Security News
Microsoft announced the public preview launch of Win32 app isolation, a new Windows 11 security feature designed to sandbox 32-bit desktop applications.Recently announced during Microsoft's Build 2023 conference, Win32 app isolation uses AppContainer to boost security by mitigating the potential harm caused by compromised applications and protecting the user's privacy.
I'm just back from the sixteenth Workshop on Security and Human Behavior, hosted by Alessandro Acquisti at Carnegie Mellon University in Pittsburgh. SHB is a small, annual, invitational workshop of people studying various aspects of the human side of security, organized each year by Alessandro Acquisti, Ross Anderson, and myself.
A suspected China-nexus threat actor dubbed UNC4841 has been linked to the exploitation of a recently patched zero-day flaw in Barracuda Email Security Gateway appliances since October 2022. "UNC4841 is an espionage actor behind this wide-ranging campaign in support of the People's Republic of China," Google-owned Mandiant said in a new report published today, describing the group as "Aggressive and skilled."
While traditional penetration testing has long been the go-to method for identifying security gaps in a organization's network and web application, a new approach has emerged: penetration testing as a service. PTaaS combines the thoroughness of traditional pen testing with the continuous vigilance of scanners offering a new perspective on security testing.
Egress filters post-compromise, where Ingress filters pre-compromise#. Ingress traffic handling was by then less trendy, it was supposed to be a done deal.
Emergent market forces are swinging back the security pendulum to the identity, causing approaches to IAM implementation to be reinforced. "It has tended to be overshadowed by more high-profile components in an IT security ecosystem. IAM doesn't headline general conference sessions like edge security or AI threat intelligence might do."
A security flaw has been uncovered in the WooCommerce Stripe Gateway WordPress plugin that could lead to the unauthorized disclosure of sensitive information. WooCommerce Stripe Gateway allows e-commerce websites to directly accept various payment methods through Stripe's payment processing API. It boasts of over 900,000 active installations.
Well-designed MFA methods continue to have a place in an organization's security ecosystem, and MFA is required to comply with many global regulations such as HIPPA, Payment Card Industry Data Security Standards, the Cybersecurity and Infrastructure Security Agency, GDPR, and the EU's Payment Services Directive 2. Organizations need protections that go beyond MFA. But MFA controls also generate considerable friction, causing customer frustration and negatively impacting business revenue.
According to ESG, 70% of cybersecurity pros expect budget cuts or freezes this year, which, in turn, will trigger project delays and greater vendor scrutiny. Understaffing and low budgets are ever-present challenges, but security teams are uniquely affected by alert overload and repetitive, manual tasks - especially those facing staff shortages after recent layoffs.
Imagine if all you needed to do to turn a security policy into an enforced workflow was type it out as a prompt.... Modern security teams have witnessed many generations of solutions that make it easier to automate security workflows across tools, from manual scripting, to Security, Automation, Orchestration, and Response tools, to low-code/no-code platforms. Now, the next generation of security automation tooling is here and it's powered by generative AI. How Generative AI Unlocks No-Code Automation for Security.