Sumedh Thakar, president and CEO, Qualys, explores the shift in cyber risk management from a tools-focused approach to strategic risk quantification, highlighting the key role of CISOs in driving this transformation. Boards are now recognizing that "cyber risk is a business risk," he said.
Verizon's 17th annual 2024 Data Breach Investigations Report highlights a troubling trend: The exploitation of vulnerabilities in the wild has tripled, primarily due to ransomware actors targeting zero-day vulnerabilities, such as the MOVEit flaw that triggered numerous data theft incidents.
A threat exposure management startup led by an ex-Claroty executive emerged from stealth to help firms proactively manage security risks and improve their defensive postures. The $30 million windfall will help Nagomi develop a comprehensive platform that integrates security tools and data sources.
A California private equity firm sued Synopsys and accused the systems design behemoth of breaching an exclusivity agreement by shopping its $525 million software integrity business. Sunstone Partners Management said it signed a letter of intent to acquire Synopsys' security testing services unit.
Cybersecurity threats are constantly innovating, and software supply chain attacks are a growing concern. These hidden dangers can infiltrate your entire system through vulnerabilities in seemingly trusted third-party software.
This essential guide empowers you to understand and combat these threats:
Unmask Supply...
Security researchers are warning about a relatively new malware called Latrodectus, believed to be an evolutionary successor to the IcedID loader. It has been detected in malicious email campaigns since November 2023, and recent enhancements make it harder to detect and mitigate.
In the latest weekly update, ISMG editors discussed key insights on OT security from the Cyber Security for Critical Assets Summit in Houston, the implications of a critical Linux utility found to have a backdoor, and a CISO's perspective on comprehensive cloud security strategy.
Threat actors are sending SMS texts to trick banking customers into downloading new and improved Vultur banking malware that interacts with infected devices and alters files. Vultur typically misuses legitimate applications, enabling remote access to the VNC server on targeted devices.
Nation-state attackers apparently backdoored widely used, open-source data compression software as part of a supply chain attack. Malicious code inserted into recent versions of XZ Utils was designed to facilitate full, remote access to an infected system.
Faced with relentless cyberattacks and the shortcomings of existing defenses, Sanaz Yashar embarked on a journey to create a security risk and mitigation platform, transforming frustration into startup Zafran, which emerged from stealth Thursday with more than $30 million in funding.
Fresh zero-day vulnerabilities continue to be actively exploited in the wild by attackers, often for surveillance and espionage purposes, according to the latest annual review of in-the-wild exploits published by Google. In 2023, 97 new zero-days came to light, up from 62 in 2022.
Iran-aligned threat actor TA450, also called MuddyWater, is using fake salary, compensation and financial incentive emails to trick Israeli employees at multinational organizations into clicking malicious links, according to researchers at security firm Proofpoint.
The integration of Oxeye into GitLab’s suite marks a significant leap in the accuracy and efficiency of security scans, directly addressing the challenge of false positives in static application security testing and enhancing software security across development stages, according to GitLab.
A new type of denial-of-service threat can disrupt an estimated 300,000 internet hosts that are at risk of exploitation. Researchers at the CISPA Helmholtz Center for Information Security say attackers are using IP spoofing to entangle two servers in a perpetual communication loop.
Researchers at security firm Salt Security have uncovered multiple vulnerabilities in third-party plug-ins used in ChatGPT, including a zero-click account takeover flaw that was triggered when users attempted to install the plug-in using their ChatGPT accounts.
Our website uses cookies. Cookies enable us to provide the best experience possible and help us understand how visitors use our website. By browsing inforisktoday.asia, you agree to our use of cookies.
