Curated cybersecurity insights, opinions, emerging technologies, AI security topics, and notable industry discussions.
1296 articles
The article argues that cloud adoption has made identity a distinct security-operations concern, citing Storm-0558, BEC and an Azure advisory, and urges organizations to improve visibility into third-party identity platforms.
A webinar-series recap explains how MSPs can guide clients on cyber insurance, security requirements, policy coverage, and claims, highlighting controls such as 24/7 EDR, MFA, vulnerability management, and security awareness training.
A webinar transcript explains how investigators can combine social-media and darknet data to assess threats, connect online identities, and spot phishing and disinformation risks. It includes a case example and discusses ethical challenges.
The article compares OIDC, IAM Roles Anywhere, and Systems Manager hybrid activation as alternatives to long-lived AWS access keys, outlining security trade-offs and possible improvements such as hardware-backed signing.
A DarkOwl analyst describes darknet platforms and criminal activity, and explains how investigators can connect usernames, cryptocurrency wallets and other OSINT to examine cybercrime.
Huntress observed no significant MOVEit exploitation after late May 2023; later victim disclosures may reflect delayed cl0p follow-up to earlier compromises. It urges defenders to retain telemetry, monitor data flows and hunt for lingering access.
A tutorial explains how Linux rootkits use LD_PRELOAD to intercept functions and hide activity, demonstrates hiding a file by hooking readdir, and outlines methods to detect preload abuse.
The article applies the PEACH tenant-isolation framework to GenAI cloud apps, explaining cross-tenant risks and how interface complexity, data access, customization and architecture choices should shape isolation.
An explainer of macOS XProtect and XProtect Remediator describes their malware-blocking and remediation roles, logging, and limitations. The author says they may suit individual users but lack the visibility and coverage needed at scale.
DarkOwl researchers examined Styx Market, documenting listings for stolen data, account access, fraud and money-laundering services, plus vendors’ use of Telegram. They describe the marketplace as geared toward experienced cybercriminals.
Security leaders offer advice for CISOs on communicating security priorities to executives, evaluating a prospective role, and building diverse teams with varied skills and perspectives.
A podcast discussion explains how organizations use darknet intelligence to find exposed credentials, assess threats and prioritize response, while emphasizing context, human judgment and layered security.
A proof of concept shows how a custom Splunk app can make Universal Forwarder periodically fetch and execute PowerShell commands from a web page. The author says this abuses supported functionality, not a Splunk vulnerability.
DarkOwl describes smaller leak-focused sites and Telegram channels selling leaked data, accounts and stealer logs, often outside ransomware groups. Analysts say the trend may reflect more decentralized trading; they could not verify data advertised on Unsafe.
An overview of macOS MDM and RMM, comparing software deployment, device visibility, remote access, and costs. MDM can deploy PPPC profiles to manage TCC permissions, while RMM generally requires endpoint approval for permissions.
A curated guide to KubeCon Europe 2023 talks on Kubernetes security, covering secrets, pod security migration, least-privilege containers, network policies, Zero Trust threat modeling, and managed-cluster risks.
The article explains how scams and fraud differ, using examples such as phishing, account takeover and identity theft, and offers factors to consider when classifying financially motivated crimes.
Huntress analysts show how they used CyberChef and regex to decode an obfuscated VBS script found persisting via a scheduled task, revealing a chain that led to an AsyncRAT loader.
An overview of macOS Endpoint Security explains its event monitoring and blocking capabilities, user approvals and permissions, and how event data can help security teams investigate activity and build detections.
Phishing is becoming more targeted across email, social media, SMS and phone calls. Attackers use evasion techniques and AI-generated lures, while user education, MFA, secure email gateways and DNS security can help reduce risk.
The article summarizes Gartner’s view that integrated CNAPPs can help organizations prioritize cloud security risks, and highlights capabilities and evaluation guidance for enterprises considering them.
Security leaders discuss how fast-growing companies can prioritize security, partner with business teams, distribute accountability, and set measurable goals while balancing security with growth.
DarkOwl describes how credentials, tokens and keys are shared or sold on darknet forums, and how attackers may use them for account abuse or to gain access to corporate networks.
An explainer on macOS notifications and security prompts, including how Ventura surfaces launch items, TCC and other permissions, and why these prompts complicate software deployment without MDM-managed PPPC profiles.
