Security Operations: Page

Security posture management a huge challenge for IT pros

Enterprise Strategy Group's John Oltsik explains why executing security hygiene and posture management at scale remains an uphill battle for organizations, despite automation.

By Linda Tucci • Oct. 10, 2023

Physical pen testing methods and tools

While companies regularly conduct network penetration tests, they may overlook physical office security. Here's how attackers -- with a baseball cap and smartphone -- get in.

By Rob Shapland • Oct. 10, 2023

CSSLP (Certified Secure Software Lifecycle Professional)

CSSLP (Certified Secure Software Lifecycle Professional) is a certification from ISC2 that focuses on application security within the software development lifecycle (SDLC).

By Madelyn Bacon • Oct. 6, 2023

IBM launches new AI-powered TDR Services

IBM followed its first AI-focused offering from April, QRadar Suite, with an MDR product -- Threat Detection and Response Services -- featuring AI capabilities.

By Alexander Culafi • Oct. 5, 2023

security posture

Security posture refers to an organization's overall cybersecurity strength and how well it can predict, prevent and respond to ever-changing cyberthreats.

By Linda Rosencrance, Cameron Hashemi-Pour • Oct. 3, 2023

How to use Wireshark to sniff and scan network traffic

Wireshark continues to be a critical tool for security practitioners. Learning how to use it to scan network traffic should be on every security pro's to-do list.

By Ed Moyle • Sept. 29, 2023

6 reasons Cisco acquired Splunk

A treasure trove of Cisco and Splunk data, AI and analytics can improve cyber-resilience, accelerate threat detection and response, and enable more intelligent networks.

By Jon Oltsik • Sept. 25, 2023

How to disable removable media access with Group Policy

Removable media can pose serious security problems. But there is a way to control who has access to optical disks and USB drives through Windows' Active Directory.

By Damon Garn • Sept. 22, 2023

How to create a SOAR playbook in Microsoft Sentinel

Using automation through tools such as SOAR and SIEM can improve incident response alert efficiency. One automated feature analysts can use is the SOAR playbook.

By Packt Publishing, Kyle Johnson • Sept. 22, 2023

How SOAR helps improve MTTD and MTTR metrics

By automating initial incident response tasks, SOAR can help SOC analysts improve MTTD and MTTR metrics and ensure they focus on true positive alerts.

By Kyle Johnson • Sept. 22, 2023

Browser companies patch critical zero-day vulnerability

While attack details remain unknown, Chrome, Edge and Firefox users are being urged to update their browsers as an exploit for CVE-2023-4863 lurks in the wild.

By Arielle Waldman • Sept. 13, 2023

10 antimalware tools for ransomware protection and removal

Businesses face billions of malware and ransomware threats each year. Antimalware tools can help enterprises protect their networks and limit any damages that may occur.

By Andrew Froehlich • Sept. 8, 2023

Cut through cybersecurity vendor hype with these 6 tips

Cybersecurity vendor hype can make purchasing decisions difficult. When considering a new product or service, think critically about whether it would truly add business value.

By Jerald Murphy • Sept. 6, 2023

Enterprise dark web monitoring: Why it’s worth the investment

Getting an early warning that your data has been compromised is a key benefit of dark web monitoring, but there are many more. By knowing your enemies, you can better protect your assets.

By Ed Moyle • Aug. 28, 2023

Kemba Walden: We need to secure open source software

During her Black Hat USA 2023 keynote, the acting national cyber director said the White House wants to develop realistic policies to improve the security of open source software.

By Rob Wright • Aug. 10, 2023

Why using ransomware negotiation services is worth a try

If stakeholders decide to pay ransom demands, using a ransomware negotiation service could improve the situation's outcome and lower the payout.

By Kyle Johnson • Aug. 10, 2023

Generative AI takes center stage at Black Hat USA 2023

About one year after generative AI launched into the spotlight, the technology is showing early signs of potential for security at Black Hat USA 2023 in Las Vegas.

By Alexander Culafi • Aug. 10, 2023

Tenable launches LLM-powered ExposureAI product

ExposureAI will be integrated into Tenable One, the vendor's encompassing exposure management platform, and is the latest cybersecurity produce to employ large language models.

By Alexander Culafi • Aug. 9, 2023

Google to discuss LLM benefits for threat intelligence programs

Large language models are the backbone of generative AI products launching in the security space. Google will discuss how best to integrate the technology at this week's Black Hat USA.

By Alexander Culafi • Aug. 7, 2023

Ransomware case study: Recovery can be painful

In ransomware attacks, backups can save the day and the data. Even so, recovery can still be expensive and painful, depending on the approach. Learn more in this case study.

By Alissa Irei • July 18, 2023

The history, evolution and current state of SIEM

SIEM met the need for a security tool that could pinpoint threats in real time. But new threats mean that the next evolution of SIEM will offer even more firepower.

By Michael Cobb • July 12, 2023

Chainalysis observes sharp rise in ransomware payments

The rise in total ransomware payments so far this year is a reversal of the decline Chainalysis saw in 2022, when payments fell sharply to $457 million from $766 million in 2021.

By Rob Wright • July 12, 2023

JumpCloud invalidates API keys in response to ongoing incident

The cloud provider did not give any details about the incident that prompted a mandatory API key rotation, which might have caused service disruptions for customers.

By Arielle Waldman • July 6, 2023

Plan ahead to reduce cloud forensics challenges

Laying out a detailed framework that governs how -- and how quickly -- information is shared by CSPs can help ease the problems associated with collecting forensics data.

By Dave Shackleford • June 22, 2023

Cisco releases new security offerings at Cisco Live 2023

At Cisco Live 2023, Cisco emphasized its plans to emphasize security, rolling out a host of new initiatives from secure access to AI-aided security to cloud-native app security.

By Melinda Marks • June 14, 2023