Explore

Rapid ReadRapid Read
Wiz Seeks Compliance Engineer for US Public Sector to Lead FedRAMP CR26 Initiative

Wiz Seeks Compliance Engineer for US Public Sector to Lead FedRAMP CR26 Initiative

Wiz, a rapidly expanding startup specializing in securing cloud and AI applications, is actively seeking a Compliance Engineer for its U.S. Public Sector team. This individual will serve as the strategic technical lead for the company's FedRAMP CR26 initiative. The role involves defining a long-term technical roadmap by architecting comprehensive compliance-as-code solutions, utilizing both Wiz's native features and custom automations to address CR26 Class D rule changes efficiently. The position is an individual contributor role that bridges complex regulatory requirements with scalable engineering practices, ensuring cloud services meet stringent federal and defense standards while maintaining high availability, security, and audit readiness. Wiz is known for integrating code, cloud, and runtime into a unified context, and is trusted by over 65% of the Fortune 100, processing over 230 billion files daily. The company is also powered by Google, leveraging its threat intelligence and security operations to...
TrendlineTrendline
Wiz Seeks Compliance Engineer to Lead FedRAMP CR26 Initiative for US Public Sector

Wiz Seeks Compliance Engineer to Lead FedRAMP CR26 Initiative for US Public Sector

Wiz Seeks Compliance Engineer to Lead FedRAMP CR26 Initiative for US Public Sector
TrendlineTrendline
Twitch Seeks Security Incident Response Engineer for U.S. Locations with Salaries Up to $212,800

Twitch Seeks Security Incident Response Engineer for U.S. Locations with Salaries Up to $212,800

Twitch Seeks Security Incident Response Engineer for U.S. Locations with Salaries Up to $212,800
FactFableFactFable
How Employee Training for a State Government Quietly Shapes Modern Security Architecture

How Employee Training for a State Government Quietly Shapes Modern Security Architecture

Discover how mandatory cybersecurity training for state government employees is quietly driving a fundamental shift toward new security models like Zero Trust.
Rapid ReadRapid Read
FBI and RCMP Seize Domains of NightmareStresser DDoS-for-Hire Service in Global Operation

FBI and RCMP Seize Domains of NightmareStresser DDoS-for-Hire Service in Global Operation

The U.S. Justice Department announced that authorities, including the FBI Anchorage field office and the Royal Canadian Mounted Police, have seized the primary domain and other associated websites of NightmareStresser. This action is part of an ongoing global coordinated effort named 'Operation PowerOFF.' NightmareStresser was identified as one of the longest-running and most popular distributed denial-of-service (DDoS) for-hire services, used by cybercriminals worldwide to launch hundreds of thousands of DDoS attacks or attempted attacks since at least 2022. These services, also known as IP stressers or DDoS booters, inundate websites, servers, and networks with junk traffic, making legitimate sites inaccessible. While officials did not name the operators or identify their country of origin, the service claimed to operate under Russian laws, according to Zach Edwards, staff threat researcher at Infoblox.
Rapid ReadRapid Read
CISA and NIST Issue New Guidance to Combat Cloud Identity Token Theft

CISA and NIST Issue New Guidance to Combat Cloud Identity Token Theft

The Cybersecurity and Infrastructure Security Agency (CISA) and the National Institute of Standards and Technology (NIST) have jointly released final guidance aimed at protecting cloud identity tokens and assertions from theft, forgery, and misuse. This guidance, detailed in Interagency Report 8587 published on September 15, addresses critical tokens used for single sign-on, identity federation, and API access, which are increasingly targeted by adversaries for unauthorized access and data exfiltration. The recommendations, though voluntary, suggest that access and identity tokens should be valid for a maximum of one hour, and expired tokens must be rejected. Key management practices include rotating signing keys for high-impact systems at least every 90 days and annually for others. These keys are mandated to be stored in hardware-backed or isolated storage, never persistently on the servers utilizing them. Additionally, tokens must include an explicit audience field, and personal data within them should ...
FactFableFactFable
If You Love PowerShell, These 6 Languages Are Worth a Look

If You Love PowerShell, These 6 Languages Are Worth a Look

For IT pros who love PowerShell, discover six other languages like Python, Go, and C# that can expand your automation and system administration skills.
Rapid ReadRapid Read
WhatsApp Enhances Account Security with Stronger Two-Step Verification and Flexible Passkeys

WhatsApp Enhances Account Security with Stronger Two-Step Verification and Flexible Passkeys

WhatsApp, a widely used messaging application, is rolling out significant security enhancements to protect its users from cyber threats such as account takeovers and phishing attempts. These updates primarily focus on three areas: stronger two-step verification, improved information for calls from unknown numbers on Android, and more flexible passkey usage. The previous multi-digit PIN for two-step verification is being replaced with a full password that can include letters, numbers, and special characters, making it significantly harder to guess or brute-force. For Android users, WhatsApp will now display additional details for calls from unknown numbers, such as the caller's country and any shared groups, providing more context before users decide to answer. Furthermore, users can now add multiple passkeys to the same account, including separate ones for Android and iOS devices, streamlining secure biometric logins across various devices. These changes aim to bolster user protection against unauthorized ...
TrendlineTrendline
RSM US LLP Advises Shift from Vulnerability Management to Exposure Management for Cybersecurity

RSM US LLP Advises Shift from Vulnerability Management to Exposure Management for Cybersecurity

RSM US LLP Advises Shift from Vulnerability Management to Exposure Management for Cybersecurity
Rapid ReadRapid Read
CISO Shares Lessons from LockBit Ransomware Attack on University

CISO Shares Lessons from LockBit Ransomware Attack on University

Zach Lewis, CISO at the University of Health Science and Pharmacy (UHSP) in St. Louis, shared insights from a LockBit ransomware attack that hit the institution in summer 2023. The university successfully recovered without paying the ransom, a process that involved significant challenges. The attack began with an outage, followed by the discovery of the ransomware note after files were encrypted. Lewis emphasized the importance of having a strong rapport with the executive team, which had previously participated in a ransomware tabletop exercise, enabling them to trust his leadership during the crisis. Post-incident, UHSP bolstered its security by migrating applications and infrastructure to cloud and SaaS platforms and centralizing identity and user access control through an enterprise browser.
Rapid ReadRapid Read
CISA's CDM Program Prioritizes Speed and Unification to Combat Evolving Cyber Threats

CISA's CDM Program Prioritizes Speed and Unification to Combat Evolving Cyber Threats

The Cybersecurity and Infrastructure Security Agency (CISA) is emphasizing the need for its Continuous Diagnostics and Mitigation (CDM) program to become significantly faster and more unified in providing cybersecurity tools and capabilities to federal agencies. Richard Grabowski, acting branch chief of service delivery and deputy program manager for the CDM program, stated that current collaboration methods are insufficient for past threats and will be even less effective for future ones. The program's core goals are velocity, unification, and data-driven risk management. Velocity involves pushing responsible automation to allow experts to focus on novel threats, while unification aims to connect deployments meaningfully to stimulate reusable lessons learned. Data-driven risk management ensures agencies have timely, accurate data for first response during crisis-level events. The CDM program has been evolving since the SolarWinds breach, which compromised at least nine federal agencies, highlighting the n...
TrendlineTrendline
Atlassian Enhances Cloud Incident Response with Automated Root Cause Analysis

Atlassian Enhances Cloud Incident Response with Automated Root Cause Analysis

Atlassian Enhances Cloud Incident Response with Automated Root Cause Analysis