Mathew Davis

Microsoft’s Patch Tuesday Fixes 63 Flaws, Including Two Under Active Exploitation Microsoft patches 63 flaws, including two exploited Windows vulnerabilities (CVE-2025-21391, CVE-2025-21418). Microsoft on Tuesday released fixes for 63 security flaws impacting its software products, including two vulnerabilities that it said has come under active exploitation in the wild. Of the 63 vulnerabilities, three are rated Critical, 57 are rated Important, one is rated Moderate, and two are rated Low in severity. This is aside from the 23 flaws Microsoft addressed in its Chromium-based Edge browser since the release of last month's Patch Tuesday update. The update is notable for fixing two actively exploited flaws - CVE-2025-21391 (CVSS score: 7.1) - Windows Storage Elevation of Privilege Vulnerability CVE-2025-21418 (CVSS score: 7.8) - Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability "An attacker would only be able to delete targeted files on a system," Microsoft said in an alert for CVE-2025-21391. "This vulnerability does not allow disclosure of any confidential information, but could allow an attacker to delete data that could include data that results in the service being unavailable." Mike Walters, president and co-founder of Action1, noted that the vulnerability could be chained with other flaws to escalate privileges and perform follow-on actions that can complicate recovery efforts and allow threat actors to cover up their tracks by deleting crucial forensic artifacts. https://lnkd.in/gCgiSUxM #cybersecurity #Windows #vulnerabilities #patchnow

66

28 commentaires

SYO - 701 Exam Study Guide  : 🔐Section 1: Foundational Pillars – Unpacking the core principles like the CIA & DAD triads, comprehensive risk management strategies, and the indispensable NIST framework. 🎯Section 2: The Adversary's Playbook – A compelling breakdown of threat actors, their vectors, and common attack surfaces, presented with engaging clarity. 🔏Section 3: Cryptographic Fortification – A deep dive into the intricacies of encryption, Public Key Infrastructure (PKI), key management, and the role of digital certificates. 🔑Section 4: Identity & Access Mastery – Essential concepts including Identity and Access Management (IAM), privileged access management, Multi-Factor Authentication (MFA), Single Sign-On (SSO), Kerberos, and biometric authentication—the tools of the trade. 🌐Section 5-6: Secure Architecture Design – Exploring the building blocks of secure network and cloud environments, from firewalls to the strategic implementation of Zero Trust principles. 🚨Section 7-13: Operational Security & Response – Covering critical areas like vulnerability management, endpoint & application security, incident response methodologies, and essential forensics techniques. 📜Section 14-16: Governance & Compliance Landscape – Navigating the complexities of governance, risk, and compliance (GRC), various security frameworks, and the ever-evolving domain of privacy laws.

44

🔐 Looking for a no-fluff guide to strengthening your data protection program? This short but solid PDF 👉 “Data Protection Checklist” by Hanım Eken (attached below) covers 12 essential areas every organization should review — whether you're just starting or reviewing your maturity. Here’s what’s included: 1️⃣ Data classification based on sensitivity 2️⃣ Role-based access & least privilege 3️⃣ Encryption of data at rest and in transit 4️⃣ Masking & anonymization in dev/test environments 5️⃣ DLP controls and endpoint protections 6️⃣ Secure retention and disposal practices 7️⃣ Backup integrity and offsite storage 8️⃣ Compliance with GDPR, CCPA and more 9️⃣ Employee training & awareness programs 🔟 Incident response, breach reporting, and regulatory readiness 🔁 Vendor risk management and contract clauses 📈 Continuous improvement based on risk assessments, lessons learned & audits ✅ Great as an internal checklist for IT/security teams ✅ Ideal for DPOs preparing for audits or DPIAs ✅ Quick reference for vendor due diligence or ISO 27001 reviews 📎 PDF is attached — share it with your team or bookmark it for your next GRC review. #DataProtection #PrivacyCompliance #GDPR #InfosecChecklist #SecurityAwareness #VendorRisk #CyberSecurity #DPOtools #RiskManagement #ISO27001 #CCPA

43

1 commentaire

After DHS did not renew its funding contract for reasons unspecified, MITRE’s 25-year-old Common Vulnerabilities and Exposures (CVE) program was slated for an abrupt shutdown on April 16, which would have left security flaw tracking in limbo. CISA stepped in to provide a bridge. A CISA spokesperson sent CSO a statement saying, “The CVE Program is invaluable to cyber community and a priority of CISA. Last night, CISA executed the option period on the contract to ensure there will be no lapse in critical CVE services. We appreciate our partners’ and stakeholders’ patience.” Sources say the contract extension will last 11 months. Yosry Barsoum, vice president and director of the Center for Securing the Homeland at MITRE, commented: “Thanks to actions taken by the government, a break in service for the Common Vulnerabilities and Exposures (CVE®) Program and the Common Weakness Enumeration (CWE™) Program has been avoided. As of Wednesday morning, April 16, 2025, CISA identified incremental funding to keep the Programs operational. We appreciate the overwhelming support for these programs that have been expressed by the global cyber community, industry, and government over the last 24 hours. The government continues to make considerable efforts to support MITRE’s role in the program and MITRE remains committed to CVE and CWE as global resources.” https://lnkd.in/gPhB8vVQ

170

12 commentaires

🚨 Two of Europe’s key regulators — 𝗕𝗦𝗜 (Germany) and 𝗔𝗡𝗦𝗦𝗜 (France) — have just released joint principles for 𝗟𝗟𝗠-𝗯𝗮𝘀𝗲𝗱 𝘀𝘆𝘀𝘁𝗲𝗺𝘀, framed within the 𝗭𝗲𝗿𝗼 𝗧𝗿𝘂𝘀𝘁 model. 🔑 The paper outlines six core design principles that give shape to this approach: 1️⃣ Authentication & Authorization — verify every identity, limit privileges. 2️⃣ Input & Output Restrictions — validate data to prevent prompt injection or leakage. 3️⃣ Sandboxing — isolate components to contain errors or misuse. 4️⃣ Monitoring & Control — log, detect anomalies, and enforce safeguards. 5️⃣ Threat Intelligence — adapt defenses to evolving attack patterns. 6️⃣ Awareness — train, communicate, and supervise with transparency. 💡 This isn’t about slowing innovation. It’s about building trustworthy, resilient AI systems — with clear guardrails that can withstand both technical and regulatory scrutiny. 📄 Full paper 👉: https://lnkd.in/eW9ibQNJ #AI #CyberSecurity #ZeroTrust #AIRegulation #AISecurity #Trust

48

1 commentaire

100% of ICS/OT networks are vulnerable to attack. So how do we defend our ICS/OT networks? One way to look at it is through the lens of MITRE ATT&CK. MITRE ATT&CK can be a bit confusing at first though. So what is MITRE ATT&CK? ATT&CK was created to help answer the question... "What do attackers do once they're in your environment?" It was started for IT enterprise environments. But ATT&CK is also VERY relavent to ICS/OT networks. So much so that MITRE created a version specifically for ICS/OT. "What do attackers do once they're in your ICS/OT environment?" MITRE mapped out 21 specific types of assets found in an OT network. And based on real world incidents, helps you to understand: -> Where are our risks? -> What gaps do we have? -> Where can we detect these attacks? -> How do attackers target our systems? -> Are we protected against these threats? -> Do we have engineered controls to prevent catastrophe? -> What controls are necessary to protect against the attacks? So at the end of the day, we can answer these questions. MITRE ATT&CK isn't just a framework. It's a road map. It's your road map to building out your ICS/OT cyber strategy. And now we can answer the most important question. How do we defend our ICS/OT network? P.S. Do you work in ICS/OT? As part or all of your job? Source: The Defending OT with ATT&CK Project

24

Hackers have issued an ultimatum to Google, threatening to leak its data unless the company fires two of its key cybersecurity employees. The hacking group specifically demanded that #Google fire two members of its Threat Intelligence Group (TIG), the internal team responsible for tracking and investigating #cybercriminal networks. While the hackers claim to have access to Google's databases, they have provided no evidence to support this claim. Source: Newsweek : https://lnkd.in/gK3iwgH2

652

126 commentaires

CAUTIONARY TALE: When "Just Asking" Leads to a $380M Cyberattack The recent Clorox-Cognizant lawsuit is a stark reminder that sometimes, hackers don't need sophisticated exploits – they just ask. In a shocking breach costing Clorox an estimated $380 million, the Scattered Spider hacking collective allegedly gained access by simply calling Cognizant's (Clorox's IT help desk provider) service desk and requesting password resets. This incident screams shared responsibility in cybersecurity. Cognizant, the vendor, is clearly at fault. Despite established protocols, their help desk staff reportedly handed over critical credentials, including multi-factor authentication, without adequate identity verification. This was a catastrophic breakdown in a crucial security gate. However, Clorox, the customer, also bears responsibility. While they entrusted a vendor with IT services, the ultimate accountability for their network's security, and the robustness of their overall cybersecurity posture, rests with them. As Cognizant reportedly countered, "it is shocking that a corporation the size of Clorox had such an inept internal cybersecurity system to mitigate this attack." Relying solely on a third-party for basic security checks, without robust oversight or internal safeguards, proved incredibly costly. https://lnkd.in/eMn8EtXH This serves as a critical lesson: - Third-party vendor management is paramount. Vet your partners thoroughly and ensure their security practices align with your own. - Human error remains the top vulnerability. Strong training, clear protocols, and robust authentication (that's actually followed!) should be non-negotiable. - Cybersecurity is a shared ecosystem. Both organizations and their partners must be vigilant and proactive. Have you encountered a similar incident where a simple oversight led to major security headaches? Share your stories below! #Cybersecurity #DataBreach #ThirdPartyRisk #InfoSec #Clorox #Cognizant #SocialEngineering #CautionaryTale IMD

21

5 commentaires

Researchers have discovered that groups are leveraging large language models to create complete ransomware kits, some selling for only a few hundred dollars. These packages don’t just encrypt files; they include sophisticated evasion techniques that once required deep expertise. Another group reportedly automated the entire ransomware lifecycle — identifying targets, writing malware, stealing data, and even handling ransom negotiations. The result: attacks that have already impacted healthcare, government, and emergency services. Even more concerning, early prototypes of AI-powered ransomware are surfacing that can generate malicious code on the fly. While not yet observed in widespread attacks, these developments signal a future where #malware continuously adapts itself in real time, creating entirely new layers of risk. The implications are profound. The barrier to entry for #cybercrime has collapsed. Attackers no longer need to be skilled developers to unleash sophisticated campaigns. The speed and scale of AI-assisted attacks will only accelerate. And unless defenders move with the same urgency, we are on the verge of an #AI arms race in cybersecurity. This is where World Wide Technology approach to AI Security becomes critical. We’re helping organizations secure both the use of AI and the defense against AI-powered threats. From testing models in our AI Proving Ground, to building resilient architectures in the #CyberRange, to embedding AI-driven threat detection and response capabilities — we partner with enterprises and governments to move faster than the adversary. This is a turning point. AI is no longer just writing fake emails or ransom notes. It is building the threats themselves. The question is not whether this will change the landscape — it already has. The question is how quickly we adapt and what bold steps we are willing to take to defend what matters most. The future of #ransomware has arrived. The future of our defenses needs to arrive just as fast. https://lnkd.in/guQZ8nQV

33

5 commentaires

Deploying #GenAI solutions?  Are they #Secure? Check NIST's  new finalized guidelines "Adversarial Machine Learning: A Taxonomy and Terminology of Attacks and Mitigations." This is a vastly elusive and complex area even for security professionals. The range of #effective attacks against ML is wide, rapidly evolving, and covers all phases of the ML lifecycle — from design and implementation to training, testing, and deployment in the real world. The nature and power of these attacks are different and their impacts may depend not only on the vulnerabilities of the ML models but also the weaknesses of the #infrastructure in which the #AI systems are deployed. Section on GenAI attacks and mitigation reflects the most recent developments regarding these technologies and how businesses are using them. A new section, an index of attacks and mitigations, has been added to allow for fine-grain definition and navigation of attacks. This improves the usability of the guidelines and will promote efficient and consistent communication between practitioners and other stakeholders. #AISecurity Attaching the document.. Questions? Post below or contact me..

41

1 commentaire

After MITRE's common vulnerability (CVE) database was almost unfunded today (1), rescued at the last minute, and now facing a funding extension for another eleven months, the European Union Agency for Cybersecurity (ENISA) surprisingly published the European Vulnerability Database (EUVD) today (2). This is a big deal. MITRE may somehow figure out how this program may work without the U.S. government. However, the global cybersecurity community needs to be able to fully trust the CVE system, its processes and the institutions responsible for it. Pulling the plug on the CVE database with a one-day notice period was a critical global risk, given its central role in cybersecurity infrastructure and the countless organisations and tools that depend on it for vulnerability management. A vulnerability database made and hosted in Europe not just means that there is now another practical source that makes triaging efficient and helps prioritise vulnerability management (3). The project comes with significantly better organisational conditions: trust, consistency and reliability, transparency, clear criteria for assignment and classification, visibility into decision-making processes, technical accuracy and quality, organisational neutrality and independence. (4) --- 1. https://lnkd.in/eASTug3z 2. https://lnkd.in/edtPRzny 3. https://lnkd.in/eHaWuQuJ 4. https://lnkd.in/ecetiAmB

635

25 commentaires