Think, Talk, Hack

Hack-Proof Your Cloud: The Step-by-Step Continuous Threat Exposure Management CTEM Strategy for AWS & AZURE

Continuous Threat Exposure Management (CTEM) is an evolving cybersecurity practice focused on identifying, assessing, prioritizing, and addressing security weaknesses and vulnerabilities in an organization’s digital assets and networks continuously. Unlike traditional approaches that might assess threats periodically, CTEM emphasizes a proactive, ongoing process of evaluation and mitigation to adapt to the rapidly changing threat landscape. […]

root

Google Launches New Cybersecurity Initiatives to Strengthen Vulnerability Management

Google on Thursday outlined a set of initiatives aimed at improving the vulnerability management ecosystem and establishing greater transparency measures around exploitation. “While the notoriety of zero-day vulnerabilities typically makes headlines, risks remain even after they’re known and fixed, which is the real story,” the company said in an announcement. “Those risks span everything from […]

root

5 best practices for securing identity and access management (IAM) systems

The term “identity and access management,” or “IAM,” refers to a framework of corporate procedures, regulations, and technology that support the management of digital identities to guarantee that users only obtain access to data when they have the right credentials. Identity and access management is abbreviated as “IAM.” In addition to the actual users,  IAM […]

root

Unpatched Security Flaws Disclosed in Multiple Document Management Systems

Multiple unpatched security flaws have been disclosed in open source and freemium Document Management System (DMS) offerings from four vendors LogicalDOC, Mayan, ONLYOFFICE, and OpenKM. Cybersecurity firm Rapid7 said the eight vulnerabilities offer a mechanism through which “an attacker can convince a human operator to save a malicious document on the platform and, once the […]

root

SERIOUS PRIVILEGES ESCALATION VULNERABILITY IN SYMANTEC PRIVILEGED ACCESS MANAGEMENT

Protecting sensitive organizational credentials, limiting privileged user access, actively imposing security policies, and monitoring and recording privileged user behavior across virtual, cloud, and physical environments are all part of Symantec Privileged Access Management’s (PAM) security breach prevention strategy. A serious security flaw in Symantec Privileged Access Management (PAM) was found by researcher Nikola Kojichas from […]

root

Infra Used in Cisco Hack Also Targeted Workforce Management Solution

The attack infrastructure used to target Cisco in the May 2022 incident was also employed against an attempted compromise of an unnamed workforce management solutions holding company a month earlier in April 2022. Cybersecurity firm eSentire, which disclosed the findings, raised the possibility that the intrusions could be the work of a criminal actor known […]

root

Over a Dozen Flaws Found in Siemens’ Industrial Network Management System

Cybersecurity researchers have disclosed details about 15 security flaws in Siemens SINEC network management system (NMS), some of which could be chained by an attacker to achieve remote code execution on affected systems. “The vulnerabilities, if exploited, pose a number of risks to Siemens devices on the network including denial-of-service attacks, credential leaks, and remote […]

root

Exploitation code for CVE-2022-1388 available: Critical remote code execution vulnerability in F5 Network management tools

A few days ago, the security teams of F5 Networks reported the correction of more than 50 vulnerabilities in various versions of BIG-IP, among which CVE-2022-1388 stands out, a critical flaw that could be exploited to deploy remote code execution (RCE) attacks. This morning the company updated its alert, recommending organizations using its application delivery […]

root

Critical Security Flaws Reported in Moxa MXview Network Management Software

Technical details have been disclosed regarding a number of security vulnerabilities affecting Moxa’s MXview web-based network management system, some of which could be chained by an unauthenticated adversary to achieve remote code execution on unpatched servers. The five security weaknesses “could allow a remote, unauthenticated attacker to execute code on the hosting machine with the […]

root

Critical vulnerabilities in MXview network management software; Moxa users should update as soon as possible

Moxa users will need to upgrade MXview to versions greater than 3.2.4 in order to address five vulnerabilities in the web-based network management system. These failures received critical scores of 10/10 according to the Common Vulnerability Scoring System (CVSS). According to Claroty researchers, unauthenticated threat actors could chain two or more of these vulnerabilities to […]

root

How Attack Surface Management Preempts Cyberattacks

The wide-ranging adoption of cloud facilities and the subsequent mushrooming of organizations’ networks, combined with the recent migration to remote work, had the direct consequence of a massive expansion of organizations’ attack surface and led to a growing number of blind spots in connected architectures. The unforeseen results of this expanded and attack surface with […]

root

Privilege escalation flaw in Cisco Unified Contact Center Management Portal

Cybersecurity specialists reported the finding of a critical vulnerability affecting Cisco Unified Contact Center Management Portal (Unified CCMP). According to the report, successful exploitation would allow hackers compromise the target system. Tracked as CVE-2022-20658, the vulnerability exists due to the lack of server-side validation of user permissions in the web-based management interface of the affected […]

root

Top workforce management firm Kronos hit by ransomware attack

Kronos has taken down its private cloud services and advises customers to use “alternative business continuity protocols” while the company is working on mitigating the attack. Kronos Private Cloud is an HR management firm, also known as Ultimate Kronos Group, offering timekeeping services to many high-profile firms globally. Reportedly, the company is the latest victim […]

root

How Extended Security Posture Management Optimizes Your Security Stack

As a CISO, one of the most challenging questions to answer is “How well are we protected right now?” Between the acceleration of hackers’ offensive capabilities and the dynamic nature of information networks, a drift in the security posture is unavoidable and needs to be continuously compensated. Therefore, answering that question implies continuously validating the […]

root

Microsoft’s Loop Project Management Software

Microsoft has been developing a project collaboration solution for enterprise projects. The Loop app is now accessible to Microsoft 365 commercial customers.  The Loop app is an independent software on the Microsoft Teams chat platform that can be integrated with other apps or used solely. Its goal is to assist businesses in expediting project details, meeting […]

root

WiFi software management firm exposed millions of users’ data

Brazil-based WiFi management software firm WSpot exposed extensive details of high-profile firms and millions of customers. WSpot provides software to let businesses secure their on-premise WiFi networks and offer password-free online access to their clients. Some of the notable clients of WSpot include Sicredi, Pizza Hut, and Unimed. According to WSpot, 5% of its customer […]

root