Oktacron logo
Cyber security aggregate rss news

Cyber security aggregator - feeds history
image for Telecom Namibia Hit ...

 Firewall Daily

Telecom Namibia has fallen victim to a cyberattack, resulting in the leak of over 400,000 customer files. The Telecom Namibia cyberattack occurred on December 11, 2024, and the company is working closely with both local and international cybersecurity experts to determine the scope of the breach and to mitigate its   show more ...  

impact.  Telecom Namibia's CEO, Stanley Shanapinda, has assured the public that the company is dedicated to addressing the cyberattack responsibly. In a confidential statement, Shanapinda highlighted the company’s recent efforts to strengthen its cybersecurity systems.   Overview of the Telecom Namibia Cyberattack  As cyber incidents have become widespread and a common occurrence, we have recently identified and, in time, successfully contained a cyber reconnaissance mission, thanks to our advanced incident monitoring and detection systems and protocols," he stated. Shanapinda also promised that Telecom Namibia would release a detailed statement regarding the cyberattack soon.  The cyberattack on Telecom Namibia was allegedly carried out by a notorious ransomware group known as Hunters International. This ransomware-as-a-service operation was able to exfiltrate 626.3GB of data, including 492,633 files, before threatening to release the stolen information unless their ransom demands were met, reported the New Era newspaper.   Once the ransom deadline passed, hundreds of sensitive customer records, including personal identification details, addresses, and banking information, were leaked and began circulating on social media.  Concerns over the Cyberattack on Telecom Namibia The Communications Regulatory Authority of Namibia (Cran) has expressed grave concern over the Telecom Namibia cyberattack. Cran’s CEO, Emilia Nghikembua, emphasized the seriousness of cybersecurity in the country. Through the Namibia Cyber Security Incident Response Team (NAM-CSIRT), Cran promptly responded upon identifying the attack, and continues to support the affected operator in mitigating its impact," Nghikembua said.  Nghikembua also noted that while Namibia currently lacks a dedicated cybercrime and data protection law, the government is committed to ensuring compliance with international best practices in cybersecurity. She encouraged stakeholders to adopt globally recognized security measures such as encryption and regular security assessments to enhance the resilience of the country's critical infrastructure. The protection of national critical infrastructure requires collective action, strategic planning, and a commitment to compliance with global standards," she added.  Conclusion   The Telecom Namibia cyberattack, with over 400,000 files leaked and sensitive customer data exposed, underscores the urgent need for stronger cybersecurity measures. The leaked information circulating on social media heightens the risk of targeted phishing attacks, where cybercriminals could use the stolen data to exploit individuals further. This is an ongoing story, and The Cyber Express will be closely monitoring the situation. We’ll update this post once we have more information of the attack or any new statements from the company.  

image for December 2024 Cyble ...

 Cyber News

The latest Sensor Intelligence Report from Cyble, dated December 4–10, 2024, sheds light on a troubling increase in cyber threats, including malware intrusions, phishing scams, and attacks targeting vulnerabilities in Internet of Things (IoT) devices.   This report, compiled from real-time data captured by   show more ...  

Cyble’s extensive network of Honeypot sensors, offers critical insights into exploitation attempts, malware, financial fraud, and Common Vulnerabilities and Exposures (CVEs).  Overview of the Cyble Sensor Intelligence Report  Cyble’s cutting-edge Sensor Intelligence Report provides a comprehensive analysis of the most prevalent cyber threats over the past week. Among the key findings, there is a notable surge in exploitation attempts, malware outbreaks, and vulnerabilities within both IoT devices and widely-used software platforms.   Cyble’s Global Sensors Intelligence (CGSI) network played a crucial role in detecting several attack vectors during this period. These attacks primarily targeted high-profile vulnerabilities such as those found in the Mirai and Gafgyt malware variants, along with exploits affecting the Telerik UI and Cisco ASA platforms. One of the standout observations was the increased frequency of financial fraud attempts, which were often delivered through phishing campaigns designed to steal personal and financial data. These campaigns, many of which were disguised as legitimate software updates or system alerts, continue to present online risks to businesses and individuals alike.  Focus on IoT Vulnerabilities  Among the many attack vectors identified, IoT vulnerabilities emerged as a primary target for cybercriminals. The rapid proliferation of connected devices has created an expansive attack surface, leaving critical systems exposed. In this report, Cyble emphasizes the importance of securing IoT devices against exploitation. A variety of vulnerabilities were identified, many of which allowed attackers to remotely access devices and potentially control them. These vulnerabilities are particularly concerning, as they may compromise entire networks of interconnected systems.  Malware, Phishing, and CVE Exploits  The Sensor Intelligence Report also provides in-depth analysis on the rise of specific malware strains and exploitation attempts targeting software vulnerabilities. Below are key highlights:  Malware: AppLite Banker Trojan  One of the most interesting threats identified was the AppLite Banker Trojan, a malware designed to steal financial data. This malware is primarily distributed through phishing emails disguised as customer relationship management (CRM) applications. Once installed, it leverages Android’s Accessibility Services to overlay fake login screens on popular banking apps, tricking users into entering their credentials.  What makes AppLite particularly dangerous is its advanced evasion techniques. It manipulates APK file structures, making it difficult for static analysis tools to detect it. After gaining access to a device, the Trojan can exfiltrate sensitive financial data, execute commands remotely, and control the device through features like screen unlocking and simulating user interactions. With its multilingual capabilities, this malware is becoming a global threat, targeting users across various regions.  CVE Exploits: A Growing Concern  Cyble’s Sensor Intelligence Report also highlights the continued exploitation of numerous CVEs, with CVE-2020-11899 standing out as the most frequently attacked. This vulnerability, which affects the Treck TCP/IP stack, allows attackers to trigger an out-of-bounds read in IPv6 communications. During the reporting period, a staggering 25,736 attempts to exploit this vulnerability were detected. Other notable CVEs under attack include:  CVE-2019-0708: A remote code execution vulnerability in Remote Desktop Services that continues to be actively targeted.  CVE-2021-44228: The infamous Log4j vulnerability, which remains a major avenue for cybercriminal exploitation.  These CVEs, along with many others, have been exploited in increasingly sophisticated attacks, demonstrating the critical need for organizations to patch vulnerabilities in a timely manner.  Case Studies on Exploited Vulnerabilities  The report also examines several vulnerabilities in widely-used software systems. Key examples include:  PHP CGI Argument Injection Vulnerability (CVE-2024-4577): This critical vulnerability in PHP configurations allows attackers to execute arbitrary commands via specially crafted URL parameters. Organizations are advised to patch PHP configurations and limit access to prevent exploitation.  OSGeo GeoServer Remote Code Execution (CVE-2024-36401): Cyble identified a remote code execution flaw in older versions of GeoServer, which allows unauthenticated users to run arbitrary code. The report recommends updating GeoServer to versions 2.23.6, 2.24.4, or 2.25.2 to mitigate the risk.  Ruby SAML Improper Signature Verification (CVE-2024-45409): This vulnerability in the Ruby-SAML library could allow attackers to forge SAML responses and gain unauthorized access to systems. Updating to Ruby-SAML version 1.17.0 is recommended.  Cisco IOS XE Web UI Privilege Escalation (CVE-2023-20198, CVE-2023-20273): Exploitation of these vulnerabilities allows attackers to escalate privileges and gain root access to affected systems, with active attacks continuing.  Conclusion   To mitigate the growing cyber threats identified in Cyble’s Sensor Intelligence Report, organizations must adopt a proactive approach by regularly updating software and hardware to patch vulnerabilities, leveraging threat intelligence feeds to block malicious IPs, enforcing strong passwords and multi-factor authentication, and continuously monitoring for Indicators of Compromise (IoCs) such as suspicious IP addresses and file hashes. Regular vulnerability audits should also be conducted to identify and remediate misconfigurations.  

image for Cyberattack Targets ...

 Cyber News

Rhode Island is tackling with a major cybersecurity breach that has compromised the personal information of thousands of residents. The Rhode Island cyberattack targeted the state’s online system for delivering health and human services benefits, known as RIBridges, potentially exposing sensitive data such as names,   show more ...  

addresses, dates of birth, Social Security numbers, and even banking information. Governor Daniel McKee and his administration are urging residents to take immediate action to protect their personal information as the threat of leaked data looms. Here’s what you need to know about the cyberattack, its implications, and the steps being taken to address the situation. The Rhode Island Cyberattack: What Happened? On December 5, 2024, Rhode Island’s vendor, Deloitte, informed state officials about a potential cyberattack on RIBridges system. At that time, it was unclear if sensitive information had been breached. Following an internal investigation and the implementation of additional security measures, Deloitte confirmed on December 10 that a breach had occurred. Hackers provided a screenshot of file folders from the system as proof, which likely contained personal data of Rhode Island residents. By December 13, malicious code was detected within the system, leading the state to take RIBridges offline to contain the threat. According to Deloitte, there is a high probability that cybercriminals have accessed files with personally identifiable information (PII). The attackers are demanding a ransom, but state officials have not disclosed the specifics of these demands. Who Is Affected? The data breach impacts individuals who have applied for or received benefits through the RIBridges system. Programs managed through this platform include: Medicaid Supplemental Nutrition Assistance Program (SNAP) Temporary Assistance for Needy Families (TANF) Child Care Assistance Program (CCAP) Rhode Island Works (RIW) Long-Term Services and Supports (LTSS) Health insurance purchased through HealthSource RI The state is still determining the full scope of the breach, but it’s clear that both current and former beneficiaries could be affected. What Information Was Compromised? The stolen data may include: Names Addresses Dates of birth Social Security numbers Banking information Deloitte is continuing its analysis to determine the exact extent of the breach. State Response and Measures Taken Governor McKee emphasized the urgency of addressing this breach during a media briefing on Friday, December 15. The state has taken the following actions: System Shutdown: RIBridges was taken offline on December 13 to mitigate the threat and begin remediation. Law Enforcement Involvement: Federal agencies, including law enforcement and the Rhode Island State Police, are assisting with the investigation. Dedicated Call Center: Rhode Islanders can contact a toll-free hotline, operated by Experian, for guidance on protecting their personal information. The call center is available Monday through Friday from 9 a.m. to 9 p.m. at 833-918-6603. Free Credit Monitoring: Impacted households will receive a letter by mail explaining how to access free credit monitoring services. What Residents Should Do Now The state advises Rhode Islanders to take proactive steps to safeguard their personal information: Monitor Financial Accounts Check bank accounts and credit card statements for any unauthorized activity. Contact your bank for guidance on securing your accounts. Freeze Your Credit Consider placing a credit freeze or fraud alert with the three major credit bureaus to prevent unauthorized use of your information. Credit Bureau Contact Information: Equifax: 1-800-349-9960 Experian: 1-888-397-3742 TransUnion: 1-888-909-8872 Update Your Passwords Change any reused or weak passwords to strong, unique ones. Use a password manager to securely store and manage your credentials. Stay Alert for Scams Be cautious of phishing emails or phone calls attempting to exploit this breach. Never provide personal information unless you are certain of the recipient’s identity. Stay Informed Visit the state’s dedicated website for updates on the situation. How Is the State Addressing the Breach? The state and Deloitte are working together to: Identify how the breach occurred. Remediate vulnerabilities in the system. Restore the RIBridges platform as quickly as possible. Law enforcement continues to investigate the cyberattack, but no further leads have been disclosed at this time. Key Takeaways for Residents While no instances of identity theft have been reported so far, residents should remain vigilant. Cybersecurity breaches of this magnitude can have long-term consequences, particularly when sensitive information like Social Security numbers and banking details are involved. Governor McKee and state officials have expressed their commitment to transparency and timely updates. However, the incident underlines the importance of strong cybersecurity measures, especially for systems handling sensitive data. What’s Next? The state continues to investigate the breach and implement measures to prevent future attacks. Deloitte, as the system vendor, will likely face scrutiny over its cybersecurity protocols and response time. For Rhode Islanders, the immediate focus should be on securing personal information and staying informed about developments in this case.

image for CISA and EPA Warn: I ...

 Firewall Daily

The Cybersecurity and Infrastructure Security Agency (CISA) and the Environmental Protection Agency (EPA) have jointly released a crucial fact sheet highlighting the cybersecurity risks posed by Internet-exposed Human Machine Interfaces (HMIs) in the Water and Wastewater Systems (WWS) sector. The fact sheet, titled   show more ...  

Internet-Exposed HMIs Pose Cybersecurity Risks to Water and Wastewater Systems, offers practical guidance for WWS facilities to mitigate the risks associated with unsecured HMIs and protect their operations from malicious cyber activity.  HMIs are integral to the operation of supervisory control and data acquisition (SCADA) systems, which are commonly used in Water and Wastewater Systems (WWS) to monitor and control a wide array of infrastructure. These systems are often connected to programmable logic controllers (PLCs), which manage real-time operations. However, when HMIs are exposed to the internet without proper security measures, they become vulnerable to exploitation by cybercriminals and other threat actors.   The Dangers of Exposed Human Machine Interfaces in WWS   Human Machine Interfaces serve as the critical bridge between operational technology (OT) and system operators, allowing them to monitor and control various aspects of WWS operations. However, when HMIs are exposed to the internet, they can be accessed by unauthorized users, putting vital water and wastewater operations at risk.  According to the joint fact sheet, unauthorized access to exposed HMIs allows malicious actors to:  View sensitive information, including graphical user interfaces, distribution system maps, event logs, and security settings.  Make unauthorized modifications, potentially disrupting water and wastewater treatment processes, which can lead to severe operational impacts.  One distressing trend that has emerged in recent years is the ability of threat actors to easily identify and exploit internet-exposed HMIs with weak or no cybersecurity defenses. In 2024, pro-Russia hacktivists exploited vulnerabilities in exposed HMIs at multiple Water and Wastewater Systems facilities.  These attackers manipulated system settings to push water pumps and blower equipment beyond their safe operating limits, altered critical settings, deactivated alarm mechanisms, and locked out system operators by changing administrative passwords. The result was a forced reversion to manual operations, disrupting services.  Mitigation Strategies for Securing HMIs  In response to these growing concerns, CISA and EPA have outlined several mitigations that WWS organizations should implement to enhance the security of their Human Machine Interfaces and protect against cyber threats. These recommendations are vital to hardening remote access to HMIs and ensuring that only authorized personnel can interact with these systems.  Organizations should identify all HMIs and related systems that are accessible from the public internet. This allows for a comprehensive understanding of the vulnerabilities within the system.  If possible, disconnect any internet-facing HMIs from the public network. If disconnection is not feasible, it is essential to secure them with strong access controls, including complex usernames and passwords.  Multifactor authentication should be implemented for all remote access to HMIs and OT networks, adding an extra layer of security to the system.  Enabling a demilitarized zone (DMZ) or bastion host at the OT network boundary can isolate sensitive systems from the broader internet, making it harder for unauthorized actors to penetrate internal networks.  Keeping systems and software up to date with the latest security patches is essential for closing vulnerabilities that could be exploited by cybercriminals.  Only allow authorized IP addresses to access the HMIs, reducing the risk of unauthorized remote login attempts.  It is important to log and review all remote logins to HMIs, paying attention to any failed login attempts or unusual login times, which could indicate suspicious activity.  Conclusion  CISA and the EPA offer valuable resources to help Water and Wastewater Systems (WWS) strengthen cybersecurity, including free vulnerability scanning and guidance like CISA’s Top Cyber Actions for Securing Water Systems and the EPA’s cybersecurity recommendations.   Tools like CISA’s Stuff Off Search help identify internet-exposed assets. As cyber threats increase, WWS must adopt strong security measures, such as access controls, multifactor authentication, and regular updates, to protect critical infrastructure and ensure the safety of water and wastewater services. 

image for Telegram account hac ...

 Tips

Account hijacking in Telegram has become a serious criminal business in todays world. Scammers employ sophisticated methods to steal access to accounts, and then use them to attack other users through deepfakes, social engineering, and other techniques. Heres how it typically works: having stolen an account, scammers   show more ...  

send phishing messages to all its contacts — such as Hi, I urgently need money. Can you help me?, Please vote for me if you have a moment or Youve received a gift – a one-year subscription to Telegram Premium — to hijack even more accounts. These messages often have phishing links at the other end, which look legitimate — for example, https://t.me/premium — but actually redirect users to fraudulent websites. If you click the link and follow the scammers instructions, youll likely lose access to your Telegram account (especially if you havent set up two-step verification in Telegram). Your contacts may then receive similar phishing messages from your account. Stolen or fake accounts can also be used for complex targeted attacks — sometimes employing deepfakes to deceive employees of organizations. You might encounter messages allegedly from company management that include personal details like your full name, mentioning some kind of inspection by government authorities, and demanding confidential information or financial assistance in an air of complete secrecy. These are always fake. Meanwhile, the original Telegram account owner might not even realize at first that their account has been compromised. They continue chatting with friends, reading their favorite channels, and assuming theyre safe from scammers. How is this possible? This happens because Telegram allows multiple sessions to the same account from different devices. Having gained access to your account, scammers open a session on their device without closing your active sessions. Then they send messages, and immediately delete them on the senders side only. In this way, recipients see the messages, but the victim doesnt. As we are seeing, scammers are interested in everyone — even the most ordinary of Telegram users. In this article, we address two key questions: how to know if your Telegram account has been hacked, and if it has, what should you do? How to know if your Telegram account has been hacked The following are possible signs that your account has been hacked: your username or profile picture has changed; youve been entered into some suspicious competitions; you see a message sent from your account thats then immediately deleted; your friends tell you theyve received strange messages from you that you cant see. Lets go through these one by one… Changes to your username or profile picture. Scammers might alter your username to include a phishing link or put the link in your bio. They might also modify your profile picture to their advantage. For example, adding a note to your photo asking for help: Im in trouble, please help me however you can. Any change of information without your knowledge indicates a compromise. In short, if something has changed by itself, then most likely attackers are responsible: youve been hacked. Participation in suspicious activities. Scammers might send you a link to activate a Telegram Premium gift subscription, and if you activate it, your account will be stolen. This is a fairly popular account hijacking scam, which weve covered in detail on the Kaspersky Daily blog. Popular, yes — but far from the only one. Heres another one: asking for help to win a vote. Friends report receiving strange messages from you, which you dont see. Scammers work hard to conceal the fact that your account has been hacked. They delete all messages sent from your account on the senders side. The recipient gets the message (and can even reply), but you wont know about it unless your friends inform you. You receive a login code for a new device. However, you definitely didnt attempt to log in, and all your known devices are already connected to your account. Scammers usually delete such messages immediately, but if you spot a request for such a code, your account is under attack right there and then. If you notice any of these signs, act quickly — youve only 24 hours to save your account. Why 24 hours? Telegram has built-in protection against account theft — preventing new devices from terminating active sessions on other devices within the first 24 hours. After 24 hours, the scammers will end all other sessions on your account, and youll lose all access. What to do if your Telegram account has been hacked Here are some basic countermeasures to take if you detect signs of a Telegram account hack. Terminate all unknown sessions To do this, go to Settings -> Devices -> Terminate all other sessions (in desktop clients, this section might be called Active sessions). This will log out all sessions except the current one, cutting off the scammers access to your account. How to terminate sessions in Telegram Alternatively, you can choose specific sessions to terminate by selecting them and clicking Terminate Session, or by clicking Edit in the top right corner of the screen. Contact technical support To do this, navigate to Settings -> Ask a question to reach Telegram support. While this might seem a safe option, the 24-hour timeline could play into the scammers hands here: Telegram support is handled by volunteers, so a response may take time in coming. So first of all, you should terminate all unknown sessions (see above), and enable two-factor authentication (see below). If you proceed with contacting support, youll enter a chat with the Volunteer Support bot. Note that this bot can only be initiated through Settings -> Ask a question — remember this to avoid falling victim to scams. The bot will provide instant FAQ answers, but theres no option for Account hacked in its standard menu. To get help from a human, either select Skip and process to volunteers, or type your request in the chat, and press Yes, redirect me. Telegram will inform you that most volunteers communicate in Russian or English. How to contact Telegram support and speak to a person instead of a bot If youve already lost access to your Telegram account, theres another way to contact Telegram support: fill out a form on the official website specifying the issue, your phone number, and your email. Recover access to your Telegram account via SMS code If more than 24 hours have passed and you no longer have access to your account on any device (because the hackers ended all your sessions), try recovering it with your phone number: Open the Telegram app Enter your phone number and confirm it Select Tap to get a code via SMS Enter the received code Enter your two-step verification password, if set End all other sessions Bear in mind that you need to act quickly here: once you enter your phone number, all devices with an active session linked to this number will receive a notification in Telegram. This means the hackers will know youre attempting to regain access. Create a new Telegram account with the same number If you cant recover your account, the only way to continue using Telegram with the same phone number is to delete the old account and create a new one. However, in this case, youll permanently lose your chat history and administrator rights in your channels. You can only delete your Telegram account if you have access to it, or if youve set up two-step verification. If youve at least one open session, go to Settings -> Privacy and Security -> Automatically delete my account if away for -> Delete Account Now. If you dont have access to your account but have two-step verification set up, you can delete the account as follows: Open the Telegram app Enter your phone number Select Forgot password? Select Unable to access Select Reset account If you dont have access to your account on any device, and two-step verification is disabled, you cant delete the account. Warn your friends and family about the loss of access so they dont fall for scams sent from your account. How to protect your Telegram account from being hacked The best thing you can do right now to protect your account is to set up two-step verification. This means a password will be required in addition to a code when logging in from a new device. This additional security factor will make hacking more difficult, give you more time to react, and allow you to delete the account in case you lose access. Go to Settings -> Privacy and Security -> Two-Step Verification. Next, create a password, enter a recovery email, and confirm it by entering the code you receive. The password should be strong and unique to make it difficult for scammers to guess. To create and store secure passwords, we recommend using Kaspersky Password Manager. Be sure to share this guide with friends and family — especially those new to Telegram, to help them stay safe in the digital space.

image for Does Desktop AI Come ...

 Feed

Artificial intelligence capabilities are coming to a desktop near you — with Microsoft 365 Copilot, Google Gemini with Project Jarvis, and Apple Intelligence all arriving (or having arrived). But what are the risks?

image for Microsoft Teams Vish ...

 Feed

A thwarted attack demonstrates that threat actors using yet another delivery method for the malware, which already has been spread using phishing emails, malvertising, hijacking of instant messages, and SEO poisoning.

 Government

The sanctions aim to impact a wide range of actors, from those involved in GRU Unit 29155 — a Russian military intelligence unit that has been accused of cyberattacks and assassinations — through to other intelligence agency staff and private individuals involved in spreading Russian propaganda.

 Feed

The Security Service of Ukraine (SBU or SSU) has exposed a novel espionage campaign suspected to be orchestrated by Russia's Federal Security Service (FSB) that involves recruiting Ukrainian minors for criminal activities under the guise of "quest games." Law enforcement officials said that it detained two FSB agent groups following a special operation in Kharkiv. These groups, per the agency,

 Feed

Cybersecurity researchers are calling attention to a new kind of investment scam that leverages a combination of social media malvertising, company-branded posts, and artificial intelligence (AI) powered video testimonials featuring famous personalities, ultimately leading to financial and data loss. "The main goal of the fraudsters is to lead victims to phishing websites and forms that harvest

 Feed

Cybersecurity researchers have discovered a new PHP-based backdoor called Glutton that has been put to use in cyber attacks targeting China, the United States, Cambodia, Pakistan, and South Africa. QiAnXin XLab, which discovered the malicious activity in late April 2024, attributed the previously unknown malware with moderate confidence to the prolific Chinese nation-state group tracked Winnti (

 Feed

A Serbian journalist had his phone first unlocked by a Cellebrite tool and subsequently compromised by a previously undocumented spyware codenamed NoviSpy, according to a new report published by Amnesty International. "NoviSpy allows for capturing sensitive personal data from a target's phone after infection and provides the ability to turn on the phone's microphone or camera remotely," the

 Feed

This past week has been packed with unsettling developments in the world of cybersecurity. From silent but serious attacks on popular business tools to unexpected flaws lurking in everyday devices, there’s a lot that might have flown under your radar. Attackers are adapting old tricks, uncovering new ones, and targeting systems both large and small. Meanwhile, law enforcement has scored wins

 Feed

With the evolution of modern software development, CI/CD pipeline governance has emerged as a critical factor in maintaining both agility and compliance. As we enter the age of artificial intelligence (AI), the importance of robust pipeline governance has only intensified. With that said, we’ll explore the concept of CI/CD pipeline governance and why it's vital, especially as AI becomes

 Feed

Cybersecurity researchers have shed light on a previously undocumented aspect associated with ClickFix-style attacks that hinge on taking advantage of a single ad network service as part of a malvertising-driven information stealer campaign dubbed DeceptionAds. "Entirely reliant on a single ad network for propagation, this campaign showcases the core mechanisms of malvertising — delivering over

 Threat Lab

The managed service provider (MSP) industry is booming with opportunities. At the same time, MSPs face the challenge of balancing customer satisfaction with profitability, making strategic decisions more important than ever. For 35% of MSPs, building cyber resiliency for customers is a top strategic priority, but   show more ...  

that goal often runs up against resource constraints and rising operational costs.[i] To stay competitive, MSPs are focusing on improving operational efficiency (35%) and keeping costs under control (33%).[ii] One of the smartest ways to tackle these strategic goals is by partnering with OpenText to deliver managed detection and response (MDR) services. This partnership empowers MSPs to offer a cutting-edge, fully managed detection and response service, taking the weight off operational costs and simplifying the complexity of building and managing an in-house MDR solution. Here are five ways OpenText MDR helps MSPs overcome their biggest challenges: 1. Filling the security staff resource and skills gap Staffing can be a perpetual challenge for MSPs, particularly when it comes to hiring and retaining skilled cybersecurity professionals. With a global shortage of 4.8 million cybersecurity experts, this issue is only becoming more pressing. MSPs feel the strain in several key areas, including: Managing an overwhelming volume of alerts with a limited team Cultivating the advanced skills needed to thoroughly investigate and prioritize threats Attracting and retaining top security talent to close skills gaps and support business growth OpenText MDR tackles this challenge for MSPs head-on by providing you with a fully managed or co-managed MDR partnership. With OpenText MDR, MSPs can access 24/7/365 security expertise and continuous threat monitoring without the cost or complexity of building an in-house SOC. This not only eases the pressure on your internal teams but ensures a high-level of security coverage for your customers at all times. 2. Streamlining alert management Detecting advanced threats requires a sophisticated approach to monitoring a customer’s attack surface. This is where SIEMs come in—essential for correlating data and identifying threats. However, SIEMs can be complex to configure, manage, and tune, which can lead to a high volume of false positives. For MSPs with limited resources, this flood of irrelevant alerts can overwhelm teams and drain operational efficiency. OpenText MDR solves this by leveraging advanced threat intelligence to correlate security logs and reduce false positives, all while managing the SIEM and monitoring alerts for you. By continuously prioritizing critical threats, our experts handle the complexity of alert management, allowing MSPs to focus on what matters most—securing their customers—without the burden of filtering through a flood of false alarms. 3. Accelerating incident response With a flood of alerts constantly coming in and the need to pivot between multiple consoles to investigate, MSP security teams often struggle with slow, time-consuming incident response. The pressure to act quickly is high, as swift action is essential to prevent the disastrous outcomes of a breach. However, many teams find themselves bogged down, bouncing between disparate tools and struggling to identify and respond to threats in real-time. OpenText MDR addresses this challenge with fast, proactive monitoring and continuous threat hunting to detect suspicious activity early. Our dedicated experts streamline incident response by quickly identifying threats and escalating them within 15 minutes, ensuring MSPs can act fast and minimize the impact of potential breaches. 4. Simplifying security management across complex environments Managing a customer’s complex environment can be challenging for MSPs. With diverse security tools, large volumes of data, and multi-environment deployments, the complexity of managing each unique environment can overwhelm MSP teams, stretching resources thin and hindering effective security management. Delivering cybersecurity services that support your diverse customer environments requires a solution that integrates seamlessly and simplifies management without adding to the burden. OpenText MDR makes it easy to support your customer environments by offering a fully integrated solution that seamlessly supports your MSP partner and tools ecosystem. With AI-driven automation, OpenText MDR processes vast amounts of data quickly, integrating effortlessly with over 500 tools and services. Its lightweight agent ensures easy deployment across multiple environments, providing end-to-end visibility through a single dashboard. This not only streamlines security management but also helps MSPs leverage their existing investments while benefiting from expert human analysts guiding the process. 5. Driving revenue growth without barriers to entry For MSPs, staying competitive and standing out in your region requires offering innovative solutions that meet customer needs without the complexity and barriers often associated with new vendor partnerships. Having an MDR offering can be a key driver for growth, but the challenge lies in finding an MDR vendor that has both a cutting-edge solution and flexible licensing, without the constraints of long-term contracts or rigid terms.OpenText MDR addresses this by offering a subscription-based model with no minimum contract, making it easy to integrate into your existing service offerings. MSPs can access additional services like penetration testing, vulnerability management, and custom incident response plans as needed, with simple, integrated billing through OpenText’s Secure Cloud Platform. This flexibility allows you to scale your MSPs cybersecurity services as your business grows. Discover how OpenText MDR can empower your MSP to overcome challenges and drive growth. [i] Datto 2024 Global State of the MSP Report [ii] Datto 2024 Global State of the MSP Report The post Top 5 roadblocks for MSPs and how OpenText MDR clears the way appeared first on Webroot Blog.

 Feed

A view of the H2 2024 threat landscape as seen by ESET telemetry and from the perspective of ESET threat detection and research experts

 1 - Cyber Security News Post

Source: www.hackerone.com – Author: johnk. In February, we opened up the first ever HackerOne Community T-shirt design contest, and we were blown away by your creativity!  We challenged you to reflect the spirit of our community, showing how ingenuity, diversity and collaborative forces make   show more ...  

#TogetherWeHitHarder. Dozens of submissions were received between February 23 and March […] La entrada Announcing the Community T-shirt Winner(s) – Source:www.hackerone.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 1 - Cyber Security News Post

Source: www.hackerone.com – Author: johnk. We have more than 1,300 customers on the HackerOne platform, so we know what it takes to build a successful bug bounty program. We also know that companies of any size and in any industry can successfully design, launch, and run a bounty program. All you need is some   show more ...  

experience, […] La entrada Learn How HackerOne Can Help You Crawl, Walk, or Run Your Way to a Bug Bounty Program – Source:www.hackerone.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 1 - Cyber Security News Post

Source: www.hackerone.com – Author: johnk. Do you know where your data is? Your customers will know in 2020 thanks to the new California Consumer Privacy Act (CCPA). The collection of personal data and the privacy issues surrounding it have been a hot topic the past several years, especially in the security   show more ...  

industry. Governments are taking […] La entrada What the California Consumer Privacy Act Means For You – Source:www.hackerone.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 1 - Cyber Security News Post

Source: www.hackerone.com – Author: HackerOne. Hacking has a storied history. Hackers have always been curious people searching for new and creative ways to understand, deconstruct, and yes break systems. This intense creativity and the positive power it brings is perfectly evident in bug bounty.  In just 7   show more ...  

years, hackers on HackerOne have managed to make […] La entrada Hackers have earned more than $50M in bug bounty cash on HackerOne: Time to celebrate! – Source:www.hackerone.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 1 - Cyber Security News Post

Source: www.hackerone.com – Author: johnk. What is the current state of security in the financial sector? How can governments contribute to this security?  These questions were addressed by Christopher Parsons in his testimony before the Standing Committee on Public Safety and National Security (SECU) in   show more ...  

Canada. Christopher is a research associate in the Citizen Lab […] La entrada Hacker-Powered Security, Government Support Needed to Protect Financial Services Consumers from Application Vulnerabilities – Source:www.hackerone.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 0CISO2CISO

Source: www.hackerone.com – Author: johnk. Please find below a list of Feature updates/releases that happened in our first quarter! You can find more details about each one by going to our Changelog. Hacker Platform Improvements  Indian Rupee Payments Hackers in India will no longer lose a portion of their   show more ...  

bounty to transfer fees as we […] La entrada Product Updates and Enhancements – Source:www.hackerone.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Beyond

Source: www.cyberdefensemagazine.com – Author: News team In the ever-evolving landscape of cryptography, traditional encryption methods safeguarding data at rest and in transit remain foundational to cybersecurity strategies. However, the security of decrypted data actively used within applications continues to   show more ...  

be a pressing concern, exposing vulnerabilities to cyber-attacks, including malicious redirects and malware intrusions. This critical […] La entrada Beyond Encryption: Advancing Data-in-Use Protection – Source: www.cyberdefensemagazine.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 CSOonline

Source: www.csoonline.com – Author: News Analysis 16 Dec 20248 mins GovernmentHealthcare IndustrySecurity In the wake of ransomware attacks on healthcare providers, US legislators have introduced three competing bills to improve cybersecurity in the industry; none are likely to pass in this session of congress.   show more ...  

Six months after Congressional hearings that promised action on the massive […] La entrada Future of proposed US cybersecurity healthcare bills in doubt – Source: www.csoonline.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 CSO and CISO

Source: www.csoonline.com – Author: CISOs share insights on lessons they have learned in 2024 about AI coding assistants, transparency with customers, deepfakes, third-party threats and more. This year has been challenging for CISOs, with a growing burden of responsibility, the push to make cybersecurity a   show more ...  

business enabler, the threat of legal liability for security incidents, […] La entrada Security leaders top 10 takeaways for 2024 – Source: www.csoonline.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 CSOonline

Source: www.csoonline.com – Author: From major IT outages and cyberattacks crippling critical infrastructure, to extreme weather testing global resilience, organizations face a relentless barrage of security and communications challenges, with the potential to also impact human safety. Against this backdrop,   show more ...  

BlackBerry has emerged as the market leader in innovative technologies that don’t just respond to […] La entrada BlackBerry’s Critical Communications: The Triple Shield Available to Safeguard Organizations and Governments – Source: www.csoonline.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 CSOonline

Source: www.csoonline.com – Author: The recent breaches of sovereign telecom networks in the United States, underscores how highly connected but fragmented public networks are increasingly vulnerable to sophisticated attacks.  Another rising concern is the blind trust organizations and individuals put into   show more ...  

consumer-grade messaging apps such as WhatsApp to share government and commercially-sensitive information.  Some of […] La entrada The Hidden Risks of Mobile Calls and Messages: Why End-to-End Encryption is Just the Starting Line – Source: www.csoonline.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cloud Security

Source: www.csoonline.com – Author: Bevor Sie in einen Cloud Access Security Broker investieren, sollten Sie diesen Artikel lesen. Lesen Sie, worauf es bei der Wahl eines Cloud Access Security Broker ankommt – und welche Anbieter was genau zu bieten haben. Jack the sparow | shutterstock.com Ein Cloud   show more ...  

Access Security Broker (CASB) sitzt zwischen Enterprise-Endpunkten und […] La entrada Cloud Access Security Broker – ein Kaufratgeber – Source: www.csoonline.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 1 - Cyber Security News Post

Source: www.hackerone.com – Author: johnk. Live hacking events have been a part of our company DNA since 2016. We connect the community of hackers and customers every day on the HackerOne platform, but bringing people together in-person in cities around the world is a special experience. The power of   show more ...  

collaboration came through in full-force for […] La entrada Airbnb and Verizon Media participate in 3rd annual h1-415 live hacking event including a cybersecurity mentorship program – Source:www.hackerone.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 0CISO2CISO

Source: www.hackerone.com – Author: johnk. Please welcome the Xiaomi Security Center (MiSRC) to HackerOne! Xiaomi, one of the world’s largest consumer electronics manufacturers, is launching a vulnerability disclosure program (VDP) on April 1, 2019 as part of its commitment to security and privacy for its   show more ...  

millions of users. The multi-billion dollar company is tapping the […] La entrada Xiaomi Security Center Welcomes Security Research with HackerOne Partnership – Source:www.hackerone.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Blog

Source: securityboulevard.com – Author: mykola myroniuk Websites have become indispensable tools for healthcare organizations to connect with patients, streamline operations, and enhance service delivery. Modern websites are composed of components that “build” unique user experiences in real time.However,   show more ...  

the use of tracking technologies on these websites presents unique challenges in complying with the Health Insurance […] La entrada Navigating HIPAA Compliance When Using Tracking Technologies on Websites – Source: securityboulevard.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cloud Security

Source: securityboulevard.com – Author: Amy Cohn Can Cloud-Native Security Be a Game-Changer for Your SOC Teams? In today’s complex digital landscape, organizations are increasingly challenged to protect their data while ensuring compliance with evolving cybersecurity regulations. From finance to healthcare,   show more ...  

businesses are recognizing the need for a more comprehensive approach to securing machine identities, especially […] La entrada Empower Your SOC Teams with Cloud-Native Security Solutions – Source: securityboulevard.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: securityboulevard.com – Author: Amy Cohn Why Should Proactive Security Management of Machine Identities Be a Priority? With the rise of digitalization across various sectors, organizations have ramped up their security measures to safeguard sensitive data. An area that often gets overlooked in this   show more ...  

process, yet is crucial to robust data security, is the management […] La entrada Proactively Securing Machine Identities to Prevent Attacks – Source: securityboulevard.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 1 - Cyber Security News Post

Source: www.hackerone.com – Author: johnk. The only constant in life is change. That statement couldn’t be more true in the world of cybersecurity, and no one knows that better than AMERICAN SYSTEMS CIO and CISO Brian Neely. He has over 23 years of experience in information technology. As a defense   show more ...  

contractor, AMERICAN SYSTEMS provides IT […] La entrada Q&A with Brian Neely, CIO & CISO of AMERICAN SYSTEMS – Source:www.hackerone.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 1 - Cyber Security News Post

Source: www.hackerone.com – Author: johnk. 19-year-old Argentinian @try_to_hack just made history as the first to earn over $1,000,000 in bounty awards on HackerOne. Since joining HackerOne in 2015, Santiago has reported over 1,670 valid unique vulnerabilities to companies such as Verizon Media Company,   show more ...  

Twitter, WordPress, Automattic, and HackerOne, as well as private programs. He consistently […] La entrada @try_to_hack Makes History as First Bug Bounty Hacker to Earn over $1 Million – Source:www.hackerone.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 1 - Cyber Security News Post

Source: www.hackerone.com – Author: johnk. “As cliche as it sounds, customer success is everyone’s job. Everyone’s,” said Jeff McBride when we asked him about his relatively new role as the the VP of Customer Success at HackerOne. Jeff has spent over a decade exploring customer management and success.   show more ...  

Most recently, Jeff came to us from […] La entrada Q&A with HackerOne’s VP of Customer Success Jeff McBride – Source:www.hackerone.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 1 - Cyber Security News Post

Source: www.hackerone.com – Author: johnk. PayPal’s digital payments platform gives 267 million active account holders in more than 200 markets around the world the confidence to connect and transact in new ways, whether they are online, on a mobile device in an app, or in person. Through a combination of   show more ...  

technological innovation and strategic partnerships, […] La entrada Program Insights from the PayPal Security Team – Source:www.hackerone.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 1 - Cyber Security News Post

Source: www.hackerone.com – Author: Martijn Russchen. Continuous improvement is at our heart, and the Hacker Dashboard is an excellent example of how we’ve been iterating based on feedback from the community. In the past few months, the Hacker Dashboard has been undergoing a number of improvements, and   show more ...  

we’re proud to announce the latest iteration of […] La entrada Introducing Hacker Task Manager and Statistics – Source:www.hackerone.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 1 - Cyber Security News Post

Source: www.hackerone.com – Author: johnk. What’s your favorite T-shirt? Maybe one from that conference you went to 5 years ago, a sleek threadless tee, or the one you earned from your submission to a bug bounty program on HackerOne. Whatever it is, we know what your newest favorite tee will be, because you   show more ...  

may be […] La entrada Design the next HackerOne T-Shirt – Source:www.hackerone.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 0CISO2CISO

Source: www.hackerone.com – Author: Katrina Dene. This blog was written by GitHub’s Engineering Team and originally published here. GitHub launched our Security Bug Bounty program in 2014, allowing us to reward independent security researchers for their help in keeping GitHub users secure. Over the past   show more ...  

five years, we have been continuously impressed by the hard work […] La entrada Five years of the GitHub Bug Bounty program – Source:www.hackerone.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cryptocurrencies

Source: securelist.com – Author: Alexander Zabrovsky, Sergey Lozhkin Review of last year’s predictions The number of services providing AV evasion for malware (cryptors) will increase We continuously monitor underground markets for the emergence of new “cryptors,” which are tools specifically designed to   show more ...  

obfuscate the code within malware samples. The primary purpose of these tools is […] La entrada Dark web threats and dark market predictions for 2025 – Source: securelist.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 cyber

Source: www.infosecurity-magazine.com – Author: Internet-exposed Human Machine Interfaces (HMIs) pose significant risks to the Water and Wastewater Systems (WWS) sector, according to a new fact sheet jointly released by the US Cybersecurity and Infrastructure Security Agency (CISA) and the Environmental   show more ...  

Protection Agency (EPA). Titled Internet-Exposed HMIs Pose Cybersecurity Risks to Water and Wastewater Systems and […] La entrada CISA and EPA Warn of Cyber Risks to Water System Interfaces – Source: www.infosecurity-magazine.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.infosecurity-magazine.com – Author: The State of Rhode Island has confirmed that its social services portal, the RIBridges system, has been subject to a major security threat. It is likely that cybercriminals have obtained files with personally identifiable information in the cyber-attack, Rhode   show more ...  

Island’s Department of Human Services (DHS) said in a statement. The State […] La entrada Deloitte Alerts Rhode Island to Significant Data Breach in RIBridges System – Source: www.infosecurity-magazine.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 CAPTCHA

Source: www.infosecurity-magazine.com – Author: A new large-scale campaign distributing Lumma infostealer malware through fake captcha pages has been observed using malvertising to exploit weaknesses in the digital advertising ecosystem. The attacks exposed thousands of victims to credential theft and financial   show more ...  

losses. Uncovered by Guardio Labs and Infoblox researchers, the campaign relies on Monetag, a subsidiary […] La entrada Fake Captcha Campaign Highlights Risks of Malvertising Networks – Source: www.infosecurity-magazine.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Amnesty

Source: www.infosecurity-magazine.com – Author: The Serbian government is using advanced mobile forensics products from Israeli surveillance firm Cellebrite to spy on journalists and environmental and civil rights activists, according to an Amnesty International report. Amnesty shared findings from its Security   show more ...  

Lab showing the use of spyware by the Serbian police forces and intelligence services in […] La entrada Amnesty Accuses Serbia of Tracking Journalists and Activists with Spyware – Source: www.infosecurity-magazine.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.infosecurity-magazine.com – Author: UK communication services regulator Ofcom has introduced new guidance for tech firms to tackle online harms on their platforms. This is part of its obligations under the Online Safety Act. The codes of practice on illegal online harms focus on acts such as terror,   show more ...  

hate, fraud, child sexual abuse and assisting […] La entrada Ofcom Issues Guidance for Tech Firms to Tackle Online Harms – Source: www.infosecurity-magazine.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.infosecurity-magazine.com – Author: Over 200,000 YouTube creators and counting have been targeted by cybercriminals masquerading as big-name brands, in a newly discovered phishing campaign. The scammers send malicious emails with subject lines like “Collaboration Proposal” and “Marketing   show more ...  

Opportunity,” in order to trick their victims into clicking through or opening malware-laden attachments, according to Cloudsek. […] La entrada YouTube Creators Targeted in Global Phishing Campaign – Source: www.infosecurity-magazine.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

2024-12
Aggregator history
Monday, December 16
SUN
MON
TUE
WED
THU
FRI
SAT
DecemberJanuaryFebruary