Supply Chain Cybersecurity Beyond Traditional Vendor Risk Management
Traditional practices are no longer sufficient in today’s threat landscape. It’s time for cybersecurity professionals to rethink their approach.
CISOs: Throwing Cash at Tools Isn’t Helping Detect Breaches
A survey shows three-quarters of CISOs are drowning in threat detections put out by a sprawling stack of tools, yet still lack the basic visibility necessary to identify breaches.
Time to Get Strict With DMARC
Adoption of the email authentication and policy specification remains low, and only about a tenth of DMARC-enabled domains enforce policies. Everyone is waiting for major email providers to get strict.
MacOS Safari ‘HM Surf’ Exploit Exposes Camera, Mic, Browser Data
Microsoft researchers toyed with app permissions to uncover CVE-2024-44133, using it to access sensitive user data. Adware merchants may have as well.
Chinese Researchers Tap Quantum to Break Encryption
But the time when quantum computers pose a tangible threat to modern encryption is likely still several years away.
American Water Reconnects Its Network Taps After Cyber Incident
The company is beginning to bring its systems back online, though the investigation wages on.
Fortinet Confirms Customer Data Breach via Third Party
The incident is a reminder why organizations need to pay attention to how they store and secure data in SaaS and cloud environments.
Microsoft VS Code Undermined in Asian Spy Attack
A technique to abuse Microsoft’s built-in source code editor has finally made it into the wild, thanks to China’s Mustang Panda APT.
Malicious Actors Sow Discord With False Election Compromise Claims
The FBI and CISA are warning citizens of attempts to convince voters that US election infrastructure has been compromised. (It hasn’t been.)
Cambodian Tycoon Sanctioned for Forced Cyber Labor, Trafficking
The sanctions are unlikely to affect the growing network of criminals who lure victims into working for cybercrime sweat shops around the world.