What's new arround internet
| Src | Date (GMT) | Titre | Description | Tags | Stories | Notes |
 |
2024-05-30 12:21:18 | Mots de passe de la culture pop les plus susceptibles de vous faire pirater, nouvelle étude Pop Culture Passwords Most Likely to Get You Hacked, New Study (lien direct) |
> Par deeba ahmed
est votre mot de passe & # 8220; Superman & # 8221;ou & # 8220; Blink-182 & # 8221;?Des millions utilisent ces favoris de la culture pop, ce qui en fait des cibles faciles pour les pirates. & # 8230;
Ceci est un article de HackRead.com Lire le post original: pop culture popMots de passe les plus susceptibles de vous faire pirater, nouvelle étude
>By Deeba Ahmed Is your password “Superman” or “Blink-182”? Millions are using these pop-culture favorites, making them easy targets for hackers.… This is a post from HackRead.com Read the original post: Pop Culture Passwords Most Likely to Get You Hacked, New Study |
Studies | ||
 |
2024-05-29 17:01:00 | La nouvelle recherche met en garde contre la faible gestion du conjoint et les risques d'initiés New Research Warns About Weak Offboarding Management and Insider Risks (lien direct) |
Une étude récente de Wing Security a révélé que 63% des entreprises peuvent avoir d'anciens employés ayant accès à des données organisationnelles, et que l'automatisation de la sécurité SaaS peut aider à atténuer les risques de décharge. & NBSP;
Le hors-bord des employés est généralement considéré comme une tâche administrative de routine, mais il peut présenter des risques de sécurité substantiels, s'ils ne sont pas gérés correctement.Omettant de supprimer rapidement et soigneusement l'accès pour
A recent study by Wing Security found that 63% of businesses may have former employees with access to organizational data, and that automating SaaS Security can help mitigate offboarding risks. Employee offboarding is typically seen as a routine administrative task, but it can pose substantial security risks, if not handled correctly. Failing to quickly and thoroughly remove access for |
Studies Cloud | ★★★ | |
 |
2024-05-22 16:15:00 | Le rapport révèle une augmentation de 341% des attaques de phishing avancées Report Reveals 341% Rise in Advanced Phishing Attacks (lien direct) |
Ces données proviennent du rapport Slashnext \'s Mid-Year State of Phishing 2024
This data comes from SlashNext\'s mid-year State of Phishing 2024 report |
Studies | ★★★ | |
 |
2024-05-22 08:31:14 | Près de la moitié des violations de données dans les organisations financières proviennent du cloud, coûtant en moyenne 5,5 millions d\'euros par an (lien direct) | Près de la moitié des violations de données dans les organisations financières proviennent du cloud, coûtant en moyenne 5,5 millions d'euros par an Avec moins d'un an pour se conformer à la DORA, les organisations financières doivent renforcer leur cyber résilience - Investigations | Studies Cloud | ★★★★ | |
|
2024-05-21 14:15:00 | Les ransomwares et les hacks alimentés par AI stimulent le cyber-investissement Ransomware and AI-Powered Hacks Drive Cyber Investment (lien direct) |
L'augmentation des ransomwares et des attaques générées par l'IA a contribué à accélérer l'investissement dans les cyber-défenses, Infoscurity Europe a trouvé dans une nouvelle étude
The rise in ransomware and AI generated attacks has contributed to accelerate investment into cyber defenses, Infosecurity Europe found in a new study |
Ransomware Studies | ★★ | |
 |
2024-05-21 14:00:00 | Trous dans votre bitbucket: pourquoi votre pipeline CI / CD fuit des secrets Holes in Your Bitbucket: Why Your CI/CD Pipeline Is Leaking Secrets (lien direct) |
Written by: Mark Swindle
While investigating recent exposures of Amazon Web Services (AWS) secrets, Mandiant identified a scenario in which client-specific secrets have been leaked from Atlassian\'s code repository tool, Bitbucket, and leveraged by threat actors to gain unauthorized access to AWS. This blog post illustrates how Bitbucket Secured Variables can be leaked in your pipeline and expose you to security breaches. Background Bitbucket is a code hosting platform provided by Atlassian and is equipped with a built-in continuous integration and continuous delivery/deployment (CI/CD) service called Bitbucket Pipelines. Bitbucket Pipelines can be used to execute CI/CD use cases like deploying and maintaining resources in AWS. Bitbucket includes an administrative function called "Secured Variables" that allows administrators to store CI/CD secrets, such as AWS keys, directly in Bitbucket for easy reference by code libraries. CI/CD Secrets: CI/CD Secrets serve as the authentication and authorization backbone within CI/CD pipelines. They provide the credentials required for pipelines to interact with platforms like AWS, ensuring pipelines possess the appropriate permissions for their tasks. Secrets are often extremely powerful and are beloved by attackers because they present an opportunity for direct, unabated access to an environment. Maintaining confidentiality of secrets while balancing ease of use by developers is a constant struggle in securing CI/CD pipelines. Bitbucket Secured Variables: Bitbucket provides a way to store variables so developers can quickly reference them when writing code. Additionally, Bitbucket offers an option to declare a variable as a "secured variable" for any data that is sensitive. A secured variable is designed such that, once its value is set by an administrator, it can no longer be read in plain text. This structure allows developers to make quick calls to secret variables without exposing their values anywhere in Bitbucket. Unless… Exporting Secrets from Bitbucket in Plain Text CI/CD pipelines are designed just like the plumbing in your house. Pipes, valves, and regulators all work in unison to provide you with reliable, running water. CI/CD pipelines are a complicated orchestration of events to accomplish a specific task. In order to accomplish this, these pipelines are highly proficient at packaging and deploying large volumes of data completely autonomously. As a developer, this creates countless possibilities for automating work, but, as a security professional, it can be a cause for anxiety and heartburn. Perhaps it\'s a line of code with a hardcoded secret sneaking into production. Maybe it\'s a developer accidentally storing secrets locally on their machine. Or maybe, as we have seen in recent investigations, it\'s a Bitbucket artifact object containing secrets for an AWS environment being published to publicly available locations like S3 Buckets or company websites. Bitbucket secured variables are a convenient way to store secrets locally in Bitbucket for quick reference by developers; however, they come with one concerning characteristic-they can be exposed in plain text through artifact objects. If a Bitbucket variable-secured or not secured-is copied to an artifact object using the artifacts: command, the result will generate a .txt file with |
Tool Threat Studies | ★★★ | |
|
2024-05-21 11:33:34 | Le rapport 2024 Voice of the CISO de Proofpoint révèle que plus des trois quarts des RSSI français considèrent l\'erreur humaine comme le risque principal pour la sécurité de l\'entreprise (lien direct) | Le rapport 2024 Voice of the CISO de Proofpoint révèle que plus des trois quarts des RSSI français considèrent l'erreur humaine comme le risque principal pour la sécurité de l'entreprise Face à cette vulnérabilité, 89 % des RSSI français se tournent vers les technologies alimentées par l'IA pour se protéger des erreurs humaines et bloquer les cybermenaces avancées qui ciblent les employés. - Investigations | Studies | ★★★★★ | |
 |
2024-05-21 05:00:13 | 74% des CISO croient que les gens sont leur plus grande vulnérabilité de leur entreprise, révèle la voix de la voix du CISO 2024 74% of CISOs Believe that People Are Their Company\\'s Biggest Vulnerability, 2024 Voice of the CISO Report Reveals (lien direct) |
Bien que les 12 derniers mois aient peut-être manqué les événements des années précédentes, il a été loin d'être silencieux pour les principaux officiers de sécurité de l'information du monde (CISO).Le besoin désormais permanent de soutenir les travaux à distance et hybride a créé une plus grande surface d'attaque pour de nombreuses entreprises que jamais auparavant.Dans le même temps, les cyber-menaces deviennent plus fréquentes, sophistiquées et dommageables. & Nbsp; & nbsp; Les employés modifient des emplois à des niveaux record et prennent des données avec eux lorsqu'ils partent.Pendant ce temps, l'IA génératrice et les outils standard mettent des menaces dévastatrices entre les mains de quiconque veut payer quelques dollars.Et la recherche pour le rapport inaugural du paysage des pertes de données de Proofpoint a révélé que les employés négligents sont des entreprises \\ '' problème de perte de données. & Nbsp; & nbsp; & nbsp; Pour comprendre comment les CISO se trouvent dans une autre année à succès dans le paysage du cyber-risque, Proofpoint a interrogé 1 600 de ces leaders de la sécurité dans le monde pour en savoir plus sur leurs rôles et leurs perspectives pour les deux prochaines années.Cette année, nous avons interrogé des organisations avec plus de 1 000 employés pour mieux comprendre les pratiques de cybersécurité complexes. & NBSP; Les cisos se sentent plus inquiets mais mieux préparés & nbsp; & nbsp; Qu'ils soient motivés par le chiffre d'affaires des employés, les cyberattaques de plus en plus sophistiquées ou la dépendance croissante à l'égard de la technologie des nuages, la plupart des CISO scannent nerveusement le paysage des menaces.Plus des deux tiers (70%) pensent que leurs entreprises sont à risque de cyberattaque au cours des 12 prochains mois de 68% en 2023 et 48% en 2022. & nbsp; & nbsp; Malgré ces préoccupations, de nombreux CISO que nous avons interrogés ont déclaré que la capacité de leur entreprise ait \\ à faire face aux conséquences.Moins de la moitié (43%) croient qu'ils ne sont pas préparés pour une cyberattaque ciblée de 61% en 2023 et 50% en 2022. & nbsp; & nbsp; Il est encourageant de savoir que plus de cisos se sentent prêts à faire face à des cybermenaces.Cependant, la réalité est que 70% des CISO croient également qu'une attaque est imminente et presque la moitié ne reste pas préparée à son impact. & Nbsp; & nbsp; Les humains restent une préoccupation majeure et NBSP; Cette année, il y a de nombreuses menaces dans l'esprit des CISO, des ransomwares et de la fraude par e-mail aux menaces d'initiés et aux compromis sur le compte cloud.Mais leur peuple leur provoque le plus d'anxiété. & Nbsp; & nbsp; Près des trois quarts (74%) des CISO croient que l'erreur humaine est leur plus grande cyber-vulnérabilité, contre 60% en 2023 et 56% en 2022. Encore plus (80%) croient que le risque humain et la négligence des employés seront des préoccupations clés de cybersécurité pourles deux prochaines années. & nbsp; & nbsp; Nos recherches montrent que les CISO croient généralement que leur peuple est conscient de leur rôle critique dans la défense de l'entreprise contre les cyber-menaces.Que les CISO voient toujours leur peuple comme le principal facteur de risque suggère qu'il y a une déconnexion entre les employés de la compréhension des cybermenaces et leur capacité à garder les menaces à distance.& nbsp; 74% des CISO croient que l'erreur humaine est leur plus grande cyber-vulnérabilité. & NBSP; 86% pensent que leurs employés comprennent leur rôle dans la défense de l'entreprise contre les cybermenaces.Près de la moitié (45%) sont fortement d'accord avec cette déclaration. & NBSP; 41% croient que les attaques de ransomwares sont la principale menace pour leur entreprise au cours des 12 prochains mois. & Nbsp; & nbsp; Les CISO ressentent la pression & nbsp; & nbsp; Les CISO ont cimenté leur place dans la salle de conférence ces dernières années, et bon nombre de ces | Ransomware Tool Vulnerability Threat Studies Cloud | ★★★★ | |
 |
2024-05-20 18:55:38 | Un nouveau rapport sur les menaces conclut que près de 90% des cybermenaces impliquent l'ingénierie sociale New Threat Report Finds Nearly 90% of Cyber Threats Involve Social Engineering (lien direct) |
Threat Studies | ★★★ | ||
|
2024-05-17 16:59:00 | Nouveau cyber-recherche XM: 80% des expositions des erreurs de configuration, moins de 1% de CVES New XM Cyber Research: 80% of Exposures from Misconfigurations, Less Than 1% from CVEs (lien direct) |
Un nouveau rapport de XM Cyber a trouvé & # 8211;Entre autres informations - A & NBSP; dramatique & nbsp; écart entre où la plupart des organisations concentrent leurs efforts de sécurité et où résident les menaces les plus graves et NBSP; en fait & nbsp; résident.
Le nouveau rapport, naviguant sur les chemins de risque: l'état de gestion de l'exposition en 2024, est basé sur des centaines de milliers d'évaluations de chemin d'attaque menées par le & nbsp; xm cyber
A new report from XM Cyber has found – among other insights - a dramatic gap between where most organizations focus their security efforts, and where the most serious threats actually reside. The new report, Navigating the Paths of Risk: The State of Exposure Management in 2024, is based on hundreds of thousands of attack path assessments conducted by the XM Cyber |
Studies | ★★★ | |
 |
2024-05-16 20:34:51 | Tous les grains de fournisseur Linux sont-ils insécurisés?Une nouvelle étude dit oui, mais il y a un correctif Are all Linux vendor kernels insecure? A new study says yes, but there\\'s a fix (lien direct) |
Tous les grains de fournisseurs sont en proie à des vulnérabilités de sécurité, selon un livre blanc CIQ.La communauté Linux acceptera-t-elle jamais les noyaux stables en amont?
All vendor kernels are plagued with security vulnerabilities, according to a CIQ whitepaper. Will the Linux community ever accept upstream stable kernels? |
Vulnerability Studies | ★★★ | |
|
2024-05-16 14:45:41 | Selon Rubrik Zero Labs, 70% de toutes les données sont soumises à des angles morts et ne sont généralement pas lisibles par les dispositifs de sécurité According to Rubrik Zero Labs, 70% of all data is subject to blind spots and is generally not readable by security devices (lien direct) |
L'adoption croissante du cloud crée de nouveaux angles morts de sécurité.
-
rapports spéciaux
Increasing adoption of the cloud is creating new security blind spots. - Special Reports |
Studies Cloud | ★★★ | |
|
2024-05-15 15:24:40 | Cyber Threat Research: Poor Patching Practices and Unencrypted Protocols Continue to Haunt Enterprises (lien direct) | Recherche de cyber-menaces: les mauvaises pratiques de correction et les protocoles non cryptés continuent de hanter les entreprises
Cato Networks a dévoilé les résultats de son inaugural Rapport de menace Cato Ctrl Sase pour le premier trimestre 2024.
Les analyses du rapport Cato Cyber Threat Labs (CTRL) inaugurales analysent 1,26 billion de flux de réseaux pour identifier les risques de sécurité d'entreprise d'aujourd'hui
-
rapports spéciaux
Cyber Threat Research: Poor Patching Practices and Unencrypted Protocols Continue to Haunt Enterprises Cato Networks unveiled the findings of its inaugural Cato CTRL SASE Threat Report for Q1 2024. Inaugural Cato Cyber Threat Research Labs (CTRL) Report Analyzes 1.26 Trillion Network Flows to Identify Today\'s Enterprise Security Risks - Special Reports |
Threat Studies Patching | ★★★ | |
|
2024-05-14 14:20:00 | 44% des professionnels de la cybersécurité luttent contre la conformité réglementaire 44% of Cybersecurity Professionals Struggle with Regulatory Compliance (lien direct) |
La recherche InfoSecurity Europe met en évidence des défis importants auxquels sont confrontés les organisations de rester au courant des exigences de conformité croissantes
Infosecurity Europe research highlights significant challenges faced by organisations in staying up to speed with increasing compliance requirements |
Studies | ★★★ | |
|
2024-05-14 13:56:06 | L'étude de consultation FTI révèle des écarts de communication importants entre les CISO FTI Consulting Study Reveals Significant Communications Gaps Between CISOs and C-Suites Despite (lien direct) |
L'étude de conseil en FTI révèle que des lacunes de communication importantes entre les CISO et les plans C malgré une concentration accrue sur les résultats de la cybersécurité indiquent que près d'un cadres sur trois pense que leurs CISO hésitent à éclairer le leadership des vulnérabilités potentielles, créant un risque organisationnel
-
rapports spéciaux
FTI Consulting Study Reveals Significant Communications Gaps Between CISOs and C-Suites Despite Increased Focus on Cybersecurity Findings Indicate Nearly One-in-Three Executives Believe their CISOs Hesitate to Inform Leadership of Potential Vulnerabilities, Creating Organizational Risk - Special Reports |
Vulnerability Studies | ★★★ | |
 |
2024-05-14 11:00:59 | Rapport d'analyste de la réponse aux incidents 2023 Incident response analyst report 2023 (lien direct) |
Le rapport partage les statistiques et les observations de la pratique de la réponse aux incidents en 2023, analyse les tendances et donne des recommandations de cybersécurité.
The report shares statistics and observations from incident response practice in 2023, analyzes trends and gives cybersecurity recommendations. |
Studies | ★★★★ | |
|
2024-05-14 09:48:08 | ExtraHop® révèle que 91% des organisations ont payé pour des ransomwares en 2023 (lien direct) | ExtraHop® révèle que 91% des organisations ont payé pour des ransomwares en 2023 Un faux sentiment de confiance rend les organisations vulnérables aux cybermenaces Les grands comptes français en tête du nombre d'heures d'arrêt pour cause de cyberattaques - Investigations | Studies | ★★★ | |
 |
2024-05-13 21:10:08 | Syndicats d'escroquerie d'Asie du Sud-Est volant 64 milliards de dollars par an, les chercheurs trouvent Southeast Asian scam syndicates stealing $64 billion annually, researchers find (lien direct) |
ExtraHop® révèle que 91% des organisations ont payé pour des ransomwares en 2023 Un faux sentiment de confiance rend les organisations vulnérables aux cybermenaces Les grands comptes français en tête du nombre d'heures d'arrêt pour cause de cyberattaques - Investigations | Studies | ★★★★★ | |
|
2024-05-13 12:31:54 | Selon Kaspersky, un cyberincident sur trois est dû à un ransomware (lien direct) | Selon Kaspersky, un cyberincident sur trois est dû à un ransomware - Malwares | Ransomware Studies | ★★★ | |
|
2024-05-13 12:26:09 | 97 % des entreprises touchées par une demande de rançon déclarent avoir collaboré avec les forces de l\'ordre, selon le rapport état des ransomwares 2024 de Sophos (lien direct) | 97 % des entreprises touchées par une demande de rançon déclarent avoir collaboré avec les forces de l'ordre, selon le rapport état des ransomwares 2024 de Sophos - Malwares | Studies | ★★ | |
 |
2024-05-10 10:00:00 | Sagesse sauvage: ce que la technologie apprend du monde naturel Wild Wisdom: What Technology Learns from the Natural World (lien direct) |
The content of this post is solely the responsibility of the author. LevelBlue does not adopt or endorse any of the views, positions, or information provided by the author in this article. As a high school student interested in exploring the connection between technology and nature, I was curious to find out how the natural world inspires modern technological advances. My research journey started with some basic Google searches and reading through articles on biomimicry. I also watched several documentaries and TED Talks that explained how animals and plants have influenced technological designs. Here is a detailed article on how space suits can benefit from biomimetics. Nature’s inspiration for innovation in Spacesuits and Cyber Defense Not only is nature beautiful to look at, but it is also providing us with fantastic ideas for solving complex technological problems. The concept of biomimicry, which refers to drawing inspiration from natural systems to address human challenges, is now trending heavily in fields such as cybersecurity and space exploration. Biomimicry involves the creation and development of materials, structures, and systems that are inspired by biological entities and processes. For thousands of years, humans have turned to the natural world as a source of inspiration for innovations across various domains, including transportation and entertainment. This approach has led to significant advancements, such as the design of aircraft inspired by the aerodynamics of bird wings and the development of anti-glare screens modeled after the intricate nanostructures found in moth eyes. By observing and emulating the unique characteristics of wildlife, we have continuously found ways to enhance our technological capabilities and improve the quality of our daily lives. This field not only highlights the ingenuity inherent in nature but also underscores the potential for sustainable and efficient design solutions drawn from the biological world Nature’s Influence on Cybersecurity Data Masking Inspired by Moths The humble moth, with its ability to blend into its surroundings, provides a perfect metaphor for data masking in cybersecurity. This technique involves hiding real data among fake data, thereby protecting sensitive information from prying eyes. Steganography and the Chameleon Similarly, the chameleon\'s ability to change its color to match its environment mirrors the practice of steganography in cybersecurity. This method involves hiding information within non-secret data, much like concealing a secret message within an ordinary-looking image or audio file. Digital watermarking in multimedia is a practical application of this technique, helping to secure copyrights by embedding invisible codes within files. Consider some applications in different industry verticals: Sacrificial systems and deception Inspired by how some animals like lizards can shed their tails to protect vital organs, healthcare cybersecurity could utilize "sacrificial systems" - offering up less critical systems or data as decoys to distract and study cyber attackers, buying time to strengthen protection of the most sensitive medical information. Biomimicry in Space Suits: A Journey from Earth to Beyond Radiation Protection Inspired by Fungi Recent studies have explored the potential of fungi, particularly those thriving in the radioactive wasteland of Chernobyl, to protect astronauts from cosmic rays. These fungi utilize radiation as an energy source, suggesting their potential to develop into living, self-repairing shie | Studies Medical | ★★★ | |
 |
2024-05-09 20:21:41 | 87% des attaques DDOS ciblées dispositifs de système d'exploitation ciblé en 2023 87% of DDoS Attacks Targeted Windows OS Devices in 2023 (lien direct) |
The content of this post is solely the responsibility of the author. LevelBlue does not adopt or endorse any of the views, positions, or information provided by the author in this article. As a high school student interested in exploring the connection between technology and nature, I was curious to find out how the natural world inspires modern technological advances. My research journey started with some basic Google searches and reading through articles on biomimicry. I also watched several documentaries and TED Talks that explained how animals and plants have influenced technological designs. Here is a detailed article on how space suits can benefit from biomimetics. Nature’s inspiration for innovation in Spacesuits and Cyber Defense Not only is nature beautiful to look at, but it is also providing us with fantastic ideas for solving complex technological problems. The concept of biomimicry, which refers to drawing inspiration from natural systems to address human challenges, is now trending heavily in fields such as cybersecurity and space exploration. Biomimicry involves the creation and development of materials, structures, and systems that are inspired by biological entities and processes. For thousands of years, humans have turned to the natural world as a source of inspiration for innovations across various domains, including transportation and entertainment. This approach has led to significant advancements, such as the design of aircraft inspired by the aerodynamics of bird wings and the development of anti-glare screens modeled after the intricate nanostructures found in moth eyes. By observing and emulating the unique characteristics of wildlife, we have continuously found ways to enhance our technological capabilities and improve the quality of our daily lives. This field not only highlights the ingenuity inherent in nature but also underscores the potential for sustainable and efficient design solutions drawn from the biological world Nature’s Influence on Cybersecurity Data Masking Inspired by Moths The humble moth, with its ability to blend into its surroundings, provides a perfect metaphor for data masking in cybersecurity. This technique involves hiding real data among fake data, thereby protecting sensitive information from prying eyes. Steganography and the Chameleon Similarly, the chameleon\'s ability to change its color to match its environment mirrors the practice of steganography in cybersecurity. This method involves hiding information within non-secret data, much like concealing a secret message within an ordinary-looking image or audio file. Digital watermarking in multimedia is a practical application of this technique, helping to secure copyrights by embedding invisible codes within files. Consider some applications in different industry verticals: Sacrificial systems and deception Inspired by how some animals like lizards can shed their tails to protect vital organs, healthcare cybersecurity could utilize "sacrificial systems" - offering up less critical systems or data as decoys to distract and study cyber attackers, buying time to strengthen protection of the most sensitive medical information. Biomimicry in Space Suits: A Journey from Earth to Beyond Radiation Protection Inspired by Fungi Recent studies have explored the potential of fungi, particularly those thriving in the radioactive wasteland of Chernobyl, to protect astronauts from cosmic rays. These fungi utilize radiation as an energy source, suggesting their potential to develop into living, self-repairing shie | Studies | ★★★★ | |
 |
2024-05-08 23:16:03 | Pourquoi la protection des appareils du personnel du secteur public est essentiel Why Protecting Public Sector Personnel\\'s Devices is Essential (lien direct) |
Le récent hack du téléphone du sénateur Lindsey Graham \\ propose une étude de cas critique, révélant comment les attaques de smirs peuvent compromettre avec succès les appareils personnels avec des conséquences alarmantes.
The recent hack of Senator Lindsey Graham\'s phone offers a critical case study, revealing how smishing attacks can successfully compromise personal devices with alarming consequences. |
Hack Studies | ★★★ | |
|
2024-05-08 08:19:06 | 97% des organisations frappées par des ransomwares ont travaillé avec les forces de l'ordre, le rapport Sophos State of Ransomware est constaté 97% of Organizations Hit by Ransomware Worked with Law Enforcement, Sophos State of Ransomware Report Finds (lien direct) |
97% des organisations frappées par les ransomwares ont travaillé avec les forces de l'ordre, les résultats du rapport de Ransomware de l'État de Sophos par Sophos
-
rapports spéciaux
97% of Organizations Hit by Ransomware Worked with Law Enforcement, Sophos State of Ransomware Report Finds by Sophos - Special Reports |
Ransomware Studies Legislation | ★★★★ | |
|
2024-05-07 16:12:00 | Nouvelle étude de cas: le commentaire malveillant New Case Study: The Malicious Comment (lien direct) |
Quelle est la sécurité de votre section commentaires?Découvrez comment un commentaire apparemment innocent \\ 'merci \' sur une page de produit a caché une vulnérabilité malveillante, soulignant la nécessité de mesures de sécurité robustes.Lisez le & nbsp; complet & nbsp; étude de cas réelle & nbsp; ici. & Nbsp;
Quand un \\ 'merci \' pas un \\ 'merci \'?Quand c'est un peu sournois de code & nbsp; que \\ 's & nbsp; été & nbsp; Hidden & nbsp; à l'intérieur a \' merci \\ '
How safe is your comments section? Discover how a seemingly innocent \'thank you\' comment on a product page concealed a malicious vulnerability, underscoring the necessity of robust security measures. Read the full real-life case study here. When is a \'Thank you\' not a \'Thank you\'? When it\'s a sneaky bit of code that\'s been hidden inside a \'Thank You\' |
Vulnerability Studies | ★★★ | |
 |
2024-05-03 16:52:14 | Top 5 des tendances mondiales de la cybersécurité de 2023, selon Google Report Top 5 Global Cyber Security Trends of 2023, According to Google Report (lien direct) |
Selon le rapport M-Trends, le temps moyen nécessaire à une organisation pour détecter un attaquant dans son environnement a diminué de 16 jours en 2022 à 10 jours en 2023.
According to the M-Trends report, the average time it takes for an organisation to detect an attacker in their environment has decreased from 16 days in 2022 to 10 days in 2023. |
Studies | ★★★ | |
|
2024-05-02 15:30:00 | Applications Android Flaw affectées avec 4 milliards d'installations Android Flaw Affected Apps With 4 Billion Installs (lien direct) |
Microsoft a illustré la gravité du problème via une étude de cas impliquant le gestionnaire de fichiers de Xiaomi \\
Microsoft illustrated the severity of the issue via a case study involving Xiaomi\'s File Manager |
Studies Mobile | ★★ | |
|
2024-05-02 07:49:28 | Le rapport État de la cybersécurité en 2024 de Splunk met en avant l\'impact grandissant de l\'IA générative dans le paysage de la cybersécurité (lien direct) | Le rapport État de la cybersécurité en 2024 de Splunk met en avant l'impact grandissant de l'IA générative dans le paysage de la cybersécurité Cette étude mondiale montre que 93 % des entreprises utilisent l'IA générative publique, mais que 34 % d'entre elles ne disposent pas de politique concernant cette technologie. - Investigations | Studies | ★★★★ | |
|
2024-05-02 07:44:47 | 2024 Rapport d'investigations sur les violations de données: La moitié des violations en EMEA sont internes 2024 Data Breach Investigations Report: Half of the breaches in EMEA are internal (lien direct) |
2024 Rapport d'investigations de violation des données: La moitié des violations en EMEA sont internes
ce que vous devez savoir:
• Plus des deux tiers (68%) des infractions à l'échelle mondiale impliquent une action humaine non malveillante.
• L'exploitation de la vulnérabilité a connu une croissance de 180% par rapport à 2023.
• En moyenne, il a fallu environ 55 jours aux organisations pour corriger 50% de leurs vulnérabilités critiques.
-
rapports spéciaux
2024 Data Breach Investigations Report: Half of the breaches in EMEA are internal What you need to know: • More than two-thirds (68%) of breaches globally involve a non-malicious human action. • Vulnerability exploitation experienced 180% growth vs 2023. • On average it took organisations about 55 days to patch 50% of their critical vulnerabilities. - Special Reports |
Data Breach Vulnerability Studies | ★★★ | |
 |
2024-05-01 19:46:49 | Attaque "Stream Dirty": découvrir et atténuer un modèle de vulnérabilité commun dans les applications Android “Dirty stream” attack: Discovering and mitigating a common vulnerability pattern in Android apps (lien direct) |
## Snapshot Microsoft discovered a path traversal-affiliated vulnerability pattern in multiple popular Android applications that could enable a malicious application to overwrite files in the vulnerable application\'s home directory. The implications of this vulnerability pattern include arbitrary code execution and token theft, depending on an application\'s implementation. Arbitrary code execution can provide a threat actor with full control over an application\'s behavior. Meanwhile, token theft can provide a threat actor with access to the user\'s accounts and sensitive data. We identified several vulnerable applications in the Google Play Store that represented over four billion installations. We anticipate that the vulnerability pattern could be found in other applications. We\'re sharing this research so developers and publishers can check their apps for similar issues, fix as appropriate, and prevent introducing such vulnerabilities into new apps or releases. As threats across all platforms continue to evolve, industry collaboration among security researchers, security vendors, and the broader security community is essential in improving security for all. Microsoft remains committed to working with the security community to share vulnerability discoveries and threat intelligence to protect users across platforms. After discovering this issue, we identified several vulnerable applications. As part of our responsible disclosure policy, we notified application developers through Coordinated Vulnerability Disclosure (CVD) via Microsoft Security Vulnerability Research (MSVR) and worked with them to address the issue. We would like to thank the Xiaomi, Inc. and WPS Office security teams for investigating and fixing the issue. As of February 2024, fixes have been deployed for the aforementioned apps, and users are advised to keep their device and installed applications up to date. Recognizing that more applications could be affected, we acted to increase developer awareness of the issue by collaborating with Google to publish an article on the Android Developers website, providing guidance in a high-visibility location to help developers avoid introducing this vulnerability pattern into their applications. We also wish to thank Google\'s Android Application Security Research team for their partnership in resolving this issue. In this post, we continue to raise developer and user awareness by giving a general overview of the vulnerability pattern, and then focusing on Android share targets, as they are the most prone to these types of attacks. We go through an actual code execution case study where we demonstrate impact that extends beyond the mobile device\'s scope and could even affect a local network. Finally, we provide guidance to users and application developers and illustrate the importance of collaboration to improve security for all. ## Activity Overview ### Data and file sharing on Android The Android operating system enforces isolation by assigning each application its own dedicated data and memory space. To facilitate data and file sharing, Android provides a component called a content provider, which acts as an interface for managing and exposing data to the rest of the installed applications in a secure manner. When used correctly, a content provider provides a reliable solution. However, improper implementation can introduce vulnerabilities that could enable bypassing of read/write restrictions within an application\'s home directory. The Android software development kit (SDK) includes the [FileProvider](https://developer.android.com/reference/androidx/core/content/FileProvider) class, a subclass of ContentProvider that enables file sharing between installed applications. An application that needs to share its files with other applications can declare a FileProvider in its app manifest and declare the specific paths to share. Every file provider has a property called authority, which identifies it system-wide, and can b | Tool Vulnerability Threat Studies Mobile Technical | ★★★ | |
|
2024-04-30 11:40:00 | Ransom Payments augmente de 500% à une moyenne de 2 millions de dollars Ransom Payments Surge by 500% to an Average of $2m (lien direct) |
Sophos a constaté que le paiement moyen de la rançon était de 2 millions de dollars en 2023, avec 63% des exigences de rançon de 1 million de dollars ou plus
Sophos found that the average ransom payment was $2m in 2023, with 63% of ransom demands $1m or more |
Studies | ★★★★ | |
|
2024-04-29 16:00:00 | L'étude révèle des niveaux alarmants du trafic de phishing USPS Study Reveals Alarming Levels of USPS Phishing Traffic (lien direct) |
Les meilleurs domaines malveillants ont attiré plus de 100 000 succès chacun, selon Akamai Security
The top malicious domains attracted over 100,000 hits each, according to Akamai Security |
Studies | ★★ | |
|
2024-04-29 14:00:00 | De l'assistant à l'analyste: la puissance de Gemini 1.5 Pro pour l'analyse des logiciels malveillants From Assistant to Analyst: The Power of Gemini 1.5 Pro for Malware Analysis (lien direct) |
Executive Summary A growing amount of malware has naturally increased workloads for defenders and particularly malware analysts, creating a need for improved automation and approaches to dealing with this classic threat. With the recent rise in generative AI tools, we decided to put our own Gemini 1.5 Pro to the test to see how it performed at analyzing malware. By providing code and using a simple prompt, we asked Gemini 1.5 Pro to determine if the file was malicious, and also to provide a list of activities and indicators of compromise. We did this for multiple malware files, testing with both decompiled and disassembled code, and Gemini 1.5 Pro was notably accurate each time, generating summary reports in human-readable language. Gemini 1.5 Pro was even able to make an accurate determination of code that - at the time - was receiving zero detections on VirusTotal. In our testing with other similar gen AI tools, we were required to divide the code into chunks, which led to vague and non-specific outcomes, and affected the overall analysis. Gemini 1.5 Pro, however, processed the entire code in a single pass, and often in about 30 to 40 seconds. Introduction The explosive growth of malware continues to challenge traditional, manual analysis methods, underscoring the urgent need for improved automation and innovative approaches. Generative AI models have become invaluable in some aspects of malware analysis, yet their effectiveness in handling large and complex malware samples has been limited. The introduction of Gemini 1.5 Pro, capable of processing up to 1 million tokens, marks a significant breakthrough. This advancement not only empowers AI to function as a powerful assistant in automating the malware analysis workflow but also significantly scales up the automation of code analysis. By substantially increasing the processing capacity, Gemini 1.5 Pro paves the way for a more adaptive and robust approach to cybersecurity, helping analysts manage the asymmetric volume of threats more effectively and efficiently. Traditional Techniques for Automated Malware Analysis The foundation of automated malware analysis is built on a combination of static and dynamic analysis techniques, both of which play crucial roles in dissecting and understanding malware behavior. Static analysis involves examining the malware without executing it, providing insights into its code structure and unobfuscated logic. Dynamic analysis, on the other hand, involves observing the execution of the malware in a controlled environment to monitor its behavior, regardless of obfuscation. Together, these techniques are leveraged to gain a comprehensive understanding of malware. Parallel to these techniques, AI and machine learning (ML) have increasingly been employed to classify and cluster malware based on behavioral patterns, signatures, and anomalies. These methodologies have ranged from supervised learning, where models are trained on labeled datasets, to unsupervised learning for clustering, which identifies patterns without predefined labels to group similar malware. | Malware Hack Tool Vulnerability Threat Studies Prediction Cloud Conference | Wannacry | ★★★ |
 |
2024-04-28 05:22:29 | À travers l'objectif d'une étude de cas: ce qu'il faut pour être un analyste des risques cyber-physiques Through the Lens of a Case Study: What It Takes to Be a Cyber-Physical Risk Analyst (lien direct) |
> Je couvre régulièrement le sujet de l'analyse des risques cyber-physiques dans mes écrits, et en conséquence, j'ai reçu ...
>I regularly cover the topic of cyber-physical risk analysis in my writings, and as a result, I’ve received... |
Studies | ★★ | |
|
2024-04-25 10:05:00 | 11% des équipes de cybersécurité n'ont aucune femme 11% of Cybersecurity Teams Have Zero Women (lien direct) |
Une nouvelle étude ISC2 met en évidence le manque de diversité en cybersécurité avec seulement 4% des équipes ayant une majorité de femmes, tandis que 11% n'en ont pas du tout
A new ISC2 study highlights the lack of diversity in cybersecurity with only 4% of teams having a majority of women, while 11% have none at all |
Studies | ★★★ | |
 |
2024-04-24 10:22:19 | Nouvelle analyse de craquage de mot de passe cible bcrypt New Password Cracking Analysis Targets Bcrypt (lien direct) |
> Les systèmes Hive mènent une autre étude sur les mots de passe de fissuration via des attaques de force brute, mais il ne cible plus MD5.
>Hive Systems conducts another study on cracking passwords via brute-force attacks, but it\'s no longer targeting MD5. |
Studies | ★★★ | |
|
2024-04-24 10:00:00 | Comprendre comment la rationalité, la théorie de la dissuasion et l'indéterminisme influencent la cybercriminalité. Understanding how Rationality, Deterrence Theory, and Indeterminism Influence Cybercrime. (lien direct) |
Understanding the factors influencing cybercriminal behavior is essential for developing effective cybercrime prevention strategies. Rationality plays a significant role in shaping criminal decisions, particularly through the lens of the rational actor model and deterrence theory. This blog explores how rationality influences cybercriminal behavior, focusing on the rational actor model, the concepts of deterrence theory, their implications for understanding and preventing cybercrime activities, and how Bayesian theory can help overcome indeterministic human criminal behavior to provide risk management. Brief History of Deterrence Theory: Deterrence theory has its roots in classical criminology and the works of philosophers such as Cesare Beccaria and Jeremy Bentham, who introduced the concept of deterrence as a means of preventing crime through the application of punishment. This idea became further developed during the mid-20th century when the theory of nuclear deterrence emerged as a prominent concept in international relations. The understanding of deterrence broadened to be applied not only in preventing nuclear conflict but also in the context of criminal justice. It was John Nash through his work in game theory that contributed significantly to the understanding of strategic decision-making and the potential for deterrence in various competitive situations. His insights were crucial in shaping the modern understanding of deterrence theory, particularly when applied to criminal decision-making and cybersecurity.[1] Explanation of Deterministic, Non-Deterministic, and Indeterministic: Deterministic: In the context of decision-making, determinism refers to the philosophical concept that all events, including human actions, are the inevitable result of preceding causes. This perspective suggests that given the same initial conditions and knowledge, an individual\'s choices can be predicted with certainty. In other words, under deterministic assumptions, human behavior can be seen as fully predictable.[2] Non-Deterministic: Non-deterministic views reject the idea that every event, including human actions, can be precisely determined or predicted based on preceding causes. Instead, non-deterministic perspectives acknowledge the role of uncertainty, chance, and randomness in decision-making. From this standpoint, human behavior is seen as influenced by a combination of factors, including personal choice, external circumstances, and unpredictable elements.[3] Indeterministic: Indeterminism represents a specific form of non-determinism. In the context of decision-making, indeterministic views emphasize the idea that certain events or actions, particularly human choices, are not entirely determined by preceding causes or predictable factors. Instead, they are seen as influenced by random or unpredictable elements, such as personal spontaneity, free will, or external factors that defy precise prediction.[4] The Indeterministic Nature of Cybercriminal Behavior: The indeterministic nature of cybercriminal behavior suggests that not all cybercrimes are the result of rational choices. Some individuals may engage in cybercriminal behavior due to impulsive actions, vulnerabilities in systems, or external pressures that override rational decision-making processes. These factors highlight the limitations of solely relying on rationality as an explanatory framework for cybercriminal behavior. Rationality and the Rational Actor Model in Cybercrime: The rational actor model suggests that cybercriminals are rational decision-makers who engage in a cost-benefit analysis before committing a cybercrime.[5] According to this model, cybercriminals weigh the potential benefits and costs of engaging in cybercriminal behavior and make a rational choice based on their assessment. The rational actor model assumes that cybercriminals have the capability to accurately assess the potential outcomes of their cyber actions and aim to maximize th | Tool Vulnerability Studies Legislation Prediction | ★★★ | |
|
2024-04-24 09:15:00 | Le cinquième des Cisos admettent que le personnel a divulgué des données via Genai Fifth of CISOs Admit Staff Leaked Data Via GenAI (lien direct) |
Une organisation britannique sur cinq a fait exposer des données d'entreprise via une IA générative, explique Riversafe
One in five UK organizations have had corporate data exposed via generative AI, says RiverSafe |
Studies | ★★★★ | |
 |
2024-04-23 19:38:00 | Résultats clés du rapport de sécurité du cloud 2024 Key Findings from the 2024 Cloud Security Report (lien direct) |
Découvrez comment les organisations utilisent le cloud, leurs défis de sécurité du cloud et d'autres informations du rapport de sécurité du cloud 2024
Learn how organizations are using the cloud, their cloud-security challenges, and other insights from the 2024 Cloud Security Report |
Studies Cloud | ★★★ | |
 |
2024-04-23 15:09:25 | Informations expertes: les méthodes de recrutement obsolètes entravent la cyber armée mondiale Expert Insight: Outdated Recruitment Methods Are Impeding The Global Cyber Army (lien direct) |
La cybersécurité est \\ 'inclusive \' par nature: personne n'est exempté des retombées du paysage cyber-menace en expansion.La notion, par conséquent, que certains groupes d'individus se voient offrir moins de possibilités de rejoindre le cyber industrie que d'autres sont franchement absurdes.La dernière étude de travail de cybersécurité d'Isc2 \\ nous donne un instantané à l'offre et à la demande de [& # 8230;]
Le post Insight expert: les méthodes de recrutement obsolètes entravent la cyber-armée mondiale Apparu pour la première fois sur gourou de la sécurité informatique .
Cybersecurity is \'inclusive\' by nature: no one is exempt from the fallout of the expanding cyber threat landscape. The notion, therefore, that some groups of individuals are offered fewer opportunities to join the cyber industry than others is frankly absurd. ISC2\'s latest Cybersecurity Workforce Study gives us a snapshot into the supply and demand of […] The post Expert Insight: Outdated Recruitment Methods Are Impeding The Global Cyber Army first appeared on IT Security Guru. |
Threat Studies | ★★★ | |
 |
2024-04-22 22:02:33 | La menace croissante des bots malveillants : rapport Imperva Bad Bot 2024 (lien direct) | Le paysage numérique mondial est de plus en plus façonné par une force invisible mais omniprésente : les bots. Une étude dévoile des résultats alarmants sur le trafic automatisé des bots sur internet. | Studies | ★★★ | |
 |
2024-04-19 20:15:33 | FBI: Akira Ransomware Group a fait 42 millions de dollars sur plus de 250 orgs FBI: Akira Ransomware Group Made $42 Million From 250+ Orgs (lien direct) |
The Akira ransomware group has breached the networks of over 250 organizations and claimed approximately $42 million (USD) in ransomware proceeds, according to a recent joint cybersecurity advisory issued by the United States Federal Bureau of Investigation (FBI), Cybersecurity and Infrastructure Security Agency (CISA), Europol\'s European Cybercrime Centre (EC3), and the Netherlands\' National Cyber Security Centre (NCSC-NL). According to FBI investigations, Akira ransomware has targeted a wide range of businesses and critical infrastructure entities across North America, Europe, and Australia since March 2023. While the ransomware initially targeted Windows systems, the FBI recently found Akira\'s Linux variant targeting VMware ESXi virtual machines that are used widely across many large businesses and organizations. ? #StopRansomare: Review our ? #cybersecurity advisory, outlining known #AkiraRansomware #TTPs & #IOCs, developed with @FBI, @EC3Europol, & @NCSC_NL to reduce the exploitation of businesses and critical infrastructure. https://t.co/2VBMKhoAXK pic.twitter.com/Nn0fEK4HRw — CISA Cyber (@CISACyber) April 18, 2024 “Early versions of the Akira ransomware variant were written in C++ and encrypted files with a .akira extension; however, beginning in August 2023, some Akira attacks began deploying Megazord, using Rust-based code which encrypts files with a .powerranges extension. Akira threat actors have continued to use both Megazord and Akira, including Akira_v2 (identified by trusted third party investigations) interchangeably,” the joint cybersecurity advisory reads. The FBI and cybersecurity researchers have observed Akira threat actors obtaining initial access to organizations through a virtual private network (VPN) service without multifactor authentication (MFA) configured, mostly using known Cisco vulnerabilities CVE-2020-3259 and CVE-2023-20269. Additional methods of initial access include the use of external-facing services such as Remote Desktop Protocol (RDP), spear phishing attacks, and credential abuse. Once initial access is obtained, Akira threat actors attempt to exploit the functions of domain controllers by creating new domain accounts to establish persis | Ransomware Vulnerability Threat Studies | ★★★ | |
|
2024-04-18 16:26:44 | Étude de Kaspersky: les appareils infectés par des logiciels malveillants de vol de données ont augmenté de 7 fois depuis 2020 Kaspersky Study: Devices Infected With Data-Stealing Malware Increased by 7 Times Since 2020 (lien direct) |
Près de 10 millions de dispositifs ont été infectés par des logiciels malveillants de vol de données en 2023, les criminels volant en moyenne 50,9 informations d'identification par appareil.
Nearly 10 million devices were infected with data-stealing malware in 2023, with criminals stealing an average of 50.9 credentials per device. |
Malware Studies | ★★★ | |
 |
2024-04-18 13:00:09 | 2024 Rapport de sécurité: édition de podcast 2024 Security Report: Podcast Edition (lien direct) |
> Une fois par an, Check Point publie un rapport annuel examinant les plus grands événements et tendances de la cybersécurité.Dans cet épisode, nous décomposons la dernière itération, en nous concentrant sur ses parties les plus importantes, pour vous rattraper ce que vous devez savoir en 2024.
>Once every year, Check Point releases an annual report reviewing the biggest events and trends in cybersecurity. In this episode we’ll break down the latest iteration, focusing on its most important parts, to catch you up on what you need to know most in 2024. |
Studies | ★★★★ | |
 |
2024-04-18 09:53:59 | The Windows Registry Adventure # 1: Résultats d'introduction et de recherche The Windows Registry Adventure #1: Introduction and research results (lien direct) |
Posted by Mateusz Jurczyk, Google Project Zero In the 20-month period between May 2022 and December 2023, I thoroughly audited the Windows Registry in search of local privilege escalation bugs. It all started unexpectedly: I was in the process of developing a coverage-based Windows kernel fuzzer based on the Bochs x86 emulator (one of my favorite tools for security research: see Bochspwn, Bochspwn Reloaded, and my earlier font fuzzing infrastructure), and needed some binary formats to test it on. My first pick were PE files: they are very popular in the Windows environment, which makes it easy to create an initial corpus of input samples, and a basic fuzzing harness is equally easy to develop with just a single GetFileVersionInfoSizeW API call. The test was successful: even though I had previously fuzzed PE files in 2019, the new element of code coverage guidance allowed me to discover a completely new bug: issue #2281. For my next target, I chose the Windows registry. That\'s because arbitrary registry hives can be loaded from disk without any special privileges via the RegLoadAppKey API (since Windows Vista). The hives use a binary format and are fully parsed in the kernel, making them a noteworthy local attack surface. Furthermore, I was also somewhat familiar with basic harnessing of the registry, having fuzzed it in 2016 together with James Forshaw. Once again, the code coverage support proved useful, leading to the discovery of issue #2299. But when I started to perform a root cause analysis of the bug, I realized that: The hive binary format is not very well suited for trivial bitflipping-style fuzzing, because it is structurally simple, and random mutations are much more likely to render (parts of) the hive unusable than to trigger any interesting memory safety violations.On the other hand, the registry has many properties that make it an attractive attack | Tool Vulnerability Threat Studies | ★★★★ | |
|
2024-04-17 18:00:31 | Réduire le désabonnement d'incitation avec une composition de modèle explosive Reducing Prompting Churn with Exploding Template Composition (lien direct) |
Engineering Insights is an ongoing blog series that gives a behind-the-scenes look into the technical challenges, lessons and advances that help our customers protect people and defend data every day. Each post is a firsthand account by one of our engineers about the process that led up to a Proofpoint innovation. In the nascent world of large language models (LLMs), prompt engineering has emerged as a critical discipline. However, as LLM applications expand, it is becoming a more complex challenge to manage and maintain a library of related prompts. At Proofpoint, we developed Exploding Prompts to manage the complexity through exploding template composition. We first created the prompts to generate soft labels for our data across a multitude of models and labeling concerns. But Exploding Prompts has also enabled use cases for LLMs that were previously locked away because managing the prompt lifecycle is so complex. Recently, we\'ve seen exciting progress in the field of automated prompt generation and black-box prompt optimization through DSPy. Black-box optimization requires hand-labeled data to generate prompts automatically-a luxury that\'s not always an option. You can use Exploding Prompts to generate labels for unlabeled data, as well as for any prompt-tuning application without a clear (or tractable) objective for optimization. In the future, Exploding Prompts could be used with DSPy to achieve a human-in-the-loop feedback cycle. We are also thrilled to announce that Exploding Prompts is now an open-source release. We encourage you to explore the code and consider how you might help make it even better. The challenge: managing complexity in prompt engineering Prompt engineering is not just about crafting queries that guide intelligent systems to generate the desired outputs; it\'s about doing it at scale. As developers push the boundaries of what is possible with LLMs, the need to manage a vast array of prompts efficiently becomes more pressing. Traditional methods often need manual adjustments and updates across numerous templates, which is a process that\'s both time-consuming and error-prone. To understand this problem, just consider the following scenario. You need to label a large quantity of data. You have multiple labels that can apply to each piece of data. And each label requires its own prompt template. You timebox your work and find a prompt template that achieves desirable results for your first label. Happily, most of the template is reusable. So, for the next label, you copy-paste the template and change the portion of the prompt that is specific to the label itself. You continue doing this until you figure out the section of the template that has persisted through each version of your labels can be improved. Now you now face the task of iterating through potentially dozens of templates to make a minor update to each of the files. Once you finish, your artificial intelligence (AI) provider releases a new model that outperforms your current model. But there\'s a catch. The new model requires another small update to each of your templates. To your chagrin, the task of managing the lifecycle of your templates soon takes up most of your time. The solution: exploding prompts from automated dependency graphs Prompt templating is a popular way to manage complexity. Exploding Prompts builds on prompt templating by introducing an “explode” operation. This allows a few single-purpose templates to explode into a multitude of prompts. This is accomplished by building dependency graphs automatically from the directory structure and the content of prompt template files. At its core, Exploding Prompts embodies the “write it once” philosophy. It ensures that every change made in a template correlates with a single update in one file. This enhances efficiency and consistency, as updates automatically propagate across all relevant generated prompts. This separation ensures that updates can be made with speed and efficiency so you can focus on innovation rather th | Malware Tool Threat Studies Cloud Technical | ★★★ | |
|
2024-04-17 08:30:00 | Les menaces d'initié augmentent 14% par an en tant que piqûres de crise du coût de la vie Insider Threats Surge 14% Annually as Cost-of-Living Crisis Bites (lien direct) |
CIFAS révèle une augmentation de 14% des employés malhonnêtes, principalement motivés par la nécessité financière l'année dernière
Cifas reveals 14% rise in dishonest employees, driven mainly by financial necessity last year |
Studies | ★★★ | |
|
2024-04-17 08:21:29 | Tendances mondiales de la cybersécurité au 1er trimestre 2024 : les cyberattaques en hausse de 28 % dans le monde (lien direct) | Tendances mondiales de la cybersécurité au 1er trimestre 2024 : les cyberattaques en hausse de 28 % dans le monde Une recrudescence des cyberattaques : au premier trimestre 2024, le nombre moyen de cyberattaques par entreprise a augmenté de 28 % par rapport à fin 2023, avec toutefois une hausse de 5 % au premier trimestre en glissement annuel La priorité aux attaques de l'industrie : les fabricants de matériel informatique ont vu une augmentation substantielle de 37 % des cyberattaques par rapport à l'année précédente, mais les secteurs de l'éducation/recherche, du gouvernement/militaire et de la santé restent les secteurs les plus attaqués au 1er trimestre 2024 Des variations régionales contrastées : la région de l'Afrique a enregistré une hausse notable de 20 % des cyberattaques contrairement à l'Amérique latine, qui a de son côté fait état d'une baisse de 20 % par rapport à l'année précédente Les ransomwares continuent de faire des ravages : en Europe, les attaques de ransomware ont augmenté de 64 % par rapport à l'année précédente, suivies par l'Afrique avec une hausse de 18 % même si l'Amérique du Nord reste la région la plus touchée, avec 59 % des près de 1 000 attaques de ransomware enregistrées sur des " shame sites " du ransomware - Malwares | Ransomware Studies | ★★★ | |
|
2024-04-16 10:00:00 | Facteur humain de la cybersécurité: fusion de la technologie avec des stratégies centrées sur les personnes Cybersecurity\\'s Human Factor: Merging Tech with People-Centric Strategies (lien direct) |
The content of this post is solely the responsibility of the author. AT&T does not adopt or endorse any of the views, positions, or information provided by the author in this article. In a digital era marked by rapidly evolving threats, the complexity of cybersecurity challenges has surged, pressing organizations to evolve beyond traditional, tech-only defense strategies. As the cyber landscape grows more intricate, there\'s a pivotal shift towards embracing methods that are not just robust from a technical standpoint but are also deeply human-centric. This also means that a significant percentage of employees, driven by the high demands of operational pressures, may engage in risky cybersecurity behaviors. Such statistics illuminate the urgent need for a more nuanced approach to cybersecurity—one that not only fortifies defenses but also resonates with and supports the people behind the screens. Integrating human-centric design with continuous threat management emerges as a forward-thinking strategy, promising a balanced blend of technical excellence and user empathy to navigate the complex cybersecurity challenges of today and tomorrow. Embracing the Human Element in Cybersecurity Diving into the realm of human-centric security design and culture, it\'s clear that the future of cybersecurity isn\'t just about the latest technology—it\'s equally about the human touch. This approach puts the spotlight firmly on enhancing the employee experience, ensuring that cybersecurity measures don\'t become an unbearable burden that drives people to take shortcuts. By designing systems that people can use easily and effectively, the friction often caused by stringent security protocols can be significantly reduced. Gartner\'s insights throw a compelling light on this shift, predicting that by 2027, half of all Chief Information Security Officers (CISOs) will have formally embraced human-centric security practices. This isn\'t just a hopeful guess but a recognition of the tangible benefits these practices bring to the table—reducing operational friction and bolstering the adoption of essential controls. This strategic pivot also acknowledges a fundamental truth. When security becomes a seamless part of the workflow, its effectiveness skyrockets. It\'s a win-win, improving both the user experience and the overall security posture. CTEM: Your Cybersecurity Compass in Stormy Seas Imagine that your organization\'s cybersecurity landscape isn\'t just a static battleground. Instead, it’s more like the open sea, with waves of threats coming and going, each with the potential to breach your defenses. That\'s where Continuous Threat Exposure Management (CTEM) sails in, serving as your trusted compass, guiding you through these treacherous waters. CTEM isn\'t your average, run-of-the-mill security tactic. It\'s about being proactive, scanning the horizon with a spyglass, looking for potential vulnerabilities before they even become a blip on a hacker\'s radar. Think of it as your cybersecurity early-warning system, constantly on the lookout for trou | Vulnerability Threat Studies Prediction Medical Technical | ★★ | |
|
2024-04-12 15:44:26 | Étude Sophos: 94% des victimes de ransomwares ont leurs sauvegardes ciblées par les attaquants Sophos Study: 94% of Ransomware Victims Have Their Backups Targeted By Attackers (lien direct) |
La recherche a révélé que les criminels peuvent exiger une rançon plus élevée lorsqu'ils compromettent les données de sauvegarde d'une organisation dans une attaque de ransomware.Découvrez les conseils d'experts en sécurité sur la façon de protéger correctement votre sauvegarde.
Research has found that criminals can demand higher ransom when they compromise an organisation\'s backup data in a ransomware attack. Discover advice from security experts on how to properly protect your backup. |
Ransomware Studies | ★★★ |
To see everything:
Our RSS (filtrered)
