We recently discussed the new SEC rule requiring all registered companies to report material cyber incidents within four (4) days. Now the National Credit Union Administration (NCUA)1 has updated their Cyber Incident Notification Rule, requiring all federally insured Credit Unions to notify the NCUA of any cyber incident no more than 72 hours after detection.2 In this post, we’ll provide a quick summary of the new requirements and how it impacts not only US Credit…
We recently hosted a compact and very engaging panel discussion about the new SEC Cyber Incident Reporting Rules due to come into effect later this year. We were fortunate to be joined by two well-known experts: Sue Bergamo, a CISO, CIO, Board Member, Executive Advisor, and Investor with a track record of effectively transforming people-process-technology to meet business needs – most recently at BTE Partners. Mike Wilkes, Adjunct Professor at NYU and former CISO at…
Introduction For any association that cycles, stores or sends charge card information, entrance testing has been a commitment since 2013. That is the point at which the consistence necessities set up by the Payment Card Industry Security Standards Council (PCI SSC) were refreshed to mirror the developing danger enemies posture to the validity of the Mastercard business. The progressions are very much promoted across the PCI people group; be that as it may, numerous associations…
Wallarm has rolled out the update to detect and mitigate CVE-2021-44228. No additional actions are required from the customers Attempts at exploitation will be automatically blocked in a blocking mode When working in a monitoring mode, consider creating a virtual patch Log4Shell A 0-day exploit in the Java core library log4j was discovered that results in Remote Code Execution (RCE) by simple 1-line exploit with JNDI URL. Given how ubiquitous this library is, the impact…
We all know how it’s convenient to use tools like Sentry or Datadogs for JavaScript events monitoring. It allows to catch errors in real-time, organize and manage issues resolution process, and genuinely shift left operations to developers. But Wallarm security experts warn of dangerous patterns to use such tools integrated into UI since it can cause private data-stealing from authenticated users in an almost invisible way. This article will explain how it could happen and…
This article explains how to exploit Oracle WebLogic for remote code execution by using valid credentials. It’s useful during black-box security audits, pentests, and infrastructure audits, including automated vulnerability scanning. To set up an example playground, we will use the following docker container: docker run -p7001:7001 –name weblogic –rm vulhub/weblogic:12.2.1.3 Again, we need to have management rights & access to the administrator console (/console web endpoint) to cause remote code execution in Oracle WebLogic. In…
Subscribe for the latest news
Subscribe