Infrastructure Security: Page

Amid explosive growth, API security a growing concern

APIs are expanding exponentially across the technology landscape and creating a vast attack surface that enterprise security teams are struggling to understand and defend.

By Arielle Waldman • Oct. 28, 2021

payload (computing)

In computing, a payload is the carrying capacity of a packet or other transmission data unit.

By Peter Loshin, Andrew Froehlich • Oct. 25, 2021

Chris Krebs weighs in on zero trust, FBI web shell removal

Regarding the FBI action to silently remove web shells from vulnerable Exchange Servers, former CISA director Chris Krebs said he expects to see the action again if appropriate.

By Alexander Culafi • Oct. 20, 2021

cryptographic nonce

A nonce is a random or semi-random number that is generated for a specific use.

By Ben Lutkevich • Oct. 8, 2021

What is an SSL VPN (Secure Sockets Layer virtual private network)?

An SSL VPN is a type of virtual private network (VPN) that uses the Secure Sockets Layer (SSL) protocol -- or, more often, its successor, the Transport Layer Security (TLS) protocol -- in standard web browsers to provide secure, remote access VPN capability.

By Linda Rosencrance • Oct. 7, 2021

5 principles for AppSec program maturity

Applications remain a top cause of external data breaches. Follow these five principles to achieve application security program maturity.

By Nabil Hannan • Oct. 4, 2021

Microsoft releases emergency Exchange Server mitigation tool

Microsoft turned its attention to organizations that are slower to patch by releasing an emergency mitigation tool as a temporary fix against current threats.

By Arielle Waldman • Sept. 28, 2021

Symantec: Staging activity observed on Exchange servers

Threat actors appear to be targeting Microsoft Exchange servers with pre-ransomware activity, including one attempt to exfiltrate data.

By Arielle Waldman • Sept. 22, 2021

SS7 attack

An SS7 attack is a security exploit that takes advantage of a weakness in the design of SS7 (Signaling System 7) to enable data theft, eavesdropping, text interception and location tracking.

By TechTarget Contributor • Aug. 27, 2021

How to navigate cybersecurity product coverage

Cybersecurity tools are complex. It can be difficult for organizations to know which tools do what, and which tools they need -- or don't.

By Rohit Dhamankar • Aug. 27, 2021

Wired Equivalent Privacy (WEP)

Wired Equivalent Privacy (WEP) is a security protocol, specified in the IEEE Wireless Fidelity (Wi-Fi) standard, 802.11b.

By Peter Loshin • Aug. 27, 2021

Why zero-trust models should replace legacy VPNs

Many organizations use legacy VPNs to secure their networks, especially in the work-from-home era. Expert Pranav Kumar explains why zero-trust models are a safer option.

By Pranav Kumar • Aug. 23, 2021

MD5

The MD5 (message-digest algorithm) hashing algorithm is a one-way cryptographic function that accepts a message of any length as input and returns as output a fixed-length digest value to be used for authenticating the original message.

By Peter Loshin, Mary Shacklett • Aug. 23, 2021

Many Exchange servers still vulnerable to ProxyLogon, ProxyShell

Tens of thousands of Exchange servers are still vulnerable to ProxyLogon and ProxyShell, and security researchers estimate honeypots represent only a small slice of those systems.

By Alexander Culafi • Aug. 17, 2021

Palo Alto Networks: Personal VPNs pose risks to enterprises

Researchers from Palo Alto Networks published a new report detailing the risks that personal VPNs pose to enterprise networks, including evasion tactics to bypass firewalls.

By Arielle Waldman • Aug. 17, 2021

Cloud-native security benefits and use cases

'Cloud native' has described applications and services for years, but its place in security is less clear. Get insight into cloud-native security from expert Dave Shackleford.

By Dave Shackleford • Aug. 11, 2021

Researchers crack new Let’s Encrypt validation feature

Multiperspective validation can be thwarted with a traffic-throttling technique that could lead to attackers obtaining digital certificates for domains they don't own.

By Shaun Nichols • Aug. 4, 2021

14 flaws in NicheStack put critical infrastructure at risk

The vulnerability disclosure process for Infra:Halt, a set of flaws impacting critical infrastructure, took nearly a year, due to the nature of supply chain vulnerabilities.

By Alexander Culafi • Aug. 4, 2021

Network security in the return-to-work era

IT teams are dealing with the challenge of reconnecting devices to office networks as employees return to work. Here's how your organization can overcome that challenge.

By Jonathan Meyers • Aug. 2, 2021

Keycloak tutorial: How to secure different application types

IT pros and developers can secure applications with the open source IAM tool Keycloak. When you don't need to worry about passwords, it reduces the potential attack surface.

By Packt Publishing, Kyle Johnson • July 30, 2021

Secure applications with Keycloak authentication tool

As we look toward the future of authentication, open source tools, such as Keycloak, provide companies a way to secure applications to its specific needs.

By Kyle Johnson • July 30, 2021

Kaspersky tracks Windows zero days to ‘Moses’ exploit author

In its second-quarter threat report, Kaspersky Lab found a rise in the use of exploits and zero-day vulnerabilities, several of which were traced to a single threat actor.

By Arielle Waldman • July 29, 2021

Automate app security with SaaS security posture management

Keeping track of cloud application security settings and configurations businesswide is no easy task. Automate this cumbersome task with SSPM.

By Ed Moyle • July 21, 2021

How to prevent software piracy

Pirated software is still a major concern nowadays. Uncover how to prevent software piracy and protect your organization's intellectual property.

By Michael Cobb, Mike Rothman • July 15, 2021

passive attack

A passive attack is a network attack in which a system is monitored and sometimes scanned for open ports and vulnerabilities.

By TechTarget Contributor • July 13, 2021