Third-party software security risks are on the rise, and so are the significant cyber attacks they facilitate. According to a CrowdStrike report, 45% of surveyed organizations said they experienced at least one software supply chain attack in 2021. In 2023,… Read More "How to Identify Vulnerable Third-Party Software (Quickly)"
Officially, the CISO or a dedicated threat intelligence lead. Unofficially, whoever wins the argument with legal over what’s allowed to leave the building, which happens more often than most org charts admit. My honest take: that fight matters less than… Read More "Strategic Threat Intelligence for Critical Attacks"
Threat actors have been observed attempting to exploit a now-patched critical security flaw impacting the Realtek Jungle software development kit (SDK) to deploy a botnet malware called Cling. “Cling is notable not because it introduces a new propagation technique, but… Read More "Realtek Jungle SDK Exploit Attempts Deliver Cling Botnet With STUN-Based C2"
Linux backdoors targeting telecom and network-edge appliances in South Korea and Taiwan have been disguising their traffic as email and their processes as legitimate services on the devices they compromise. In research published October 2, Rapid7 said it tracked a… Read More "Linux Backdoors Target Telecoms, Masquerade as Email Traffic"
Any organization that relies on third-party vendors for critical business functions should develop and maintain an effective third-party risk management (TPRM) policy. A TPRM policy is the first document an organization should create when establishing its TPRM program. TPRM policies… Read More "Essential Components of an Effective TPRM Policy"
Google has temporarily closed its Open Source Software Vulnerability Reward Program (OSS VRP) to product vulnerability submissions, saying a growing number of automated reports, most of them invalid, prompted the move. The pause was announced on X on October 1.… Read More "Google Narrows Open Source Bug Bounty Amid Wave of Invalid Automated Reports"
A blank field. A public repo. One reply to an email. A box left exposed. None of this sounds dramatic, which is partly the problem. This week’s threats keep finding leverage in small things that were easy to overlook. There… Read More "⚡ Weekly Recap: NetScaler and FortiMail 0-Days, AI Coding Leaks, Spectre v2 and Ransomware Arrests"
A Linux proxy backdoor has been observed exploiting known, unpatched flaws in internet-facing IoT devices and abusing legitimate public STUN servers to keep compromised systems reachable as remotely controlled proxy nodes. FortiGuard Labs, which dubbed the malware ClingSTUN, said in… Read More "ClingSTUN Malware Turns Unpatched IoT Devices Into Proxy Nodes"
Vendor risk scoring is a critical component within vendor risk management (VRM) or third-party risk management (TPRM) programs and an organization’s overall risk management strategy. Risk scoring is an integral tool in the risk assessment process, helping organizations identify, evaluate,… Read More "Ultimate Guide to Vendor Risk Scoring"
Healthcare organizations Clover Health Investments and AngMar Management Services are notifying more than 250,000 people that their information was stolen in separate data breaches. Jersey City, New Jersey-based Clover Health Investments was hacked in early July, after attackers used social… Read More "250,000 Impacted by Data Breaches at New Jersey, Texas Healthcare Firms"
