Another year has passed, and once again Contrast is proud to be a Champion for Cybersecurity Awareness Month throughout October, to help in promoting global awareness of online safety and privacy. Co-led by the National Cyber Security Alliance an…
Author: David Lindner, Director, Application Security
Europe, Global Security News, North America
Cybersecurity Insights with Contrast CISO David Lindner | 9/30
by David Lindner, Director, Application Security •
Insight #1
“Cybersecurity Awareness month starts on October 1, 2022. One of the themes is enabling MFA. If you haven’t done so, it’s time.”
Insight #2
”
Security leaders need to stop blaming people for breaches and start e…
Europe, Global Security News, North America
Cybersecurity Insights with Contrast CISO David Lindner | 9/23
by David Lindner, Director, Application Security •
Insight #1
”
Are you scanning your code repositories for secrets? What about your open file or network shares? Breaches will happen, but once a malicious actor has a foothold in the environment, ensuring other controls are in place to prev…
Europe, Global Security News, North America
Cybersecurity Insights with Contrast CISO David Lindner | 9/9
by David Lindner, Director, Application Security •
Insight #1
”
What is holding you back from evaluating a better way to do application security at your organization? I talk to many who are just flat-out unhappy with their current tools, but they continue to pay for the services every year…
Europe, Global Security News, North America
Cybersecurity Insights with Contrast CISO David Lindner | 9/2
by David Lindner, Director, Application Security •
Insight #1
”
Another breach of a developer environment this week leads us to yet another realization that the Solarwinds-like threat vector is here to stay. If you haven’t started strengthening your dev environments/pipelines, there is no …
Europe, Global Security News, North America
Cybersecurity Insights with Contrast CISO David Lindner | 8/26
by David Lindner, Director, Application Security •
Insight #1
”
If you are struggling with the adoption of MFA across your organization, it’s time to focus all your efforts in rolling out a solution that provides the best experience for your users. Enabling MFA is paramount to protecting y…
Europe, Global Security News, North America
Cybersecurity Insights with Contrast CISO David Lindner | 8/19
by David Lindner, Director, Application Security •
Insight #1
”
The National Defense Authorization Act for Fiscal Year 2023 was recently passed by the US House. This bill has a provision requiring any software purchased by the Department of Defense to be free of all known CVEs. The age of …
Europe, Global Security News, North America
Cybersecurity Insights with Contrast CISO David Lindner | 8/12
by David Lindner, Director, Application Security •
Insight #1
“Penetration testing and vulnerability scanning are two different things. Penetration testing will give you information about exploiting vulnerabilities whereas a vulnerability scan will just provide you with potential avenues for …
Europe, Global Security News, North America
Cybersecurity Insights with Contrast CISO David Lindner | 8/5
by David Lindner, Director, Application Security •
Insight #1
”
Are you paying if you get hit with ransomware? I provided my thoughts here. The reality shows that most companies hit with ransomware who pay the ransom, get hit a subsequent time. Are you paying?”
Insight #2
“…
Europe, Global Security News, North America
Cybersecurity Insights with Contrast CISO David Lindner | 7/14
by David Lindner, Director, Application Security •
Insight #1
”
I see a lot of blame being placed on users (or the intern) when it comes to breaches and security issues. As an industry, we need to move on from this old way of thinking and start utilizing new strategies and technologies to …
Europe, Global Security News, North America
Cybersecurity Insights with Contrast CISO David Lindner | 6/17
by David Lindner, Director, Application Security •
Insight #1
”
Incremental and measurable improvement over time is the key to a successful security program.”
Insight #2
”
If you sell a product or service, and in selling that product or service you are charging more fo…
Europe, Global Security News, North America
Cybersecurity Insights with Contrast CISO David Lindner | 6/11
by David Lindner, Director, Application Security •
Insight #1
”
Another week, another OGNL injection vulnerability in a widely used on premises system. As consumers, we need to start holding these companies with repetitive, pervasive, and destructive vulnerabilities accountable. Also, it’s…
Europe, Global Security News, North America, Vulnerabilities
Contrast Protect eliminates another zero-day headache
by David Lindner, Director, Application Security •
On June 2nd, Atlassian released a security advisory about another remote code execution vulnerability (CVE-2022-26134) affecting all on- premises versions of Confluence Server and Confluence Data Center. The initial report to Atlassian came from …
Europe, Global Security News, North America
Cybersecurity Insights with Contrast CISO David Lindner | 6/3
by David Lindner, Director, Application Security •
Insight #1
”
The most recent malicious takeover of the ctx and phpass packages unearthed yet another gap in supply chain security. I say anything not maintained or changed within the last year should be scrutinized by security teams, and a…
Europe, Global Security News, North America
Cybersecurity Insights with Contrast CISO David Lindner | 5/27
by David Lindner, Director, Application Security •
Insight #1
“A recent survey shows developers are struggling to write secure code and often times publish code with known security vulnerabilities due to juggling priorities and demands. The only way to solve this is to provide your developer…
Europe, Global Security News, North America
Cybersecurity Insights with Contrast CISO David Lindner | 5/20
by David Lindner, Director, Application Security •
Insight #1
“The Exploit Prediction Scoring System (EPSS) is yet another data point I urge you to add to your risk calculations of known CVEs. More data, better risk measurements, and easier prioritization.”
Insight #2
“Did …
Europe, Global Security News, North America
Cybersecurity Insights with Contrast Security CISO David Lindner | 5/6
by David Lindner, Director, Application Security •
Insight #1
“If your website authentication form prevents users from pasting in their password, or from using their password manager you need to fix it immediately. You are enabling and encouraging users to create and use poor passwords.”
…
Europe, Global Security News, North America
CISO Thoughts with David Lindner – April 29
by David Lindner, Director, Application Security •
Insight #1
“How do you measure risk between vulnerabilities in custom code vs vulnerabilities in third-party code? To determine the real risk, I strongly encourage developers to start utilizing other measuring tools such as the Exploit Predi…
Europe, Global Security News, North America
CISO Thoughts with David Lindner – April 22
by David Lindner, Director, Application Security •
Insight #1
”
Another critical Java zero-day was revealed in the last week. Turns out, the issue was originally reported 5 months ago to Oracle and was just now addressed. This only adds to your need to increase your control layers for the…
Europe, Global Security News, North America
CISO Thoughts with David Lindner – April 15
by David Lindner, Director, Application Security •
Insight #1
“Again we had an instance where a CVE was not appropriately fixed and a year later a new CVE was released for the same problem and a better fix. This brings back memories of log4j and numerous updates over a 2 week period. Because…
Europe, Global Security News, North America
CISO Thoughts with David Lindner – April 8
by David Lindner, Director, Application Security •
Insight #1
Every single CISO/CIO should realize their organization is building and using software. That being said, securing your software factory should be in your top 3 priorities this year and every year. The changing developer landscape …
Europe, Global Security News, North America
CISO Thoughts with David Lindner – April 1
by David Lindner, Director, Application Security •
Insight #1
Spring4Shell, the latest vulnerability in a Java ubiquitous library is the second major vulnerability in the last 4 months. It’s time we get focused on how we secure our open source by employing easier upgrade paths and utilizing i…
Europe, Global Security News, North America
Cyber Incident Reporting For Critical Infrastructure Act of 2022
by David Lindner, Director, Application Security •
On March 15, 2022, United States President Joe Biden signed the Cyber Incident Reporting For Critical Infrastructure Act of 2022. This Act requires critical infrastructure entities and government agencies report a cyber security incident within a…
Europe, Global Security News, North America
CISO Thoughts with David Lindner – March 18th
by David Lindner, Director, Application Security •
Insight #1
If you can accomplish one thing in your AppSec program this year, it should be keeping secrets out of your source code. The number of secrets in source code is doubling year over year, which will lead to more breaches. T…
Europe, Global Security News, North America
CISO Thoughts with David Lindner
by David Lindner, Director, Application Security •
Insight #1
The number one thing an organization can do today to help prevent the next major breach is to implement multi-factor authentication (MFA) on all things. According to research by Microsoft, MFA can block over 99.9 percent of account com…
Europe, Global Security News, North America
DHS Warns of Imminent Nation State Cyberthreats
by David Lindner, Director, Application Security •
Situation
Due to the ongoing degradation in Ukrainian and Russian relations, today, intelligence agencies from major NATO member nations have issued a warning against imminent nation state cyber threats from Russia. For example, the US Department…
Europe, Global Security News, North America
THE 2021 OWASP TOP TEN EMPHASIZES SECURITY CONTROL AREAS OVER INDIVIDUAL VULNERABILITIES FOR IMPROVED RISK MANAGEMENT
by David Lindner, Director, Application Security •
The primary goal of the OWASP Top Ten has always been to drive awareness of the biggest application security risks out there, and thereby establish a “floor” or minimum standard for application security efforts at an organization. The newly released 20…