Tag: information security
76 articles
Mid-Market IT Leaders Face Growing Cybersecurity Pressures
Mid-market IT leaders are under siege, facing the same daunting cybersecurity threats as large enterprises but with limited resources to defend themselves. As a result, understaffed IT teams are forced to juggle fragmented tools, leaving them vulnerable to attacks and stuck in reactive mode.
South Korea Pushes for AI-Powered Cyber Defenses
South Korean President Lee Jae Myung is taking a bold stance against AI-powered cyber threats, calling for a government-led response to rapidly deploy cutting-edge defenses. He urges swift action to minimize damage and build unbreachable security capabilities.
Microsoft expands Outlook restrictions to block two more file types
Microsoft is taking a firmer stance on email attachments, adding two new file types to Outlook's restricted list in a bid to boost security and keep users safe. This move is the latest effort to crack down on potentially hazardous files.
AI Augments SOC Analyst Capacity, Raises Skill Development Concerns
As AI takes on more tasks, security operations center (SOC) analysts are gaining a boost in capacity and more time to tackle complex work - but this shift also raises important questions about skill development and trust in AI. With nearly half of respondents citing greater capacity as a top impact of AI, it's clear that analysts are getting a productivity lift.
UK Businesses Expose Gaps in Basic Cyber Skills
The UK is facing a wake-up call: over half of its businesses lack confidence in their basic cyber skills, leaving them vulnerable to breaches and slow to recover. This alarming gap in technical abilities affects an estimated 808,000 businesses, a significant jump from 699,000 last year.
CISA Unveils Plan to Boost CVE Program Quality
The Cybersecurity and Infrastructure Security Agency (CISA) is taking its CVE Program to the next level with a new plan to boost quality, accuracy, and consistency, ensuring organizations have a reliable catalog of software and product vulnerabilities to build on. This Quality Era marks a major milestone in CISA's 25-year commitment to leading and growing the program.
FBI Tightens CJIS Encryption, Vulnerability Rules
The FBI's latest update to the CJIS Security Policy, version 6.1, strengthens encryption rules and closes security gaps, building on the December 2024 modernization. Key changes include upgraded encryption requirements, now mandating 256-bit strength for SC-13 and SC-28.
CISA Scraps Weekly Vulnerability Bulletin
Big change alert: starting September 28, CISA is ditching its weekly vulnerability bulletin to shake up its approach to cybersecurity, shifting from severity-based listings to a modern, risk-based strategy. This move aims to help prioritize vulnerabilities based on real-world risks, not just their severity.
NCSC Warns of Shadow AI Security Risks
Employees are increasingly turning to AI tools outside of company-approved systems, a phenomenon known as "shadow AI," which poses significant security risks. A staggering 71% of UK employees have already admitted to using unauthorized AI tools at work.
IDScan Faces Lawsuits Over Alleged Driver's License Data Breach
Data breaches can be devastating, and now IDScan.net is facing multiple class-action lawsuits over an alleged driver's license data breach, with plaintiffs seeking damages and improved security measures. The lawsuits, filed in Louisiana, highlight the importance of protecting sensitive information and holding companies accountable for data security.
OpenAI Bolsters Frontline Cyber Defenders With $1 Billion in AI Credits
OpenAI is stepping up to support the world's cyber defenders with a game-changing $1 billion pledge in AI credits, aiming to empower those on the frontlines of cybersecurity. This initiative, called Daybreak for Frontline Defenders, will help resource-strapped defenders access critical tools and training to protect our world's critical infrastructure.
Tech Giants Warn of AI-Driven Cyber Threats, Push for AI-Powered Defenses
The world's top tech and security companies are sounding the alarm: AI-driven cyber threats are on the rise and we only have a small window of time to boost our defenses before attacks become more widespread and sophisticated. Over 100 industry giants, including OpenAI, Google, and Microsoft, are urging for AI-powered defenses to protect critical infrastructure like hospitals and water treatment plants.
NIST Seeks Overhaul of Vulnerability Database for AI-Driven Era
The National Institute for Standards and Technology is calling for a major revamp of its National Vulnerability Database to better tackle software vulnerabilities in the AI-driven era. It's seeking public input on how to modernize the database and its processes to stay ahead of emerging threats.
USENIX Security Symposium Tackles AI-Driven Paper Surge
The USENIX Security Symposium has seen a record-breaking surge in submissions, with approximately 3,030 valid papers pouring in - a significant jump from last year's 2,400. To keep pace, the conference expanded its Program Committee to handle the influx of innovative research in the security community.
Zero-Knowledge Proofs Offer Secure Path for Cyber Risk Disclosure
ZKPs offer a game-changing solution, allowing companies to securely share proof of vulnerabilities without exposing sensitive data that could be exploited by attackers. By using ZKPs, organizations can demonstrate the truth of a statement, such as confirming a specific vulnerability exists, without revealing confidential details.
AI Platforms Shine in SOCs with Clear Roles
Discover how AI platforms are revolutionizing Security Operations Centers (SOCs) by taking on high-level roles and freeing teams to focus on critical threats. By integrating with existing security tools, these platforms enable teams to efficiently sift through millions of alerts and catch potential threats that might otherwise fly under the radar.
UK Government Investments Exposes Official Contact Data in 40-Hour Breach
A simple mistake by a staff member at UK Government Investments left sensitive contact information of 51 government officials exposed to the public for a staggering 40 hours. The breach, revealed in the organization's annual report, highlights the importance of following basic security protocols to protect official data.
Botnets Persist Despite Takedowns, Fueled by Residential Proxy Networks
Botnets just won't quit, and it's no surprise why - there's a thriving market for access to millions of IPs, making it easy for them to keep growing and snaring more victims. Residential proxy networks are fueling this expansion, with nearly 60 million victim IP addresses globally and a significant chunk of them right here in the US.
Evaluating AI in Security Operations Requires New Framework
When evaluating AI in security operations, it's crucial to determine if it can deliver accurate verdicts across various scenarios and attack surfaces - and surprisingly, verdict quality only improves dramatically once a certain threshold of relevant data, such as identity and context, is reached. Below that threshold, no amount of fine-tuning can compensate.
Staffing Shortages Plague Security Operations Centers
The 2026 SANS SOC Survey reveals a disconnect: while 79% of respondents use AI or machine learning tools, only 36% have integrated them into a defined workflow, highlighting a key challenge in Security Operations Centers. Practitioners cite staffing shortages as their top operational challenge, but leaders seem less concerned.
OWASP Unveils Framework to Gauge Agentic AI Security Maturity
As organizations rapidly deploy AI agents, governance often lags behind - but a new framework from OWASP aims to change that. The Enterprise Adoption Maturity Model provides a practical roadmap for gauging and improving agentic AI security maturity.
AI Transforms SOCs, But Human Analysts Remain Vital
AI is revolutionizing Security Operations Centers, but not by replacing human analysts - instead, it's freeing them from tedious tasks to focus on high-stakes decision-making. By automating routine work, AI is augmenting human capabilities, not replacing them.
NIST's Vulnerability Database Plagued by Duplication, Inefficiency
The National Vulnerability Database is facing a massive backlog crisis, with unprocessed security flaws doubling from 13,000 in June 2024 to over 27,000 by the end of 2025, and officials admit they lack a long-term plan to tackle the problem. Despite promising to clear the backlog by September 2024, the database continues to struggle with inefficiencies and a lapsed contract.
Cybersecurity Pros Prefer CISOs With Live Attack Response Experience
When it comes to cybersecurity leadership, professionals trust those who have been battle-tested, with 75% believing that experience in live attack response boosts a leader's credibility. Hands-on experience navigating high-pressure incidents gives leaders a unique perspective, composure, and trustworthiness.