Identity and access

CISA’s Untitled Goose Tool aims to support network defenders with finding and detecting malicious activity in Microsoft Azure, Active Directory, and Microsoft 365 environments.

New research reveals a potential post-exploitation attack method in Okta that enables adversaries to read users’ passwords in Okta audit logs.

An unsecured database with nearly 50,000 invoice records tied to Encore Support Services was found online, containing the data of students with special education needs.

The practice guide, part of the NSA's Enduring Security Framework, was developed through a public-private partnership to thwart risks that threaten critical infrastructure and national security systems.

Jelly Bean Communications didn’t patch known flaws in its website, which led to the hacking of over 500,000 applications of a Florida children's health insurance site, DoJ argued.

Twitter will effectively ban SMS two-factor authentication in two weeks. Failing to shift users into a more secure authenticator is a "missed opportunity," experts say.

A carding marketplace known as BidenCash leaked over 2 million payment card records on a top tier dark net for free in celebration of its first anniversary.