A vulnerability in a U.S. Postal Service application for tracking mail in real time reportedly allowed anyone logged into the service to view personal data, and it persisted for more than a year after USPS failed to heed a warning from an anonymous security researcher.
A vulnerability is only as bad as the threat exploiting it and the impact on the organization. Security and risk management leaders should rate vulnerabilities on the basis of risk in order to improve vulnerability management program effectiveness.
Gartner receives frequent inquiries from clients who are...
In this report we analyze real-world end-user vulnerability assessment (VA) behavior using a machine learning (ML)
algorithm to identify four distinct strategies, or "styles." These are based on five VA key performance indicators (KPIs)
which correlate to VA maturity characteristics.
This study specifically focuses...
No one migrates to the cloud to become less secure than before the migration. Knowing what to expect when it comes to security will allow you to avoid pitfalls and slow migrations.
Download this white paper and learn how to avoid:
Exposing sensitive information;
Accounts running amok;
Network misconfigurations...
Traditional pen tests work well for testing on-site security and running crystal-box, insider tests. However, adding a hacker-powered pen test to your rotation of traditional pen tests enables you to do true black box testing.
Download this white paper and learn how hacker-powered pen testing:
Utilizes more...
The Hacker-Powered Security Report 2018 is the most comprehensive report on the bug bounty and vulnerability disclosure ecosystem. It contains a detailed analysis of 78,275 security vulnerability reports reported over the past year by ethical hackers through more than 1,000 programs.
This report looks exclusively...
Microsoft appears set to patch a zero-day local privilege escalation vulnerability after a researcher published proof-of-concept exploit code for the flaw. That's a relatively rare turn of events these days, owing to Microsoft's bug bounty program rules.
Apache has released an emergency fix for its Struts web application framework to patch a flaw that attackers can exploit to take full control of the application. Some incident response experts, based on the severity of breaches they've investigated, recommend dropping Struts altogether.
As the threat landscape evolves in today's networks, information security teams are scrambling to keep up. Attackers are using new and stealthy methods to infiltrate organizations and steal data, and the complexity of most environments makes it easier than ever for attackers to compromise assets and send malicious...
The head of the NSA's Cybersecurity Threat Operations Center says attackers haven't bothered targeting unclassified U.S. Defense Department networks with a zero-day exploit in 24 months. Instead, they attempt to exploit flaws within 24 hours of information of the vulnerability or exploit going public.
The annual Vulnerability Review analyzes the evolution of software security from a vulnerability perspective. Secunia Research at Flexera monitors thousands of applications, appliances and operating systems to test and verify vulnerabilities, while mapping the security threats to IT infrastructures.
Download this...
The technologies and processes that businesses deploy today are so tightly linked to their customers and markets that the
boundary between the company's internal operations and external
ecosystem (i.e., customers, markets, competitors, partners,
regulators) is rapidly disappearing. Business leaders are
...
A set of vulnerabilities in AMD chipsets that gives attackers enduring persistence on machines appears to be legitimate. But experts are questioning the motivations of the Israeli security company that found the flaws, contending it ambushed AMD to maximize attention.
Penetration testing can help find vulnerabilities that aren't typically identified by scanning and other monitoring. But the testing comes with some risks, Duke Health CISO Chuck Kelser and pen tester John Nye explain in a joint interview.
The fact that Federal agencies are prime targets for the most sophisticated cyber threats is undeniable. If cyberattacks are inevitable, then robust capabilities for security investigation, threat hunting, and rapid response are essential. Government cybersecurity professionals require visibility across their silos of...
Our website uses cookies. Cookies enable us to provide the best experience possible and help us understand how visitors use our website. By browsing databreachtoday.com, you agree to our use of cookies.
