Curated cybersecurity insights, opinions, emerging technologies, AI security topics, and notable industry discussions.
1296 articles
Semgrep’s Clint Gibler recommends making security a service for developers: provide self-service resources with security built in, embed staff across teams, make secure choices easy, and build capabilities that benefit the wider organization.
Cloud security experts identify API attacks, ransomware and cryptomining as key risks, and discuss safeguards including strong authorization, behavioral analytics and regular staff training.
The article explains how EDR collects endpoint telemetry over time to add context beyond antivirus alerts, and outlines the data and response capabilities Huntress says its managed EDR provides.
The guide explains how macOS tools—TCC, File Quarantine, Gatekeeper, XProtect, MRT and XProtect Remediator—control access, check downloaded apps, block malware and remediate threats, while discussing their limits and when businesses may need additional coverage.
DarkOwl analysts describe how romance scams intersect with identity theft, money laundering and exploitation, and report finding scam scripts, eWhoring guides and victim discussions on darknet and adjacent platforms.
Security leaders discuss managing budget constraints through clear communication with executives, risk-based investment, tool consolidation, and prioritizing fundamentals such as misconfiguration fixes, vulnerability management, MFA, and network segmentation.
A tutorial introduces Open Policy Agent and Rego, then explains a sample policy that checks whether AWS security-group egress rules allow unrestricted access to the public internet.
DarkOwl describes retail fraud methods observed in underground networks, including refund schemes, POS malware, counterfeit goods, phishing sites, stolen gift cards and tactics targeting retailers and consumers.
Kubernetes v1.25’s alpha user namespaces can limit container-escape impact through UID remapping and safer privilege use, but kernel attack surface and workload compatibility limitations mean operators should assess fit and block unshare(CLONE_NEWUSER) with seccomp.
DarkOwl describes darknet discussions and sales involving API tokens, keys, and exploitation tools, and relates them to incidents involving USPS, GitHub, Toyota, and FTX users.
Huntress explains macOS persistence mechanisms, including Launch Daemons and Agents, login hooks, cron and periodic scripts. Its agent currently monitors Launch Items, which can be used by both legitimate software and malware.
CISOs interviewed by Wiz recommend strengthening collaboration and staff capabilities, protecting cloud data, investing in security data and measured innovation, and prioritizing value from existing tools.
AWS delegated administration lets organizations grant member accounts limited visibility into accounts and policies or control specific SCPs. The article covers security use cases, example configurations, and risks such as self-lockout and uneven protection.
Wiz presents PEACH, a framework for evaluating tenant isolation in cloud applications, with five hardening factors and remediation guidance. A ChaosDB case study illustrates how isolation gaps contributed to the Azure Cosmos DB vulnerability.
A roundup of five AWS re:Invent talks covers Netflix’s multi-account architecture and SDK instrumentation, zero-privilege service design, AWS’s Log4Shell response, and cloud security posture management.
Following the Uber CISO conviction, security leaders share recommendations on transparency, executive coordination, incident-response planning, legal support, and organizational ethics.
The article explains how criminals use leaked credentials, wordlists, automated checking tools, and proxies for credential stuffing, and discusses account trading and why MFA does not guarantee protection.
An explainer distinguishes the surface web, deep web and darknet, describing how Tor, I2P, ZeroNet, Freenet, Lokinet and Yggdrasil work and why darknet terminology matters to OSINT investigators.
Huntress recaps hack_it 2022 sessions on cybercrime, AI claims in security, DLL hijacking techniques, using Process Monitor, and a live exercise involving vulnerability discovery and privilege escalation.
A Huntress article outlines cybersecurity hygiene practices for MSPs and clients, emphasizing documented onboarding, automated monitoring and alerts, security ownership, and deploying MFA.
DarkOwl and Corsha speakers discuss API credential risks, darknet trading and discussion of keys and exploits, and security practices including least privilege, credential rotation, revocation, and monitoring.
A webinar transcript outlines how investigators can correlate marketplace aliases, posts, PGP keys, cryptocurrency wallets, and other online accounts to investigate vendors and illicit trade, while noting that such links are not always certain.
A Huntress conversation with Syncro discusses cybersecurity basics for SMBs and MSPs, recommending a NIST-based approach to security tools, alert monitoring, and incident-response planning.
A curated guide to KubeCon + CloudNativeCon North America 2022 sessions on Kubernetes security, cloud attack paths, policy migration, software supply chains, and integrating security testing into CI/CD.
