AMD said it is investigating a potential data breach after RansomHouse, a relatively new data cybercrime operation, claims to have extorted data from the US chipmaker. In addition to the fact that RansomHouse are focussing on large enterprises with weak security, Dr Darren Williams at ADX and ransomware prevention

Computer security specialist Blackfog has warned that ransomware attacks could lead to a cyber-attack.

Computerbeveiligingsspecialist Blackfog heeft gewaarschuwd dat ransomware-aanvallen kunnen leiden tot een cyberaanval.

AMD said it is investigating a potential data breach after RansomHouse, a relatively new data cybercrime operation, claims to have extorted data from the US chipmaker. In addition to the fact that RansomHouse are focussing on large enterprises with weak security, Dr Darren Williams at ADX and ransomware prevention specialists, Blackfog notes that if an attacker wants to make their way in, they will, regardless of how weak or strong your password is, as their main focus is the data that leave with…

AMD zei dat het een potentieel datalek onderzoekt nadat RansomHouse, een relatief nieuwe cybercriminele operatie, beweert gegevens te hebben afgeperst van de Amerikaanse chipmaker. Naast het feit dat RansomHouse zich richt op grote ondernemingen met een zwakke beveiliging, merkt Dr Darren Williams van ADX en ransomware preventie specialisten, Blackfog op dat als een aanvaller zich een weg naar binnen wil banen, ze dat zullen doen, ongeacht hoe zwak of sterk je wachtwoord is, omdat hun belangrijkste focus de gegevens zijn die mee...

AMD said it is investigating a potential data breach after RansomHouse, a relatively new data cybercrime operation, claims to have extorted data from the US chipmaker.

In addition to the fact that RansomHouse are focussing on large enterprises with weak security, Dr Darren Williams at ADX and ransomware prevention specialists, Blackfog notes that if an attacker wants to make their way in, they will, regardless of how weak or strong your password is, as their main focus is the data that leave with…

Expert Insight On RansomHouse Attacking AMD

SD-WAN remains an opportunity for partners in 2022. Read about how SD-WAN can enable a foundational platform for SASE, Zero Trust Edge, and SD-Branch solutions.…

When it comes to security, SD-WAN is a key part of the IT industry.

Als het gaat om beveiliging, is SD-WAN een belangrijk onderdeel van de IT-industrie.

Many organizations still view SD-WAN through the lens of its first- or second-generation iterations. But with third-generation SD-WAN, partners have a stronger opportunity than ever before to offer customers a strategic solution that enhances security, simplifies operations, and enhances network performance, especially when providing it as a tightly-integrated platform. In addition, now SD-WAN can enable a foundational platform for SASE, Zero Trust Edge, and SD-Branch solutions.

Veel organisaties bekijken SD-WAN nog steeds door de lens van de eerste of tweede generatie iteraties. Maar met SD-WAN van de derde generatie hebben partners een sterkere kans dan ooit om klanten een strategische oplossing te bieden die de beveiliging verbetert, de activiteiten vereenvoudigt en de netwerkprestaties verbetert, vooral wanneer ze deze oplossing als een hecht geïntegreerd platform aanbieden. Bovendien kan SD-WAN nu een fundamenteel platform vormen voor SASE-, Zero Trust Edge- en SD-Branch-oplossingen.

SD-WAN has been a regular topic of conversation for IT and security professionals for over five years. Even before the pandemic and subsequent widespread shift to remote work, many organizations were beginning to deploy this technology. Many organizations still view SD-WAN through the lens of its first- or second-generation iterations. Initial SD-WAN solutions focused on transforming the network. Second generation SD-WAN solutions provided “always-on” security over direct internet access.

But with third-generation SD-WAN, partners have a stronger opportunity than ever before to offer customers a strategic solution that enhances security, simplifies operations, and enhances network performance, especially when providing it as a tightly-integrated platform. In addition, now SD-WAN can enable a foundational platform for SASE, Zero Trust Edge, and SD-Branch solutions.

SD-WAN is an alternative to WAN infrastructure that is cost-effective but historically SD-WAN solutions provided little to no security as part of their solution unless part of an overlay. Therefore, organizations have had to apply security as an afterthought adding complexity and cost. For SD-WAN to be truly effective, it must converge networking and security.

Secure SD-WAN actually reduces network complexity with a security-driven networking strategy. This technology reduces network complexity and burdens on IT staff by converging networking and security across the connected environment.

With network security increasingly important across distributed workforces, partners can distinguish themselves by transforming WAN edges with secure SD-WAN that responds to multi-cloud and hybrid environment needs by combining:

Secure SD-WAN devices offer centralized management and visibility through a single-pane-of-glass view. Converging networking and security reduces the strains that IT teams face by giving them a way to manage two problems in one solution. When these offerings are scalable across any enterprise size, IT teams can keep pace with the organization’s growth objectives without compromising security.

Customers need to enhance their security without negatively impacting their IT operations. SD-WAN also solves this problem by reducing the time IT staff spend on infrastructure deployment and changes.

When partners provide an SD-WAN with zero-touch deployment, they streamline the setup process, reducing operational impact. The unconfigured SD-WAN appliance automatically connects to a service authenticating the remote devices and a centralized management system. IT teams then gain an immediate, unified view of traffic, enabling faster issue resolution. With guided workflows, automated overlay, and simplified business policies, IT staff can respond to issues rapidly. The SD-WAN’s predictive analytics help with troubleshooting by enabling them to solve issues within minutes or seconds. Ultimately, SD-WAN is a multipurpose solution to a complex problem.

Cloud-based applications and tools, like voice and video, are critical to distributed workforce models. Organizations need security without compromising application performance and user productivity. With SD-WAN, workforce members gain the network speed necessary to maintain productivity and reduce frustration.

Applications are everywhere, not just in the data center. This gives workforce members the freedom to work from an office, airport, or home. However, they need a consistent, secure user experience. An intelligent SD-WAN offers this by steering remote workers using bandwidth-intensive applications to the best performing WAN link for optimal performance. When combined with instant multi-cloud access, it enables a low latency connection through public internet links to ensure security.

This gives partners another opportunity to distinguish themselves in the market. When they provide an SD-WAN enabling a reliable user experience on any transport with self-healing capabilities, they increase workforce member productivity and satisfaction. Ultimately, this drives revenue. Coupled with enhanced security and operational efficiency, secure SD-WAN provides a solution for the multi-pronged business problems modern organizations face.

A Platform Approach Responds to Evolving Security and Business Needs

Many customers viewing SD-WAN through a first- or second-generation lens believe it is a point solution that increases network, security, operational, and productivity-related complexity. Third-generation SD-WAN, however, takes a tightly-integrated, automated platform approach, eliminating the complexity and tool proliferation that threat actors continue to exploit.



Secure SD-WAN incorporated as part of a cybersecurity mesh is a broad platform, fully integrated and automated across the technology and cybersecurity stacks. A security-driven network eliminates the disconnect caused by multiple point products, providing the single-pane-of-glass unified management required in today’s connected workplaces. Further, a broad platform approach like this allows partners to secure all remote work edges, including IoT and 5G networks. With secure SD-WAN tightly integrated and automated, customers can achieve zero-trust access across on-premises, hybrid, and multi-cloud environments. In a multi-cloud deployment situation, SD-WAN can help provide reliable access to cloud-based resources with granular controls, including dynamic failover, SLA-based application steering, and application availability.

When partners can offer an SD-WAN that enables secure work from home models, they also have an opportunity to establish a customer relationship and IT foundation that makes transitioning to SASE easier. An SD-WAN platform with consistent security no matter where users work, on or off network, creates an opportunity for long-term business strategies as customers evolve their security posture.

Partners offering a cybersecurity mesh or fabric-based approach with SD-WAN give their customers the technology needed to thwart threat actors. Without the blind spots created by multiple point products, clients can securely scale their business operations and advance their cloud strategies without compromising security.

SD-WAN is no longer a simple router replacement. Today, it is a strategic solution that offers end-to-end security, operations, and productivity for employees working from anywhere. SD-WAN provides a zero-trust network access enforcement that enables organizations to ensure only authorized users can only access applications that are allowed to, especially when integrated into multi-cloud infrastructures. Even more important, as companies build out their LTE and 5G networks, SD-WAN enhances these areas providing more resilient performance.

Partners providing a platform experience that incorporates SD-WAN give customers a solution to solving immediate problems and anticipating future needs. In doing so, they bring in new revenue while building crucial long-term customer relationships for continued success.

Take a security-driven networking approach to improve user experience and simplify operations at the WAN edge with Fortinet Secure SD-WAN.

SD-WAN Still Presents an Opportunity for Partners in 2022 (and Beyond)

Organizations are rapidly turning to APIs because they bridge the gap between independent applications and programs and, in turn, facilitate proper and consistent communication between them. APIs have become a fundamental part of every application, and it’s easy to see why many companies are developing their applications using APIs and DevOps. APIs can become more […]

A growing number of companies are developing their applications using artificial intelligence (APIs).

Een groeiend aantal bedrijven ontwikkelt hun toepassingen met behulp van kunstmatige intelligentie (API's).

APIs have become a fundamental part of every application, and it’s easy to see why many companies are developing their applications using APIs and DevOps. APIs can accelerate development, reduce time to market without compromising quality, and increase customer coverage and business value. Building a DevOps strategy consists of adopting CI/CD platforms, training the right IT professionals, and integrating new application testing and release cycles.

Organisaties maken snel gebruik van API's omdat zij de kloof tussen onafhankelijke toepassingen en programma's overbruggen en op hun beurt een correcte en consistente communicatie tussen hen vergemakkelijken. API's zijn een fundamenteel onderdeel geworden van elke applicatie, en het is gemakkelijk te zien waarom veel bedrijven hun applicaties ontwikkelen met behulp van API's en DevOps. API's kunnen veiliger en betrouwbaarder worden door gebruik te maken van beheersinstrumenten.

Organizations are rapidly turning to APIs because they bridge the gap between independent applications and programs and, in turn, facilitate proper and consistent communication between them. APIs have become a fundamental part of every application, and it’s easy to see why many companies are developing their applications using APIs and DevOps.

APIs can become more secure and reliable by using management tools. Organizations must perform routine API audits to improve their development. This will significantly help in preventing attacks from malicious bots and hackers.

APIs can accelerate development, reduce time to market without compromising quality, and increase customer coverage and business value.

Building a DevOps strategy consists of adopting CI/CD platforms, training the right IT professionals, and integrating new application testing and release cycles.

DevOps is at the crossroads of IT and digital innovation. It plays a crucial role in securing the entire API lifecycle. In the race to scale APIs, many companies ignore other security threats.

So how do you optimize DevOps security issues with APIs?
• Don’t secure APIs, protect the API lifecycle: API security works best when built into every lifecycle stage like QA staging, development, user acceptance testing, versioning, production, and even API retirement.
• Scale user identity and access features: A key to API security for DevOps is scaling modern user authentication and access features. Examples include JWT tokens, OIDC, and OAuth. This can mitigate the risks associated with API users at multiple scales.

The second inevitable challenge is compliance. Almost every business faces regulatory, compliance, and governance oversight challenges.

So how do you optimize DevOps compliance with APIs?
• Use an API management platform for automation: This can simplify policy management, authorization, authentication, logs, redacting, and other oversights activities.
• Use API analysis to exceed benchmarks: set thresholds based on your compliance needs. This contains everything from limiting user API access based on geo-location to setting up custom alerts to detect threats.

Reduce the complexity of Microservices endpoints using APIs

There are more services, platforms, languages, teams, and moving parts than ever before.

So how does the DevOps team keep track of all these moving parts? By creating, at the highest level, a meditation layer to manage microservices access.

This frees DevOps teams from the complexity of managing microservices. It also adds more granular access to core services. This allows consistency across security, quality measurement, and other organization-specific values.

Centralizing core technology and applications can generally enhance CI and CD channel pipelines. This simplifies microservices management and endpoint complexity.

With a secure, single-interface DevOps ecosystem, you can focus your energy on improving CI and CD results using API functionality.

Using APIs at scale, you can now manage application functionality based on real-time deployment needs, such as:
• Partitioning services to different clouds or databases.
• Expose internal applications and services for third parties’ consumption.
• Monitoring of trends and usage rates of internal and external applications.
• Adjust speed or access restriction according to usage habits.

In short, API management authorizes DevOps teams to make security, technical, and environmental adjustments faster. Additionally, APIs make it easy to monitor and manage all systems.

How to implement your application Security Using API?

When you hear about DevOps, sooner or later, you will hear about a continuous implementation-continuous deployment (CI/CD). The process helps integrate the development and release processes better so that new features and applications are launched faster without compromising quality.

Set up a web application firewall (WAF) for environments that use APIs

A Web Application Firewall (WAF) solution is needed to ensure API security to inspect inbound and outbound HTTPS/HTTP like any other web application. A WAF provides specialized security features that complement API Gateways, making it essential for modern application environments.

Application environments and available tools are changing rapidly. If security solutions are designed to be rigid, it will be challenging to break from previous strategies and keep up with new developments.

When companies focus on DevOps, APIs, and CI/CDs, sometimes they tend to stop protecting their data. Data security is even more important as applications and frameworks become more integrated and distributed in DevOps. Over time, complex interdependencies emerge that can span clouds, containers, APIs, and services.

Implementing a data-centric audit and protection (DCAP) solution is an excellent way to approach this complex ecosystem. This will help protect data stored in files, databases, and repositories.

APIs provide a secure approach to connecting and exposing resources. Therefore, when creating a new application or resource, a team can capitalize on these reusable components, eliminating the time and resources required to start each project from scratch.

For companies looking to bolster their DevOps environment with APIs, here are key considerations to get started:

As teams build new applications, it is necessary to create recipes that allow the application to be reassembled correctly each time it is disassembled for changes and updates.

Most developers wait until the end of the code to create tests. Instead, developers should create tests before writing a single line of code using mock data. As a result, code can be moved much faster from development to deployment.

Effective version control allows developers to move code to a different set of teams, direct parallel development, and provide instant visibility into incompatible changes with what others are doing.

Like creating a recipe for how an app is built, you should create a recipe for how apps are deployed. The recipe should help determine which environments the applications should be deployed to, how they are promoted across environments (e.g., development, QA, security, production), and how the settings change based on the environment.

APIs required a focused approach to security to protect them across their full lifecycle. WAFs and other tooling are good for application protection, but they won’t defend you against dedicated API attacks. Those attacks are low and slow and cannot be detected by WAFs or API gateways. You’ll also want automated discovery to go with your runtime protection, so you know the full landscape of APIs in your environment.

How To Build A DevOps Strategy With APIs

Decrypting Hive Ransomware Data - Schneier on Security

In our series of letters from African journalists, we look at the vulnerability of Hive ransomware.

In onze reeks brieven van Afrikaanse journalisten kijken we naar de kwetsbaarheid van Hive ransomware.

In this paper, we analyzed Hive ransomware, which appeared in June 2021. To minimize the damage caused by Hive Ransomware and to help victims recover their files, we analyzed Hive Ransomware and studied recovery methods. By analyzing the encryption process of Hive ransomware, we confirmed that vulnerabilities exist by using their own encryption algorithm.

Aangezien gegevens niet kunnen worden hersteld als de encryptiesleutel niet wordt verkregen, lijden sommige bedrijven aanzienlijke schade, zoals de betaling van enorme bedragen of het verlies van belangrijke gegevens. Om de schade veroorzaakt door Hive Ransomware te minimaliseren en slachtoffers te helpen hun bestanden te herstellen, hebben we Hive Ransomware geanalyseerd en herstelmethoden bestudeerd. Door het analyseren van het encryptie proces van Hive ransomware, hebben we bevestigd dat er kwetsbaarheden bestaan door het gebruik van hun eigen encryptie algoritme.

Abstract: Among the many types of malicious codes, ransomware poses a major threat. Ransomware encrypts data and demands a ransom in exchange for decryption. As data recovery is impossible if the encryption key is not obtained, some companies suffer from considerable damage, such as the payment of huge amounts of money or the loss of important data. In this paper, we analyzed Hive ransomware, which appeared in June 2021. Hive ransomware has caused immense harm, leading the FBI to issue an alert about it. To minimize the damage caused by Hive Ransomware and to help victims recover their files, we analyzed Hive Ransomware and studied recovery methods. By analyzing the encryption process of Hive ransomware, we confirmed that vulnerabilities exist by using their own encryption algorithm. We have recovered the master key for generating the file encryption key partially, to enable the decryption of data encrypted by Hive ransomware. We recovered 95% of the master key without the attacker’s RSA private key and decrypted the actual infected data. To the best of our knowledge, this is the first successful attempt at decrypting Hive ransomware. It is expected that our method can be used to reduce the damage caused by Hive ransomware.

The cryptographic vulnerability identified by the researchers concerns the mechanism by which the master keys are generated and stored, with the ransomware strain only encrypting select portions of the file as opposed to the entire contents using two

The encryption keystream, which is created from an XOR operation of the two keystreams, is then XORed with the data in alternate blocks to generate the encrypted file. But this technique also makes it possible to guess the keystreams and restore the master key, in turn enabling the decode of encrypted files sans the attacker’s private key.

The researchers said that they were able to weaponize the flaw to devise a method to reliably recover more than 95% of the keys employed during encryption.

Network segmentation is a best practice and when done correctly it improves network security and

The SolarWinds breach has been linked to a massive cyber-attack that has left more than 100 people dead.

De inbreuk bij SolarWinds is in verband gebracht met een grootschalige cyberaanval waarbij meer dan 100 mensen om het leven zijn gekomen.

Every organization is at risk for cyberattacks, and it’s unsettling that the attackers are so good at maximizing the damage to their victims. The time an attacker spends inside a network is referred to as ‘dwell time,’ and it’s measured from the point of intrusion to the point of detection. Long dwell times increase the damage of an attack, often in ways that can’t be measured.

Elke organisatie loopt het risico op cyberaanvallen, en het is verontrustend dat de aanvallers zo goed zijn in het maximaliseren van de schade aan hun slachtoffers. Aanvallers die de bedrijfsverdediging omzeilen, zullen zich zo lang mogelijk in het netwerk verbergen, zelfs als ze van plan zijn een ransomware-aanval uit te voeren. Lange verblijftijden verhogen de schade van een aanval, vaak op een manier die niet kan worden gemeten.

Every organization is at risk for cyberattacks, and it’s unsettling that the attackers are so good at maximizing the damage to their victims. Their tactics are increasingly sophisticated and often involve some type of email attack, bot attack, or even just old-school social engineering. Attackers who bypass company defenses will hide inside the network as long as possible, even if they’re planning to launch a ransomware attack. They use this time to explore the network, steal data and user credentials, destroy backups, and do anything else they can do to set themselves up for future attacks.

The time an attacker spends inside a network is referred to as ‘dwell time,’ and it’s measured from the point of intrusion to the point of detection. Long dwell times increase the damage of an attack, often in ways that can’t be measured. The SolarWinds breach is the perfect example of this. The intruders entered the network in early 2019 and were not discovered until December 2020. The exact number of victims and costs associated with the attack remain unknown.

Network segmentation is one of the easiest and most effective ways to reduce dwell time. For those of you not familiar with this practice, it’s just like it sounds: You divide your network into different sections (segments) and you ‘lock the doors’ between them.

You’ve seen this concept at work in high-security buildings that restrict access to certain parts of the facility to people who have been granted permission to enter that restricted section. This keeps people from wandering around and exploring areas that are critical to operations or contain sensitive information. Segmentation does something similar for your network.

There are immediate security benefits to separating your network into multiple contained segments:
• Segmentation creates a smaller attack surface within the network. An intruder will be limited to the segment that was breached. The attacker can go no further unless they successfully breach another segment. Isolating your mission-critical servers and data can prevent an intruder from gaining access to your resources through a neglected printer or rogue smart device.
• Segmentation makes it easier to detect and isolate security incidents. The division between the segments helps contain the spread of malware and viruses. It limits the areas where the intruder can hide, and it can improve the efficiency of security monitoring.

There are non-security benefits as well. For example, POS devices fall under strict compliance rules. Assigning POS devices their own segment helps companies by limiting the cardholder data environment (CDE) and reducing the scope of PCI DSS compliance.

Segmentation also improves network performance by separating traffic. A good example of improving both security and performance is the separation of a public network from private resources. A shopping center or school campus that offers free wireless access to guests would want that traffic separated from the line-of-business applications. This keeps the potential traffic congestion of public wireless access isolated to assigned segments.

Gartner analysts have warned against over-segmentation, which can complicate the management and use of the network. One Gartner study found that over 70% of segmentation projects had to be re-architected because the segmentation made it too difficult for authorized users to access what they needed to perform their work.

“A principle of network segmentation is to group like resources together, to minimize security overhead: Build a fence around the car park, not a fence and gate around every car. ~Gartner”

Barracuda can help you secure your network while making it easier to manage. Visit our website for more information on Barracuda CloudGen Firewall, secure SD-WAN, and other network security solutions.

How network segmentation can help secure your business

Pursuing a SOC 2 audit is a multi-step process. This blog clarifies the SOC 2 audit process and explains the role of SOC 2 auditors and compliance software.

When it comes to cybersecurity, companies need to demonstrate their ability to protect data and information.

Als het om cyberbeveiliging gaat, moeten bedrijven aantonen dat zij in staat zijn gegevens en informatie te beschermen.

Pursuing a SOC 2 audit is a multi-step process, which can seem confusing at first glance given the fact that there are vendors that provide compliance software, and other vendors who are themselves certified SOC 2 auditors. This blog will clarify the SOC 2 audit process, as well as explain the role of SOC 2 auditors and compliance software. When and How to Use SOC 2 Software ToolsThere are multiple steps to completing a SOC 2 audit.

Enter, SOC 2 (Service Organization Control 2), een populaire audit die getuigt van het vermogen van een bedrijf om gegevens en informatie te beschermen. Het nastreven van een SOC 2-audit is een proces dat uit verschillende stappen bestaat, wat op het eerste gezicht verwarrend kan lijken, gezien het feit dat er verkopers zijn die nalevingssoftware leveren, en andere verkopers die zelf gecertificeerde SOC 2-auditors zijn. Wanneer en hoe SOC 2-softwaretools gebruikenEr zijn verschillende stappen om een SOC 2-audit te voltooien.

Data breaches and ransomware attacks continue to dominate the news cycle. To protect data, and position themselves favorably among prospects and customers, companies need to demonstrate a commitment to cybersecurity.

Enter, SOC 2 (Service Organization Control 2), a popular audit that attests to a company’s ability to protect data and information. It’s a strong validator for any company looking to demonstrate its commitment to cybersecurity to partners and customers.

Pursuing a SOC 2 audit is a multi-step process, which can seem confusing at first glance given the fact that there are vendors that provide compliance software, and other vendors who are themselves certified SOC 2 auditors.

This blog will clarify the SOC 2 audit process, as well as explain the role of SOC 2 auditors and compliance software.

When and How to Use SOC 2 Software Tools

There are multiple steps to completing a SOC 2 audit. Many companies start with a readiness/gap assessment, which is the process of reviewing existing controls in place and identifying those that need to be improved or implemented. This process can be executed via an audit consultant, or through specialized software tools that help simplify this process (like A-SCEND).

Compliance software tools typically provide automated workflows and compliance templates, comparing your existing controls against the controls within a selected compliance framework — which, in this case, would be the SOC 2 framework.

Typically, this software allows you to visualize progress toward compliance goals, assign tasks related to evidence collection or policy updates, and collaborate all in one dashboard. Software tools provide a simple way to understand the framework requirements, assess them against your existing policies and procedures, and manage the process of updating policies. While these tools help to better prepare for an audit and streamline the assessment process, an experienced auditor is still a critical component of compliance.

When and How to Use SOC 2 Auditors

Software tools can only take you so far with SOC 2. They can help prepare a company for a SOC 2 audit, but not complete the audit itself. When the actual audit takes place, companies must turn to a SOC auditor.

SOC 2 audits are regulated by the American Institute of Certified Public Accountants (AICPA) and must be completed by an external auditor from a licensed CPA firm. This is the only way a company can receive an official SOC 2 report, whether it’s a Type 1 or Type 2 report.

An official SOC 2 report is valid for one year following the date the report was issued. Future annual audits must also be completed by an external auditor from a licensed CPA firm.

If your organization plans to use software to prepare for an audit, it’s helpful to work with a software partner who can also conduct the official audit (as a certified CPA) because it provides an added layer of convenience throughout the SOC 2 process and results in a reputable report. 



Organizations need to go beyond the data collection by their compliance software tool and conduct further due diligence, such as observations and walkthroughs (conversations) between the audit team and the client. SOC 2 auditors may also find that they need additional data or evidence necessary to validate the design and operating effectiveness of a complete control set. When you use the same company for a technology-enabled audit, and a SOC 2 report, the software is designed to request all audit materials needed, including manually operated controls and supporting evidence. In this convenient scenario, you can save time, resources, and money.

Stephanie Oyler is the Vice President of Attestation Services at A-LIGN focused on overseeing a variation of many assessments within the SOC practice. Stephanie’s responsibilities include managing key service delivery leadership teams, maintaining auditing standards and methodologies, and analyzing business unit metrics. Stephanie has spent several years at A-LIGN in service delivery roles from auditing and managing client engagements to overseeing audit teams and providing quality reviews of reports. Prior to joining A-LIGN, Stephanie worked for CBIZ, the tenth largest accounting firm in the U.S., providing auditing services in the financial accounting spectrum for various industries including automobile, hospitality, not-for-profit, real estate, and cloud architecture. Stephanie graduated from the University of South Florida with a bachelor’s degree of Science in Accounting. During her time at the University of South Florida, Stephanie was an active member of Beta Alpha Psi, an international honor society for Accounting, Finance, and Information Systems students and professionals.

Who Performs a SOC 2 Audit? The Role of SOC 2 Auditors | CSA

By Guy Rosefelt, CPO, Sangfor Technologies NFTs have become very popular with collectors and are more ubiquitous every day.  The idea of owning a one-of-a-kind object even in the digital world is very attractive.  The

In our series of letters from African journalists, novelist and writer Jonathan Marcus looks at how security issues affect crypto-wallets.

In onze reeks brieven van Afrikaanse journalisten bekijkt romanschrijver en schrijver Jonathan Marcus hoe veiligheidskwesties crypto-wallets beïnvloeden.

The idea of owning a one-of-a-kind object even in the digital world is very attractive. But artists and creatives of all types, be it painting and graphics, music, photography, and even video can now create and sell unique works that cannot be replicated. Besides security issues, they are being used by criminals for money laundering of cryptocurrency, and I do not see the value in something that will immediately become worthless when the internet apocalypse happens and your NFT wallet is no longer accessible.

Het idee is niet nieuw, aangezien het kopen van unieke voorwerpen in games al tientallen jaren bestaat. Maar kunstenaars en creatieven van alle soorten, of het nu gaat om schilderen en grafiek, muziek, fotografie, en zelfs video, kunnen nu unieke werken maken en verkopen die niet kunnen worden nagemaakt. Naast beveiligingsproblemen worden ze door criminelen gebruikt voor het witwassen van cryptocurrency, en ik zie de waarde niet in van iets dat onmiddellijk waardeloos wordt als de internetapocalyps gebeurt en je NFT wallet niet meer toegankelijk is.

NFTs have become very popular with collectors and are more ubiquitous every day. The idea of owning a one-of-a-kind object even in the digital world is very attractive. The idea is not new as buying unique items inside games has been around for decades. But artists and creatives of all types, be it painting and graphics, music, photography, and even video can now create and sell unique works that cannot be replicated.

First, I need to disclose I am not a huge fan of Non-Fungible Tokens (NFTs). Besides security issues, they are being used by criminals for money laundering of cryptocurrency, and I do not see the value in something that will immediately become worthless when the internet apocalypse happens and your NFT wallet is no longer accessible. But that is just me. Until that happens let’s talk about the security issues. Security issues include phishing scams to access crypto-wallets and steal NFTs, and selling counterfeit items, but the issue I want to discuss is using NFTs to distribute malware.

VIA, a company that specializes in solutions for infrastructure and government, reported that they discovered instances of malware being injected into NFTs and demonstrated how easy it is. It makes sense as NFTs are normally media files that have historically been used to inject code or embed malicious software that runs when open. All being an NFT does is verify that it is the only file of its kind using blockchain. But it does nothing to verify the safety of the file. VIA has even created an open-source tool to scan NFTs to look for malicious code or software in the file.

So, the next time you spend thousands of dollars on an NFT, make sure, even if it comes from a reputable vendor, to scan it before opening it and hope there is a return policy if you find something unexpected. Otherwise, your crypto wallet might have a surprise for you once the internet apocalypse ends.

Guy is Chief Product Officer for Sangfor Technologies. He has over 20 years experience (though some say it is one year’s experience twenty times) in application and network security, kicking it off with 10 years in the U.S. Air Force, reaching rank of captain. After his time in the USAF building the first fiber to the desktop LAN and other things you would find in Tom Clancy novels, Guy worked at NGAF, SIEM, WAF and CASB startups as well as big-name brands like Imperva and Citrix. He has spoken at numerous conferences around the world and in people’s living rooms, written articles about the coming Internet Apocalypse, and even managed to occasionally lead teams that designed and built security stuff. Guy is thrilled to be in his current position at Sangfor — partly because he was promised there would always be Coke Zero in the breakroom. His favorite cake is German Chocolate.

Guy can be reached online at guy.rosefelt@sangfor.com or on Twitter at @otto38dd and at our company website www.sangfor.com.

FAIR USE NOTICE: Under the "fair use" act, another author may make limited use of the original author's work without asking permission. Pursuant to 17 U.S. Code § 107, certain uses of copyrighted material "for purposes such as criticism, comment, news reporting, teaching (including multiple copies for classroom use), scholarship, or research, is not an infringement of copyright." As a matter of policy, fair use is based on the belief that the public is entitled to freely use portions of copyrighted materials for purposes of commentary and criticism. The fair use privilege is perhaps the most significant limitation on a copyright owner's exclusive rights. Cyber Defense Media Group is a news reporting company, reporting cyber news, events, information and much more at no charge at our website Cyber Defense Magazine. All images and reporting are done exclusively under the Fair Use of the US copyright act.

NFTS Are Cool but Dangerous

By Randy Reiter CEO of Don’t Be Breached April, 2022 Microsoft reported that vulnerabilities in its Azure Database for PostgreSQL could have let Hackers gain access to other customers' databases after bypassing authentication. "By exploiting

Hackers could have exploited a vulnerability in Microsoft’s databases, according to researchers.

Hackers hebben volgens onderzoekers misbruik kunnen maken van een kwetsbaarheid in de databases van Microsoft.

By Randy Reiter CEO of Don’t Be BreachedApril, 2022 Microsoft reported that vulnerabilities in its Azure Database for PostgreSQL could have let Hackers gain access to other customers’ databases after bypassing authentication. Microsoft said its analysis showed no evidence of attackers having exploited the vulnerabilities to access customer data. Wiz said Microsoft awarded its researchers a $40,000 bug bounty — the amount can be viewed as confirmation of the vulnerability’s severity.

Door Randy Reiter CEO van Don't Be BreachedIn april 2022 meldde Microsoft dat kwetsbaarheden in zijn Azure Database voor PostgreSQL hackers toegang konden verschaffen tot de databases van andere klanten nadat ze de authenticatie hadden omzeild. Volgens Microsoft heeft zijn analyse geen aanwijzingen opgeleverd dat aanvallers de kwetsbaarheden hebben misbruikt om toegang te krijgen tot klantengegevens. Wiz zei dat Microsoft zijn onderzoekers een bounty van 40.000 dollar heeft toegekend - het bedrag kan worden gezien als een bevestiging van de ernst van de kwetsbaarheid.

By Randy Reiter CEO of Don’t Be Breached

April, 2022 Microsoft reported that vulnerabilities in its Azure Database for PostgreSQL could have let Hackers gain access to other customers’ databases after bypassing authentication. “By exploiting an elevated permissions bug in the Flexible Server authentication process for a replication user, a malicious user could leverage an improperly anchored regular expression to bypass authentication to gain access to other customers’ databases” the Microsoft Security Response Center reported.

The cloud security firm Wiz’s research team discovered the security vulnerabilities. An attacker could create a full copy of a target database in Azure PostgreSQL [Flexible Server], essentially exfiltrating all the information stored in the database, says Ami Luttwak, co-founder and CTO at Wiz.

Microsoft said it mitigated the issue on Jan. 13, 2022, less than 48 hours after Wiz had notified it of the issue. Microsoft said its analysis showed no evidence of attackers having exploited the vulnerabilities to access customer data. Wiz said Microsoft awarded its researchers a $40,000 bug bounty — the amount can be viewed as confirmation of the vulnerability’s severity.

How to Have Exploited the Database Vulnerability

As explained by Microsoft, the Wiz researchers went through the following steps to gain elevated privileges and remote code execution, which allowed them to bypass cross-account authentication using a forged certificate and access other customers’ databases:
• Retrieve the target’s common name from the Certificate Transparency feed.
• Find the target’s Azure region by resolving the database domain name and matching it to one of Azure’s public IP ranges.
• Create an attacker-controlled database in the target’s Azure region.
• Exploit vulnerability #1 on the attacker-controlled instance to escalate privileges and gain code execution.
• Scan the subnet for the target instance and exploit vulnerability #2 to gain read access!

How to Prevent Data Exfiltration and Data Breaches in Todays Complex Environment

Multiple layers of data protection are required today to prevent Data Exfiltration and Data Breaches. In 2020 the DHS, Department of State, U.S. Marine Corps and the Missile Defense Agency recognized this and all issued requests for proposals (RFP) for network full packet data capture for Deep Packet Inspection analysis (DPI) of network traffic. This is an important step forward protecting confidential database data and organization information.

Zero-day vulnerabilities that allow hackers to gain system privileges are a major threat to all organizations encrypted and unencrypted confidential data. Confidential data includes: credit card, tax ID, medical, social media, corporate, manufacturing, trade secrets, law enforcement, defense, homeland security, power grid and public utility data. This confidential data is almost always stored in DB2, Informix, MariaDB, Microsoft SQL Server, MySQL, Oracle, PostgreSQL and SAP Sybase databases.

How to Stop Data Exfiltration and Data Breaches with Deep Packet Inspection

Protecting encrypted and unencrypted confidential database data is much more than securing databases, operating systems, applications and the network perimeter against Hackers, Rogue Insiders and Supply Chain Attacks.

Non-intrusive network sniffing technology can perform a real-time Deep Packet Inspection (DPI) of 100% the database activity from a network tap or proxy server with no impact on the database servers. The database SQL activity is very predictable. Database servers servicing 1,000 to 10,000 end-users typically process daily 2,000 to 10,000 unique queries or SQL commands that run millions of times a day. Deep Packet Analysis does not require logging into the monitored networks, servers or databases. This approach can provide CISOs with what they can rarely achieve. Total visibility into the database activity 24×7 and 100% protection of confidential database data.

Advanced SQL Behavioral Analysis of 100% of the real-time database SQL packets can learn what the normal database activity is. Now the database query and SQL activity can be non-intrusively monitored in real-time with DPI and non-normal SQL activity immediately pinpointed. This approach is inexpensive to setup and has a low cost of operation. Now non-normal database activity from Hackers, Rogue Insiders or and Supply Chain Attacks can be detected in a few milli seconds. The Security Team can be immediately notified and the Hacker session terminated so that confidential database data is not stolen, ransomed or sold on the Dark Web.

Reiter is the CEO of Don’t Be Breached a Sql Power Tools company. He is the architect of the Database Cyber Security Guard product, a database Data Breach prevention product for DB2, Informix, MariaDB, Microsoft SQL Server, MySQL, Oracle, PostgreSQL, and SAP Sybase databases. He has a Master’s Degree in Computer Science and has worked extensively over the past 25 years with real-time network sniffing and database security. Randy can be reached online at rreiter@DontBeBreached.com, www.DontBeBreached.com and www.SqlPower.com/Cyber-Attacks.

FAIR USE NOTICE: Under the "fair use" act, another author may make limited use of the original author's work without asking permission. Pursuant to 17 U.S. Code § 107, certain uses of copyrighted material "for purposes such as criticism, comment, news reporting, teaching (including multiple copies for classroom use), scholarship, or research, is not an infringement of copyright." As a matter of policy, fair use is based on the belief that the public is entitled to freely use portions of copyrighted materials for purposes of commentary and criticism. The fair use privilege is perhaps the most significant limitation on a copyright owner's exclusive rights. Cyber Defense Media Group is a news reporting company, reporting cyber news, events, information and much more at no charge at our website Cyber Defense Magazine. All images and reporting are done exclusively under the Fair Use of the US copyright act.

Azure PostgreSQL User Databases Were Exposed Due to Critical Vulnerabilities

Sea-Doo maker BRP Inc. says work at its factories remains at a standstill following a cyberattack it reported Monday. Spokeswoman Biliana Necheva says in

A Canadian manufacturing company says it has been forced to freeze its operations following a cyber attack.

Een Canadees productiebedrijf zegt dat het gedwongen is zijn activiteiten te bevriezen na een cyberaanval.

Sea-Doo maker BRP Inc. says work at its factories remains at a standstill following a cyberattack it reported Monday. Spokeswoman Biliana Necheva says in an email operations have not resumed more than 48 hours after they were halted as a cautionary measure. It comes at a tough time for BRP, as supply chain woes weighed on sales in its first quarter, with more input obstacles expected on the powersport vehicle maker’s path for the rest of the year.

Woordvoerster Biliana Necheva zegt in een e-mail dat de operaties meer dan 48 uur nadat ze uit voorzorg waren stopgezet, nog niet zijn hervat. Dit komt op een moeilijk moment voor BRP, aangezien de problemen met de toeleveringsketen de verkoop in het eerste kwartaal hebben gedrukt. Voor de rest van het jaar worden nog meer invoerbelemmeringen verwacht voor de fabrikant van motorvoertuigen.

Sea-Doo maker BRP Inc. says work at its factories remains at a standstill following a cyberattack it reported Monday.

Spokeswoman Biliana Necheva says in an email operations have not resumed more than 48 hours after they were halted as a cautionary measure.

The Quebec-based company, which manufactures Ski-Doos and off-road vehicles, announced Monday morning it was the target of “malicious cybersecurity activity” and took “immediate measures to contain the situation.”

Deploying its own information technology staff, BRP also said it hired cybersecurity experts to help secure its systems and support an internal investigation.

The company said its freeze on operations could delay some transactions with customers and suppliers.

It comes at a tough time for BRP, as supply chain woes weighed on sales in its first quarter, with more input obstacles expected on the powersport vehicle maker’s path for the rest of the year.

Spun off from Bombardier Inc. in 2003, BRP employs nearly 20,000 workers, mainly at manufacturing and distribution sites in Mexico, Canada, Austria, the United States, Finland and Australia. Its products are sold in more than 120 countries.

This report by The Canadian Press was first published Aug. 11, 2022.

BRP operations remain frozen more than two days after cyberattack

A 39-year-old Saskatchewan man accused of stabbing someone in a hospital is facing an elevated charge of second-degree murder. Police were called to

Two men have been charged with murder after a fatal stabbing in Saskatoon.

Twee mannen zijn aangeklaagd voor moord na een dodelijke steekpartij in Saskatoon.

Police were called to Saskatoon’s Royal University Hospital in June after a 55-year-old man was stabbed. The suspect was initially charged with attempted murder, but police say the charge was upgraded after the man recently succumbed to his injuries in hospital. Police did not identify the two men in the case.

De politie werd in juni opgeroepen naar het Royal University Hospital in Saskatoon nadat een 55-jarige man was neergestoken. De verdachte werd aanvankelijk poging tot moord ten laste gelegd, maar de politie zegt dat de aanklacht werd opgewaardeerd nadat de man onlangs in het ziekenhuis aan zijn verwondingen was bezweken. De politie heeft de twee mannen in de zaak niet geïdentificeerd.

A 39-year-old Saskatchewan man accused of stabbing someone in a hospital is facing an elevated charge of second-degree murder.

Police were called to Saskatoon’s Royal University Hospital in June after a 55-year-old man was stabbed.

The suspect was initially charged with attempted murder, but police say the charge was upgraded after the man recently succumbed to his injuries in hospital.

Police did not identify the two men in the case.

They say the accused is in custody and scheduled to appear in court today.

It’s the seventh homicide in Saskatoon so far this year.

This report by The Canadian Press was first published Aug. 11, 2022.

Inzicht van experts in RansomHouse-aanvallen op AMD

Vergelijkbare publicaties

Hoe netwerksegmentatie uw bedrijf kan beveiligen

Wie voert een SOC 2-audit uit? De rol van SOC 2 auditors | CSA

NFTS zijn cool maar gevaarlijk

Azure PostgreSQL gebruikersdatabases werden blootgesteld als gevolg van kritieke kwetsbaarheden

Verrichtingen BRP blijven meer dan twee dagen na cyberaanval bevroren

Aanklacht tegen man van steekpartij in ziekenhuis Saskatoon is verhoogd na overlijden slachtoffer

Gevonden topics

SD-WAN biedt nog steeds een kans voor partners in 2022 (en daarna)

Hoe bouw je een DevOps-strategie met API's

Hive Ransomware gegevens ontsleutelen - Schneier on Security