Nair previously worked at TechCircle, IDG, Times Group and other publications, where he reported on developments in enterprise technology, digital transformation and other issues.
A malicious Python package that mimics a popular SSH automation library has been live on PyPi since 2021 and delivers payloads that steal credentials and create backdoors. The package steals AWS access and secret keys, sending them to a remote server operated through a VPN in Paris
As OT systems become more interconnected, traditional air gaps disappear, creating new risks, said Joseph Carson, chief security scientist and advisory CISO at Delinea. The convergence of IT and OT environments requires a stronger focus on protecting digital identities and access controls.
Organizations mistakenly believe their operational technology systems are air-gapped and immune to cyberthreats. Dawn Cappelli, director of OT-CERT at Dragos, discusses why these assumptions are dangerous security gaps and why organizations need to rethink their approach to OT security.
Vulnerabilities in a smart building energy management system including an easily exploitable, two-year-old flaw that hasn't been widely patched could let hackers take over instances misconfigured to allow internet exposure. The flaws affect Cylon Aspect software from electrical engineering firm ABB.
A "road map to resilience" approach helps organizations balance immediate, low-cost security improvements with complex, long-term risk reduction initiatives in industrial control systems, said Mex Martinot, vice president and global head of industrial cybersecurity at Siemens Energy.
With 75% of cybersecurity leaders facing the worst threat landscape they've seen and 90% reporting workforce shortages, emotional intelligence has become crucial for effective leadership and team retention, said Tara Wisniewski, EVP of advocacy, global markets and member engagement at ISC2.
Operators of a Russian-speaking ransomware group launched a new encryptor with enhanced measures for defeating cyber defenders including wiping logs, disrupting backup systems and stopping decryption without insiders knowledge. The same group disrupted London hospitals in a July attack.
Traditional data center security approaches do not translate very well to cloud environments as cloud computing and Layer 7 applications have fundamentally changed the way organizations should implement security controls, said Traceable AI's Richard Bird.
A recently constituted and apparently well-resourced ransomware player is developing and testing tools to disable security defenses, including a method that exploits a vulnerability in drivers. Embargo first surfaced in April amid an ongoing shakeup in the ransomware world.
More incidents, vulnerability remediation timelines that can stretch into a year and mismatched budget priorities - such is the state of operational technology cybersecurity in 2024, according to participants in an annual SANS survey. Incident response remains a weak point.
The proliferation of data in today’s hyperconnected world presents both opportunities and risks. Rigo Van den Broeck, executive vice president of cybersecurity at Mastercard, said the sheer scale and accessibility of data require organizations to adopt proactive cybersecurity strategies.
Ivanti confirmed that hackers are exploiting an SQL injection vulnerability in its Ivanti Endpoint Manager enabling remote code execution, despite the company addressing the issue with a patch in May. The flaw allows unauthenticated attackers within the same network to execute arbitrary code.
Don't pull data from an operational technology network: OT networks should push data out. Segment critical OT networks. Don't introduce cybersecurity systems into an OT network unless administrators can guarantee they won't hinder a restart after a complete loss of electricity.
Rackspace confirmed that criminals exploited a zero day vulnerability in a ScienceLogic third-party application, forcing the cloud-hosting provider to take monitoring dashboards offline. ScienceLogic confirmed it issued a patch for the zero-day remote code execution vulnerability.
Now patched vulnerabilities in online services from carmaker Kia allowed attackers to remotely control vehicle functions using only a license plate number, putting millions of cars at risk. The flaws were present in the South Korean automaker's official website for owners and in its iOS app.
Our website uses cookies. Cookies enable us to provide the best experience possible and help us understand how visitors use our website. By browsing inforisktoday.eu, you agree to our use of cookies.
