Third-party risk and resilience in DORA
In February 2016, it was reported that threat actors exploited vulnerabilities in the SWIFT banking network to steal more than $80 million from the central bank of Bangladesh. SWIFT, the global financial system’s main electronic payment system, which processes billions of dollars of transactions every day, was unprepared for the threat of a major cyber attack. The incident served as a pivotal wake-up call for the entire financial services industry, highlighting the previously underestimated systemic risks posed by unsecured systems. It reinforced the need for stronger security controls, safeguards and a more proactive approach to cybersecurity across the sector.
Today, organizations understand that it’s a matter of when -- not if -- their organization or supply chain is targeted with a cyber attack. Threats continue to increase in sophistication and frequency, particularly when it comes to ransomware.
The increasing priority of security in data management
Data security has become a top concern for businesses across all industries. As organizations accumulate and leverage vast amounts of data to drive decision-making, the need to safeguard that information from both internal and external threats is more important than ever.
For companies managing sensitive customer information, intellectual property, or proprietary business insights, data security is no longer a negotiable priority -- it’s a critical component in strengthening your overall security strategy.
The Internet Archive suffers massive data breach affecting tens of millions of users
The Wayback Machine has suffered a colossal security incident after the Internet Archive fell victim to a huge data breach.
Data breach notification service Have I Been Pwned (HIBP) says that a 6.4GB SQL file containing registered users’ authentication information has been shared. In all, 31 million email addresses have been found to be part of the database, and tests have shown the the data is genuine.
Still running Windows 11 22H2? No more security fixes from Microsoft for you!
Following the launch of Windows 11 24H2, this week marks the release of the final updates for various other versions of Windows. This means that anyone who has yet to upgrade from Windows 11 22H2 will not receive any more security updates.
There are numerous editions of Windows 11 affected by the end-of-service, specifically Windows 11 Home, Pro, Pro Education, Pro for Workstations and SE. The same is true for Windows 11 21H2 Enterprise, Education and IoT Enterprise, none of which will receive further updates. So, what does this mean for users?
Google removes Kaspersky apps from its store
Google has unceremoniously evicted Kaspersky’s apps from the Play Store. While the Russian security firm insists that the removal is temporary, it comes after the company’s software was banded from being sold in the US.
The move not only means that it is no longer possible to download Kaspersky apps from Google store, but also that existing users are unable to obtain updates. Google did announce the removals ahead of time.
Building a security-first culture for MSPs: Always ready, always protected
For IT professionals and MSPs, a company’s security posture is influenced not only by technology but also by its team's daily actions. Whether intentional or accidental, human behavior plays a significant role in either fortifying or undermining security measures.
Verizon Business’ 2024 Data Breach Investigation Report revealed that 68 percent of breaches this year involved a non-malicious human element, such as people falling for phishing schemes, mishandling sensitive information or getting tricked by a social engineering ploy.
Kaspersky users in the US find themselves forcibly migrated to the mysterious UltraAV
It is not unusual for software to update itself without user interaction; when it comes to delivering security patches and new features this is entirely desirable. But to have an app uninstall itself and replace itself with a different product? That’s not only highly unusually, it’s also worrying.
And yet this is what is happening for users of Kaspersky antivirus software in the US. Having been deemed a threat to national security, the sale of software from the Russian cybersecurity firm Kaspersky was banned in the US. Having promised that its customers would be taken care of, Kaspersky is now keeping its promise but forcibly replacing its security software with the largely unknown UltraAV on US customers’ computers
Save $17! Get 'Not with a Bug, But with a Sticker' for FREE
In Not With A Bug, But With A Sticker: Attacks on Machine Learning Systems and What To Do About Them, a team of distinguished adversarial machine learning researchers deliver a riveting account of the most significant risk to currently deployed artificial intelligence systems: cybersecurity threats. The authors take you on a sweeping tour -- from inside secretive government organizations to academic workshops at ski chalets to Google’s cafeteria -- recounting how major AI systems remain vulnerable to the exploits of bad actors of all stripes.
Based on hundreds of interviews of academic researchers, policy makers, business leaders and national security experts, the authors compile the complex science of attacking AI systems with color and flourish and provide a front row seat to those who championed this change. Grounded in real world examples of previous attacks, you will learn how adversaries can upend the reliability of otherwise robust AI systems with straightforward exploits.
The five stages of vulnerability management
Nearly every organization today builds a lot of software, and the majority of that software is developed by cobbling together open source components. When using open source and trying a software composition analysis (SCA) scanner for the first time, it is not uncommon for those organizations to be surprised at what they learn about their open source usage. Many times it quickly comes to light that they have a large load of new and unplanned work to address in the form of security issues in dependencies. They need to fix these issues not just for the organization itself but also to stay compliant with certifications such as PCI or SOC2.
That’s when these organizations begin to experience the five stages of vulnerability management.
Why early detection of software vulnerabilities saves time and money
Modern software development teams are under so much pressure to deliver fast. Unfortunately, speed can mean security gets overlooked during development. Fixing these issues later in the development cycle, or worse, after the software has been released, can be time-consuming, expensive and damaging to a company’s reputation. That’s where early detection of software vulnerabilities comes in. By finding and fixing these issues early organizations can save time, reduce costs and protect their users from security breaches.
In this post, we’ll look at why early detection is key, how it impacts development timelines and budgets and how security in the early stages of software development is the key to both secure and efficient software delivery.
How to keep using Windows 10 safely after Microsoft ends support
As of October 14, 2025, Microsoft will officially stop supporting Windows 10, marking the end of the road for regular security updates and technical support.
This doesn’t mean your Windows 10 machine will suddenly stop working of course, but it does mean that keeping it safe and secure will require more proactive measures. Here’s how you can protect your Windows 10 system after official support ends.
The $13 billion problem: Tackling the growing sophistication of account takeovers
Fraudsters have used account takeovers (ATOs) to victimize 29 percent of internet users, resulting in $13 billion in losses in 2023. Over three-quarters of security leaders listed ATOs as one of the most concerning cyber threats, and the danger grows as bad actors leverage AI to launch more potent attacks.
The Snowflake breach demonstrates the devastating consequences of ATOs. Attackers gained access to 165 of the data platform’s customers’ systems, including AT&T and Ticketmaster, and exfiltrated hundreds of millions of records containing sensitive data. The attack wasn’t some brilliant hacking scheme -- the bad actors simply used legitimate credentials to log into the platform.
Why third-party email filters may be ineffective in Microsoft 365 environments
Because email is the primary source of initial entry in many breaches, many organizations pay for sophisticated, third-party email filtering solutions on top of the protections afforded by Microsoft 365. This is a wise investment; having layers of protection by different vendors helps eliminate blind spots found in any one vendor solution and provides complexity that can foil attack attempts.
Yet, few know that threat actors can easily bypass these third-party filtering products by directing emails to onmicrosoft.com domains that are an inherent part of the Microsoft 365 configuration.
Log files: What are they, why do they matter and how to protect them?
Log files come with many challenges. Firstly, they exist as enormous volumes of data. Almost everything that a user does is recorded, meaning that they quickly pile up, and not all of them are useful.
Secondly, they aren’t all uniform as they come in various shapes and sizes, serving various purposes. Event logs, system logs, access logs and server logs are just some of the various types that are collected and stored. This large volume of data means that processing and analyzing logs for use can be time-consuming and complex.
Old habits, new threats -- Why more phishing attacks are bypassing outdated perimeter detection
Perimeter solutions such as Secure Email Gateways (SEGs) have long been a cornerstone of email security, historically serving as the primary line of defence against malicious emails entering an organization. Utilizing legacy technology such as signature and reputation-based detection, SEGs have provided pre-delivery intervention by quarantining malicious attacks before they reach the end recipient.
Why, then, are 91 percent of cybersecurity leaders frustrated with their SEGs, and 87 percent considering a replacement?
Recent Headlines
Most Commented Stories
© 1998-2024 BetaNews, Inc. All Rights Reserved. Privacy Policy - Cookie Policy.