Startup Security Tactics: Friction Surveys

Startup Security Tactics: Friction Surveys,

When we do quarterly planning, my team categorizes our goals within four evergreen outcomes:

Reduce the risk of information security incidents
Increase trust in Vanta’s information security program
Reduce the friction caused by information security controls
Use security expertise to support the business

In this article, I’m going to focus on number three: reducing friction.
Declaring your

,

When we do quarterly planning, my team categorizes our goals within four evergreen outcomes:

Reduce the risk of information security incidents
Increase trust in Vanta’s information security program
Reduce the friction caused by information security controls
Use security expertise to support the business

In this article, I’m going to focus on number three: reducing friction.
Declaring your

, ,
https://thehackernews.com/2023/06/startup-security-tactics-friction.html

Critical ‘nOAuth’ Flaw in Microsoft Azure AD Enabled Complete Account Takeover

Critical ‘nOAuth’ Flaw in Microsoft Azure AD Enabled Complete Account Takeover

,

A security shortcoming in Microsoft Azure Active Directory (AD) Open Authorization (OAuth) process could have been exploited to achieve full account takeover, researchers said.
California-based identity and access management service Descope, which discovered and reported the issue in April 2023, dubbed it nOAuth.
« nOAuth is an authentication implementation flaw that can affect Microsoft Azure AD

,

A security shortcoming in Microsoft Azure Active Directory (AD) Open Authorization (OAuth) process could have been exploited to achieve full account takeover, researchers said.
California-based identity and access management service Descope, which discovered and reported the issue in April 2023, dubbed it nOAuth.
« nOAuth is an authentication implementation flaw that can affect Microsoft Azure AD

, ,
https://thehackernews.com/2023/06/critical-noauth-flaw-in-microsoft-azure.html

Chinese Hacker Group ‘Flea’ Targets American Ministries with Graphican Backdoor

Chinese Hacker Group ‘Flea’ Targets American Ministries with Graphican Backdoor

,

Foreign affairs ministries in the Americas have been targeted by a Chinese state-sponsored actor named Flea as part of a recent campaign that spanned from late 2022 to early 2023.
The cyber attacks, per Broadcom’s Symantec, involved a new backdoor codenamed Graphican. Some of the other targets included a government finance department and a corporation that markets products in the Americas as

,

Foreign affairs ministries in the Americas have been targeted by a Chinese state-sponsored actor named Flea as part of a recent campaign that spanned from late 2022 to early 2023.
The cyber attacks, per Broadcom’s Symantec, involved a new backdoor codenamed Graphican. Some of the other targets included a government finance department and a corporation that markets products in the Americas as

, ,
https://thehackernews.com/2023/06/chinese-hacker-group-flea-targets.html

New Condi Malware Hijacking TP-Link Wi-Fi Routers for DDoS Botnet Attacks

New Condi Malware Hijacking TP-Link Wi-Fi Routers for DDoS Botnet Attacks,

A new malware called Condi has been observed exploiting a security vulnerability in TP-Link Archer AX21 (AX1800) Wi-Fi routers to rope the devices into a distributed denial-of-service (DDoS) botnet.
Fortinet FortiGuard Labs said the campaign has ramped up since the end of May 2023. Condi is the work of a threat actor who goes by the online alias zxcr9999 on Telegram and runs a Telegram channel

,

A new malware called Condi has been observed exploiting a security vulnerability in TP-Link Archer AX21 (AX1800) Wi-Fi routers to rope the devices into a distributed denial-of-service (DDoS) botnet.
Fortinet FortiGuard Labs said the campaign has ramped up since the end of May 2023. Condi is the work of a threat actor who goes by the online alias zxcr9999 on Telegram and runs a Telegram channel

, ,
https://thehackernews.com/2023/06/new-condi-malware-hijacking-tp-link-wi.html

Alert! Hackers Exploiting Critical Vulnerability in VMware’s Aria Operations Networks

Alert! Hackers Exploiting Critical Vulnerability in VMware’s Aria Operations Networks

,

VMware has flagged that a recently patched critical command injection vulnerability in Aria Operations for Networks (formerly vRealize Network Insight) has come under active exploitation in the wild.
The flaw, tracked as CVE-2023-20887, could allow a malicious actor with network access to the product to perform a command injection attack, resulting in remote code execution.
It impacts VMware

,

VMware has flagged that a recently patched critical command injection vulnerability in Aria Operations for Networks (formerly vRealize Network Insight) has come under active exploitation in the wild.
The flaw, tracked as CVE-2023-20887, could allow a malicious actor with network access to the product to perform a command injection attack, resulting in remote code execution.
It impacts VMware

, ,
https://thehackernews.com/2023/06/alert-hackers-exploiting-critical.html

Researchers Expose New Severe Flaws in Wago and Schneider Electric OT Products

Researchers Expose New Severe Flaws in Wago and Schneider Electric OT Products,

Three security vulnerabilities have been disclosed in operational technology (OT) products from Wago and Schneider Electric.
The flaws, per Forescout, are part of a broader set of shortcomings collectively called OT:ICEFALL, which now comprises a total of 61 issues spanning 13 different vendors.
« OT:ICEFALL demonstrates the need for tighter scrutiny of, and improvements to, processes related to

,

Three security vulnerabilities have been disclosed in operational technology (OT) products from Wago and Schneider Electric.
The flaws, per Forescout, are part of a broader set of shortcomings collectively called OT:ICEFALL, which now comprises a total of 61 issues spanning 13 different vendors.
« OT:ICEFALL demonstrates the need for tighter scrutiny of, and improvements to, processes related to

, ,
https://thehackernews.com/2023/06/researchers-expose-new-severe-flaws-in.html

Zyxel Releases Urgent Security Updates for Critical Vulnerability in NAS Devices

Zyxel Releases Urgent Security Updates for Critical Vulnerability in NAS Devices,

Zyxel has rolled out security updates to address a critical security flaw in its network-attached storage (NAS) devices that could result in the execution of arbitrary commands on affected systems.
Tracked as CVE-2023-27992 (CVSS score: 9.8), the issue has been described as a pre-authentication command injection vulnerability.
« The pre-authentication command injection vulnerability in some Zyxel

,

Zyxel has rolled out security updates to address a critical security flaw in its network-attached storage (NAS) devices that could result in the execution of arbitrary commands on affected systems.
Tracked as CVE-2023-27992 (CVSS score: 9.8), the issue has been described as a pre-authentication command injection vulnerability.
« The pre-authentication command injection vulnerability in some Zyxel

, ,
https://thehackernews.com/2023/06/zyxel-releases-urgent-security-updates.html

SaaS in the Real World: How Global Food Chains Can Secure Their Digital Dish

SaaS in the Real World: How Global Food Chains Can Secure Their Digital Dish,

The Quick Serve Restaurant (QSR) industry is built on consistency and shared resources. National chains like McDonald’s and regional ones like Cracker Barrel grow faster by reusing the same business model, decor, and menu, with little change from one location to the next. 
QSR technology stacks mirror the consistency of the front end of each store. Despite each franchise being independently

,

The Quick Serve Restaurant (QSR) industry is built on consistency and shared resources. National chains like McDonald’s and regional ones like Cracker Barrel grow faster by reusing the same business model, decor, and menu, with little change from one location to the next. 
QSR technology stacks mirror the consistency of the front end of each store. Despite each franchise being independently

, ,
https://thehackernews.com/2023/06/saas-in-real-world-how-global-food.html

Experts Uncover Year-Long Cyber Attack on IT Firm Utilizing Custom Malware RDStealer

Experts Uncover Year-Long Cyber Attack on IT Firm Utilizing Custom Malware RDStealer,

A highly targeted cyber attack against an East Asian IT company involved the deployment of a custom malware written in Golang called RDStealer.
« The operation was active for more than a year with the end goal of compromising credentials and data exfiltration, » Bitdefender security researcher Victor Vrabie said in a technical report shared with The Hacker News.
Evidence gathered by the Romanian

,

A highly targeted cyber attack against an East Asian IT company involved the deployment of a custom malware written in Golang called RDStealer.
« The operation was active for more than a year with the end goal of compromising credentials and data exfiltration, » Bitdefender security researcher Victor Vrabie said in a technical report shared with The Hacker News.
Evidence gathered by the Romanian

, ,
https://thehackernews.com/2023/06/experts-uncover-year-long-cyber-attack.html

ASUS Releases Patches to Fix Critical Security Bugs Impacting Multiple Router Models

ASUS Releases Patches to Fix Critical Security Bugs Impacting Multiple Router Models,

Taiwanese company ASUS on Monday released firmware updates to address, among other issues, nine security bugs impacting a wide range of router models.
Of the nine security flaws, two are rated Critical and six are rated High in severity. One vulnerability is currently awaiting analysis.
The list of impacted products are GT6, GT-AXE16000, GT-AX11000 PRO, GT-AXE11000, GT-AX6000, GT-AX11000,

,

Taiwanese company ASUS on Monday released firmware updates to address, among other issues, nine security bugs impacting a wide range of router models.
Of the nine security flaws, two are rated Critical and six are rated High in severity. One vulnerability is currently awaiting analysis.
The list of impacted products are GT6, GT-AXE16000, GT-AX11000 PRO, GT-AXE11000, GT-AX6000, GT-AX11000,

, ,
https://thehackernews.com/2023/06/asus-releases-patches-to-fix-critical.html