Tag: Security

The National Security Agency (NSA) and the Cybersecurity and Infrastructure Security Agency (CISA) released a report which details threats to Kubernetes environments and provides configuration guidance to minimize risk. What is Kubernetes? Kubernetes is an open source system that automates the deployment, scaling, and management of applications run in containers. Kubernetes clusters are often hosted in a cloud environment, and provide increased flexibility from traditional software platforms. Kubernetes is commonly targeted for three reasons: data … More →
The post How to harden Kubernetes systems and minimize risk appeared first on Help Net Security. …

Managing digital certificates, especially expirations and renewals, continues to be a challenging process for businesses of all sizes, a study of over 300 IT professionals in the U.S. and the UK conducted by Opinium reveals. There is also a great deal of misunderstanding about digital signatures, how they are different from electronic signatures and the need for each type. PKI is a critical technology in the security ecosystem As more companies look to automation and … More →
The post Managing digital certificates still a challenge, automation lagging appeared first on Help Net Security. …

The PCI Security Standards Council (PCI SSC) and the Cloud Security Alliance (CSA) issued a joint bulletin to highlight the importance of properly scoping cloud environments. Why cloud computing matters The use of cloud computing services has accelerated in recent years and is projected to continue expanding in the future. This dramatic increase in use of cloud services makes sense given the many benefits cloud computing can provide to businesses large and small. Cloud computing … More →
The post Scoping cloud environments: Tips and best practices appeared first on Help Net Security. …

Here’s an overview of some of last week’s most interesting news, articles and podcasts: Patch bypass flaw in Pulse Secure VPNs can lead to total compromise (CVE-2021-22937) The patch for a vulnerability (CVE-2020-8260) in Pulse Connect Secure VPN devices that attackers have been exploiting in the wild can be bypassed, security researcher Rich Warren has found. A clever phishing campaign is targeting Office 365 users Microsoft is warning about an ongoing, “sneakier than usual” phishing … More →
The post Week in review: Clever Office 365 phishing, 2021 CWE Top 25, Patch Tuesday forecast appeared first on Help Net Security. …

Spectral announced the release of DeepConfig, a detection technology that can identify misconfigurations at all layers of software to prevent exploits of security gaps and data breaches. Additionally, this protection also helps companies comply with privacy regulations at all layers of software. Spectral’s DeepConfig is the first solution that can detect misconfigurations at all layers of software, including the infrastructure layer and the data layer, which is composed of products like Elastic, MySQL, Redis, Memcache, … More →
The post Spectral DeepConfig detects software misconfigurations at all layers to prevent breaches appeared first on Help Net Security. …

Qualys announced it has collaborated with Red Hat to drive greater security for both the container and host operating system for Red Hat OpenShift. Teaming with Red Hat, Qualys is offering a unique approach providing a containerized Qualys Cloud Agent that extends security to the operating system. The Cloud Agent for Red Hat Enterprise Linux CoreOS on OpenShift combined with the Qualys solution for Container Security provides continuous discovery of packages and vulnerabilities for the … More →
The post Qualys scans Red Hat Enterprise Linux CoreOS on Red Hat OpenShift to reduce risk appeared first on Help Net Security. …

ACI Worldwide announced an expanded multi-year strategic alliance with Microsoft to deliver payments solutions in the cloud. The alliance will accelerate and expand ACI’s cloud payments offerings in Microsoft Azure as more financial institutions (FIs) embrace digital transformation. With global demand for SaaS-based payment offerings increasing, ACI and Microsoft will closely collaborate on innovations that empower FIs to launch new solutions, add new services to their existing platforms and deliver those new capabilities more quickly … More →
The post ACI Worldwide expands alliance with Microsoft to deliver payments solutions in the cloud appeared first on Help Net Security. …

Checkmarx announced that it has acquired Dustico, a SaaS-based solution that detects malicious attacks and backdoors in open source software supply chains. Through this acquisition, Checkmarx will combine its AST capabilities with Dustico’s behavioral analysis technology to give customers a unified view into the risk, reputation, and behavior of open source packages, resulting in a more comprehensive approach to preventing supply chain attacks. According to Gartner, “by 2025, 45% of organizations worldwide will have experienced … More →
The post Checkmarx acquires Dustico to help customers secure their software supply chains appeared first on Help Net Security. …

Elastic announces a single management interface for Elastic Enterprise Search in Kibana, updated App Search precision tuning capabilities, and content source flexibility and synonym support for Workplace Search in the 7.14 release of Elastic Enterprise Search. Elastic Enterprise Search can now be centrally managed in Kibana, the single management interface for all Elastic solutions. With this beta integration, users can access App Search and Workplace Search features with consistent, cross-platform navigation in Kibana to create … More →
The post Elastic enables deeper search experience insights with Kibana visualizations appeared first on Help Net Security. …

Code42 announced that its Code42 Incydr software solution can now automatically distinguish between browser uploads to corporate and personal cloud applications, including Google Drive and Box. Today, 91% of security leaders believe that users are exfiltrating data through personal cloud accounts, yet nearly half (49%) don’t have a tool to differentiate personal and corporate cloud application uploads. As cloud-based collaboration tools have risen in popularity within the enterprise, personal use of the same tools has … More →
The post Code42 Incydr can now differentiate between personal and corporate cloud application uploads appeared first on Help Net Security. …