Week in review: Quantum Locker ransomware, most exploited vulnerabilities in 2021
Here’s an overview of some of last week’s most interesting news, articles and interviews:
Meteoric attack deploys Quantum ransomware in mere hours
A group wielding the Quantum Locker ransomware is hitting targets in a blitzkrieg-like manner, going from intial compromise to domain-wide deployment and execution in under four hours, researchers with The DFIR Report are warning.
Nimbuspwn bugs allow attackers to gain root privileges on some Linux machines (CVE-2022-29799, CVE-2022-29800)
Microsoft has unearthed two security vulnerabilities (CVE-2022-29799, CVE-2022-29800) in the networkd-dispatcher daemon that may be exploited by attackers to gain root on many Linux endpoints, allowing them to deploy backdoors, malware, ransomware, or perform other malicious actions.
The 15 most exploited vulnerabilities in 2021
In 2021, threat actors aggressively exploited newly disclosed critical software vulnerabilities to hit a broad set of targets worldwide, says the latest advisory published by the US Cybersecurity and Infrastructure Security Agency.
Critical vulnerabilities open Synology, QNAP NAS devices to attack
Users of Synology and QNAP network-attached storage (NAS) devices are advised to be on the lookout for patches for several critical vulnerabilities affecting Netatalk, an open-source implemention of the Apple Filing Protocol (AFP) that allows Unix-like operating systems to serve file servers for Macs.
Is cybersecurity talent shortage a myth?
In this interview for Help Net Security, Ricardo Villadiego, CEO at Lumu, explains why he thinks the cybersecurity talent shortage is a myth and how organizations can overcome this challenge by improving technology.
41% of businesses had an API security incident last year
In the wake of the digital transformation wave, web application program interfaces (APIs) have experienced exponential growth as the rise of integrated web and mobile-based offerings requires significantly more data sharing across products.
Keep your digital banking safe: Tips for consumers and banks
In this interview for Help Net Security, Reza Zaheri, CSO at Quantum Metric, talks about digital banking security and what can banks, as well as consumers, do to protect their assets and data in today’s digital payment world.
Phishing attacks soar, retail and wholesale most targeted
Zscaler released the findings of a report that reviews 12 months of global phishing data from its security cloud to identify key trends, industries and geographies at risk, and emerging tactics.
How to avoid compliance leader burnout
There has been a lot of talk about the sharp increase in workplace burnout. The WHO defines burnout as a syndrome resulting from chronic workplace stress that has not been successfully managed.
Medical device cybersecurity: What to expect in 2022?
Cybellum released a survey report about medical device cybersecurity, along with trends and predictions for 2022.
Principles for Kubernetes security and good hygiene
Traditional methods of software security are not a good fit for Kubernetes: a renewed set of security implementations are required to make it less vulnerable.
Multi-vector DDoS attacks on the rise, attackers indiscriminate and persistent
Comcast Business published results from a report which provides an overview of the distributed denial of service (DDoS) attack landscape, trends experienced by its customers and insights for measuring and mitigating risks.
The hierarchy of cybersecurity needs: Why EASM is essential to any zero-trust architecture
Zero trust was born out of the critical need to modernize outdated IT architecture, which assumes that all assets within an organization – and attached to it – should be implicitly trusted.
Manage and monitor third-party identities to protect your organization
SecZetta shared a research that demonstrates a clear misalignment between the strategies organizations currently use and what is actually required to protect them from cyberattacks due to third-party vulnerabilities.
Top 5 security analytics to measure
You don’t need a Ph.D. in cybersecurity to recognize the importance of security analytics. Security analytics uses data analysis – often aided by machine learning – to detect security threats and measure the effectiveness of security operations.
Shadow IT is a top concern related to SaaS adoption
Torii announced a report revealing that 69% of tech executives believe shadow IT is a top concern related to SaaS – or cloud application – adoption.
Leadership and recruitment changes needed to address burnout in cybersecurity
Most organizations—across almost every industry—have been forced to implement extensive digital components to their everyday operations so they can function efficiently.
Prevent HEAT attacks to foil ransomware incidents
In this video for Help Net Security, Mark Guntrip, Sr Director, Cybersecurity Strategy at Menlo Security, talks about highly evasive adaptive threats (HEAT attacks).
Fraudsters answer security questions better than customers
Pindrop released a report uncovering how companies might be accidentally inviting fraud, threat mongers from the dark web and bad actors better prepared to pass authentication.
Network attacks increased to a 3-year high
In this video for Help Net Security, Corey Nachreiner, CSO at WatchGuard Technologies, gives a high-level summary of the Internet Security Report for Q4 2021, which revealed all of the threats were up, whether they’re network attacks or malware.
Do you need cyber asset attack surface management (CAASM)?
In this video for Help Net Security, James Mignacca, CEO at Cavelo, talks about cyber asset attack surface management (CAASM), which Gartner recently identified as an emerging technology.
MFA: A simple solution to protect your identity
In this video for Help Net Security, Dan Lohrmann, Field CISO at Presidio, talks about multi factor authentication (MFA) and how everyone should consider it to protect their identity and accounts.
Governments under attack must think defensively
In this video for Help Net Security, Tom Van de Wiele, Principal Security Consultant, Cyber Security Services at WithSecure, talks about cyber threats aimed at governmental organizations.
How to deal with security challenges fueled by multicloud environments
In this video for Help Net Security, Jane Wong, VP of Security Products at Splunk, talks about challenges organizations are facing to secure their multicloud environments.
Modern bank heists: How can they be thwarted?
In this video for Help Net Security, Tom Kellermann, Head of Cybersecurity Strategy at VMware, talks about threats against financial institutions and the findings of the Modern Bank Heists 5.0 report.
How to make DevSecOps a reality
Every AppSec leader recognizes and admits that software development is accelerating, and there’s no way their current approach is going to keep up. It is much better to prevent incidents than react to them after they have already happened.
Don’t ignore risks lurking within your own network
In this video for Help Net Security, Chris Waynforth, AVP Northern Europe at Imperva, talks about insider threats to organizations.
Download: CISO’s guide to choosing an automated security questionnaire platform
Failing to adequately screen suppliers’ security can lead to data breaches, which can shut down operations, damage customer trust and incur hefty regulatory penalties.
eBook: A new breed of endpoint protection
Our workforce has rapidly evolved, with millions of employees permanently working from home or transitioning to a hybrid setting. Unfortunately for cybersecurity, hackers aren’t confined by office walls.
Cyber-attack defense: CIS Benchmarks + CDM + MITRE ATT&CK
CIS Benchmarks map to the MITRE Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK) framework and CIS Community Defense Model (CDM) 2.0.
Cybercriminals deliver IRS tax scams and phishing campaigns by mimicking government vendors
Cybercriminals are leveraging advanced tactics in their phishing-kits granting them a high delivery success rate of spoofed e-mails which contain malicious attachments right before the end of the 2021 IRS income tax return deadline in the U.S. April 18th, 2022.
New infosec products of the week: April 29, 2022
Here’s a look at the most interesting products from the past week, featuring releases from Akamai, Alert Logic, BreachBits, Kudelski Security, ThreatX, and Workato.