Conventional wisdom recommends to never negotiate with ransomware actors. They can't be trusted. But Mark Lance at GuidePoint Security recently made the case that organizations can gather important information through negotiations, slow down the process and even lower the ransom demand.
This year's massive exploitation of managed file transfer products such as Fortra's GoAnywhere and Progress Software's MOVEit proves that MFTs are a hacker's paradise. Research by John Dwyer of IBM Security X-Force shows why and also reveals a path toward protecting MFTs in the future.
Large enterprises may have hundreds or thousands of APIs. Concerns over API vulnerabilities have been around for years, but most organizations outside of highly regulated industries such as banking have not taken the steps to understand the threats they face, said Richard Bird, CSO at Traceable.
The cyber insurance landscape has evolved significantly over the last 10 to 15 years. Initially, renewals were relatively straightforward, but with the rise of cyberthreats such as ransomware, the market has shifted dramatically to reduce risk exposure.
Browser security and microsegmentation play critical roles in stemming the bleeding from ransomware attacks, as "almost always the attacks come from a point-based browser vector," said Spencer Tall, managing director, AllegisCyber Capital. He shared two approaches to ensure secure browser adoption.
As the potential harm posed by technology increases, the cybersecurity stakes are changing, warned speakers at Black Hat Europe. With governments taking a greater interest in regulating cybersecurity - and perhaps practitioners - experts urged practitioners to collectively guide their own destiny.
"Who here thinks your network or environment will become more complex next year?" a cybersecurity veteran asked the audience at Black Hat Europe this week in London. As attackers' capabilities continue to improve, Jeff Moss said defenders must learn to succeed or fail faster.
Black Hat Europe returns to London, offering deep dives into the latest cybersecurity research and trends, including how to build an open, transparent, but also secure internet; harvesting zero-day flaws before attackers; what we can learn from "metaparasitical" scammers who scam scammers; and more.
Security executives at Black Hat USA 2022 discuss the latest cybersecurity trends from confidential computing and unified threat hunting languages to attack surface management and recovery services, social engineering campaigns and blockchain vulnerabilities.
Black Hat USA 2022 opened with somber warnings from Chris Krebs about why application developers, vendors and the government need to solve major industry challenges. Key security executives also discussed DNS visibility, cloud security, patch management, APT strategies and supply chain woes.
Black Hat 2022 kicks off today with security experts sharing cutting-edge research and insights through demos, technical trainings and hands-on labs. Keynote speaker Chris Krebs will discuss risk trends in cybercrime, geopolitical threats and what they mean for tomorrow's network defenders.
Lacework has used the $1.3 billion raised to strengthen its multi-cloud support, giving customers better visibility across development and production environments. The company is able to identify elusive threats and zero-day vulnerabilities by finding spikes in anomalous activity.
An open architecture, a single pane of glass and robust endpoint security are vital to fueling Trellix's growth in XDR, says Chief Product Officer Aparna Rayasam. Trellix has given customers a unified view into their security posture for configuration, reporting and forensic purposes.
Fortinet has taken advantage of its ASIC chip and network security expertise to drive massive growth in both its SD-WAN and OT security businesses, CEO Ken Xie says. OT devices are difficult to secure on their own, so Fortinet uses its ability to block bad network traffic to keep them secure.
ISMG caught up with 11 security executives in Las Vegas on Tuesday to discuss everything from open-source intelligence and Web3 security to training new security analysts and responding to directory attacks. Here's a look at some of the most interesting things we heard from industry leaders.