Network security
Enterprise cyberdefense strategies must include network security best practices. Get advice on essential network security topics such as remote access, VPNs, zero-trust security, NDR, endpoint management, IoT security, hybrid security, Secure Access Service Edge, mobile security and more.
Top Stories
-
News
19 Nov 2024
2 Palo Alto Networks zero-day vulnerabilities under attack
CVE-2024-9474 marks the second zero-day vulnerability in Palo Alto Networks' PAN-OS firewall management interface to come under attack in the last week. Continue Reading
-
Tip
18 Nov 2024
What CISOs need to know to build an OT cybersecurity program
More companies are tasking CISOs with operational technology security. But this oversight means a new strategy for those unfamiliar with building an effective OT security program. Continue Reading
-
News
18 Nov 2024
Chinese APT exploited unpatched Fortinet zero-day flaw
Volexity reported that a Chinese APT actor exploited a zero-day vulnerability in Fortinet's Windows VPN FortiClient software that enables credentials to be stolen from a system. Continue Reading
-
Definition
18 Nov 2024
What is data egress? How it works and how to manage costs
Data egress is when data leaves a closed or private network and is transferred to an external location. Continue Reading
-
Definition
18 Nov 2024
What is a spam trap?
A spam trap is an email address that's used to identify and monitor spam email. It's also a type of honeypot because it uses a fake email address to bait spammers. Continue Reading
-
News
15 Nov 2024
Palo Alto Networks PAN-OS management interfaces under attack
Palo Alto Networks confirmed that threat actors are exploiting a vulnerability in PAN-OS firewall management interfaces after warning customers to secure them for nearly a week. Continue Reading
-
News
14 Nov 2024
Infoblox: 800,000 domains vulnerable to hijacking attack
While the 'Sitting Ducks' attack vector continues to pose a problem, Infoblox says domain registrars, DNS providers and government bodies remain inactive. Continue Reading
-
News
14 Nov 2024
CISA, FBI confirm China breached telecommunication providers
The government agencies confirmed Wall Street Journal reports that China-backed threat actors breached telecommunication providers and access data for law enforcement requests. Continue Reading
-
News
13 Nov 2024
Most widely exploited vulnerabilities in 2023 were zero days
While zero-day exploitation surged throughout 2023, CISA said threat actors continue to exploit known vulnerabilities that were disclosed and patched as far back as 2017. Continue Reading
-
Tip
12 Nov 2024
EDR vs. XDR vs. MDR: Key differences and benefits
One of the most important goals of cybersecurity professionals is to quickly identify potential or in-progress cyberattacks. These three approaches can help. Continue Reading
-
News
07 Nov 2024
Ransomware attacks caused prolonged disruptions in October
The Ransomhub, Rhysdia and Interlock ransomware gangs claimed responsibility for attacks that knocked victims' services offline, sometimes for several weeks. Continue Reading
-
Tutorial
07 Nov 2024
How to build a Python port scanner
Python offers beginning coders a lot of flexibility and is a novel way to build tools designed to probe port performance across your network. Continue Reading
-
Definition
01 Nov 2024
What is unified threat management (UTM)?
Unified threat management (UTM) is an information security system that provides a single point of protection against cyberthreats, including viruses, worms, spyware and other malware, as well as network attacks. Continue Reading
-
Tip
01 Nov 2024
API security testing checklist: 7 key steps
APIs are a common attack vector for malicious actors. Use our API security testing checklist and best practices to protect your organization and its data. Continue Reading
-
News
30 Oct 2024
Microsoft warns of Midnight Blizzard spear phishing campaign
The tech giant is notifying users affected by a recently observed campaign, which has targeted more than 100 victim organizations globally so far. Continue Reading
-
News
29 Oct 2024
REvil convictions unlikely to curb Russian cybercrime
In a rare action against cybercrime, a court in Russia sentenced four individuals tied to the Revil ransomware gang for money laundering and malware distribution charges. Continue Reading
-
Feature
29 Oct 2024
How to configure and customize Kali Linux settings
Learning how to use Kali Linux for ethical hacking and penetration testing? Read step by step how to configure and customize the distribution. Continue Reading
-
Tip
25 Oct 2024
DDoS mitigation: How to stop DDoS attacks
A DDoS attack can wreak havoc on an organization, but a number of strategies can help stop such attacks and minimize their damage. Continue Reading
-
News
24 Oct 2024
Cisco ASA and FTD zero day used in password spraying attacks
One day after Cisco disclosed a zero-day vulnerability discovered in its VPN software, CISA added the flaw to its Known Exploited Vulnerabilities catalog. Continue Reading
-
News
24 Oct 2024
Fortinet FortiManager zero-day flaw exploited since June
Mandiant researchers first observed exploitation activity against CVE-2024-47575 on June 27, with more than 50 FortiManager devices compromised since. Continue Reading
-
News
22 Oct 2024
Thoma Bravo-owned Sophos to acquire Secureworks for $859M
Sophos said it plans to integrate Secureworks' products into a broader portfolio that serves both large enterprises and small and medium-sized businesses. Continue Reading
-
Tip
22 Oct 2024
How to detect DDoS attacks
DDoS attacks are on the rise -- again. While they usually strike without warning, there are some red flags to be aware of. Rapid detection is key to surviving such an attack. Continue Reading
-
News
21 Oct 2024
Cisco confirms attackers stole data from DevHub environment
While Cisco said its systems were not breached, the vendor did confirm that attackers stole sensitive information from the public-facing portal. Continue Reading
-
Tip
18 Oct 2024
How to prevent DDoS attacks
Organizations have many methods they can use to prevent DDoS attacks, including increasing bandwidth and server scalability, rate limiting and using a web application firewall. Continue Reading
-
News
17 Oct 2024
DOJ charges alleged Anonymous Sudan ringleaders
Two Sudanese brothers are accused of leading the cybercriminal group that caused significant damage to healthcare organizations as well as other high-profile victims. Continue Reading
-
News
16 Oct 2024
Microsoft sees drop in ransomware reaching encryption phase
In its Digital Defense Report 2024, Microsoft observed a significant increase in the number of human-operated ransomware attacks, which often originated from unmanaged devices. Continue Reading
-
Definition
11 Oct 2024
What is the Mitre ATT&CK framework?
The Mitre ATT&CK -- pronounced miter attack -- framework is a free, globally accessible knowledge base that describes the latest behaviors and tactics of cyberadversaries to help organizations strengthen their cybersecurity strategies. Continue Reading
-
News
10 Oct 2024
Coalition: Ransomware severity up 68% in first half of 2024
The cyber insurance carrier examined claims trends for the first half of 2024, which showed policyholders experienced disruptive and increasingly costly ransomware attacks. Continue Reading
-
Tutorial
04 Oct 2024
How to conduct firewall testing and analyze test results
A misconfigured firewall can wreak havoc throughout your organization. Firewall testing to ensure rules are written correctly and that any changes are validated is critical. Continue Reading
-
Feature
03 Oct 2024
'Defunct' DOJ ransomware task force raises questions, concerns
A report from the Office of the Inspector General reviewed the U.S. Department of Justice's efforts against ransomware and found its task force was largely ineffective. Continue Reading
-
Definition
02 Oct 2024
What is Android System WebView and should you uninstall it?
Android System WebView is a system component for the Android operating system (OS) that enables Android apps to display web content directly inside an application. Continue Reading
-
Podcast
30 Sep 2024
Risk & Repeat: Inside the Microsoft SFI progress report
The first Secure Future Initiative progress report highlighted improvements to Microsoft's security posture. But the company still faces major SecOps challenges. Continue Reading
-
Definition
30 Sep 2024
What is WPA3 (Wi-Fi Protected Access 3)?
WPA3, also known as Wi-Fi Protected Access 3, is the third iteration of a security certification standard developed by the Wi-Fi Alliance. WPA3 is the latest updated implementation of WPA2, which has been in use since 2004. Continue Reading
-
Definition
27 Sep 2024
What is access control?
Access control is a security technique that regulates who or what can view or use resources in a computing environment. Continue Reading
-
News
27 Sep 2024
CUPS vulnerabilities could put Linux systems at risk
Security researcher Simone Margaritelli discovered vulnerabilities in the Common UNIX Printing System that attackers could exploit during print jobs against Linux systems. Continue Reading
-
Definition
26 Sep 2024
What is ICMP (Internet Control Message Protocol)?
ICMP (Internet Control Message Protocol) is a network layer error-reporting protocol that's used to communicate data transmission problems. Continue Reading
-
News
26 Sep 2024
Ransomware Task Force finds 73% attack increase in 2023
The Institute for Security and Technology's Ransomware Task Force says a shift to big game hunting tactics led to a significant rise in attacks last year. Continue Reading
-
News
24 Sep 2024
Arkansas City water treatment facility hit by cyberattack
While disruptions are limited, the attack on the water treatment facility highlights how the critical infrastructure sector remains a popular target for threat actors. Continue Reading
-
Tutorial
24 Sep 2024
How to use tcpreplay to replay network packet files
The suite of tools that comprise tcpreplay offers administrators a variety of network security options. Learn some of the benefits of this free utility. Continue Reading
-
Tip
19 Sep 2024
DNS security best practices to implement now
DNS is a key component in any enterprise network. Auditing DNS servers and encrypting DNS traffic are just two of the steps to take to protect your organization's DNS deployment. Continue Reading
-
Podcast
19 Sep 2024
SecOps' new frontier in the remote work era: HR
A CISO shares the story of how his SOC staff caught and contained a North Korean agent posing as a software engineer, saying he hopes to raise awareness of a growing threat. Continue Reading
-
News
19 Sep 2024
FBI disrupts another Chinese state-sponsored botnet
The FBI said the massive botnet, which included 260,000 connected devices, was developed and operated by a publicly traded Chinese company named Integrity Technology Group. Continue Reading
-
News
18 Sep 2024
Orca: AI services, models falling short on security
New research from Orca Security shows that AI services and models in cloud contain a number of risks and security shortcomings that could be exploited by threat actors. Continue Reading
-
News
13 Sep 2024
Fortinet confirms data breach, extortion demand
Fortinet confirmed that a threat actor stole data from a third-party cloud-based shared file drive, which affected a small number of customers, but many questions remain. Continue Reading
-
Answer
11 Sep 2024
HTTP vs. HTTPS: What's the difference?
HTTP and HTTPS are web communication protocols. HTTP lacks security, while HTTPS encrypts data to adhere to the security standards of confidentiality, integrity and authenticity. Continue Reading
-
News
09 Sep 2024
Akira ransomware gang targeting SonicWall VPN accounts
Arctic Wolf recently observed the Akira ransomware gang compromising SonicWall SSL VPN accounts, which could be connected to a critical vulnerability in SonicOS. Continue Reading
-
Definition
06 Sep 2024
What is network detection and response (NDR)?
Network detection and response (NDR) technology continuously scrutinizes network traffic to identify suspicious activity and potentially disrupt an attack. Continue Reading
-
News
06 Sep 2024
Ransomware rocked healthcare, public services in August
Ransomware remained a highly disruptive threat last month, as notable attacks claimed victims in healthcare, technology, manufacturing and the public sector. Continue Reading
-
News
04 Sep 2024
White House unveils plan to improve BGP security
The Office of the National Cyber Director has published a roadmap for internet routing security that outlines recommendations for mitigating BGP hijacking and other threats. Continue Reading
-
News
03 Sep 2024
FBI: North Korean hackers targeting cryptocurrency employees
North Korean state-sponsored threat actors have been conducting successful social engineering campaigns against cryptocurrency employees over the last several months. Continue Reading
-
News
29 Aug 2024
Russia's APT29 using spyware exploits in new campaigns
A new report from Google TAG suggests that Russia's APT29 is using vulnerability exploits first developed from spyware vendors to target Mongolian government websites. Continue Reading
-
News
22 Aug 2024
GuidePoint talks ransomware negotiations, payment bans
GuidePoint Security's Mark Lance discusses the current ransomware landscape and the steps that go into negotiating potential payments with cybercriminal gangs. Continue Reading
-
News
21 Aug 2024
Microchip Technology discloses cyberattack, business delays
The microprocessor manufacturer says it detected malicious activity in its network over the weekend, which disrupted business operations and impaired its ability to fulfill orders. Continue Reading
-
Video
21 Aug 2024
An explanation of cybersecurity
Cybersecurity protects internet-connected systems from attacks, covering hardware, software and data. Continue Reading
-
Definition
16 Aug 2024
What is an endpoint protection platform (EPP)?
An endpoint protection platform (EPP) is a security technology that safeguards endpoint devices. Continue Reading
-
Feature
15 Aug 2024
The 5 different types of firewalls explained
The firewall remains a core fixture in network security. But, with five types of firewalls, three firewall deployment models and multiple placement options, things can get confusing. Continue Reading
-
Tip
15 Aug 2024
How to select an MDR security service
With the threat landscape as challenging as it is, organizations are looking for reinforcements. One option is to bolster detection and response via third-party MDR services. Continue Reading
-
News
07 Aug 2024
Akamai warns enterprises that VPN attacks will only increase
During Black Hat USA 2024, Akamai's Ori David revealed new VPN post-exploitation techniques that open the attack vector to threat actors of all skill levels. Continue Reading
-
Tip
07 Aug 2024
12 types of endpoint security
With the rise of remote work, mobile devices and IoT, the traditional security perimeter extends beyond corporate networks, making endpoint security crucial for organizations. Continue Reading
-
Tutorial
07 Aug 2024
Examine a captured packet using Wireshark
Wireshark is a useful tool for capturing network traffic data. Network pros can make the most of the tool by analyzing captured packets to see what that data means for troubleshooting. Continue Reading
-
Definition
02 Aug 2024
What is endpoint security? How does it work?
Endpoint security is the protection of endpoint devices against cybersecurity threats. Continue Reading
-
News
01 Aug 2024
InfoSec community sounds off on CrowdStrike outage, next steps
Security experts offered their thoughts on the recent IT outage, praising CrowdStrike's response time but saying the outage highlights issues in the software updating process. Continue Reading
-
News
30 Jul 2024
Microsoft: Ransomware gangs exploiting VMware ESXi flaw
VMware ESXi has proven to be a popular target for ransomware threat actors and a challenge for enterprises to patch. Continue Reading
-
Feature
29 Jul 2024
How the Change Healthcare attack may affect cyber insurance
UnitedHealth's Change Healthcare attack continued to show the devastating aftermath of supply chain attacks. Experts say it could change contingent language for future policies. Continue Reading
-
Definition
29 Jul 2024
What is SSH (Secure Shell) and How Does It Work?
SSH (Secure Shell or Secure Socket Shell) is a network protocol that gives users -- particularly systems administrators -- a secure way to access a computer over an unsecured network. Continue Reading
-
Tutorial
25 Jul 2024
How to use PuTTY for SSH key-based authentication
This tutorial on the open source PuTTY SSH client covers how to install it, its basic use and step-by-step instructions for configuring key-based authentication. Continue Reading
-
News
24 Jul 2024
KnowBe4 catches North Korean hacker posing as IT employee
KnowBe4 says it hired a new principal security engineer for its internal AI team, but quickly detected suspicious activity originating from the employee's workstation. Continue Reading
-
Tip
24 Jul 2024
What is ERP security and why is it critical?
An ERP system is vulnerable whether it's on premises or in the cloud, and supply chain attacks continue to increase. Learn why it's important to secure your company's ERP software. Continue Reading
-
Tutorial
23 Jul 2024
Intro: How to use BlackArch Linux for pen testing
BlackArch Linux offers a lot of pen testing and security benefits, but it requires knowledgeable and independent professionals who can put the distribution to work. Continue Reading
-
Video
23 Jul 2024
WPA2 vs. WPA3
Wireless security has evolved from WEP to WPA protocols and play a pivotal role in safeguarding against cyberattacks. Continue Reading
-
News
23 Jul 2024
Dragos: New ICS malware FrostyGoop abuses Modbus
Dragos published research Tuesday unveiling an industrial control systems-focused malware it dubbed FrostyGoop that targets Modbus to disrupt critical infrastructure. Continue Reading
-
News
22 Jul 2024
Microsoft: Faulty CrowdStrike update affected 8.5M devices
Microsoft says less than 1% of all Windows machines were affected by a defective CrowdStrike Falcon update on Friday, but the disruption has been widespread. Continue Reading
-
Tip
22 Jul 2024
Where to place a firewall in an enterprise network
Firewalls are a foundational element of a strong security posture, and their positioning affects both enterprise performance and cyberdefense. Continue Reading
-
Answer
19 Jul 2024
How to protect port 139 from SMB attacks
Keeping port 139 open is perfectly normal -- but only for good reason. Without the proper protections, it can present a major security risk. Continue Reading
-
News
18 Jul 2024
Fin7 helps ransomware gangs with EDR bypass
SentinelOne found the Russia-based cybercriminal group is helping other threat actors, including ransomware gangs, to evade detection with a custom tool named AvNeutralizer. Continue Reading
-
News
11 Jul 2024
Ransomware gangs increasingly exploiting vulnerabilities
New research from Cisco Talos highlighted three of the most popular known vulnerabilities that were exploited by ransomware gangs for initial access during 2023 and 2024. Continue Reading
-
Answer
11 Jul 2024
CASB vs. SASE: What's the difference?
CASB and SASE enhance network and SaaS application security. CASB acts as a security layer for cloud services, while SASE integrates networking and security into one framework. Continue Reading
-
Tip
11 Jul 2024
Understand the uses of blockchain in data centers
Blockchain is most famous for its cryptocurrency applications, but data centers can employ it for a variety of business-related reasons -- including increased security. Continue Reading
-
News
09 Jul 2024
Governments issue warning on China's APT40 attacks
Government agencies say APT40 continues to pose significant risk to organizations across the globe by exploiting vulnerabilities in public-facing applications. Continue Reading
-
News
08 Jul 2024
Ransomware hits CDK Global, public sector targets in June
The prevalent threat continued to cause disruptions last month as city halls were forced to close and auto dealerships faced downstream effects after an attack against CDK Global. Continue Reading
-
Definition
05 Jul 2024
What is a cyber attack? How they work and how to stop them
A cyber attack is any malicious attempt to gain unauthorized access to a computer, computing system or computer network with the intent to cause damage. Continue Reading
-
Feature
01 Jul 2024
Compare 5 single-vendor SASE providers
SASE has broad enterprise appeal because it combines security and connectivity. With so many vendor options available, enterprises might need help narrowing the search. Continue Reading
-
News
27 Jun 2024
Supply chain attacks conducted through Polyfill.io service
In February, a Chinese company named Funnell bought the Polyfill.io domain, which sparked concerns in the infosec community about potential supply chain threats. Continue Reading
-
Answer
26 Jun 2024
SPF, DKIM and DMARC: What are they and how do they work together?
Internet protocols for email authentication -- SPF, DKIM and DMARC -- coordinate defense against spammers, phishing and other spoofed email problems. Continue Reading
-
Definition
25 Jun 2024
What is security information and event management (SIEM)?
Security information and event management (SIEM) is an approach to security management that combines security information management (SIM) and security event management (SEM) functions into one security management system. Continue Reading
-
News
21 Jun 2024
Biden administration bans Kaspersky Lab products in US
The Biden administration announced a ban on Kaspersky Lab products inside the United States due to the antivirus vendor's ties with the Russian government. Continue Reading
-
News
20 Jun 2024
SolarWinds Serv-U vulnerability under attack
The Centre for Cybersecurity Belgium observed exploitation against CVE-2024-28995, a high-severity vulnerability in SolarWind's Serv-U file transfer product. Continue Reading
-
News
20 Jun 2024
Phoenix SecureCore UEFI firmware bug affects Intel processors
Multiple Intel processors and hundreds of PC models are potentially vulnerable to a recently disclosed vulnerability in Phoenix SecureCore UEFI firmware. Continue Reading
-
News
18 Jun 2024
EPAM denies link to Snowflake customer attacks
EPAM, a Belarusian software company, said an investigation found no evidence that it was connected to recent attacks against Snowflake customer databases. Continue Reading
-
Definition
18 Jun 2024
DNS attack
A DNS attack is an exploit in which an attacker takes advantage of vulnerabilities in the domain name system. Continue Reading
-
Feature
17 Jun 2024
CASB vs. CSPM vs. CWPP: Comparing cloud security tool types
Let's break down some cloud security alphabet soup. CASB, CSPM and CWPP overlap to an extent, but you'll want to pay close attention to how they accomplish different things. Continue Reading
-
Definition
13 Jun 2024
secure access service edge (SASE)
Secure access service edge (SASE), pronounced sassy, is a cloud architecture model that bundles together network and cloud-native security technologies and delivers them as a single cloud service. Continue Reading
-
Definition
13 Jun 2024
Transmission Control Protocol (TCP)
Transmission Control Protocol (TCP) is a standard protocol on the internet that ensures the reliable transmission of data between devices on a network. Continue Reading
-
News
12 Jun 2024
Black Basta might have exploited Microsoft flaw as zero-day
While investigating a ransomware attack, Symantec found evidence that suggests Black Basta threat actors exploited a Microsoft vulnerability as a zero-day. Continue Reading
-
Answer
12 Jun 2024
Zero trust vs. defense in depth: What are the differences?
Security administrators don't have to choose between zero-trust and defense-in-depth cybersecurity methodologies. Learn how the two frameworks complement each other. Continue Reading
-
Tip
11 Jun 2024
SASE vs. SSE: Explaining the differences
Most security professionals are familiar with secure access service edge, but now, there's a new tool for administrators to consider: security service edge. Continue Reading
-
Tip
10 Jun 2024
Why it's SASE and zero trust, not SASE vs. zero trust
When it comes to adopting SASE or zero trust, it's not a question of either/or, but using SASE to establish and enable zero-trust network access. Continue Reading
-
Guest Post
07 Jun 2024
SASE operational pain points and how to fix them
SASE offers companies a compelling security strategy, but it takes time to ensure network teams have the visibility and management oversight they need. Continue Reading
-
Definition
07 Jun 2024
proof of concept (PoC) exploit
A proof of concept (PoC) exploit is a nonharmful attack against a computer or network. PoC exploits are not meant to cause harm, but to show security weaknesses within software. Continue Reading
-
News
06 Jun 2024
Critical Progress Telerik vulnerability under attack
Threat actors are targeting vulnerable Progress Telerik Report Server systems just days after a proof of concept was published detailing a vulnerability exploit chain. Continue Reading
-
News
06 Jun 2024
Ransomware ravaged schools and cities in May
The public sector took the brunt of ransomware in May, while another damaging attack against a healthcare company disrupted patient access to pharmacy services. Continue Reading
-
News
03 Jun 2024
Mandiant: Ransomware investigations up 20% in 2023
The cybersecurity company observed a sharp rise in activity on data leak sites in 2023 as well as an increase in ransomware actors using legitimate commercial tools during attacks. Continue Reading