リソースと資産のタグ付けでクラウドセキュリティを強化
2024/6/26
CVE-2024-5806: Progress MOVEit Transfer における認証バイパスの脆弱性
2024/6/25Progress Software has patched a high severity authentication bypass in the MOVEit managed file transfer (MFT) solution. As MOVEit has been a popular target for ransomware gangs and other threat actors, we strongly recommend prioritizing patching of this vulnerability.
AWS、Azure、GCP における顧客管理暗号化キー (CMK) の比較と理解
2024/6/25Explore critical differences in handling customer-managed encryption keys (CMKs) across AWS, Azure and GCP to avoid security misconfigurations and protect your data effectively.
CVE-2024-28995: SolarWinds Serv-U のパス/ディレクトリトラバーサルの脆弱性の悪用が確認される
2024/6/21Following the publication of proof-of-concept exploit details for a high-severity flaw in SolarWinds Serv-U, researchers have observed both automated and manual in-the-wild exploitation attempts; patching is strongly advised.
サイバーセキュリティニュース: 米連邦取引委員会（FTC）が TikTok に対する提訴を検討するよう米司法省に求める、フランスのサイバー機関が「Midnight Blizzard（別名Nobelium）」について警告
2024/6/21TikTok’s legal troubles in the U.S. could get thornier after the FTC refers complaint to the DOJ. Meanwhile, France says Russia-backed Nobelium / Midnight Blizzard is a major cyber espionage threat to European governments. Plus, check out a Tenable poll about dealing with vulnerabilities without patches. And did LockBit 3.0 make a comeback in May? Maybe – or maybe not. そのほか豊富な内容も掲載しています。
生成型 AI で脅威をより早く検知、分析、対応する
2024/6/17Generative AI (GenAI) is being hailed as the most transformative innovation since the rise of the internet. For security, GenAI can revolutionize the field if applied correctly, especially when it comes to threat detection and response. It enhances efficiency and productivity by swiftly processing and delivering critical information when it matters most.
サイバーセキュリティニュース: 英国 サイバー機関がソフトウェアベンダーに製品セキュリティの強化を要請、米国政府は金融機関の AI 利用に関する情報を求める
June 14, 2024Check out the NCSC’s call for software vendors to make their products more secure. Plus, why the Treasury Department is looking at how financial institutions are using AI. And the latest on the cybersecurity skills gap in the U.S. そのほか豊富な内容も掲載しています。
Microsoft の 2024 年 6 月月例セキュリティ更新プログラム、49 件の CVE を修正
2024/6/11Microsoft addresses 49 CVEs in its June 2024 Patch Tuesday release with one rated as critical and no zero-day or publicly disclosed vulnerabilities. Our counts omitted two CVEs that were not issued by Microsoft, which include CVE-2023-50868 (issued by MITRE) and CVE-2024-29187 (issued by GitHub).
クラウドワークロード保護: クラウドセキュリティリスクを効果的に軽減
2024/6/11More than 80% of all breaches involve data stored in the cloud, and security teams that don’t use cloud workload protection (CWP) may never get ahead of attackers who want to access as much data as possible with the least effort. A single cloud breach is often the most straightforward way into these sensitive environments. On average, it costs nearly $5 million to respond and recover. So, why are so many organizations still using traditional on-prem security that isn't designed for the dynamic cloud?
CVE-2024-4577: PHP-CGI の引数インジェクション脆弱性の概念実証が公開される
2024/6/7Researchers disclose a critical severity vulnerability affecting PHP installations and provide proof-of-concept exploit code, which could lead to remote code execution.
サイバーセキュリティニュース: NIST プログラムは現実的なシナリオで AI がどのように機能するかを評価、FBI は LockBit の被害者を支援するため多数の復号化キーを保有していることを公表
2024/6/7Check out the new ARIA program from NIST, designed to evaluate if an AI system will be safe and fair once it’s launched. Plus, the FBI offers to help LockBit victims with thousands of decryption keys. In addition, Deloitte finds that boosting cybersecurity is key for generative AI deployment success. And why identity security is getting harder. そのほか豊富な内容も掲載しています。
Tenable、CISA と提携し、セキュリティ・バイ・デザインのプラクティスを強化
June 6, 2024When CISA called on the world’s leading software manufacturers to sign its Secure by Design Pledge, Tenable answered promptly and enthusiastically, becoming part of the first wave of supporters of this landmark initiative. In this blog post, Tenable CSO, Head of Research and President of Public Sector Robert Huber explains the significance of this pledge for the software industry, as well as for Tenable and for our customers.
ロックウェル･オートメーション: パブリックインターネットアクセスを持つ OT デバイスを切断し、Logix、FactoryTalk の CVE にパッチを適用しリスクを軽減する
2024/6/5An advisory from Rockwell Automation reiterates the importance of disconnecting operational technology devices with public-facing internet access and patching and mitigating systems vulnerable to several flaws.