There is a vulnerability in specific Microsoft OAuth 2.0 applications that could let an attacker gain access and control of a victim’s Azure account. The flaw was found by Cyberark researchers who noticed that many white-listed OAuth applications, at least 54, automatically trust domains and sub-domains that are not registered by Microsoft so anyone can…
Google and health care provider organization Ascension have publicly confirmed a recent report that the two companies have embarked on a massive initiative to aggregate the data of roughly 50 million patients and store it on the cloud. The companies say it will improve patient care and administration, but the strategy has also sparked concern…
Unsecured AWS servers belonging to two online recruitment firms – U.S.-based Authentic Jobs and Sonic Jobs in the U.K. – have exposed more than 250,000 CVs of job candidates. Authentic Jobs, used by the likes of the New York Times and EY, took the biggest hit with 221,130 CVs exposed to the public, according to…
Starbucks shuttered a subdomain that pointed to an abandoned Azure cloud resource after a security researcher in its bug bounty program discovered it was vulnerable to cross-site script and session hijacking. The subdomain, svcgatewayus.starbucks.com, “pointed to Microsoft Azure Cloud App [1fd05821-7501-40de-9e44-17235e7ab48b.cloudapp.net] which was no longer registered under Azure,” researcher Patrik wrote in a report on…
Cybersecurity company Imperva today disclosed a data breach that impacts certain customers of its Cloud Web Application Firewall (WAF) product who had accounts through Sept. 15, 2017. The breach exposed email addresses, hashed and salted passwords, and, for a subset of customers, API keys and customer-provided SSL certificates. In a company blog post, Imperva says…
VMware will acquire Carbon Black, according to a definitive agreement inked by the two companies. Carbon Black stockholders will receive $26 per share cash, putting the net cash payout for VMware at $1.9 billion and representing an enterprise value of $2.1 billion, said a release from VMWare, which also will acquire Pivotal Software in a…
To most effectively combat sophisticated and stealthy cyberattacks by advanced nation-state actors, today’s modern-day security operations center must first truly understand their own businesses, according to Monzy Merza, vice president of security research at Splunk. “They have to understand where the risks are, where the threats are based on the environment that they’re living. So…
Buzzwords are the lifeblood of technology: think cloud, cyber, app, virtualization and the ever-popular “things,” to name just a few. One of the newer additions to the vocabulary is “fog” — as in fog computing. It does not take too much imagination to suspect that fog could be a variant of cloud. Indeed, fog is…
Securing the cloud requires a different mindset than securing your on-prem infrastructure Enterprise cloud operations are expanding and maturing, but as with any natural maturation, inevitable growing pains must be endured and overcome. As organizations increasingly migrate operations to the cloud providers, security experts rapidly are realizing that automated cloud security services are essential to…
Cloud-based IAM puts authentication to the test Traditional brick-and-mortar organizations with on-premise servers are striving every day to keep pace with cloud-driven digital enterprises that are untethered by physical restraints, enabling employees to work from anywhere, accessing applications, services and mobile devices as regular parts of their flexible workdays. However, much like ducks on the…
