サイバーセキュリティニュース: NIST Program Probes AI Cyber and Privacy Risks, as U.S. Gov’t Tackles Automotive IoT Threat from Russia, China
September 27, 2024
CVE-2024-47076, CVE-2024-47175, CVE-2024-47176, CVE-2024-47177: Common UNIX Printing System (CUPS) の脆弱性に関するよくある質問
2024/9/26Frequently asked questions about multiple vulnerabilities in the Common UNIX Printing System (CUPS) that were disclosed as zero-days on September 26.
クラウド セキュリティ プログラムを確立するためのベスト プラクティスと教訓
2024/9/26As we’ve developed Tenable’s cloud security program, we in the Infosec team have asked many questions and faced interesting challenges. Along the way, we’ve learned valuable lessons and incorporated key best practices. In this blog, we’ll discuss how we’ve approached implementing our cloud security program using Tenable Cloud Security, and share recommendations that you may find helpful.
サイバーセキュリティニュース: 重要インフラ組織は代表的なサイバー攻撃に対して脆弱、新しい MITRE ツールは機械学習を使用して攻撃チェーンを予測
2024/9/20Report finds that many critical infrastructure networks can be breached using simple attacks. Plus, a new MITRE Engenuity tool uses machine learning to infer attack sequences. Meanwhile, CISA will lead a project to standardize civilian agencies’ cyber operations. And get the latest on XSS vulnerabilities, CIS Benchmarks and a China-backed botnet’s takedown!
クラウドネイティブの脆弱性管理に関するアナリストガイド
2024/9/19Cloud-native workloads introduce a unique set of challenges that complicate traditional approaches to vulnerability management. Learn how to address these challenges and scale cloud-native VM in your org.
コンテナ化をマスターする: 主要な戦略とベストプラクティス
2024/9/17As organizations modernize their infrastructure, containers offer unparalleled flexibility and scalability but they also introduce unique security challenges. In this blog we explain container security challenges, identify top threats and share how the newly released Tenable Enclave Security can keep your containers secure.
CloudImposer: 一つの悪意あるパッケージで何百万もの Google サーバーでコードを実行
2024/9/16Tenable Research discovered a remote code execution (RCE) vulnerability in Google Cloud Platform (GCP) that is now fixed and that we dubbed CloudImposer. The vulnerability could have allowed an attacker to hijack an internal software dependency that Google pre-installs on each Google Cloud Composer pipeline-orchestration tool. Tenable Research also found risky guidance in GCP documentation that customers should be aware of.
サイバーセキュリティニュース: ロシアの支援を受けたハッカーが重要インフラ組織を狙う、仮想通貨関連の詐欺が急増
September 13, 2024Critical infrastructure operators must beware of Russian military hacking groups. Plus, cyber scammers are having a field day with crypto fraud. Meanwhile, AI and cloud vendors face stricter reporting regulations in the U.S. And get the latest on AI-model risk management and on cybersecurity understaffing!
マイクロソフト、2024 年 9 月の月例セキュリティ更新プログラムで 79 件の CVE に対応 (CVE-2024-43491)
September 10, 2024Microsoft addresses 79 CVEs with seven critical vulnerabilities and four zero-day vulnerabilities, including three that were exploited in the wild.
CVE-2021-20123、CVE-2021-20124: Tenable Research が発見した DrayTek の脆弱性が CISA の既知の悪用された脆弱性カタログ (KEV) に追加されたことについて
2024/9/9With patches out for three years, attackers have set their sights on a pair of vulnerabilities affecting DrayTek VigorConnect.
サイバーセキュリティニュース: CISA が RansomHub に関する注意喚起を公表、FBI は北朝鮮のハッカーが暗号通貨組織を狙っていると発表
2024/9/6Cybersecurity teams must beware of RansomHub, a surging RaaS gang. Plus, North Korea has unleashed sophisticated social-engineering schemes against crypto employees. Meanwhile, a new SANS report stresses the importance of protecting ICS and OT systems. And a Tenable poll sheds light on cloud-native VM. そのほか豊富な内容も掲載しています。
サイバーセキュリティニュース: ランサムウェア攻撃により学校で大規模なダウンタイムによる損失が発生、銀行は AI の課題に取り組む
2024/8/30The cost of ransomware downtime in schools gets pegged at $500K-plus per day. Meanwhile, check out the AI-usage risks threatening banks’ cyber resilience. Plus, Uncle Sam is warning about a dangerous Iran-backed hacking group. And get the latest on AI-system inventories, the APT29 nation-state attacker and digital identity security!
AA24-241A : 米国組織を標的とするイランのサイバー攻撃者に関するサイバーセキュリティ共同勧告
2024/8/28A joint Cybersecurity Advisory highlights Iran-based cyber actor ransomware activity targeting U.S. organizations. The advisory includes CVEs exploited, alongside techniques, tactics and procedures used by the threat actors.