Data Safety and Information Security

Foolish Kubernetes misconfigurations continue to lead to major security foul-ups.

Scientists successfully taught advanced neural network sophisticated Darknet slang recognition capabilities

One frustrating aspect of email phishing is the frequency with which scammers fall back on tried-and-true methods that really have no business working these days. Like attaching a phishing email to a traditional, clean email message, or leveraging link redirects…

Researchers this month uncovered a two-year-old Linux-based remote access trojan dubbed AVrecon that enslaves Internet routers into botnet that bilks online advertisers and performs password-spraying attacks. Now new findings reveal that AVrecon is the malware engine behind a 12-year-old service…

We’re in an exciting time for users who want to take back control from major platforms like Twitter and Facebook. However, this new environment comes with challenges and risks for user privacy, so we need to get it right and make sure networks like the Fediverse and Bluesky are mindful of past...

Developers and security teams should work together toward a scalable, flexible, multilayered approach for any type of workload in any environment.

This memo contains the thoughts and recountings of events that transpired during and after the release of information about the United States National Security Agency (NSA) by Edward Snowden in 2013. There are four perspectives: that of someone who was involved with sifting through the information to responsibly inform the public, that of a security area director of the IETF, that of a human rights expert, and that of a computer science and affiliate law professor. The purpose of this memo is to provide some historical perspective, while at the same time offering a view as to what security and privacy challenges the technical community should consider. These essays do not represent a consensus view, but that of the individual authors.

Please choose a password

175+ Cybersecurity Misconceptions and the Myth-Busting Skills You Need to Correct ThemCybersecurity is fraught with hidden and unsuspected dangers and difficulties. Despite our best intentions, there are common and avoidable mistakes that arise from folk wisdom, faulty assumptions about the world, and our own human biases. Cybersecurity implementations, investigations, and research all suffer as a result.

Integrating security solutions into DevOps toolchains will take effort, but once in place they will enhance application security.

Authorization is the largest vulnerability area that is not protected well and represents the biggest current risk for API security.

BrutePrint requires just $15 of equipment and a little amount of time with a phone.

(Editor's note: This article contains plot spoilers.) Society's understanding of technology and cybersecurity often is based on simple stereotypes and sensational portrayals in the entertainment media. I've written about how certain scenarios are entertaining but misleading. Think of black-clad teenage hackers prowling megacities challenging corporate villains. Or think of counterintelligence specialists repositioning a satellite from the back of a surveillance van via a phone call.

Code scanning detects ReDoS vulnerabilities automatically, but fixing them isn’t always easy. This blog post describes a 4-step strategy for fixing ReDoS bugs.

Security best practices have emerged, including those for cloud native deployments. However, that remains a work in progress.

Pipeline controls can only ensure security and compliance for changes that have gone through the pipeline. They don't account for "dark deploys" from bad actors who access production by going around the golden path.

Last week's IIW was great with many high intensity discussions of identity by people from across the globe.

ETHOS is the OT-centric, open-source platform for sharing anonymous early warning threat information.

Attached: 4 images Google has just updated its 2FA Authenticator app and added a much-needed feature: the ability to sync secrets across devices. TL;DR: Don't turn it on. The new update allows users to sign in with their Google Account and sync 2FA secrets across their iOS and Android devices. We analyzed the network traffic when the app syncs the secrets, and it turns out the traffic is not end-to-end encrypted. As shown in the screenshots, this means that Google can see the secrets, likely even while they’re stored on their servers. There is no option to add a passphrase to protect the secrets, to make them accessible only by the user. Why is this bad? Every 2FA QR code contains a secret, or a seed, that’s used to generate the one-time codes. If someone else knows the secret, they can generate the same one-time codes and defeat 2FA protections. So, if there’s ever a data breach or if someone obtains access .... 🧵 #Privacy #Cybersecurity #InfoSec #2FA #Google #Security

Search engine of Internet-connected devices. Create a free account to get started.

The transition from traditional logins to cryptographic passkeys is getting messy. But don’t worry—there’s a plan.

Salt Security finds It's well past time for us to lock down our application programming interfaces.

Entitle has raised $15 million in seed funding for a solution designed to automate identity permissions management in the cloud.

Were you supposed to sign an electronic document? Come look deeper into what makes your electronic signature as secure as it should be.

In this guide, we will explain what SSRF attacks are and how you can protect against them with open-source Svix

Lots of companies are eager to provide their identity provider: Twitter, Facebook, Google, etc. For smaller businesses, not having to manage identities is a benefit. However, we want to avoid being locked into one provider. In this post, I want to demo how to use OpenID Connect using Google underneath and then switch to Azure. OpenID Connect The idea of an authorization open standard started with OAuth around 2006. Because of a security issue, OAuth 2.0 superseded the initial version. OAuth 2

The Biden administration today issued its vision for beefing up the nation's collective cybersecurity posture, including calls for legislation establishing liability for software products and services that are sold with little regard for security. The White House's new national cybersecurity…