Administrative rights can be some of the most powerful tools in the arsenal of any malicious agent. Look at any enterprise breach of the last few years and you will see admin accounts almost invariably play a central role.
The future is always in front of us. As we look at our overall business objectives, supporting the growth of our people is a critical component of achieving overall company success. BeyondTrust is committed to meeting the development needs of our workforce - both within and outside of their functions.
As digital transformation connects even more people businesses, educators, and students, the opportunities for cybercriminals have never been more expansive. While organizations have been making strides in modernizing or creating new cyber-awareness programs for their employees, what about all the kids and students who are connected today—even forced to be connected—to remain relevant with their education through E-Learning? What are we doing to better prepare them for this increasingly digital-first era?
Cyber-attacks on critical OT infrastructure have been on a stratospheric trajectory, increasing 2000% in recent years! Audacious attacks have been launched on everything from nuclear plants to water treatment facilities. In fact, a poisoning attack at a Florida water treatment facility was particularly scary because of how easily an attacker gained sensitive access via inadequate password management and how they were able to leverage unsophisticated actions via a consumer-grade remote access tool within the environment to order the system to increase the amount of lye in the water.
The terms allow list, block list (also called deny list), and application control are frequently used or referred to in IT security. However, while these terms are often used interchangeably, it’s important to understand the distinctions of each.
True story - An end user confided in me about a password sharing predicament that got him in hot water with his IT and Human Resources departments. The employee’s corporate-issued computing device needed some IT maintenance. So, IT requested the end user share his password so IT could resolve the issue. However, the employee objected to the password sharing request and asked for IT to just reset his password. That way, the employee could perform a password change without ever exposing his password.
Today, cloud vendor lock-in fears of the past seem overblown. Instead of choosing one cloud or another, organizations are simply choosing both, or to be more precise, many! Most organizations aren’t merely in the cloud—they’re in many clouds (PaaS, IaaS), and their end users regularly consume dozens, or even hundreds, of different SaaS applications. A McAfee study published a couple years back reported the average organization used 1,935 cloud services. And that number has almost certainly ballooned further since then.
Server security, and the protection of Unix and Linux environments, has never been more urgent. While the adoption of PaaS, IaaS, and SaaS models has been underway for years, demand for all things cloud has become supercharged in this era of accelerated digital transformation to accommodate a vast increase in remote work and distributed ways of conducting business. This speed of evolution and increase in complexity contributes to server vulnerabilities and gaps in protections that attackers—whether external threat actor or insider—can exploit to inflict substantial damage. In this blog we will explore Unix/Linux server security, including best practices..
Back when I was a contract firewall installer for Trusted Information Systems, we had a phrase for the way a lot of companies looked at connected networks: Mallomars. If you’re not familiar, Mallomars are a cookie with a hard, crunchy outer layer of graham cracker and chocolate and soft gooey marshmallow inside. And “Mallomar” companies thought that if they installed a strong enough firewall -- that hard, crunchy outer layer -- they didn’t need to worry about security on the inside. What happened? Internal networks were not secured—like the gooey marshmallow in the center of a Mallomar.
Learn how the top 10 CIO priorities for government agencies, according to NASCIO, are enabled by privileged access management (PAM).
The eighth edition of our popular Microsoft Vulnerabilities Report has arrived. The unique research provides comprehensive insight into a year’s worth of vulnerability disclosures by Microsoft in 2020.
Let’s start with candid discussion on IoT and Internet Security. It you are an IoT vendor, you bear some fundamental responsibilities to protect your company, infrastructure, and the security and privacy of your clients—whether they are other businesses you are selling to or consumers. You would absolutely want to architect and deploy a solution that in no way--ever--could a single credential or account be used to jeopardize the trust and well-being of your clients and solution. Moreover, your customers should have every expectation that should be the case. Right?
