Threat Detection

Cybersecurity experts often say that an organisation’s security posture is only as strong as its weakest link. For most organisations, the weakest link isn’t technology – it’s the people who operate it. According to one recent report, 68% of data breaches involve a non-malicious human element, typically someone falling for a phishing scam or another form of social engineering. For that reason, along with a digital firewall, organisations also have to start thinking about how...

An insider threat can feel a bit like the plot twist in a spy thriller. You know, the moment when the protagonist realises the enemy is not just at the gates but has been inside the house the whole time. Suddenly, all those polite conversations by the water cooler take on a sinister meaning. So, what do you do when your very own corporate narrative takes a turn for the dramatic?   Identifying the Mole...

Presently, SaaS has become one of the most integral parts of the rapidly evolving cloud computing environment for the organizations that are striving for cost efficiencies, flexibility, and more adaptability. However, this change is rapid and accompanied by an increased chance of a cyber-attack on a SaaS product. The security of SaaS apps must be ensured; penetration testing helps with this. Among the many techniques used, automated technologies have become vital parts of a cybersecurity...

New research by Outpost24 has revealed that malware developers are using sandbox evasion techniques to avoid exposing malicious behaviour inside a sandbox where malware is analysed by security researches. Outpost24’s threat intelligence team, KrakenLabs, discovered that malware developers are using trigonometry to detect human behaviour based on cursor positions to avoid automated security analysis. The Malware-as-a-Service (MaaS) model poses a significant threat in the realm of cybersecurity. This model allows individuals or groups with limited technical expertise...

Obrela Security Industries recently launched their H1 2022 Digital Universe Study, which provides detailed insight into this year’s security and threat landscape. The results provide a ‘funnel’ view of real-time visibility data, and allow organisations to gain a better understanding of how threats are security are developing, and how they can better protect themselves.   To put together this report, Obrela collected and analysed 1 PBs of logs as well as 100,000 devices. In this time,...

DomainTools has announced the availability of DomainTools Iris Detect, an innovative new product designed to discover and monitor domain names spoofing brands, trademarks, or other domains with unprecedented speed, accuracy, and comprehensiveness. Building on the world’s largest databases of domain registration and Domain Name System (DNS) data developed by DomainTools and Farsight Security, the discovery engine underpinning Iris Detect identifies some 350,000 new domains every day—far more than any other technology available. In fact, in a 12-hour period earlier...

Next-Gen SIEM provider, Securonix has announced availability of its SearchMore functionality that helps operations teams better detect and respond to threats that bypass preventative and detection controls. The company states that "SearchMore delivers the industry’s first Community-Powered Threat Hunting capability and provides the ability to search on real-time, streaming data, as well as long-term data." CEO Sachin Nayyar elaborated: “This is a huge step in cybersecurity monitoring. With a combination of cloud-native and big data...

You only have to read the news on this very website to find countless stories of instances where companies have inadvertently left a database exposed on the web - it’s every security professional’s worst nightmare.   Researchers at Comparitech, who will often be the source of finding these misconfigured databases to alert the unsuspecting company, decided to set up a honeypot experiment to see just how little time it would take before such a database...

The success of open source and collaborative projects depends on the community that supports them. The development model is driven solely by a common goal, and has consistently been an invaluable resource for the IT and IT security industries.  Guided by the common goal of making the internet a little more secure and to help users hunt unknown malicious infrastructure, DomainTools has announced that it will integrate its Iris tool with TheHive and Cortex platform....

The NSA recently issued an advisory to enterprises that adopt 'break and inspect' technologies to gain visibility over encrypted traffic, warning them of the potential risks of such an approach. In fact, decrypting and re-encrypting traffic through a proxy device, a firewall, intrusion detection or prevention systems (IDS/IPS) that that doesn't properly validate transport layer security (TLS) certificates, for instance, will weaken the end-to-end protection provided by the TLS encryption to the end-users, drastically increasing...