Researchers uncover 6 new vulnerabilities in MiCODUS MV720 GPS tracker devices — used by over 1.5 million vehicles.

Welcome to a series of technical advice from across the world.

Welkom bij een reeks technische adviezen uit de hele wereld.

Weet uw weg in netwerken en client-server Linux-systemen - technieken, commandoregel, shellscripting en meer

Know Your Way Around Networks and Client-Server Linux Systems — Techniques, Command Line, Shell Scripting, and More

Unpatched GPS Tracker Bugs Could Let Attackers Disrupt Vehicles Remotely

WSJ: "Cyber Insurance Went Up A Whopping 92% In 2021"

Whoa Nellie, that's getting to be real money here. This is the kind of thing that starts cutting into your whole IT budget.

The WSJ said: "Many U.S. cyber insurers dramatically increased their rates during 2021, alarmed by a rash of cyberattacks that struck companies around the world and drew the attention of national governments. Data from regulatory filings and collated by ratings agencies shows that among the largest insurers, direct written premiums rose a whopping 92%, while direct loss ratios fell slightly.

IInsurers significantly increased premiums for cyber coverage over the course of 2021, as a string of high-profile attacks and government action helped boost demand for products, data collected by industry bodies shows. Analysts say that the increase primarily reflects higher rates, rather than insurers significantly expanding the amount of money they are willing to cover.

Cyber insurers are also taking a tougher line on would-be clients, demanding security measures such as multi-factor authentication and more sophisticated endpoint protection, brokers say." At KnowBe4 we have also observed that iinsurers are often mandating effective security awareness training as a prerequisite to get insured. Some insurers even send their customers to us as part of a standing offer.

Getting your employees trained is a must today, and the cost is a total no-brainer. Join the 50,000 organizations that use KnowBe4 and create a strong human firewall as your last line of defense.

By Mark Guntrip, Senior Director of Cybersecurity Strategy, Menlo Security The impact of the global pandemic has resulted in a paradigm shift that has drastically expanded attack surfaces, as hybrid and remote working environments become

Companies are struggling to adapt to a new type of cyber threat, writes Mark Guntrip.

Bedrijven worstelen met de aanpassing aan een nieuw type cyberdreiging, schrijft Mark Guntrip.

Employees now spend most of their time working in the cloud, using SaaS applications and other web-based tools that are pivotal to productivity, efficiency and collaboration. During the last 10 years, cybercriminals have adapted to find new ways in which they can exploit and bypass legacy security systems. HEAT attacks target web browsers as the attack vector and use techniques to evade detection from traditional tools used in current security stacks, such as firewalls, Secure Web Gateways, sandbox analysis, URL reputation and phishing detection solutions.

Daarbij worstelen bedrijven nu echter met een aantal nieuwe blinde vlekken in traditionele benaderingen van beveiliging die niet geschikt zijn om moderne werkmodellen te beschermen. HEAT-aanvallen richten zich op webbrowsers als aanvalsvector en maken gebruik van technieken om detectie te omzeilen van traditionele hulpmiddelen die in de huidige beveiligingspakketten worden gebruikt, zoals firewalls, Secure Web Gateways, sandbox-analyse, URL-reputatie en oplossingen voor phishing-detectie. Het onderzoeksteam van Menlo Labs constateerde in de tweede helft van vorig jaar een toename van het aantal HEAT-aanvallen met 224 procent.

The impact of the global pandemic has resulted in a paradigm shift that has drastically expanded attack surfaces, as hybrid and remote working environments become the norm.

Employees now spend most of their time working in the cloud, using SaaS applications and other web-based tools that are pivotal to productivity, efficiency and collaboration. However, in doing so, companies are now struggling to manage a variety of new blind spots in traditional approaches to security that are not fit to protect modern working models.

During the last 10 years, cybercriminals have adapted to find new ways in which they can exploit and bypass legacy security systems. Consequently, there has been a surge in a new class of cyber threats known as Highly Evasive Adaptive Threats (HEAT).

HEAT attacks target web browsers as the attack vector and use techniques to evade detection from traditional tools used in current security stacks, such as firewalls, Secure Web Gateways, sandbox analysis, URL reputation and phishing detection solutions. The Menlo Labs research team observed a 224 per cent increase in HEAT attacks in the second half of last year.

Used to deliver malware or to compromise credentials, which in many cases leads to ransomware payloads, HEAT attacks include at least one of four evasion techniques:

We have recently published a new report looking at how much organizations know about these types of advanced threats, whether they are seeing more of them, and how well equipped they are to deal with them. We uncovered five key insights based on the findings.

There is no doubt that companies are concerned about modern cyber threats. The European Union Agency for Cybersecurity (ENISA) recently stated that we are witnessing the “golden era of ransomware” – and for good reason. The consequences of such attacks can be catastrophic, from prolonged operational delays and data loss and exposure to huge reputational damages. Meanwhile, cybercriminals are successfully extorting financial sums in the tens of millions of dollars from their victims.

The shift to home working has changed everything. Many security solutions became redundant almost overnight, with enterprises now struggling to manage potential vulnerabilities owing to a distinct lack of visibility into those unmanaged devices that end users are using to access corporate networks. A series of security blind spots have emerged that many organizations simply are not aware of or able to manage. Add to this the threat of more sophisticated attacks, and the security implications of hybrid and remote models are clear to see.

Threat actors today are not standing still. They are constantly working to tweak and change their attack methods in order to further evade security systems and exploit their targets successfully. The adaptiveness of HEAT attacks is a key challenge. If security teams find a fix, attackers will alter their tactics to work around it. If a new web browser-focused tactic is proven to work it is in turn exploited at scale, often by a thriving and growing ransomware-as-a-service landscape.

The transition to hybrid and remote working has expanded attack surfaces and exposed new vulnerabilities, yet security has largely failed to adapt and properly serve these new operating environments. Organizations today are relying on outdated technologies from a different era to mitigate HEAT attacks. From antivirus software to firewalls, many of the solutions deployed for on-prem environments a decade ago simply are not fit for the purpose of dealing with modern cloud-based threats and defending against browser-led attacks.

Working practices today look fundamentally different compared to pre-pandemic, from the applications needed to complete tasks to the devices used during the day-to-day. From a security perspective, this has created many different problems that each need unique solutions. In order to determine which should take precedence, organizations should consider what will provide the greatest return on investment regarding risk reduction, working to remediate the greatest risk areas first. Critically, a layered approach should be adopted to both prevent attacks and manage them beyond the perimeter.

Cyber attacks are a case of ‘when’ not ‘if’ for those organizations not fully prepared. Security teams need to stop relying on traditional tools and strategies that are no longer adequate in dealing with these HEAT attacks. Adopting a prevention-driven approach is the most effective way in reducing the opportunity for attackers to breach the network and endpoint.

Mark Guntrip has over 20 years of experience in Strategy, Product Management, and GTM expertise across the enterprise and commercial organizations. Mark is responsible for articulating the future of threats and prevention strategies to security leaders and professionals across the globe. Prior to joining Menlo, Mark was a security strategist at Proofpoint, Symantec, Cisco, and several other leading security solutions providers. Mark holds a Master of Engineering (Hons) from the Southampton University. Mark Guntrip can be reached online at https://www.linkedin.com/in/mguntrip/ and at https://www.menlosecurity.com/

FAIR USE NOTICE: Under the "fair use" act, another author may make limited use of the original author's work without asking permission. Pursuant to 17 U.S. Code § 107, certain uses of copyrighted material "for purposes such as criticism, comment, news reporting, teaching (including multiple copies for classroom use), scholarship, or research, is not an infringement of copyright." As a matter of policy, fair use is based on the belief that the public is entitled to freely use portions of copyrighted materials for purposes of commentary and criticism. The fair use privilege is perhaps the most significant limitation on a copyright owner's exclusive rights. Cyber Defense Media Group is a news reporting company, reporting cyber news, events, information and much more at no charge at our website Cyber Defense Magazine. All images and reporting are done exclusively under the Fair Use of the US copyright act.

The Rise of Highly Evasive Adaptive Threats – Five Key Insights

Tsippi Dach explores some notable breaches caused by misconfigurations and how organizations can avoid becoming the next big headline    In the past year, we […]

When it comes to internet security, there’s a growing number of ways to avoid being the next big headline.

Op het gebied van internetbeveiliging zijn er steeds meer manieren om te voorkomen dat u de volgende grote krantenkop wordt.

and how organizations can avoid becoming the next big headlineIn the past year, we witnessed anything from security breaches to complete cutoff of the most used social applications due to preventable misconfigurations. Before going into the details of these incidents, let’s see why such misconfigurations occur. But in the worst-case scenario, you might end up having to deal with a crippling security breach and reputational damage.

en hoe organisaties kunnen voorkomen de volgende grote krantenkop te wordenIn het afgelopen jaar zijn we getuige geweest van alles van beveiligingsinbreuken tot volledige afsluiting van de meest gebruikte sociale applicaties als gevolg van vermijdbare misconfiguraties. Het configureren van een netwerk kan een enorm gecompliceerde taak zijn en problemen ontstaan vaak als gevolg van een slecht beoordelingsvermogen of gewoon omdat men niet in staat is te zien wat er in de hele infrastructuur gebeurt. Maar in het ergste geval kunt u te maken krijgen met een verlammende inbreuk op de beveiliging en reputatieschade.

and how organizations can avoid becoming the next big headline

In the past year, we witnessed anything from security breaches to complete cutoff of the most used social applications due to preventable misconfigurations. Before going into the details of these incidents, let’s see why such misconfigurations occur.

When organizations push out new applications and application updates at top speed, it’s no surprise that the security teams struggle. One small unforeseen error could cause downtime or reveal a vulnerability that could easily be exploited.

Configuring a network can be a hugely complicated task and issues often arise due to poor judgement or simply from not being able to see what’s happening across the entire infrastructure. In the best-case scenario, you find these issues before they lead to a serious crisis. But in the worst-case scenario, you might end up having to deal with a crippling security breach and reputational damage. We’ve seen dozens of examples over the last 12 months alone, here are some highlights:

The live-streaming platform Twitch confirmed that it was the victim of a large-scale data breach. The breach exposed its source code as well as other confidential data. In the aftermath, Twitch attributed the cause of the breach to on an error in a server configuration change. They said that the error was “subsequently accessed by a malicious third party.”

In June 2021, large areas of the internet went down with the 503: Service Unavailable error message after Fastly, a US-based content distribution network (CDN), suffered a configuration issue. Downed for almost an hour long, sites like Amazon and eBay became inaccessible, costing these companies millions of dollars’ worth of revenue.

Facebook, WhatsApp, Instagram, and any services using Facebook services were unavailable for six hours in October due to a configuration change that disconnected the applications from the internet. As the story developed, it became apparent that the incident was caused by a configuration issue within Facebook’s BGP (Border Gateway Protocol), one of the systems that the internet uses to get your traffic where it needs to go as quickly as possible. You can read more about our analysis of the outage here.

How can configuration errors be mitigated?

In large organizations, the number of applications and cloud accounts could be in their thousands. This is quite a challenge for IT teams that are responsible for the ongoing security of the network. With such a complex hybrid network environment, managing network security can not only become a tedious task but also risky, one that could be difficult to execute unless automated.

Enterprise-wide automation of application connectivity flows and security policies is proven to enhance business agility without introducing any element of risk, vulnerability, or compliance caused by manual, ad-hoc processes.

You can find out more about it in this blog. We’re here to help you secure your applications and the network. Get your personal demo to learn more.

Lessons from 2021: Painful Misconfigurations | AlgoSec

Pursuing a SOC 2 audit is a multi-step process. This blog clarifies the SOC 2 audit process and explains the role of SOC 2 auditors and compliance software.

When it comes to cybersecurity, companies need to demonstrate their ability to protect data and information.

Als het om cyberbeveiliging gaat, moeten bedrijven aantonen dat zij in staat zijn gegevens en informatie te beschermen.

Pursuing a SOC 2 audit is a multi-step process, which can seem confusing at first glance given the fact that there are vendors that provide compliance software, and other vendors who are themselves certified SOC 2 auditors. This blog will clarify the SOC 2 audit process, as well as explain the role of SOC 2 auditors and compliance software. When and How to Use SOC 2 Software ToolsThere are multiple steps to completing a SOC 2 audit.

Enter, SOC 2 (Service Organization Control 2), een populaire audit die getuigt van het vermogen van een bedrijf om gegevens en informatie te beschermen. Het nastreven van een SOC 2-audit is een proces dat uit verschillende stappen bestaat, wat op het eerste gezicht verwarrend kan lijken, gezien het feit dat er verkopers zijn die nalevingssoftware leveren, en andere verkopers die zelf gecertificeerde SOC 2-auditors zijn. Wanneer en hoe SOC 2-softwaretools gebruikenEr zijn verschillende stappen om een SOC 2-audit te voltooien.

Data breaches and ransomware attacks continue to dominate the news cycle. To protect data, and position themselves favorably among prospects and customers, companies need to demonstrate a commitment to cybersecurity.

Enter, SOC 2 (Service Organization Control 2), a popular audit that attests to a company’s ability to protect data and information. It’s a strong validator for any company looking to demonstrate its commitment to cybersecurity to partners and customers.

Pursuing a SOC 2 audit is a multi-step process, which can seem confusing at first glance given the fact that there are vendors that provide compliance software, and other vendors who are themselves certified SOC 2 auditors.

This blog will clarify the SOC 2 audit process, as well as explain the role of SOC 2 auditors and compliance software.

When and How to Use SOC 2 Software Tools

There are multiple steps to completing a SOC 2 audit. Many companies start with a readiness/gap assessment, which is the process of reviewing existing controls in place and identifying those that need to be improved or implemented. This process can be executed via an audit consultant, or through specialized software tools that help simplify this process (like A-SCEND).

Compliance software tools typically provide automated workflows and compliance templates, comparing your existing controls against the controls within a selected compliance framework — which, in this case, would be the SOC 2 framework.

Typically, this software allows you to visualize progress toward compliance goals, assign tasks related to evidence collection or policy updates, and collaborate all in one dashboard. Software tools provide a simple way to understand the framework requirements, assess them against your existing policies and procedures, and manage the process of updating policies. While these tools help to better prepare for an audit and streamline the assessment process, an experienced auditor is still a critical component of compliance.

When and How to Use SOC 2 Auditors

Software tools can only take you so far with SOC 2. They can help prepare a company for a SOC 2 audit, but not complete the audit itself. When the actual audit takes place, companies must turn to a SOC auditor.

SOC 2 audits are regulated by the American Institute of Certified Public Accountants (AICPA) and must be completed by an external auditor from a licensed CPA firm. This is the only way a company can receive an official SOC 2 report, whether it’s a Type 1 or Type 2 report.

An official SOC 2 report is valid for one year following the date the report was issued. Future annual audits must also be completed by an external auditor from a licensed CPA firm.

If your organization plans to use software to prepare for an audit, it’s helpful to work with a software partner who can also conduct the official audit (as a certified CPA) because it provides an added layer of convenience throughout the SOC 2 process and results in a reputable report. 



Organizations need to go beyond the data collection by their compliance software tool and conduct further due diligence, such as observations and walkthroughs (conversations) between the audit team and the client. SOC 2 auditors may also find that they need additional data or evidence necessary to validate the design and operating effectiveness of a complete control set. When you use the same company for a technology-enabled audit, and a SOC 2 report, the software is designed to request all audit materials needed, including manually operated controls and supporting evidence. In this convenient scenario, you can save time, resources, and money.

Stephanie Oyler is the Vice President of Attestation Services at A-LIGN focused on overseeing a variation of many assessments within the SOC practice. Stephanie’s responsibilities include managing key service delivery leadership teams, maintaining auditing standards and methodologies, and analyzing business unit metrics. Stephanie has spent several years at A-LIGN in service delivery roles from auditing and managing client engagements to overseeing audit teams and providing quality reviews of reports. Prior to joining A-LIGN, Stephanie worked for CBIZ, the tenth largest accounting firm in the U.S., providing auditing services in the financial accounting spectrum for various industries including automobile, hospitality, not-for-profit, real estate, and cloud architecture. Stephanie graduated from the University of South Florida with a bachelor’s degree of Science in Accounting. During her time at the University of South Florida, Stephanie was an active member of Beta Alpha Psi, an international honor society for Accounting, Finance, and Information Systems students and professionals.

Who Performs a SOC 2 Audit? The Role of SOC 2 Auditors | CSA

By Guy Rosefelt, CPO, Sangfor Technologies NFTs have become very popular with collectors and are more ubiquitous every day.  The idea of owning a one-of-a-kind object even in the digital world is very attractive.  The

In our series of letters from African journalists, novelist and writer Jonathan Marcus looks at how security issues affect crypto-wallets.

In onze reeks brieven van Afrikaanse journalisten bekijkt romanschrijver en schrijver Jonathan Marcus hoe veiligheidskwesties crypto-wallets beïnvloeden.

The idea of owning a one-of-a-kind object even in the digital world is very attractive. But artists and creatives of all types, be it painting and graphics, music, photography, and even video can now create and sell unique works that cannot be replicated. Besides security issues, they are being used by criminals for money laundering of cryptocurrency, and I do not see the value in something that will immediately become worthless when the internet apocalypse happens and your NFT wallet is no longer accessible.

Het idee is niet nieuw, aangezien het kopen van unieke voorwerpen in games al tientallen jaren bestaat. Maar kunstenaars en creatieven van alle soorten, of het nu gaat om schilderen en grafiek, muziek, fotografie, en zelfs video, kunnen nu unieke werken maken en verkopen die niet kunnen worden nagemaakt. Naast beveiligingsproblemen worden ze door criminelen gebruikt voor het witwassen van cryptocurrency, en ik zie de waarde niet in van iets dat onmiddellijk waardeloos wordt als de internetapocalyps gebeurt en je NFT wallet niet meer toegankelijk is.

NFTs have become very popular with collectors and are more ubiquitous every day. The idea of owning a one-of-a-kind object even in the digital world is very attractive. The idea is not new as buying unique items inside games has been around for decades. But artists and creatives of all types, be it painting and graphics, music, photography, and even video can now create and sell unique works that cannot be replicated.

First, I need to disclose I am not a huge fan of Non-Fungible Tokens (NFTs). Besides security issues, they are being used by criminals for money laundering of cryptocurrency, and I do not see the value in something that will immediately become worthless when the internet apocalypse happens and your NFT wallet is no longer accessible. But that is just me. Until that happens let’s talk about the security issues. Security issues include phishing scams to access crypto-wallets and steal NFTs, and selling counterfeit items, but the issue I want to discuss is using NFTs to distribute malware.

VIA, a company that specializes in solutions for infrastructure and government, reported that they discovered instances of malware being injected into NFTs and demonstrated how easy it is. It makes sense as NFTs are normally media files that have historically been used to inject code or embed malicious software that runs when open. All being an NFT does is verify that it is the only file of its kind using blockchain. But it does nothing to verify the safety of the file. VIA has even created an open-source tool to scan NFTs to look for malicious code or software in the file.

So, the next time you spend thousands of dollars on an NFT, make sure, even if it comes from a reputable vendor, to scan it before opening it and hope there is a return policy if you find something unexpected. Otherwise, your crypto wallet might have a surprise for you once the internet apocalypse ends.

Guy is Chief Product Officer for Sangfor Technologies. He has over 20 years experience (though some say it is one year’s experience twenty times) in application and network security, kicking it off with 10 years in the U.S. Air Force, reaching rank of captain. After his time in the USAF building the first fiber to the desktop LAN and other things you would find in Tom Clancy novels, Guy worked at NGAF, SIEM, WAF and CASB startups as well as big-name brands like Imperva and Citrix. He has spoken at numerous conferences around the world and in people’s living rooms, written articles about the coming Internet Apocalypse, and even managed to occasionally lead teams that designed and built security stuff. Guy is thrilled to be in his current position at Sangfor — partly because he was promised there would always be Coke Zero in the breakroom. His favorite cake is German Chocolate.

Guy can be reached online at guy.rosefelt@sangfor.com or on Twitter at @otto38dd and at our company website www.sangfor.com.

FAIR USE NOTICE: Under the "fair use" act, another author may make limited use of the original author's work without asking permission. Pursuant to 17 U.S. Code § 107, certain uses of copyrighted material "for purposes such as criticism, comment, news reporting, teaching (including multiple copies for classroom use), scholarship, or research, is not an infringement of copyright." As a matter of policy, fair use is based on the belief that the public is entitled to freely use portions of copyrighted materials for purposes of commentary and criticism. The fair use privilege is perhaps the most significant limitation on a copyright owner's exclusive rights. Cyber Defense Media Group is a news reporting company, reporting cyber news, events, information and much more at no charge at our website Cyber Defense Magazine. All images and reporting are done exclusively under the Fair Use of the US copyright act.

NFTS Are Cool but Dangerous

By Randy Reiter CEO of Don’t Be Breached April, 2022 Microsoft reported that vulnerabilities in its Azure Database for PostgreSQL could have let Hackers gain access to other customers' databases after bypassing authentication. "By exploiting

Hackers could have exploited a vulnerability in Microsoft’s databases, according to researchers.

Hackers hebben volgens onderzoekers misbruik kunnen maken van een kwetsbaarheid in de databases van Microsoft.

By Randy Reiter CEO of Don’t Be BreachedApril, 2022 Microsoft reported that vulnerabilities in its Azure Database for PostgreSQL could have let Hackers gain access to other customers’ databases after bypassing authentication. Microsoft said its analysis showed no evidence of attackers having exploited the vulnerabilities to access customer data. Wiz said Microsoft awarded its researchers a $40,000 bug bounty — the amount can be viewed as confirmation of the vulnerability’s severity.

Door Randy Reiter CEO van Don't Be BreachedIn april 2022 meldde Microsoft dat kwetsbaarheden in zijn Azure Database voor PostgreSQL hackers toegang konden verschaffen tot de databases van andere klanten nadat ze de authenticatie hadden omzeild. Volgens Microsoft heeft zijn analyse geen aanwijzingen opgeleverd dat aanvallers de kwetsbaarheden hebben misbruikt om toegang te krijgen tot klantengegevens. Wiz zei dat Microsoft zijn onderzoekers een bounty van 40.000 dollar heeft toegekend - het bedrag kan worden gezien als een bevestiging van de ernst van de kwetsbaarheid.

By Randy Reiter CEO of Don’t Be Breached

April, 2022 Microsoft reported that vulnerabilities in its Azure Database for PostgreSQL could have let Hackers gain access to other customers’ databases after bypassing authentication. “By exploiting an elevated permissions bug in the Flexible Server authentication process for a replication user, a malicious user could leverage an improperly anchored regular expression to bypass authentication to gain access to other customers’ databases” the Microsoft Security Response Center reported.

The cloud security firm Wiz’s research team discovered the security vulnerabilities. An attacker could create a full copy of a target database in Azure PostgreSQL [Flexible Server], essentially exfiltrating all the information stored in the database, says Ami Luttwak, co-founder and CTO at Wiz.

Microsoft said it mitigated the issue on Jan. 13, 2022, less than 48 hours after Wiz had notified it of the issue. Microsoft said its analysis showed no evidence of attackers having exploited the vulnerabilities to access customer data. Wiz said Microsoft awarded its researchers a $40,000 bug bounty — the amount can be viewed as confirmation of the vulnerability’s severity.

How to Have Exploited the Database Vulnerability

As explained by Microsoft, the Wiz researchers went through the following steps to gain elevated privileges and remote code execution, which allowed them to bypass cross-account authentication using a forged certificate and access other customers’ databases:
• Retrieve the target’s common name from the Certificate Transparency feed.
• Find the target’s Azure region by resolving the database domain name and matching it to one of Azure’s public IP ranges.
• Create an attacker-controlled database in the target’s Azure region.
• Exploit vulnerability #1 on the attacker-controlled instance to escalate privileges and gain code execution.
• Scan the subnet for the target instance and exploit vulnerability #2 to gain read access!

How to Prevent Data Exfiltration and Data Breaches in Todays Complex Environment

Multiple layers of data protection are required today to prevent Data Exfiltration and Data Breaches. In 2020 the DHS, Department of State, U.S. Marine Corps and the Missile Defense Agency recognized this and all issued requests for proposals (RFP) for network full packet data capture for Deep Packet Inspection analysis (DPI) of network traffic. This is an important step forward protecting confidential database data and organization information.

Zero-day vulnerabilities that allow hackers to gain system privileges are a major threat to all organizations encrypted and unencrypted confidential data. Confidential data includes: credit card, tax ID, medical, social media, corporate, manufacturing, trade secrets, law enforcement, defense, homeland security, power grid and public utility data. This confidential data is almost always stored in DB2, Informix, MariaDB, Microsoft SQL Server, MySQL, Oracle, PostgreSQL and SAP Sybase databases.

How to Stop Data Exfiltration and Data Breaches with Deep Packet Inspection

Protecting encrypted and unencrypted confidential database data is much more than securing databases, operating systems, applications and the network perimeter against Hackers, Rogue Insiders and Supply Chain Attacks.

Non-intrusive network sniffing technology can perform a real-time Deep Packet Inspection (DPI) of 100% the database activity from a network tap or proxy server with no impact on the database servers. The database SQL activity is very predictable. Database servers servicing 1,000 to 10,000 end-users typically process daily 2,000 to 10,000 unique queries or SQL commands that run millions of times a day. Deep Packet Analysis does not require logging into the monitored networks, servers or databases. This approach can provide CISOs with what they can rarely achieve. Total visibility into the database activity 24×7 and 100% protection of confidential database data.

Advanced SQL Behavioral Analysis of 100% of the real-time database SQL packets can learn what the normal database activity is. Now the database query and SQL activity can be non-intrusively monitored in real-time with DPI and non-normal SQL activity immediately pinpointed. This approach is inexpensive to setup and has a low cost of operation. Now non-normal database activity from Hackers, Rogue Insiders or and Supply Chain Attacks can be detected in a few milli seconds. The Security Team can be immediately notified and the Hacker session terminated so that confidential database data is not stolen, ransomed or sold on the Dark Web.

Reiter is the CEO of Don’t Be Breached a Sql Power Tools company. He is the architect of the Database Cyber Security Guard product, a database Data Breach prevention product for DB2, Informix, MariaDB, Microsoft SQL Server, MySQL, Oracle, PostgreSQL, and SAP Sybase databases. He has a Master’s Degree in Computer Science and has worked extensively over the past 25 years with real-time network sniffing and database security. Randy can be reached online at rreiter@DontBeBreached.com, www.DontBeBreached.com and www.SqlPower.com/Cyber-Attacks.

FAIR USE NOTICE: Under the "fair use" act, another author may make limited use of the original author's work without asking permission. Pursuant to 17 U.S. Code § 107, certain uses of copyrighted material "for purposes such as criticism, comment, news reporting, teaching (including multiple copies for classroom use), scholarship, or research, is not an infringement of copyright." As a matter of policy, fair use is based on the belief that the public is entitled to freely use portions of copyrighted materials for purposes of commentary and criticism. The fair use privilege is perhaps the most significant limitation on a copyright owner's exclusive rights. Cyber Defense Media Group is a news reporting company, reporting cyber news, events, information and much more at no charge at our website Cyber Defense Magazine. All images and reporting are done exclusively under the Fair Use of the US copyright act.

Azure PostgreSQL User Databases Were Exposed Due to Critical Vulnerabilities

Sea-Doo maker BRP Inc. says work at its factories remains at a standstill following a cyberattack it reported Monday. Spokeswoman Biliana Necheva says in

A Canadian manufacturing company says it has been forced to freeze its operations following a cyber attack.

Een Canadees productiebedrijf zegt dat het gedwongen is zijn activiteiten te bevriezen na een cyberaanval.

Sea-Doo maker BRP Inc. says work at its factories remains at a standstill following a cyberattack it reported Monday. Spokeswoman Biliana Necheva says in an email operations have not resumed more than 48 hours after they were halted as a cautionary measure. It comes at a tough time for BRP, as supply chain woes weighed on sales in its first quarter, with more input obstacles expected on the powersport vehicle maker’s path for the rest of the year.

Woordvoerster Biliana Necheva zegt in een e-mail dat de operaties meer dan 48 uur nadat ze uit voorzorg waren stopgezet, nog niet zijn hervat. Dit komt op een moeilijk moment voor BRP, aangezien de problemen met de toeleveringsketen de verkoop in het eerste kwartaal hebben gedrukt. Voor de rest van het jaar worden nog meer invoerbelemmeringen verwacht voor de fabrikant van motorvoertuigen.

Sea-Doo maker BRP Inc. says work at its factories remains at a standstill following a cyberattack it reported Monday.

Spokeswoman Biliana Necheva says in an email operations have not resumed more than 48 hours after they were halted as a cautionary measure.

The Quebec-based company, which manufactures Ski-Doos and off-road vehicles, announced Monday morning it was the target of “malicious cybersecurity activity” and took “immediate measures to contain the situation.”

Deploying its own information technology staff, BRP also said it hired cybersecurity experts to help secure its systems and support an internal investigation.

The company said its freeze on operations could delay some transactions with customers and suppliers.

It comes at a tough time for BRP, as supply chain woes weighed on sales in its first quarter, with more input obstacles expected on the powersport vehicle maker’s path for the rest of the year.

Spun off from Bombardier Inc. in 2003, BRP employs nearly 20,000 workers, mainly at manufacturing and distribution sites in Mexico, Canada, Austria, the United States, Finland and Australia. Its products are sold in more than 120 countries.

This report by The Canadian Press was first published Aug. 11, 2022.

BRP operations remain frozen more than two days after cyberattack

A 39-year-old Saskatchewan man accused of stabbing someone in a hospital is facing an elevated charge of second-degree murder. Police were called to

Two men have been charged with murder after a fatal stabbing in Saskatoon.

Twee mannen zijn aangeklaagd voor moord na een dodelijke steekpartij in Saskatoon.

Police were called to Saskatoon’s Royal University Hospital in June after a 55-year-old man was stabbed. The suspect was initially charged with attempted murder, but police say the charge was upgraded after the man recently succumbed to his injuries in hospital. Police did not identify the two men in the case.

De politie werd in juni opgeroepen naar het Royal University Hospital in Saskatoon nadat een 55-jarige man was neergestoken. De verdachte werd aanvankelijk poging tot moord ten laste gelegd, maar de politie zegt dat de aanklacht werd opgewaardeerd nadat de man onlangs in het ziekenhuis aan zijn verwondingen was bezweken. De politie heeft de twee mannen in de zaak niet geïdentificeerd.

A 39-year-old Saskatchewan man accused of stabbing someone in a hospital is facing an elevated charge of second-degree murder.

Police were called to Saskatoon’s Royal University Hospital in June after a 55-year-old man was stabbed.

The suspect was initially charged with attempted murder, but police say the charge was upgraded after the man recently succumbed to his injuries in hospital.

Police did not identify the two men in the case.

They say the accused is in custody and scheduled to appear in court today.

It’s the seventh homicide in Saskatoon so far this year.

This report by The Canadian Press was first published Aug. 11, 2022.

Man accused in Saskatoon hospital stabbing has charge upgraded after victim dies

Ontario's cannabis wholesaler is temporarily capping the number of products retailers can order and expanding its delivery window as it works through a

Canadian cannabis shops have been warned they will be limited to ordering more than 30 packs of products.

Canadese cannabiswinkels zijn gewaarschuwd dat ze niet meer dan 30 verpakkingen met producten mogen bestellen.

Ontario’s cannabis wholesaler is temporarily capping the number of products retailers can order and expanding its delivery window as it works through a backlog caused by a cyberattack on its logistics partner. The Ontario Cannabis Store said in a letter Thursday to retailers obtained by The Canadian Press that shops will be limited to ordering no more than 30 packs of product. Since the OCS disclosed the attack on Monday, Ontario cannabis stores have been worried the delays will cause them to lose sales and customers because their supplies are dwindling and shops have no choice but to purchase the product they sell from the OCS.

De cannabisgroothandel van Ontario beperkt tijdelijk het aantal producten dat detailhandelaren kunnen bestellen en verruimt zijn leveringsvenster terwijl het een achterstand wegwerkt die is ontstaan door een cyberaanval op zijn logistieke partner. De achterstand werd veroorzaakt door een aanval op 5 augustus op de moedermaatschappij van het distributiecentrum van de OCS, Domain Logistics, die niet heeft gereageerd op een verzoek om commentaar. Sinds de OCS de aanval op maandag bekendmaakte, zijn de Ontario cannabiswinkels bezorgd dat ze door de vertragingen omzet en klanten zullen verliezen omdat hun voorraden slinken en de winkels geen andere keuze hebben dan het product dat ze verkopen van de OCS te kopen.

Ontario’s cannabis wholesaler is temporarily capping the number of products retailers can order and expanding its delivery window as it works through a backlog caused by a cyberattack on its logistics partner.

The Ontario Cannabis Store said in a letter Thursday to retailers obtained by The Canadian Press that shops will be limited to ordering no more than 30 packs of product.

“This will create even access to products for all stores and will avoid creating a larger backlog of orders that could delay us from getting product to stores as quickly as possible,” said the letter signed by OCS CEO David Lobo.

The backlog was caused by an Aug. 5 attack on the parent company of the OCS’s third-party distribution centre, Domain Logistics, which has not responded to a request for comment.

Since the OCS disclosed the attack on Monday, Ontario cannabis stores have been worried the delays will cause them to lose sales and customers because their supplies are dwindling and shops have no choice but to purchase the product they sell from the OCS.

The OCS pushed out a small number of orders last night, but to clear the backlog, Lobo said it will make deliveries seven days a week between 6 a.m. and 10 p.m.

The OCS confirmed the cap and new delivery window on Thursday afternoon.

It noted in the letter it might have to move to a 24-hour delivery window until it has fully returned to standard operations.

The situation has created a headache for pot shop owners trying to make due with limited supply they still have from last week.

Anthony Horvath, the owner and CEO of Tonik Cannabis in Brantford, Ont., has already run out of some products and can’t afford to keep a stockpile for unexpected situations like this one.

“We’re a small, independent, family-owned business and we only have the one location, so I can’t have half a million dollars of inventory sitting here and six weeks worth of back stock for a situation like that,” he said.

“In many cases, we order just in time just to keep our inventory costs down.”

Horvath has received no indication when his next delivery could arrive, making staffing challenging.

“I may be told at 3 a.m. in the morning expect your delivery guy to come by and we still have to arrange to have someone open up,” he said.

The product that gets dropped off will be significantly less than Tonik Cannabis is used to receiving.

Horvath typically orders between 250 and 300 cases of products, much less than the 30 he is being limited to.

He said, “My concern is that even though I placed an order for 30, I may only get 25 because some products simply won’t be available, so it’s probably going to be even less.”

This report by The Canadian Press was first published Aug. 11, 2022.

Ongepatchte GPS Tracker bugs kunnen aanvallers voertuigen op afstand laten ontregelen

Vergelijkbare publicaties

Wie voert een SOC 2-audit uit? De rol van SOC 2 auditors | CSA

NFTS zijn cool maar gevaarlijk

Azure PostgreSQL gebruikersdatabases werden blootgesteld als gevolg van kritieke kwetsbaarheden

Verrichtingen BRP blijven meer dan twee dagen na cyberaanval bevroren

Aanklacht tegen man van steekpartij in ziekenhuis Saskatoon is verhoogd na overlijden slachtoffer

OCS beperkt bestellingen van wietwinkels en wijzigt leveringstermijn na cyberaanval op partner

Gevonden topics

WSJ: "Cyberverzekering steeg met maar liefst 92% in 2021"

De opkomst van zeer ontwijkende, adaptieve bedreigingen - vijf belangrijke inzichten

Lessen uit 2021: Painful Misconfigurations | AlgoSec