ITCurated, Author at Cyber Security Minute

Integrating threat intelligence with existing security technologies

Issued by: Help Net Security

70 percent of security industry professionals believe threat intelligence is often too voluminous and/or complex to provide actionable insights. The Ponemon Institute study, based on 1,072 respondents in the United Kingdom and North America, also showed that organizations neglect to share essential threat data with board members and C-level executives, despite the fact that security…

Vulnerabilities

Despite the DDoS attacks, don’t give up on Dyn or DNS service providers

Issued by: CSO

The DDoS attacks that flooded Dyn last month and knocked some high-profile Web sites offline don’t mean businesses should abandon it or other DNS service providers, Gartner says. In fact, the best way to go is to make sure critical Web sites are backed by more than one DNS provider, says Gartner analyst Bob Gill.

Software Security

IDG Contributor Network: 6 steps to creating a culture of security ownership

Issued by: CIO Security

The state of corporate cyber-security is anything but static. With the list of potential threats diversifying, the stakes are high for securing company systems and data. As the average cost of a data breach grows (currently estimated at $4 million), business leaders’ appetite for risk lessens. And yet fewer than half of information security professionals…

Software Security

PCI 3.2 Compliant Organizations Are Likely GDPR Compliant

Issued by: Security Week

PCI DSS version 3.1 will be retired on October 31, 2016, with version 3.2 being the only valid version beginning the 1st of November. From that date, any new validation of PCI compliance will have to be against version 3.2. The new requirements will, however, be considered ‘best practices’ until Feb. 1, 2018 when they…

Malware & Threats

U.S. Should Strike Back at Cyberattackers: Report

Issued by: Security Week

The US government and private sector should strike back against hackers to counter cyber-attacks aimed at stealing data and disrupting important computer networks, a policy report said Monday. A panel of experts assembled by the George Washington University Center for Cyber and Homeland Security said policies should be eased to allow “active defense” measures that…

Application Security

IBM deploys machine learning to bolster online banking security program

Issued by: CIO Security

Behavioral biometrics that uses machine learning is behind new features being added to IBM’s Trusteer Pinpoint Detect platform, which financial institutions use to head off crooks who may have stolen the username and password of legitimate account holders. The new feature looks for anomalies between legitimate users’ normal mouse gestures and those of the current…

Network Security

The difference between IT security and ICS security

Issued by: Help Net Security

In this podcast recorded at IoT Solutions World Congress Barcelona 2016, Andrew Ginter, VP of Industrial Security at Waterfall Security, talks about the difference between IT security and ICS security. On IT networks, the focus of a security program is generally preventing the theft of information. The primary focus on control system networks is safety…

Vulnerabilities

AtomBombing: The Windows Vulnerability that Cannot be Patched

Issued by: Security Week

Researchers have discovered a code-injection vulnerability in the Windows operating system that cannot, because of the nature of the operating system, be patched. It could be used to bypass current malware protection solutions in place. “Unfortunately,” writes enSilo researcher Tal Liberman in a report published Oct. 27, “this issue cannot be patched since it doesn’t rely…

Vulnerabilities

Many Joomla Sites Hacked via Recently Patched Flaws

Issued by: Security Week

Less than 24 hours after Joomla released patches for a couple of critical account creation vulnerabilities, researchers noticed that malicious actors had already started exploiting the flaws in the wild. Joomla announced on October 25 the availability of version 3.6.4 to fix two serious vulnerabilities: CVE-2016-8870, which allows attackers to create user accounts even if…