guard regulations now mandate a Cybersecurity Officer (CySO), assessment, and plan, but compliance does not guarantee the ability to move cargo if the 'operating picture' is lost.

SpaceX's Starlink Implements Hardware Security Keys to Combat Cyberattacks

SpaceX's Starlink Implements Hardware Security Keys to Combat Cyberattacks

SpaceX's Starlink satellite internet system is enhancing its cybersecurity measures by implementing hardware-based security keys for internal access. This move aims to provide a stronger defense against hacking attempts compared to traditional passwords and standard multi-factor authentication. The company detailed these security practices on a new Starlink webpage, emphasizing the use of USB devices to store private authentication keys, thereby circumventing the vulnerabilities associated with digital-only credentials. This approach is designed to resist phishing attacks, which often trick users into revealing login information through fake emails, text messages, or websites. Starlink also adheres to a least-privilege model with role-based access controls and separation of duties, ensuring that access to its systems requires multi-factor authentication, including these hardware security keys. All access is regularly reviewed and revoked when no longer necessary.

Scholastic Corporation Seeks Principal Security Engineer to Bolster Cybersecurity Defenses

Scholastic Corporation Seeks Principal Security Engineer to Bolster Cybersecurity Defenses

Scholastic Corporation Seeks Principal Security Engineer to Bolster Cybersecurity Defenses