Discrepancies in reports to the national vulnerability databases (NVD) show the U.S. lags behind China, exposing U.S. firms to cyber attacks.
The post Gaps in the NVD increase U.S. cyber threat appeared first on Security Boulevard.
Author: Paul Roberts
Europe, Global Security News, North America
The pandemic turned out to be a boon for public-private cybersecurity cooperation
by Paul Roberts •
The shift to remote work punched holes in government networks. But it also fostered a transformation in public-private cooperation, one NSA official noted at LABScon.
The post The pandemic turned out to be a boon for public-private cybersecurity…
Security Bloggers
Episode 243: The CSTO is a thing- a conversation with Chris Hoff of LastPass
by Paul Roberts •
Paul talks with Chris Hoff the Chief Secure Technology Officer at LastPass about the CSTO role and the security implications of “software eating the world.”
The post Episode 243: The CSTO is a thing- a conversation with Chris Hoff of LastPass appeared…
Europe, Global Security News, North America
ConversingLabs: Unpacking the Follina exploit
by Paul Roberts •
In our latest episode of the ConversingLabs podcast, host Paul Roberts interviews ReversingLabs researcher Joseph Edwards about his analysis of Follina, a newly discovered exploit with a pretty name, but nasty intentions.
The post ConversingLabs…
Security Bloggers
Episode 242: Hacking the Farm (and John Deere) with Sick Codes
by Paul Roberts •
In our latest podcast, Paul caught up with Sick Codes (@sickcodes) to talk about his now-legendary presentation at the DEF CON Conference in Las Vegas, in which he demonstrated a hack that ran the Doom first person shooter on a John Deere 4240 touch-sc…
Security Bloggers, Vulnerabilities
Episode 241: If Its Smart, Its Vulnerable a Conversation wit Mikko Hyppönen
by Paul Roberts •
We speak with Mikko Hyppönen on the sidelines of the DEF CON Conference in Las Vegas to talk about his new book, “If its Smart it Vulnerable.”
The post Episode 241: If Its Smart, Its Vulnerable a Conversation wit Mikko Hyppönen appeared first on The S…
Security Bloggers, Vulnerabilities
DEF CON DOOM Patrol: Deere Jailbreak Raises Questions on Security, Competition
by Paul Roberts •
A researcher presented the results of a year-long effort to reverse engineer John Deere hardware to run a version of the DOOM first person shooter. He also discovered a number of security flaws along the way.
The post DEF CON DOOM Patrol: Deere Jailbr…
Europe, Global Security News, North America
Researchers demo AI bias, explain why ‘Copilot should remain a co-pilot’ for dev teams
by Paul Roberts •
GitHub updated guidance on using its Copilot AI-powered code bot after researchers demonstrated at Black Hat that it often generates vulnerable code.
The post Researchers demo AI bias, explain why ‘Copilot should remain a co-pilot’ fo…
Europe, Global Security News, North America
Researchers demo AI bias, explain why ‘Copilot should remain a co-pilot’ for dev teams
by Paul Roberts •
GitHub updated guidance on using its Copilot AI-powered code bot after researchers demonstrated at Black Hat that it often generates vulnerable code.
The post Researchers demo AI bias, explain why ‘Copilot should remain a co-pilot’ fo…
Europe, Global Security News, North America
Software supply chain security takes center stage at Black Hat 2022
by Paul Roberts •
Black Hat is best known for hardware and traditional software exploits, but this year it showcases more software supply chain security issues—marking the shift in the threat landscape.
The post Software supply chain security takes center stage at…
Security Bloggers
Episode 240: As Stakes Of Attacks Grow, Can Cyber Policy “Shift Right”?
by Paul Roberts •
In this episode of the podcast (#240) Lauren Zabierek, the Executive Director for the Cyber Project at the Belfer Center at Harvard’s Kennedy School joins us to talk about the need for a re-think of national cybersecurity preparedness, as major hacks l…
Europe, Global Security News, North America
The Week in Cybersecurity: SolarWinds attackers tap Google Drive, malware spreads via Play Store apps
by Paul Roberts •
Welcome to the latest edition of The Week in Cybersecurity, which brings you the latest headlines from both the world and our team about the most pressing topics in cybersecurity. This week: Cozy Bear APT group is using Dropbox and Google drive t…
Europe, Global Security News, North America
CISA: Log4j threat will linger for years—so be prepared
by Paul Roberts •
A survey of the post-Log4j landscape found few successful hacks linked to it. The bad news? Log4Shell will linger for years — so you need to prepare.
The post CISA: Log4j threat will linger for years—so be prepared appeared first on Security Boul…
Europe, Global Security News, North America
The Week in Cybersecurity: NPM removes malicious modules, Microsoft backtracks on macros
by Paul Roberts •
Welcome to the latest edition of The Week in Cybersecurity, which brings you the latest headlines from both the world and our team about the most pressing topics in cybersecurity. This week: fallout from another supply chain attack involving mali…
Europe, Global Security News, North America
The Week in Cybersecurity: NATO creates cyber rapid response
by Paul Roberts •
Welcome to the The Week in Cybersecurity, which brings you the latest headlines from both the world and our team at ReversingLabs about the most pressing topics in cybersecurity. This week: International relations intersects with cybersecurity, l…
Security Bloggers
Episode 239: Power shifts from Russia to China in the Cyber Underground
by Paul Roberts •
Naomi Yusupov, a Chinese Intelligence Analyst at the threat intelligence firm CyberSixGill talks to host Paul Roberts about that company’s new report: The Bear and the Dragon: Analyzing the Russian and Chinese Cybercriminal Communities.
The post Epis…
Europe, Global Security News, North America
MITRE’s System of Trust: A proposed standard for software supply chain security
by Paul Roberts •
MITRE’s System of Trust framework is aiming to standardize how software supply chain security is assessed. MITRE’s Robert Martin explains.
The post MITRE’s System of Trust: A proposed standard for software supply chain security appeared first on …
Europe, Global Security News, North America
What’s hot at #RSAC? Here’s our picks for the big show
by Paul Roberts •
It’s two years in, and COVID is still threatening to steal RSA Conference’s mojo. But for those willing to brave Moscone in San Francisco (and those attending virtually), you won’t be disappointed. Here are our picks for must-see talks.
The post …
Security Bloggers, Vulnerabilities
Episode 238: Robots Are The Next Frontier In Healthcare Cyber Risk
by Paul Roberts •
In this episode of the podcast (#238) we speak with Daniel Brodie, the CTO at the firm Cynerio. about his firm’s discovery of a string of critical security flaws in an autonomous medical robot, TUG, that is already deployed in hundreds of clinical sett…
Security Bloggers, Vulnerabilities
Cyber Attack Halts Production at Ag Equipment Maker AGCO Fendt
by Paul Roberts •
A cyber attack has disrupted the operations of AGCO/Fendt, a major manufacturer of agricultural equipment, the company has acknowledged.
The post Cyber Attack Halts Production at Ag Equipment Maker AGCO Fendt appeared first on The Security Ledger with…
Security Bloggers, Vulnerabilities
Feel Good Ukraine Tractor Story Highlights Ag Cyber Risk
by Paul Roberts •
The good news? John Deere bricked expensive farm equipment taken by thieving Russian troops. The bad news: those same remote access features could be used to launch crippling, large scale attacks on US farms.
The post Feel Good Ukraine Tractor Story H…
Security Bloggers
Episode 237: Jacked on the Beanstalk – DeFi’s Security Debt Runs Wide, Deep
by Paul Roberts •
The hack of Beanstalk is just the latest major compromise of a decentralized finance (DeFi) platform. In this podcast, Jennifer Fernick of NCC Group joins me to talk about why DeFi’s security woes are much bigger than Beanstalk.
The post Episode 237: …
Security Bloggers
Episode 236: Cyberwar Takes A Back Seat In Ukraine (For Now)
by Paul Roberts •
we sit down with Christian Sorenson, the former lead of the international cyber warfare team at US Cyber Command and CEO of cybersecurity firm, SightGain, to talk about what we’ve learned so far from Russia’s war in Ukraine, and what may be coming next…
Security Bloggers
Episode 235: Justine Bone of MedSec on Healthcare Insecurity
by Paul Roberts •
In this episode of the podcast (#235) Justine Bone, the CEO of Medsec, joins Paul to talk about cyber threats to healthcare organizations in the age of COVID. Justine’s firm works with hospitals and healthcare organizations to understand their cyber ri…
Security Bloggers
Episode 234: Rep. Jim Langevin on Cyber Policy in an Age of Political Polarization
by Paul Roberts •
In this episode of the podcast (#234) US Representative Jim Langevin (D-RI), joins Paul to talk about the flurry of legislation passed on Capitol Hill in recent months to boost the U.S.’s cyber defenses.
The post Episode 234: Rep. Jim Langevin on Cyber…
Security Bloggers
Spotlight: COVID, Cloud Sovereignty and Other 2022 Trends with DigiCert
by Paul Roberts •
What does 2022 have in store? Dean Coclin of DigiCert speaks with host Paul Roberts about the trends that will shape the New Year, from cloud sovereignty to the growing reliance on PKI to secure digital identities, DEVOPs and more.
The post Spotlight:…
Security Bloggers
Spotlight: ShardSecure on Protecting Data At Rest Without Encryption
by Paul Roberts •
Host Paul Roberts speaks with Marc Blackmer of ShardSecure about that company’s new approach to protecting data at rest, which relies on fragmenting and scattering data to make it impossible to steal.
The post Spotlight: ShardSecure on Protecting Data…
Security Bloggers, Vulnerabilities
Episode 233: Unpacking Log4Shell’s Un-coordinated Disclosure Chaos
by Paul Roberts •
In this episode of the podcast (#233) Mark Stanislav, a Vice President at the firm Gemini, joins Paul to talk about what went wrong with disclosure of Log4Shell, the critical, remote code execution flaw in the Log4j open source library. Mark talks abou…
Security Bloggers
Leonardo DRZ wins first ever TCG CodeGen Developer Challenge
by Paul Roberts •
President and Chairman of Trusted Computing Group (TCG), Dr. Joerg Borchert, shares the news regarding TCG’s first ever CodeGen Developer Challenge.
The post Leonardo DRZ wins first ever TCG CodeGen Developer Challenge appeared first on The Security Le…
Security Bloggers, Vulnerabilities
Episode 232: Log4j Won’t Go Away (And What To Do About It.)
by Paul Roberts •
In this episode of the podcast (#232), Tomislav Peričin of the firm ReversingLabs joins us to talk about Log4Shell, the vulnerability in the ubiquitous Log4j Apache library. Tomislav tells us why issues related to Log4j won’t be going away anytime soon…
Security Bloggers
Episode 231: Solving the US’s Endemic Cybersecurity Worker Shortage
by Paul Roberts •
Rodney Petersen, the director of the National Initiative for Cybersecurity Education (NICE) talks about the massive shortage of information security workers at the United States – estimated at more than 400,000 workers.
The post Episode 231: Solving th…
Security Bloggers
Spotlight: How Secrets Sprawl Undermines Software Supply Chain Security
by Paul Roberts •
Mackenzie Jackson, the Developer Advocate at GitGuardian joins Paul to discuss how “secrets sprawl” on sites like GitHub threatens software supply chains.
The post Spotlight: How Secrets Sprawl Undermines Software Supply Chain Security appeared first o…
Security Bloggers
Episode 230: Are Vaccine Passports Cyber Secure?
by Paul Roberts •
In this episode of the podcast (#230) Siddarth Adukia, a regional Director at NCC Group, joins host Paul Roberts to talk about the (cyber) risks and (public health) rewards of vaccine passport systems: how they work, how they can be compromised and wha…
Security Bloggers, Vulnerabilities
Episode 229: BugCrowd’s Casey Ellis On What’s Hot In Bug Hunting
by Paul Roberts •
We talk with Casey Ellis, founder and CTO of BugCrowd about how the market for software bugs has changed since the first bug bounty programs emerged nearly 20 years ago, and what’s hot in bug hunting in 2021.
The post Episode 229: BugCrowd’s Casey Ell…
Security Bloggers
Spotlight: Your IoT Risk Is Bigger Than You Think. (And What To Do About It.)
by Paul Roberts •
In this Spotlight edition of the podcast, we’re joined by Curtis Simpson, the Chief Information Security Officer at Armis. Curtis and I discuss the growing cyber risks posed by Internet of Things devices within enterprise networks. IoT and OT (operatio…
Security Bloggers
Spotlight: Automation Beckons as DevOps, IoT Drive PKI Explosion
by Paul Roberts •
Brian Trzupek of DigiCert joins Paul to talk about the findings of a recent State of PKI Automation survey and the challenges of managing fast-growing population of tens of thousands of PKI certificates.
The post Spotlight: Automation Beckons as DevOps…