This is the RSS 2.0 feed from www.secnews.physaphae.fr. IT's a simple agragated flow of multiple articles soruces. Liste of sources, can be found on www.secnews.physaphae.fr. 2024-05-23T03:43:31+00:00 www.secnews.physaphae.fr CVE Liste - Common Vulnerability Exposure user_oidc provides the OIDC connect user backend for Nextcloud, an open-source cloud platform. Starting in version 1.0.0 and prior to version 1.3.3, missing verification of the issuer would have allowed an attacker to perform a man-in-the-middle attack returning corrupted or known token they also have access to. user_oidc 1.3.3 contains a patch. No known workarounds are available.]]> 2023-08-10T14:15:15+00:00 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-39953 www.secnews.physaphae.fr/article.php?IdArticle=8368485 False Cloud None None Palo Alto Network - Site Constructeur Palo Alto Networks et Deloitte ont une nouvelle offre SSDL pour renforcer les environnements cloud des clients avec des mesures de sécurité améliorées du code au cloud.

---

>Palo Alto Networks and Deloitte have a new SSDL offering to reinforce customers\' cloud environments with enhanced security measures from code to cloud. ]]> 2023-08-10T13:00:20+00:00 https://www.paloaltonetworks.com/blog/2023/08/deloitte-safeguards-software-development-lifecycle/ www.secnews.physaphae.fr/article.php?IdArticle=8368353 False Cloud Deloitte 2.0000000000000000 AlienVault Lab Blog - AlienVault est un acteur de defense majeur dans les IOC SentinelOne in 2021 and Microsoft in 2022. As stated in Microsoft’s report on UpdateAgent, a malware delivering AdLoad through drive-by compromise, AdLoad redirected users’ traffic through the adware operators’ servers, injecting advertisements and promotions into webpages and search results with a Person-in-The-Middle (PiTM) attack. These two previous campaigns, together with the campaign described in this blog, support the theory that AdLoad could be running a pay-per-Install campaign in the infected systems. The main purpose of the malware has always been to act as a downloader for subsequent payloads. It has been identified delivering a wide range of payloads (adware, bundleware, PiTM, backdoors, proxy applications, etc.) every few months to a year, sometimes conveying different payloads depending on the system settings such as geolocation, device make and model, operating system version, or language settings, as reported by SentinelOne. In all observed samples, regardless of payload, they report an Adload server during execution on the victim’s system. This beacon (analyzed later in Figure 3 & 4) includes system information in the user agent and the body, without any relevant response aside from a 200 HTTP response code. This activity probably represents AdLoad\'s method of keeping count of the number of infected systems, supporting the pay-per-Install scheme. AT&T Alien Labs™ has observed similar activity in our threat analysis systems throughout the last year, with the AdLoad malware being installed in the infected systems. However, Alien Labs is now observing a previously unreported payload being delivered to the victims. The payload corresponds to a proxy application, converting its targets into proxy exit nodes after infection. As seen in Figure 1, the threat actors behind this campaign have been very active since the beginning of 2022. Figure 1. Histogram of AdLoad samples identified by Alien Labs. The vast numb]]> 2023-08-10T10:00:00+00:00 https://cybersecurity.att.com/blogs/labs-research/mac-systems-turned-into-proxy-exit-nodes-by-adload www.secnews.physaphae.fr/article.php?IdArticle=8368296 False Threat,Spam,Malware,Cloud APT 32 2.0000000000000000 Dark Reading - Informationweek Branch 2023-08-09T21:33:00+00:00 https://www.darkreading.com/cloud/sweet-security-lands-12m-in-seed-funding-to-shift-cloud-security-right www.secnews.physaphae.fr/article.php?IdArticle=8368093 False Cloud None 1.00000000000000000000 Global Security Mag - Site de news francais rapports spéciaux

---

Schools are at a Greater Risk for Cyber Attacks Than Ever Before – New K-12 Cybersecurity Report Report from Leading Zero Trust Edge Cloud Security Company iboss and education nonprofit Project Tomorrow Reveals Lack of Collaboration in Schools is Contributing to Increased Cyber Risk. More than 84% of District Leaders and Administrators Agree That K-12 Schools are at a Higher Risk for Cyber Attacks than Ever Before. - Special Reports]]> 2023-08-09T19:26:08+00:00 https://www.globalsecuritymag.fr/Schools-are-at-a-Greater-Risk-for-Cyber-Attacks-Than-Ever-Before-New-K-12.html www.secnews.physaphae.fr/article.php?IdArticle=8368014 False Cloud None 2.0000000000000000 CVE Liste - Common Vulnerability Exposure Sentry is an error tracking and performance monitoring platform. Starting in version 10.0.0 and prior to version 23.7.2, an attacker with sufficient client-side exploits could retrieve a valid access token for another user during the OAuth token exchange due to incorrect credential validation. The client ID must be known and the API application must have already been authorized on the targeted user account. Sentry SaaS customers do not need to take any action. Self-hosted installations should upgrade to version 23.7.2 or higher. There are no direct workarounds, but users should review applications authorized on their account and remove any that are no longer needed.]]> 2023-08-09T17:15:09+00:00 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-39531 www.secnews.physaphae.fr/article.php?IdArticle=8367995 False Cloud None None Dark Reading - Informationweek Branch Existing detection tools either provide limited functionality or aren\'t optimized for the cloud, Israeli startup claims.]]> 2023-08-09T16:26:00+00:00 https://www.darkreading.com/cloud/sweet-security-debuts-runtime-management-for-cloud www.secnews.physaphae.fr/article.php?IdArticle=8367962 False Cloud,Tool None 2.0000000000000000 CybeReason - Vendor blog ]]> 2023-08-09T13:00:00+00:00 https://www.cybereason.com/blog/extend-cloud-detection-and-response-with-sysdig-and-cybereason www.secnews.physaphae.fr/article.php?IdArticle=8367905 False Cloud None 2.0000000000000000 Dark Reading - Informationweek Branch Protecting the spaces where private, public, and hybrid clouds meet users\' technologies requires a cloud-centric approach.]]> 2023-08-09T12:45:00+00:00 https://www.darkreading.com/microsoft/closing-coverage-gaps-where-customer-resources-meet-cloud-environments www.secnews.physaphae.fr/article.php?IdArticle=8367866 False Cloud None 2.0000000000000000 Global Security Mag - Site de news francais Business]]> 2023-08-09T07:48:15+00:00 https://www.globalsecuritymag.fr/Rubrik-acquiert-Laminar.html www.secnews.physaphae.fr/article.php?IdArticle=8367756 False Cloud None 2.0000000000000000 CVE Liste - Common Vulnerability Exposure "FFRI yarai", "FFRI yarai Home and Business Edition" and their OEM products handle exceptional conditions improperly, which may lead to denial-of-service (DoS) condition. Affected products and versions are as follows: FFRI yarai versions 3.4.0 to 3.4.6 and 3.5.0, FFRI yarai Home and Business Edition version 1.4.0, InfoTrace Mark II Malware Protection (Mark II Zerona) versions 3.0.1 to 3.2.2, Zerona / Zerona PLUS versions 3.2.32 to 3.2.36, ActSecure ? versions 3.4.0 to 3.4.6 and 3.5.0, Dual Safe Powered by FFRI yarai version 1.4.1, EDR Plus Pack (Bundled FFRI yarai versions 3.4.0 to 3.4.6 and 3.5.0), and EDR Plus Pack Cloud (Bundled FFRI yarai versions 3.4.0 to 3.4.6 and 3.5.0).]]> 2023-08-09T03:15:43+00:00 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-39341 www.secnews.physaphae.fr/article.php?IdArticle=8367723 False Malware,Cloud None None Vuln GCP - FLux Vuln GoogleCloudPlatform 2023-08-09T00:33:56+00:00 https://cloud.google.com/support/bulletins/index#gcp-2023-025 www.secnews.physaphae.fr/article.php?IdArticle=8367788 False Cloud None 1.00000000000000000000 The State of Security - Magazine Américain All segments of the cloud market are predicted to see growth in 2023, according to research by Gartner. In an April Press Release, the firm forecasts that global spending on public cloud services will exceed 21% this year, totaling $597.3 billion overall in 2023. This is up over $100 billion from last year\'s (mere) $491 billion. “Organizations today view cloud as a highly strategic platform for digital transformation, which is requiring cloud providers to offer more sophisticated capabilities as the competition for digital services heats up,” notes Sid Nag, Vice President Analyst at Gartner...]]> 2023-08-09T00:19:18+00:00 https://www.tripwire.com/state-of-security/top-vendor-neutral-cloud-security-certifications www.secnews.physaphae.fr/article.php?IdArticle=8367775 False Cloud None 3.0000000000000000 Dark Reading - Informationweek Branch 2023-08-08T21:30:00+00:00 https://www.darkreading.com/operations/brillio-partners-with-google-cloud-to-build-generative-ai-solutions-for-the-financial-services-and-healthcare-industries www.secnews.physaphae.fr/article.php?IdArticle=8367590 False Cloud None 2.0000000000000000 Netskope - etskope est une société de logiciels américaine fournissant une plate-forme de sécurité informatique Netskope Threat Labs publie un article de blog de résumé mensuel des principales menaces que nous suivons sur la plate-forme Netskope.Le but de cet article est de fournir des renseignements stratégiques et exploitables sur les menaces actives contre les utilisateurs d'entreprise du monde entier.Les attaquants récapitulatifs continuent de tenter de voler sous le radar en utilisant des applications cloud pour fournir des logiciels malveillants, [& # 8230;]

---

>Netskope Threat Labs publishes a monthly summary blog post of the top threats we are tracking on the Netskope platform. The purpose of this post is to provide strategic, actionable intelligence on active threats against enterprise users worldwide. Summary Attackers continue to attempt to fly under the radar by using cloud apps to deliver malware, […] ]]> 2023-08-08T18:33:07+00:00 https://www.netskope.com/blog/netskope-threat-labs-stats-for-july-2023 www.secnews.physaphae.fr/article.php?IdArticle=8367419 False Threat,Cloud None 3.0000000000000000 CVE Liste - Common Vulnerability Exposure Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability]]> 2023-08-08T18:15:16+00:00 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-36904 www.secnews.physaphae.fr/article.php?IdArticle=8367534 False Cloud,Vulnerability None None Vuln GCP - FLux Vuln GoogleCloudPlatform Intel Security Advisory Intel-SA-00828 . High CVE-2022-40982

---

Published: 2023-08-08Description Description Severity Notes Intel disclosed a vulnerability in select processors (CVE-2022-40982). Google has taken steps to mitigate its server fleet, including Google Cloud, to ensure customers are protected. The vulnerability details: CVE-2022-40982 (Intel IPU 2023.3, "GDS" aka "Downfall") What should I do?No customer action is required. All available patches have already been applied to the Google server fleet for Google Cloud, including Google Compute Engine. At this time, the following products require additional updates from partners and vendors. Google Cloud VMware Engine Google Distributed Cloud Hosted Google Distributed Cloud Edge Google Cloud Bare Metal Solution Evolved Packet Core Google will remediate these products once these patches have been made available, and this bulletin will be updated accordingly. Google Chromebook and ChromeOS Flex customers automatically received the Intel provided mitigations in Stable (115), Beta (116), and LTC (114). Chromebook and ChromeOS Flex customers pinned to an older release should consider unpinning and moving to Stable or LTS releases to ensure they receive this and other vulnerability fixes. What vulnerabilities are being addressed? CVE-2022-40982 - For more information, see Intel Security Advisory INTEL-SA-00828. High CVE-2022-409]]> 2023-08-08T16:41:49+00:00 https://cloud.google.com/support/bulletins/index#gcp-2023-024 www.secnews.physaphae.fr/article.php?IdArticle=8367404 False Cloud,Vulnerability None 1.00000000000000000000 GoogleSec - Firm Security Blog Downfall and Zenbleed, two new security vulnerabilities (one of which was disclosed today) that prior to mitigation had the potential to affect billions of personal and cloud computers, signifying the importance of vulnerability research and cross-industry collaboration. Had these vulnerabilities not been discovered by Google researchers, and instead by adversaries, they would have enabled attackers to compromise Internet users. For both vulnerabilities, Google worked closely with our partners in the industry to develop fixes, deploy mitigations and gather details to share widely and better secure the ecosystem.What are Downfall and Zenbleed?Downfall (CVE-2022-40982) and Zenbleed (CVE-2023-20593) are two different vulnerabilities affecting CPUs - Intel Core (6th - 11th generation) and AMD Zen2, respectively. They allow an attacker to violate the software-hardware boundary established in modern processors. This could allow an attacker to access data in internal hardware registers that hold information belonging to other users of the system (both across different virtual machines and different processes). These vulnerabilities arise from complex optimizations in modern CPUs tha]]> 2023-08-08T13:33:00+00:00 http://security.googleblog.com/2023/08/downfall-and-zenbleed-googlers-helping.html www.secnews.physaphae.fr/article.php?IdArticle=8367398 False Cloud,Prediction,Vulnerability None 2.0000000000000000 Dragos - CTI Society Pour les organisations industrielles en électricité, en pétrole et en gaz et en fabrication, les services cloud et les migrations ont le potentiel de débloquer de nouveaux ... Le post dragos, un partenaire AWS, annonce la disponibilité de la plate-forme dragos dans AWSMarketplace pour sécuriser et gérer les systèmes de contrôle industriel (ICS) Cyber Risk est apparu pour la première fois sur dragos .

---

>For industrial organizations in electric, oil and gas, and manufacturing, cloud services and migrations have the potential to unlock new... The post Dragos, an AWS Partner, Announces the Availability of the Dragos Platform in AWS Marketplace to Secure and Manage Industrial Control Systems (ICS) Cyber Risk first appeared on Dragos.]]> 2023-08-08T12:00:00+00:00 https://www.dragos.com/blog/dragos-platform-now-available-in-aws-marketplace/ www.secnews.physaphae.fr/article.php?IdArticle=8367192 False Cloud,Industrial None 3.0000000000000000 Global Security Mag - Site de news francais Investigations]]> 2023-08-08T09:06:35+00:00 https://www.globalsecuritymag.fr/10-minutes-suffisent-pour-lancer-une-cyberattaque-selon-Sysdig.html www.secnews.physaphae.fr/article.php?IdArticle=8367150 False Threat,Cloud None 2.0000000000000000 CVE Liste - Common Vulnerability Exposure In PHOENIX CONTACTs TC ROUTER and TC CLOUD CLIENT in versions prior to 2.07.2 as well as CLOUD CLIENT 1101T-TX/TX prior to 2.06.10 an unauthenticated remote attacker could use a reflective XSS within the license viewer page of the devices in order to execute code in the context of the user\'s browser.]]> 2023-08-08T07:15:10+00:00 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-3526 www.secnews.physaphae.fr/article.php?IdArticle=8367165 False Cloud None None CVE Liste - Common Vulnerability Exposure In PHOENIX CONTACTs TC ROUTER and TC CLOUD CLIENT in versions prior to 2.07.2 as well as CLOUD CLIENT 1101T-TX/TX prior to 2.06.10 an authenticated remote attacker with admin privileges could upload a crafted XML file which causes a denial-of-service.]]> 2023-08-08T07:15:10+00:00 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-3569 www.secnews.physaphae.fr/article.php?IdArticle=8367166 False Cloud None None CVE Liste - Common Vulnerability Exposure SAP Commerce Cloud may accept an empty passphrase for user ID and passphrase authentication, allowing users to log into the system without a passphrase.]]> 2023-08-08T01:15:19+00:00 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-39439 www.secnews.physaphae.fr/article.php?IdArticle=8367087 False Cloud None None CVE Liste - Common Vulnerability Exposure Cryptomator encrypts data being stored on cloud infrastructure. The MSI installer provided on the homepage for Cryptomator version 1.9.2 allows local privilege escalation for low privileged users, via the `repair` function. The problem occurs as the repair function of the MSI is spawning an SYSTEM Powershell without the `-NoProfile` parameter. Therefore the profile of the user starting the repair will be loaded. Version 1.9.3 contains a fix for this issue. Adding a `-NoProfile` to the powershell is a possible workaround.]]> 2023-08-07T20:15:09+00:00 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-39520 www.secnews.physaphae.fr/article.php?IdArticle=8366973 False Cloud None None AlienVault Lab Blog - AlienVault est un acteur de defense majeur dans les IOC As we go about our daily lives, whether that be shopping with the family, enjoying dinner at a restaurant, finding our gate at the airport, or even watching TV, we find ourselves more and more often encountering the QR code. These black-and-white checkerboards of sorts have gained a reputation for being a fast and convenient way of obtaining information via our smartphones while at the same time contributing to environmental conservation, as they allow businesses such as retailers and restaurants to print fewer paper menus or flyers. But before you whip out that phone and activate your camera, you should be aware that these seemingly innocuous QR codes can also be used for purposes you aren’t anticipating. Adversaries can also abuse them to steal your money, identity, or other data.  In fact, the term in the cybersecurity industry for attacks that leverage QR codes as a means of delivery is “quishing.” Although this may sound cute, the intentions behind these intrusions are, in reality, quite sinister. A brief history of the QR code While it may seem like we have only been interacting with QR codes over the past several years, they were in fact invented almost 30 years ago in 1994 by a Japanese company called Denso Wave, a subsidiary of Toyota Motor Corporation, for the purposes of tracking automotive parts in the assembly process. QR stands for “quick response” and is a sophisticated type of bar code that utilizes a square pattern containing even smaller black and white squares that represent numbers, letters, or even non-Latin scripts which can be scanned into a computer system. Have you ever noticed that there are larger black and white squares in just three of the corners of a QR code? Their purpose is to allow a scanning device to determine the code’s orientation, regardless of how it may be turned. The use of QR codes has expanded considerably since 1994. They have become a favored means for businesses to circulate marketing collateral or route prospects to web forms, and other even more creative uses have also been cultivated. Instead of printing resource-consuming user manuals, manufacturers may direct their consumers to web-hosted versions that can be reached by scanning codes printed on the packaging materials. Event venues print QR codes on tickets that can be scanned upon entry to verify validity, and museums post signs next to exhibits with QR codes for visitors to obtain more information. During the COVID-19 pandemic, the use of QR codes accelerated as organizations sought to create contactless methods of doing business. The dangers that lie beneath QR codes don’t appear to be going away anytime soon. The speed, and versatility they offer is hard to deny. However, any hacker worth their salt understands that the most effective attacks leverage social engineering to prey upon human assumptions or habits. We’ve become accustomed to scanning QR codes to quickly transact or to satisfy our sense of curiosity, but this convenience can come at a cost. There are several websites that make it incredibly simple and low cost (or free) for cybercriminals to generate QR codes, which they can use to do any of the following: Open a spoofed web page – Upon scanning the QR code, your browser will open a fake web page that appears to be a legitimate business, such as a bank or e-commerce site, where you are requested to provide login credentials or payment data, also known as a phishing attack. It is also possible that this site contains links to malware. Recommend an unscrupulous app – You will be directed to a particular app on the Apple App or Google Play Store and given the option to download the app to your mobile device. These apps can contain malware that installs additi]]> 2023-08-07T10:00:00+00:00 https://cybersecurity.att.com/blogs/security-essentials/what-may-be-lurking-behind-that-qr-code www.secnews.physaphae.fr/article.php?IdArticle=8366831 False Threat,Spam,Malware,Cloud None 3.0000000000000000 Recorded Future - FLux Recorded Future Microsoft a résolu une vulnérabilité qui permet aux acteurs de menace d'accéder aux informations gérées par Azure AD, une offre cloud utilisée par les grandes entreprises pour gérer l'authentification des utilisateurs.Les préoccupations concernant la question ont fait irruption dans le public cette semaine quand Amit Yoran, PDG de la société de cybersécurité Tenable, a publié un post linkedin cinglant

---

Microsoft has resolved a vulnerability that allows threat actors to gain access to information managed by Azure AD, a cloud offering used by large companies for managing user authentication. Concerns about the issue burst into public view this week when Amit Yoran, the CEO of cybersecurity firm Tenable, published a scathing LinkedIn post bashing the]]> 2023-08-04T22:00:00+00:00 https://therecord.media/microsoft-resolves-vulnerability-following-criticism www.secnews.physaphae.fr/article.php?IdArticle=8365861 False Threat,Cloud,Vulnerability None 4.0000000000000000 Dark Reading - Informationweek Branch 2023-08-04T20:48:00+00:00 https://www.darkreading.com/cloud/cloud-security-market-worth-62-9b-by-2028 www.secnews.physaphae.fr/article.php?IdArticle=8365845 False Cloud None 2.0000000000000000 CVE Liste - Common Vulnerability Exposure CloudExplorer Lite is an open source, lightweight cloud management platform. Versions prior to 1.3.1 contain a command injection vulnerability in the installation function in module management. The vulnerability has been fixed in v1.3.1. There are no known workarounds aside from upgrading.]]> 2023-08-04T18:15:14+00:00 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-38692 www.secnews.physaphae.fr/article.php?IdArticle=8365831 False Cloud,Vulnerability None None Netskope - etskope est une société de logiciels américaine fournissant une plate-forme de sécurité informatique Les acteurs de la menace parrainés par l'État continuent d'exploiter les services cloud légitimes, et en particulier un groupe, l'APT29 russe (également connu sous le nom de confortable ours, Ursa masqué, Bluebravo, Midnight Blizzard et anciennement Nobelium), semble particulièrement actif.Entre mars et mai 2023, les chercheurs en sécurité du groupe INSIKT de Future \\ ont déniché une campagne de cyber-espionnage par la même [& # 8230;]

---

>State-sponsored threat actors continue to exploit legitimate cloud services, and especially one group, the Russian APT29 (also known as Cozy Bear, Cloaked Ursa, BlueBravo, Midnight Blizzard, and formerly Nobelium), seems to be particularly active. Between March and May 2023, security researchers at Recorded Future\'s Insikt Group have unearthed a cyber espionage campaign by the same […] ]]> 2023-08-04T16:48:11+00:00 https://www.netskope.com/blog/cloud-threats-memo-russian-state-sponsored-threat-actors-increasingly-exploiting-legitimate-cloud-services www.secnews.physaphae.fr/article.php?IdArticle=8365743 False Threat,Cloud APT 29,APT 29 2.0000000000000000 CVE Liste - Common Vulnerability Exposure MeterSphere is an open-source continuous testing platform. Prior to version 2.10.4 LTS, some interfaces of the Cloud version of MeterSphere do not have configuration permissions, and are sensitively leaked by attackers. Version 2.10.4 LTS contains a patch for this issue.]]> 2023-08-04T16:15:10+00:00 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-38494 www.secnews.physaphae.fr/article.php?IdArticle=8365782 False Cloud None None Checkpoint - Fabricant Materiel Securite *** Ce contenu a été initialement publié sur Cloud Girls.Trisha Paine, responsable du marketing mondial de la sécurité du cloud chez Check Point Software, a été reconnu par Cloud Girls, en collaboration avec l'Alliance of Channel Women, en tant qu'étoile montante dans le huitième prix annuel des filles de cloud Rising «Women to Watch» annoncées en maide 2023. Le Cloud Girl Rising Awards a été créé pour honorer les femmes dans les télécommunications et informatiques qui ont montré le leadership et l'innovation dans l'espace cloud émergent ainsi que pour inspirer davantage de femmes à avancer et à suivre leur exemple.Trisha a été honorée en tant que trailblazer, une femme chevronnée [& # 8230;]

---

>***This content was originally published on Cloud Girls. Trisha Paine, Head of Global Marketing of Cloud Security at Check Point Software, was recognized by Cloud Girls, in collaboration with the Alliance of Channel Women, as a Rising Star in the eighth annual Cloud Girls Rising “Women to Watch” awards announced in May of 2023. The Cloud Girl Rising awards were created to honor women in the telecom and IT channel who have shown leadership and innovation in the emerging cloud space as well as to inspire more women to step forward and follow their example. Trisha was honored as a Trailblazer, a seasoned female […] ]]> 2023-08-04T14:00:25+00:00 https://blog.checkpoint.com/security/meet-cloud-girls-2023-trailblazer-trisha-paine/ www.secnews.physaphae.fr/article.php?IdArticle=8365691 False Cloud None 2.0000000000000000 The Register - Site journalistique Anglais Microsoft is moving Windows to the cloud and Apple will be happy to have you run macOS on the cloud Opinion  If you count Android and Chrome OS as Linux, which I do, the Linux desktop accounts for 44.98 percent of the end user market. But if your idea of the "Linux desktop" has a front end of Cinnamon, GNOME or KDE, then it\'s more like 3.06 percent. Better than it has been at times, but it\'s no "Year of the Linux desktop." Maybe, though, it will be someday.…]]> 2023-08-04T13:36:09+00:00 https://go.theregister.com/feed/www.theregister.com/2023/08/04/linux_desktop_cloud_desktops/ www.secnews.physaphae.fr/article.php?IdArticle=8365693 False Cloud None 2.0000000000000000 Bleeping Computer - Magazine Américain The Google Cloud security team acknowledged a common tactic known as versioning used by malicious actors to slip malware on Android devices after evading the Google Play Store\'s review process and security controls. [...]]]> 2023-08-04T13:04:02+00:00 https://www.bleepingcomputer.com/news/security/google-explains-how-android-malware-slips-onto-google-play-store/ www.secnews.physaphae.fr/article.php?IdArticle=8365745 False Malware,Cloud None 2.0000000000000000 InfoSecurity Mag - InfoSecurity Magazine Google Cloud figures also point to misconfiguration]]> 2023-08-04T09:30:00+00:00 https://www.infosecurity-magazine.com/news/credentials-account-half-of-cloud/ www.secnews.physaphae.fr/article.php?IdArticle=8365628 False Cloud None 4.0000000000000000 CVE Liste - Common Vulnerability Exposure Fabasoft Cloud Enterprise Client 23.3.0.130 allows a user to escalate their privileges to local administrator.]]> 2023-08-03T18:15:11+00:00 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-32764 www.secnews.physaphae.fr/article.php?IdArticle=8365409 False Cloud None None CyberScoop - scoopnewsgroup.com special Cyber Des modèles de gros langues qui alimentent les chatbots IA émergents pourraient compliquer davantage la sécurité du cloud, les chercheurs avertissent

---

>Large language models that power emerging AI chatbots could further complicate cloud security, researchers warn. ]]> 2023-08-03T16:00:00+00:00 https://cyberscoop.com/google-cloud-hackers-cybersecurity/ www.secnews.physaphae.fr/article.php?IdArticle=8365284 False Cloud None 3.0000000000000000 Checkpoint - Fabricant Materiel Securite La sécurité du réseau cloud peut ne pas sembler très différente de la sécurité du réseau traditionnel & # 8211;Et ce n'est pas, du moins à certains égards.Les réseaux cloud utilisent les mêmes paradigmes et protocoles fondamentaux que les réseaux sur site, il y a donc un certain chevauchement entre la sécurité du réseau cloud et la sécurité des réseaux conventionnels.Selon les analystes de l'industrie, les pare-feu sont aussi fondamentaux dans le cloud que sur site, par exemple, comme le note Gartner, & # 8220; les pare-feu réseau restent les contrôles de sécurité du réseau clés & # 8220 ;.Mais si vous pensez que les solutions et les processus de sécurité des réseaux traditionnels que vous avez en place peuvent protéger vos réseaux cloud, détrompez-vous.Malgré certaines similitudes entre [& # 8230;]

---

>Cloud network security may not sound very different from traditional network security – and it’s not, at least in some respects. Cloud networks use the same fundamental paradigms and protocols as on-prem networks, so there is some overlap between cloud network security and conventional network security. According to industry analysts, firewalls are as foundational in the cloud as they are on-premises, for instance, as Gartner notes, “network firewalls remain key network security controls“. But if you think the traditional network security solutions and processes that you have in place can protect your cloud networks, think again. Despite some similarities between […] ]]> 2023-08-03T14:00:19+00:00 https://blog.checkpoint.com/securing-the-cloud/all-cisos-should-know-this-about-cloud-network-security/ www.secnews.physaphae.fr/article.php?IdArticle=8365246 False Cloud None 3.0000000000000000 Mandiant - Blog Sécu de Mandiant août 2023 Rapport des horizons de menace , Et notre

---

The Google Cloud Threat Horizons Report first launched in November 2021 with the ultimate goal of providing security decision-makers with strategic intelligence about threats to cloud enterprise users, along with data, metrics, trends, and additional cloud research. Perhaps most importantly, the report aimed to provide recommendations from Google\'s intelligence and security teams to help defenders protect against, detect, and respond to the latest cloud and other threats. Today marks the release of the seventh edition of our quarterly publication, August 2023 Threat Horizons Report, and our]]> 2023-08-03T11:30:00+00:00 https://www.mandiant.com/resources/blog/threat-horizons-report-august-2023 www.secnews.physaphae.fr/article.php?IdArticle=8377332 False Threat,Cloud None 3.0000000000000000 Korben - Bloger francais Suite]]> 2023-08-03T07:00:00+00:00 https://korben.info/immich-solution-sauvegarde-auto-hebergee-photos-videos.html www.secnews.physaphae.fr/article.php?IdArticle=8365107 False Cloud None 2.0000000000000000 Dark Reading - Informationweek Branch 2023-08-02T20:50:00+00:00 https://www.darkreading.com/cloud/solvo-unveils-securitygenie-a-revolutionary-chatgpt-like-solution-for-cloud-security-teams www.secnews.physaphae.fr/article.php?IdArticle=8364911 False Cloud ChatGPT 2.0000000000000000 Global Security Mag - Site de news francais Produits]]> 2023-08-02T20:24:06+00:00 https://www.globalsecuritymag.fr/VMware-Carbon-Black-lance-Cloud-Native-Detection-and-Response-CNDR.html www.secnews.physaphae.fr/article.php?IdArticle=8364917 False Threat,Cloud Uber 2.0000000000000000 Global Security Mag - Site de news francais nouvelles commerciales

---

ReliaQuest Advances Cybersecurity Capabilities for Global Enterprises through partnership with Google Cloud - Business News]]> 2023-08-02T16:02:44+00:00 https://www.globalsecuritymag.fr/ReliaQuest-Advances-Cybersecurity-Capabilities-for-Global-Enterprises-through.html www.secnews.physaphae.fr/article.php?IdArticle=8364805 False Cloud None 3.0000000000000000 InfoSecurity Mag - InfoSecurity Magazine Halcyon said that Cloudzy has been playing a pivotal role in facilitating cyber-criminal activities]]> 2023-08-02T15:30:00+00:00 https://www.infosecurity-magazine.com/news/cloudzy-suspected-support-apt/ www.secnews.physaphae.fr/article.php?IdArticle=8364804 False Cloud None 3.0000000000000000 CVE Liste - Common Vulnerability Exposure A XSS vulnerability exists in the Xiaomi cloud service Application product. The vulnerability is caused by Webview\'s whitelist checking function allowing javascript protocol to be loaded and can be exploited by attackers to steal Xiaomi cloud service account\'s cookies.]]> 2023-08-02T14:15:10+00:00 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-26316 www.secnews.physaphae.fr/article.php?IdArticle=8364831 False Cloud,Vulnerability None None Recorded Future - FLux Recorded Future Une entreprise technologique iranienne fournit des services d'infrastructure aux gangs de ransomware et à une gamme de pirates de pirates nationaux, ont révélé des chercheurs.A Rapport publié mardi Détails comment le fournisseur de services Internet Cloudzy accepte la crypto-monnaie en échange de l'utilisation anonyme des services technologiques utilisés pour effectuer des cyberattaques.L'entreprise prétendument

---

An Iranian technology company is providing infrastructure services to ransomware gangs and an array of nation-state hackers, researchers have found. A report released Tuesday by the cybersecurity firm Halcyon details how the internet service provider Cloudzy accepts cryptocurrency in exchange for the anonymous use of technological services used to carry out cyberattacks. The company allegedly]]> 2023-08-01T17:24:00+00:00 https://therecord.media/iran-company-providing-ransomware-infrastructure www.secnews.physaphae.fr/article.php?IdArticle=8364378 False Ransomware,Cloud None 3.0000000000000000 The Hacker News - The Hacker News est un blog de news de hack (surprenant non?) Data Security Posture Management is an approach to securing cloud data by ensuring that sensitive data always has the correct security posture - regardless of where it\'s been duplicated or moved to. So, what is DSPM? Here\'s a quick example: Let\'s say you\'ve built an excellent security posture for your cloud data. For the sake of this example, your data is in production, it\'s protected behind a]]> 2023-08-01T15:45:00+00:00 https://thehackernews.com/2023/08/what-is-data-security-posture.html www.secnews.physaphae.fr/article.php?IdArticle=8364235 False Cloud None 3.0000000000000000 InfoSecurity Mag - InfoSecurity Magazine Published by Qualys, the document draws from anonymized global cloud scans conducted in April 2023]]> 2023-08-01T15:00:00+00:00 https://www.infosecurity-magazine.com/news/cloud-tech-debt-puts-millions-apps/ www.secnews.physaphae.fr/article.php?IdArticle=8364311 False Cloud,Studies None 3.0000000000000000 Checkpoint - Fabricant Materiel Securite Statista dit que 71% des entreprises mondiales ont ressenti l'impact des tendances des ransomwares.Au total, 62,9% des victimes de ransomwares ont payé la rançon.Ils utilisent une myriade de techniques et d'outils pour infiltrer les réseaux, les applications et les ordinateurs car ils jettent les bases de la demande de rançon.C'est pourquoi une solution Secure Access Service Edge (SASE) qui se concentre sur la protection de ces actifs contre les ransomwares est votre première ligne de défense contre les attaquants.Un risque accru avec des ransomwares de travail flexibles peut exploiter l'accès aux ressources des entreprises, y compris les centres de données, les IaaS et les environnements de production cloud pour se propager au sein de votre organisation, vous bloquant de Vital [& # 8230;]

---

>Statista says that 71% of global businesses felt the impact of ransomware trends. A total of 62.9% of the ransomware victims paid the ransom. They use myriad techniques and tools to infiltrate networks, applications and computers as they lay the groundwork for the ransom demand. This is why a Secure Access Service Edge (SASE) solution that focuses on protecting these assets against ransomware is your first line of defense against attackers. Increased Risk with Flexible Work Ransomware can exploit access to corporate resources, including data centers, IaaS, and cloud production environments to propagate within your organization, blocking you from vital […] ]]> 2023-08-01T14:00:03+00:00 https://blog.checkpoint.com/connect-sase/your-first-line-of-defense-against-ransomware-sase/ www.secnews.physaphae.fr/article.php?IdArticle=8364289 False Ransomware,Cloud,Tool None 1.00000000000000000000 AlienVault Lab Blog - AlienVault est un acteur de defense majeur dans les IOC DSPM) plays a critical role in identifying security risks, prioritizing misconfigurations, and implementing a zero-trust framework. It is an emerging technology, and there are only a few capable solutions that provide good product offerings. Check out the list of some of the best DSPM platforms that can be considered to streamline data protection, governance, and compliance efforts. Top Data Security Posture Management (DSPM) tools to watch 1. Securiti DSPM Securiti DSPM ranks at the top on Gartner’s list of DSPM platforms in this category. Gartner has given a rating of 4.7 which is the highest amongst other products. The tool is built to protect an organization’s data, especially sensitive data, everywhere. The platform covers data in numerous environments and across various formats, such as structured and unstructured data systems. Users can gain visibility of their data at rest and in motion across public, private, hybrid, and multi-cloud systems. The solution also covers SaaS environments which is a plus since traditionally, DSPM covers only public clouds. The solution leverages AI/ML-powered sensitive data insights to streamline their data governance strategy, data lineage, access policies and controls, and privacy operations, such as cross-border transfer policies. 2.  Symmetry DataGuard Symmetry DataGuard comes second to Securiti in ranking and rating as well. The DSPM solution has received a 4.6 rating in the Product Capabilities and Customer Experience categories. It delivers real-time data protection. With visibility of data and advanced analytics, security teams can not only ensure data security but also availability and integrity. Users can leverage that granular information to power their IAM engines to implement effective data controls, access, and permission. Symmetry DataGuard can be an expensive and you’ll need to invest time to understand the product because of its extensive capabilities and features. 3. Sentra Sentra’s DSPM platform is built for speed and efficiency. The platform offers agentless discovery, which means that data doesn’t leave an organization’s secure environment, and hence there’s zero disruption to the productivity of teams. Another important aspect of Sentra’s DSPM solution is that it is easy to implement and scale. It further offers great integration capability and thus enables organizations to integrate with various ecosystems for discovering data. 4.  Dig Security Platform Up to 77% of users would recommend Dig Security Platform, suggests Gartner. The DSPM platform has garnered a 4.2 rating on the review platform. The tool can help security and data teams to effectively identify and discover data and perform accurate categorization and classification. The data detection and response capabilities of the solution further ensure robust data protection. Teams can have a complete understanding of their data spread across physical and virtual databases and protect sensitive data from security risks, such as data exfiltration, ransomware, and shadow data. 5.  Flow Security Flow Security covers a large set of environments to discover all data of an organization. For instance, the solution can scan through on-prem infrastructure, multiple cloud environments, SaaS applicatio]]> 2023-08-01T10:00:00+00:00 https://cybersecurity.att.com/blogs/security-essentials/top-15-data-security-posture-management-dspm-platforms-for-2023 www.secnews.physaphae.fr/article.php?IdArticle=8364218 False Cloud,Tool,Vulnerability None 2.0000000000000000 Network World - Magazine Info 2023-08-01T06:35:00+00:00 https://www.networkworld.com/article/3703829/cisco-brings-ransomware-protection-to-xdr-saas-package.html#tk.rss_security www.secnews.physaphae.fr/article.php?IdArticle=8364288 False Ransomware,Cloud None 2.0000000000000000 TrendLabs Security - Editeur Antivirus Why endpoint security falls short in the complexity of modern IT infrastructure]]> 2023-08-01T00:00:00+00:00 https://www.trendmicro.com/en_us/research/23/h/secure-servers-cloud-workloads.html www.secnews.physaphae.fr/article.php?IdArticle=8364417 False Cloud None 2.0000000000000000 Global Security Mag - Site de news francais opinion

---

4 Essential Elements for a Comprehensive Cloud Security Stack - Opinion]]> 2023-07-31T15:38:41+00:00 https://www.globalsecuritymag.fr/Check-Point-News-4-Essential-Elements-for-a-Comprehensive-Cloud-Security-Stack.html www.secnews.physaphae.fr/article.php?IdArticle=8364167 False Cloud None 2.0000000000000000 InfoSecurity Mag - InfoSecurity Magazine Wiz Research said the vulnerabilities were discovered in the Linux filesystem, OverlayFS]]> 2023-07-28T15:30:00+00:00 https://www.infosecurity-magazine.com/news/40-ubuntu-cloud-workloads/ www.secnews.physaphae.fr/article.php?IdArticle=8362803 False Cloud,Vulnerability None 2.0000000000000000 Global Security Mag - Site de news francais Produits]]> 2023-07-28T12:41:43+00:00 https://www.globalsecuritymag.fr/Palo-Alto-Networks-lance-le-module-CI-CD-Security.html www.secnews.physaphae.fr/article.php?IdArticle=8362740 False Cloud None 1.00000000000000000000 Recorded Future - FLux Recorded Future Un sénateur américain de premier plan a demandé au ministère de la Justice et à plusieurs autres agences d'enquêter sur un récent hack de comptes de messagerie fournis par Microsoft utilisés par les hauts responsables gouvernementaux.Dans une lettre publié jeudi et premier rapporté par le Wall Street Journal , le sénateur américain Ron Wyden (D-ou)Département de la justice, Commission fédérale du commerce et cybersécurité et

---

A leading U.S. senator asked the Justice Department and several other agencies to investigate a recent hack of Microsoft-provided email accounts used by top government officials. In a letter published on Thursday and first reported by the Wall Street Journal, U.S. Senator Ron Wyden (D-OR) asked the Justice Department, Federal Trade Commission and Cybersecurity and]]> 2023-07-27T20:10:00+00:00 https://therecord.media/senator-calls-on-doj-to-investigate-alleged-china-microsoft-hack www.secnews.physaphae.fr/article.php?IdArticle=8362404 False Hack,Cloud,Tool None 2.0000000000000000 CVE Liste - Common Vulnerability Exposure Crossplane is a framework for building cloud native control planes without needing to write code. In versions prior to 1.11.5, 1.12.3, and 1.13.0, Crossplane\'s image backend does not validate the byte contents of Crossplane packages. As such, Crossplane does not detect if an attacker has tampered with a Package. The problem has been fixed in 1.11.5, 1.12.3 and 1.13.0. As a workaround, only use images from trusted sources and keep Package editing/creating privileges to administrators only.]]> 2023-07-27T19:15:10+00:00 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-38495 www.secnews.physaphae.fr/article.php?IdArticle=8362409 False Cloud None None The Hacker News - The Hacker News est un blog de news de hack (surprenant non?) Cybersecurity researchers have disclosed two high-severity security flaws in the Ubuntu kernel that could pave the way for local privilege escalation attacks. Cloud security firm Wiz, in a report shared with The Hacker News, said the easy-to-exploit shortcomings have the potential to impact 40% of Ubuntu users. "The impacted Ubuntu versions are prevalent in the cloud as they serve as the default]]> 2023-07-27T18:55:00+00:00 https://thehackernews.com/2023/07/gameoverlay-two-severe-linux.html www.secnews.physaphae.fr/article.php?IdArticle=8362245 False Cloud,Vulnerability None 3.0000000000000000 Recorded Future - FLux Recorded Future Les chercheurs ont ont découvert deux vulnérabilités dans le système d'exploitation Linux, Ubuntu avec le potentiel d'accorder des attaquants a augmenté les privilèges.Les deux bogues ont un impact sur les surlayfs, un système de fichiers Linux largement installé utilisé pour la conteneurisation sur les serveurs cloud avec des technologies comme Docker et Kubernetes.Après avoir été informé des vulnérabilités par les chercheurs avec la société de sécurité du cloud Wiz

---

Researchers have discovered two vulnerabilities in the Linux operating system Ubuntu with the potential to grant attackers escalated privileges. The two bugs impact OverlayFS, a widely installed Linux filesystem used for containerization on cloud servers with technologies like Docker and Kubernetes. After being notified of the vulnerabilities by researchers with the cloud security firm Wiz]]> 2023-07-27T17:05:00+00:00 https://therecord.media/ubuntu-linux-overlayfs-vulnerabilities www.secnews.physaphae.fr/article.php?IdArticle=8362345 False Cloud,Vulnerability Uber 2.0000000000000000 The Hacker News - The Hacker News est un blog de news de hack (surprenant non?) As cloud applications are built, tested and updated, they wind their way through an ever-complex series of different tools and teams. Across hundreds or even thousands of technologies that make up the patchwork quilt of development and cloud environments, security processes are all too often applied in only the final phases of software development.  Placing security at the very end of the]]> 2023-07-27T16:55:00+00:00 https://thehackernews.com/2023/07/the-4-keys-to-building-cloud-security.html www.secnews.physaphae.fr/article.php?IdArticle=8362202 False Cloud,Tool None 2.0000000000000000 Dark Reading - Informationweek Branch Some 40% of Ubuntu Linux cloud workloads subject to GameOverlay security bugs in the OverlayFS module.]]> 2023-07-27T16:42:00+00:00 https://www.darkreading.com/cloud/ubuntu-linux-cloud-workloads-face-rampant-root-takeovers www.secnews.physaphae.fr/article.php?IdArticle=8362309 False Cloud None 2.0000000000000000 CVE Liste - Common Vulnerability Exposure Crossplane is a framework for building cloud native control planes without needing to write code. In versions prior to 1.11.5, 1.12.3, and 1.13.0, a high-privileged user could create a Package referencing an arbitrarily large image containing that Crossplane would then parse, possibly resulting in exhausting all the available memory and therefore in the container being OOMKilled. The impact is limited due to the high privileges required to be able to create the Package and the eventually consistency nature of controller. This issue is fixed in versions 1.11.5, 1.12.3, and 1.13.0.]]> 2023-07-27T16:15:10+00:00 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-37900 www.secnews.physaphae.fr/article.php?IdArticle=8362365 False Cloud None None Global Security Mag - Site de news francais Produits]]> 2023-07-27T14:27:01+00:00 https://www.globalsecuritymag.fr/Citrix-etend-ses-capacites-dans-le-Cloud-et-On-premise.html www.secnews.physaphae.fr/article.php?IdArticle=8362270 False Cloud None 2.0000000000000000 AlienVault Lab Blog - AlienVault est un acteur de defense majeur dans les IOC every organization, regardless of size, especially organizations with sensitive data.  Organizations, now more than ever before, rely on voluminous amounts of data to conduct business. When data leakage or a breach occurs, the organization is forced to deal with the negative consequences, such as the high cost associated with data breach fines and remediation and reputational harm to their company and brand.  Data loss prevention (DLP) solutions help mitigate the risk of data loss. Losses can occur as a result of insider-related incidents (e.g., employee theft of proprietary information), or due to physical damage to computers, or as a result of human error (e.g., unintentional file deletion or sharing sensitive data in an email). In addition to the various ways an organization might experience data loss, mitigating the risk of loss requires the right people, processes, and technology. Meeting the technology requirement can be a challenge when it comes to selecting the right DLP solution. During the vendor exploration and evaluation phases, there may be questions about whether it makes sense to invest in a solution that protects the network, endpoints, or the cloud or whether it’s better to select a solution that protects the enterprise and takes into account the hybrid nature of many organizations. Data classification and labeling The decision to invest in a DLP solution should be informed by sufficient research and planning with key stakeholders. This blog will discuss three additional things you should consider before making such an investment. Let’s begin with the types of data an organization collects, stores, and analyzes to conduct business.  To have a successful data loss prevention program, it’s important to identify all types of data (e.g., financial data, health data, or personally identifiable information) and to classify the data according to its value and the risk to the organization if it is leaked or exfiltrated. Data classification is the process of categorizing data to easily retrieve and store it for business use. It also protects it from loss and theft and enables regulatory compliance activities. Today, systems are more dispersed, and organizations have hybrid and remote workforce models, so it is critical to protect data regardless of where it resides or with whom it is shared. This kind of protection requires properly classified and labeled data. Automated data classification is foundational to preventing data loss. It is the best way for organizations to fully understand what types of data they have, as well as the characteristics of the data and what privacy and security requirements are necessary to protect the data. Properly classifying data also enables the organization to set policies for each data type. Techniques to identify sensitive data DLP solutions detect instances of either intentional or unintentional exfiltration of data. DLP policies describe what happens when a user uses sensitive data in a way the policy does not allow. For example, when a user attempts to print a document containing sensitive data to a home printer, the DLP policy might display a message stating that printing the docu]]> 2023-07-27T10:00:00+00:00 https://cybersecurity.att.com/blogs/security-essentials/what-your-peers-want-to-know-before-buying-a-dlp-tool www.secnews.physaphae.fr/article.php?IdArticle=8362263 False Data Breach,Cloud,Tool None 3.0000000000000000 Global Security Mag - Site de news francais revues de produits

---

SentinelOne® launches Cloud Data Security product line Company unveils high-speed malware detection products for leading cloud and network storage providers Amazon S3 and NetApp, enabling customers to revolutionise protection as threats evolve - Product Reviews]]> 2023-07-26T14:20:38+00:00 https://www.globalsecuritymag.fr/SentinelOne-R-launches-Cloud-Data-Security-product-line.html www.secnews.physaphae.fr/article.php?IdArticle=8361756 False Malware,Cloud None 2.0000000000000000 Checkpoint - Fabricant Materiel Securite La transformation numérique pousse les entités commerciales pour déployer des produits plus rapidement que jamais, mais à quel prix?Les équipes informatiques ressentent une pression colossale pour équilibrer la vitesse avec la sécurité.Bien qu'ils adoptent le nuage comme moyen de rester agile et évolutif, cela signifie également qu'ils sont plus vulnérables aux attaques malveillantes.Rien qu'en 2022, le coût moyen d'une violation de données aux États-Unis seul était de 9,44 millions de dollars.Dans cet article, nous examinerons comment votre entreprise peut réduire les dépendances, améliorer la sécurité et déléguer les tâches aux fournisseurs tout en augmentant la vitesse de développement en même temps.Nous explorerons les dernières tendances de l'industrie [& # 8230;]

---

>Digital transformation is pushing business entities to deploy products faster than ever, but at what cost? IT teams feel colossal pressure to balance speed with security. While they are adopting the cloud as a way to remain agile and scalable, this also means they are more vulnerable to malicious attacks. In 2022 alone, the average cost of a data breach in the US alone was $9.44 million. In this article, we’ll examine how your company can reduce dependencies, improve security and delegate tasks to vendors while increasing development velocity at the same time. We will explore the latest industry trends […] ]]> 2023-07-26T14:00:30+00:00 https://blog.checkpoint.com/securing-the-cloud/4-essential-elements-for-a-comprehensive-cloud-security-stack/ www.secnews.physaphae.fr/article.php?IdArticle=8361723 False Data Breach,Cloud None 2.0000000000000000 Global Security Mag - Site de news francais Produits]]> 2023-07-26T13:39:14+00:00 https://www.globalsecuritymag.fr/SentinelOne-R-lance-sa-suite-Cloud-Data-Security.html www.secnews.physaphae.fr/article.php?IdArticle=8361733 False Cloud None 1.00000000000000000000 CVE Liste - Common Vulnerability Exposure Sentry is an error tracking and performance monitoring platform. Starting in version 8.21.0 and prior to version 23.5.2, an authenticated user can download a debug or artifact bundle from arbitrary organizations and projects with a known bundle ID. The user does not need to be a member of the organization or have permissions on the project. A patch was issued in version 23.5.2 to ensure authorization checks are properly scoped on requests to retrieve debug or artifact bundles. Authenticated users who do not have the necessary permissions on the particular project are no longer able to download them. Sentry SaaS users do not need to take any action. Self-Hosted Sentry users should upgrade to version 23.5.2 or higher.]]> 2023-07-25T19:15:11+00:00 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-36826 www.secnews.physaphae.fr/article.php?IdArticle=8361419 False Cloud None None Vuln GCP - FLux Vuln GoogleCloudPlatform 2023-07-24T20:14:21+00:00 https://cloud.google.com/support/bulletins/index#gcp-2023-020 www.secnews.physaphae.fr/article.php?IdArticle=8360913 False Cloud,Vulnerability None 2.0000000000000000 The Hacker News - The Hacker News est un blog de news de hack (surprenant non?) The healthcare industry is under a constant barrage of cyberattacks. It has traditionally been one of the most frequently targeted industries, and things haven\'t changed in 2023. The U.S. Government\'s Office for Civil Rights reported 145 data breaches in the United States during the first quarter of this year. That follows 707 incidents a year ago, during which over 50 million records were]]> 2023-07-24T17:40:00+00:00 https://thehackernews.com/2023/07/how-to-protect-patients-and-their.html www.secnews.physaphae.fr/article.php?IdArticle=8360782 False Cloud None 2.0000000000000000 Silicon - Site de News Francais 2023-07-24T14:06:38+00:00 https://www.silicon.fr/cloud-en-france-les-3-hyperscalers-poursuivent-leur-croissance-sur-liaas-470283.html www.secnews.physaphae.fr/article.php?IdArticle=8360778 False Cloud None 2.0000000000000000 Silicon - Site de News Francais AWS, Mircrosoft Azure et Google Cloud captent l\'essentiel de la croissance du Cloud en France avec une part de marché, cumulée, de 70 %. Sa taille est passée de 1,4 milliard à 2,2 milliards € entre 2020 et 2022.]]> 2023-07-24T14:06:38+00:00 https://www.silicon.fr/cloud-en-france-les-3-hyperscalers-poursuivent-leur-croissance-470283.html www.secnews.physaphae.fr/article.php?IdArticle=8360800 False Cloud None 2.0000000000000000 Soc Radar - Blog spécialisé SOC Researchers discovered a critical security design flaw in Google Cloud Build, which they dubbed as... ]]> 2023-07-24T09:52:48+00:00 https://socradar.io/google-partially-patches-cloud-builds-critical-design-flaw-bad-build/ www.secnews.physaphae.fr/article.php?IdArticle=8360710 False Cloud None 3.0000000000000000 The State of Security - Magazine Américain A few years back, data was constrained to the on-premise infrastructure. Data management, governance, and protection were fairly uncomplicated in this enclosed environment. The emergence of cloud computing and multi-cloud infrastructures has not only introduced more complexity in data management and governance, but it has also increased security risks significantly. Consequently, organizations have turned to solutions like Data Security Posture Management (DSPM) and Cloud Security Posture Management (CSPM) to mitigate those security risks and cope with the growing demand for cloud adoption...]]> 2023-07-24T03:07:43+00:00 https://www.tripwire.com/state-of-security/dspm-and-cspm-what-are-differences www.secnews.physaphae.fr/article.php?IdArticle=8360690 False Cloud None 3.0000000000000000 Data Security Breach - Site de news Francais 2023-07-24T01:05:11+00:00 https://www.datasecuritybreach.fr/microsoft-cloud-hack-china/ www.secnews.physaphae.fr/article.php?IdArticle=8360588 False Cloud None 3.0000000000000000 Wired Threat Level - Security News Plus: Microsoft expands access to premium security features, AI child sexual abuse material is on the rise, and Netflix\'s password crackdown has its intended effect.]]> 2023-07-22T13:00:00+00:00 https://www.wired.com/story/china-breach-microsoft-cloud-email-may-expose-deeper-problems/ www.secnews.physaphae.fr/article.php?IdArticle=8360092 False Cloud None 3.0000000000000000 CVE Liste - Common Vulnerability Exposure Dapr is a portable, event-driven, runtime for building distributed applications across cloud and edge. A vulnerability has been found in Dapr that allows bypassing API token authentication, which is used by the Dapr sidecar to authenticate calls coming from the application, with a well-crafted HTTP request. Users who leverage API token authentication are encouraged to upgrade Dapr to 1.10.9 or to 1.11.2. This vulnerability impacts Dapr users who have configured API token authentication. An attacker could craft a request that is always allowed by the Dapr sidecar over HTTP, even if the `dapr-api-token` in the request is invalid or missing. The issue has been fixed in Dapr 1.10.9 or to 1.11.2. There are no known workarounds for this vulnerability.]]> 2023-07-21T21:15:11+00:00 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-37918 www.secnews.physaphae.fr/article.php?IdArticle=8359916 False Cloud,Vulnerability None None The Hacker News - The Hacker News est un blog de news de hack (surprenant non?) The recent attack against Microsoft\'s email infrastructure by a Chinese nation-state actor referred to as Storm-0558 is said to have a broader scope than previously thought. According to cloud security company Wiz, the inactive Microsoft account (MSA) consumer signing key used to forge Azure Active Directory (Azure AD or AAD) tokens to gain illicit access to Outlook Web Access (OWA) and]]> 2023-07-21T20:44:00+00:00 https://thehackernews.com/2023/07/azure-ad-token-forging-technique-in.html www.secnews.physaphae.fr/article.php?IdArticle=8359761 False Cloud None 3.0000000000000000 Dark Reading - Informationweek Branch China-inked APT actors could have single-hop access to the gamut of Microsoft cloud services and apps, including SharePoint, Teams, and OneDrive, among many others.]]> 2023-07-21T16:45:00+00:00 https://www.darkreading.com/cloud/microsoft-365-breach-risk-widens-millions-of-azure-ad-apps www.secnews.physaphae.fr/article.php?IdArticle=8359786 False Cloud None 3.0000000000000000 SecurityWeek - Security News Le chercheur à la sécurité du cloud avertit que la clé de signature de Microsoft volée était plus puissante et non limitée à Outlook.com et échange en ligne.

---

>Cloud security researcher warns that stolen Microsoft signing key was more powerful and not limited to Outlook.com and Exchange Online. ]]> 2023-07-21T16:39:28+00:00 https://www.securityweek.com/microsoft-cloud-hack-exposed-more-than-exchange-outlook-emails/ www.secnews.physaphae.fr/article.php?IdArticle=8359802 False Hack,Cloud None 3.0000000000000000 InfoSecurity Mag - InfoSecurity Magazine PromptGuard is a new cloud access security broker (CASB) that supports employee AI use while ensuring that sensitive data is not released to AI systems]]> 2023-07-21T14:45:00+00:00 https://www.infosecurity-magazine.com/news/plurilock-generative-ai-guardrails/ www.secnews.physaphae.fr/article.php?IdArticle=8359747 False Cloud None 3.0000000000000000 Dark Reading - Informationweek Branch 2023-07-20T20:24:00+00:00 https://www.darkreading.com/ics-ot/deloitte-global-expands-mxdr-cybersecurity-saas-solution-with-operational-technology-and-identity-modules www.secnews.physaphae.fr/article.php?IdArticle=8359432 False Cloud Deloitte 2.0000000000000000 Dark Reading - Informationweek Branch The SaaS product is available under the Company\'s early access program as a closed, invitation-only beta experience, as part of the Plurilock AI platform.]]> 2023-07-20T16:18:00+00:00 https://www.darkreading.com/operations/plurilock-announces-generative-ai-guardrails-product-promptguard www.secnews.physaphae.fr/article.php?IdArticle=8359315 False Cloud None 2.0000000000000000 CyberScoop - scoopnewsgroup.com special Cyber Les violations répétées des services de cloud computing font de la compréhension un incident récent affectant Microsoft Essential.

---

>Repeated breaches of cloud computing services makes understanding a recent incident affecting Microsoft essential. ]]> 2023-07-20T15:04:25+00:00 https://cyberscoop.com/microsoft-cloud-breach-china/ www.secnews.physaphae.fr/article.php?IdArticle=8359294 False Cloud None 3.0000000000000000 Palo Alto Network - Site Constructeur Le développement de grands modèles de langue (LLMS) a montré beaucoup de promesses dans l'amélioration de la sécurité du cloud.

---

>The development of large language models (LLMs) has shown great promise in enhancing cloud security. ]]> 2023-07-20T15:00:58+00:00 https://www.paloaltonetworks.com/blog/2023/07/llm-in-the-cloud/ www.secnews.physaphae.fr/article.php?IdArticle=8361345 False Cloud None 2.0000000000000000 Netskope - etskope est une société de logiciels américaine fournissant une plate-forme de sécurité informatique Devrions-nous utiliser plusieurs fournisseurs de cloud publics?Alors que les organisations continuent de migrer les applications et les charges de travail vers des plateformes de cloud public, elles sont souvent confrontées à la décision difficile de s'en tenir à un seul fournisseur ou d'embrasser plusieurs nuages.L'utilisation de plusieurs fournisseurs de cloud promet une variété d'avantages, notamment la possibilité de minimiser le verrouillage des fournisseurs, de tirer parti des services de meilleur reprochage, [& # 8230;]

---

>Should we be using multiple public cloud providers? As organizations continue to migrate applications and workloads to public cloud platforms, they often face the tough decision of sticking with a single provider or embracing multiple clouds. Using multiple cloud providers promises a variety of benefits including the ability to minimize vendor lock-in, leverage best-of-breed services, […] ]]> 2023-07-20T15:00:00+00:00 https://www.netskope.com/blog/is-your-multi-cloud-strategy-paying-off-unlocking-the-benefits-of-multi-cloud-architectures-with-netskope-sase www.secnews.physaphae.fr/article.php?IdArticle=8359266 False Cloud None 2.0000000000000000 InfoSecurity Mag - InfoSecurity Magazine The company said they collaborated closely with CISA to expand cloud logging]]> 2023-07-20T14:30:00+00:00 https://www.infosecurity-magazine.com/news/microsoft-enhances-cloud-logging/ www.secnews.physaphae.fr/article.php?IdArticle=8359276 False Cloud None 2.0000000000000000 The Hacker News - The Hacker News est un blog de news de hack (surprenant non?) Cybersecurity researchers have uncovered a new cloud targeting, peer-to-peer (P2P) worm called P2PInfect that targets vulnerable Redis instances for follow-on exploitation. "P2PInfect exploits Redis servers running on both Linux and Windows Operating Systems making it more scalable and potent than other worms," Palo Alto Networks Unit 42 researchers William Gamazo and Nathaniel Quist said. "This]]> 2023-07-20T11:42:00+00:00 https://thehackernews.com/2023/07/new-p2pinfect-worm-targeting-redis.html www.secnews.physaphae.fr/article.php?IdArticle=8359134 False Cloud None 3.0000000000000000 The Hacker News - The Hacker News est un blog de news de hack (surprenant non?) Microsoft on Wednesday announced that it\'s expanding cloud logging capabilities to help organizations investigate cybersecurity incidents and gain more visibility after facing criticism in the wake of a recent espionage attack campaign aimed at its email infrastructure. The tech giant said it\'s making the change in direct response to increasing frequency and evolution of nation-state cyber]]> 2023-07-20T10:36:00+00:00 https://thehackernews.com/2023/07/microsoft-expands-cloud-logging-to.html www.secnews.physaphae.fr/article.php?IdArticle=8359121 False Cloud None 3.0000000000000000 Global Security Mag - Site de news francais Produits]]> 2023-07-20T07:42:17+00:00 https://www.globalsecuritymag.fr/Tenable-annonce-de-nouvelles-fonctionnalites-pour-Tenable-Cloud-Security.html www.secnews.physaphae.fr/article.php?IdArticle=8359150 False Cloud None 2.0000000000000000 Dark Reading - Informationweek Branch Industry pushback prompts Microsoft to drop premium pricing for access to cloud logging data.]]> 2023-07-20T01:00:00+00:00 https://www.darkreading.com/application-security/microsoft-relents-offers-free-key-logging-365-customers www.secnews.physaphae.fr/article.php?IdArticle=8358949 False Cloud None 3.0000000000000000 Dark Reading - Informationweek Branch Supports company focus on bridging the cyber skills gap, strengthening cyber defenses, and protecting the front lines.]]> 2023-07-19T22:51:00+00:00 https://www.darkreading.com/ics-ot/cloud-range-appoints-cybersecurity-leader-galina-antova-to-board-of-directors www.secnews.physaphae.fr/article.php?IdArticle=8359007 False Cloud None 2.0000000000000000 Dark Reading - Informationweek Branch 2023-07-19T22:05:00+00:00 https://www.darkreading.com/vulnerabilities-threats/hypersense-fraud-management-now-available-on-google-cloud www.secnews.physaphae.fr/article.php?IdArticle=8359012 False Cloud,Tool None 3.0000000000000000 Dark Reading - Informationweek Branch Although not all Redis instances are vulnerable to the P2P worm variant, all of them can expect a compromise attempt, researchers warn.]]> 2023-07-19T21:11:00+00:00 https://www.darkreading.com/application-security/new-cloud-worm-targets-redis-open-source-database-app- www.secnews.physaphae.fr/article.php?IdArticle=8358980 False Cloud None 2.0000000000000000 Recorded Future - FLux Recorded Future Microsoft élargit l'accès aux outils critiques qui aideront les organisations à étudier les incidents de cybersécurité après avoir fait face à des réalisations importantes à la suite d'une violation liée aux pirates chinois.Mercredi, l'Agence de sécurité de la cybersécurité et de l'infrastructure (CISA) a déclaré qu'elle avait travaillé avec Microsoft pour étendre l'accès aux capacités de journalisation cloud gratuites pour tous les clients gouvernementaux et commerciaux après plusieurs

---

Microsoft is expanding access to critical tools that will help organizations investigate cybersecurity incidents after facing significant backlash following a breach linked to Chinese hackers. On Wednesday, the Cybersecurity and Infrastructure Security Agency (CISA) said it worked with Microsoft to expand access to free cloud logging capabilities for all government and commercial customers after several]]> 2023-07-19T17:30:00+00:00 https://therecord.media/cisa-microsoft-expands-access-to-logging-tools-after-data-breach www.secnews.physaphae.fr/article.php?IdArticle=8358924 False Hack,Cloud,Tool None 3.0000000000000000 The Hacker News - The Hacker News est un blog de news de hack (surprenant non?) Attack surfaces are growing faster than security teams can keep up. To stay ahead, you need to know what\'s exposed and where attackers are most likely to strike. With cloud migration dramatically increasing the number of internal and external targets, prioritizing threats and managing your attack surface from an attacker\'s perspective has never been more important. Let\'s look at why it\'s growing]]> 2023-07-19T17:28:00+00:00 https://thehackernews.com/2023/07/how-to-manage-your-attack-surface.html www.secnews.physaphae.fr/article.php?IdArticle=8358788 False Cloud None 3.0000000000000000 The Hacker News - The Hacker News est un blog de news de hack (surprenant non?) Cybersecurity researchers have uncovered a privilege escalation vulnerability in Google Cloud that could enable malicious actors tamper with application images and infect users, leading to supply chain attacks. The issue, dubbed Bad.Build, is rooted in the Google Cloud Build service, according to cloud security firm Orca, which discovered and reported the issue. "By abusing the flaw and enabling]]> 2023-07-19T15:04:00+00:00 https://thehackernews.com/2023/07/badbuild-flaw-in-google-cloud-build.html www.secnews.physaphae.fr/article.php?IdArticle=8358731 False Cloud,Vulnerability None 2.0000000000000000 Dark Reading - Informationweek Branch Security debt exists in on-premises data centers as well as in cloud platforms - but preventing it from accumulating in the cloud requires different skills, processes, and tools.]]> 2023-07-19T14:00:00+00:00 https://www.darkreading.com/cloud/reducing-security-debt-in-the-cloud www.secnews.physaphae.fr/article.php?IdArticle=8358827 False Cloud None 4.0000000000000000 Silicon - Site de News Francais 2023-07-19T13:01:47+00:00 https://www.silicon.fr/avis-expert/attaques-dans-le-cloud-7-solutions-pragmatiques-pour-les-contrer www.secnews.physaphae.fr/article.php?IdArticle=8358808 False Cloud None 3.0000000000000000 Global Security Mag - Site de news francais nouvelles commerciales

---

Cohesity Expands Partnerships with Cisco and HPE to Grow Market Penetration of Its Cloud Services Cisco and HPE bring Cloud Simplicity and Cost Savings to Cohesity Data Security and Management for Enterprises Deploying Hybrid, Multicloud Models - Business News]]> 2023-07-19T12:12:37+00:00 https://www.globalsecuritymag.fr/Cohesity-Expands-Partnerships-with-Cisco-and-HPE.html www.secnews.physaphae.fr/article.php?IdArticle=8358806 False Cloud None 2.0000000000000000 Silicon - Site de News Francais 2023-07-19T10:06:34+00:00 https://www.silicon.fr/copilot-chatgpt-microsoft-470154.html www.secnews.physaphae.fr/article.php?IdArticle=8358748 False Cloud None 2.0000000000000000