• Search for:
    27Nov, 2023
    Critical Vulnerabilities Expose ownCloud Users to Data Breaches

    The maintainers of the open-source file-sharing software ownCloud have warned of three critical security flaws that could be exploited to disclose sensitive information and modify files.

    A brief description of the vulnerabilities is as follows –

    • Disclosure of sensitive credentials and configuration in containerized deployments impacting graphapi versions from 0.2.0 to 0.3.0. (CVSS score: 10.0)
    • WebDAV Api Authentication Bypass using Pre-Signed URLs impacting core versions from 10.6.0 to 10.13.0 (CVSS score: 9.8)
    • Subdomain Validation Bypass impacting oauth2 prior to version 0.6.1 (CVSS score: 9.0)

    “The ‘graphapi’ app relies on a third-party library that provides a URL. When this URL is accessed, it reveals the configuration details of the PHP environment (phpinfo),” the company said of the first flaw.

    “This information includes all the environment variables of the web server. In containerized deployments, these environment variables may include sensitive data such as the ownCloud admin password, mail server credentials, and license key.”

    As a fix, ownCloud is recommending to delete the “owncloud/apps/graphapi/vendor/microsoft/microsoft-graph/tests/GetPhpInfo.php” file and disable the ‘phpinfo’ function. It is also advising users to change secrets like the ownCloud admin password, mail server and database credentials, and Object-Store/S3 access keys.

    The second problem makes it possible to access, modify or delete any file sans authentication if the username of the victim is known and the victim has no signing-key configured, which is the default behavior.

    Lastly, the third flaw relates to a case of improper access control that allows an attacker to “pass in a specially crafted redirect-url which bypasses the validation code and thus allows the attacker to redirect callbacks to a TLD controlled by the attacker.”

    Besides adding hardening measures to the validation code in the oauth2 app, ownCloud has suggested that users disable the “Allow Subdomains” option as a workaround.

    The disclosure comes as a proof-of-concept (PoC) exploit has been released for a critical remote code execution vulnerability in the CrushFTP solution (CVE-2023-43177) that could be weaponized by an unauthenticated attacker to access files, run arbitrary programs on the host, and acquire plain-text passwords.

    The issue, discovered and reported by Converge security researcher Ryan Emmons, has been addressed in CrushFTP version 10.5.2, which was released on August 10, 2023.

    “This vulnerability is critical because it does NOT require any authentication,” CrushFTP noted in an advisory released at the time. “It can be done anonymously and steal the session of other users and escalate to an administrator user.”

    Found this article interesting? Follow us on Twitter  and LinkedIn to read more exclusive content we post.

    Resoruce : https://thehackernews.com/2023/11/warning-3-critical-vulnerabilities.html

    1Feb, 2023
    The Different Types of Cybersecurity

    Cyber security is a wide field covering several disciplines. It can be divided into seven main pillars:

    1. Network Security

    Most attacks occur over the network, and network security solutions are designed to identify and block these attacks. These solutions include data and access controls such as Data Loss Prevention (DLP), IAM (Identity Access Management), NAC (Network Access Control), and NGFW (Next-Generation Firewall) application controls to enforce safe web use policies.

    Advanced and multi-layered network threat prevention technologies include IPS (Intrusion Prevention System), NGAV (Next-Gen Antivirus), Sandboxing, and CDR (Content Disarm and Reconstruction). Also important are network analytics, threat hunting, and automated SOAR (Security Orchestration and Response) technologies.

    2. Cloud Security

    As organizations increasingly adopt cloud computing, securing the cloud becomes a major priority. A cloud security strategy includes cyber security solutions, controls, policies, and services that help to protect an organization’s entire cloud deployment (applications, data, infrastructure, etc.) against attack.

    While many cloud providers offer security solutions, these are often inadequate to the task of achieving enterprise-grade security in the cloud. Supplementary third-party solutions are necessary to protect against data breaches and targeted attacks in cloud environments.

    3. Endpoint Security

    The zero-trust security model prescribes creating micro-segments around data wherever it may be. One way to do that with a mobile workforce is using endpoint security. With endpoint security, companies can secure end-user devices such as desktops and laptops with data and network security controls, advanced threat prevention such as anti-phishing and anti-ransomware, and technologies that provide forensics such as endpoint detection and response (EDR) solutions.

    4. Mobile Security

    Often overlooked, mobile devices such as tablets and smartphones have access to corporate data, exposing businesses to threats from malicious apps, zero-day, phishing, and IM (Instant Messaging) attacks. Mobile security prevents these attacks and secures the operating systems and devices from rooting and jailbreaking. When included with an MDM (Mobile Device Management) solution, this enables enterprises to ensure only compliant mobile devices have access to corporate assets.

    5. IoT Security

    While using Internet of Things (IoT) devices certainly delivers productivity benefits, it also exposes organizations to new cyber threats. Threat actors seek out vulnerable devices inadvertently connected to the Internet for nefarious uses such as a pathway into a corporate network or for another bot in a global bot network.

    IoT security protects these devices with discovery and classification of the connected devices, auto-segmentation to control network activities, and using IPS as a virtual patch to prevent exploits against vulnerable IoT devices. In some cases, the firmware of the device can also be augmented with small agents to prevent exploits and runtime attacks.

    6. Application Security

    Web applications, like anything else directly connected to the Internet, are targets for threat actors. Since 2007, OWASP has tracked the top 10 threats to critical web application security flaws such as injection, broken authentication, misconfiguration, and cross-site scripting to name a few.

    With application security, the OWASP Top 10 attacks can be stopped. Application security also prevents bot attacks and stops any malicious interaction with applications and APIs. With continuous learning, apps will remain protected even as DevOps releases new content.

    7. Zero Trust

    The traditional security model is perimeter-focused, building walls around an organization’s valuable assets like a castle. However, this approach has several issues, such as the potential for insider threats and the rapid dissolution of the network perimeter.

    As corporate assets move off-premises as part of cloud adoption and remote work, a new approach to security is needed. Zero trust takes a more granular approach to security, protecting individual resources through a combination of micro-segmentation, monitoring, and enforcement of role-based access controls.

    Resource : https://www.checkpoint.com/cyber-hub/cyber-security/what-is-cybersecurity/

    26Dec, 2022
    Dealing with cloud security shortfalls

    72% of IT leaders believe their companies moved to the cloud without properly understanding the skills, maturity curve, and complexities of making it all work securely, according to a recent CloudBolt Software report.

    The results of the study should be concerning to enterprises:

    • 68% said their organization’s security skill set across all clouds was only “somewhat mature.”
    • Only 8% of respondents confirmed they had implemented highly operationalized cloud security practices when spinning up new compute resources and environments; 83% say that they have “somewhat” done so.
    • Only 6% of respondents say that their companies automatically build security into every workload up front; 51% say they do it “sometimes.”

    “Several years ago in cybersecurity, companies realized that the single greatest threat vector was the individual end user. So, the focus shifted from perimeter and end-point security to automatically applying security at the user level,” said Jeff Kukowski, CEO of CloudBolt.

    “I think this new report reveals a similar parallel in cloud security. Macro solutions that don’t make cloud security automatic at the individual, cloud-provisioning ‘moment of truth’ create lots of opportunity for exposure and leave enterprises only ‘somewhat, sometimes’ secure. I predict 2023 will be the year we see significantly more focus on shoring up these current cloud security shortfalls. It’s a very solvable problem when you apply the right approaches,” Kukowski continued.

    Respondents primarily attributed shortfalls in cloud security at the user level to a growing multi-cloud skills gap and over-reliance on cloud-native security and monitoring tools.

    The multi-cloud skills gap

    As revealed in a previous CII study, there simply aren’t enough people with the necessary skills across all major cloud platforms to effectively address the biggest cloud challenges – including security.

    This latest CII report further validates these findings:

    • 56% of respondents cited “depth of native cloud skill sets/expertise” as a top security concern.
    • 29% pointed to a “lack of talent with deep security expertise” as an issue.

    Organizations rely heavily on cloud-native security tools

    Companies say they are largely utilizing the security tools each public cloud provider offers:

    • 74% said they rely on these tools to provide “adequate security.”
    • 84% indicated that simply using a monitoring tool was the best way to deal with cloud security.
    • 64% believe they can solve their cloud security concerns by embracing HashiCorp’s Terraform.

    However, each is fraught with limitations that create the “somewhat, sometimes” security issues at the user level.

    “People want to believe the cloud-native tools they use will simply take care of security for them,” said Kukowski.

    “But in a multi-cloud world, the unique nuances of settings and required knowledge between each major cloud create plenty of opportunities for errors, omissions, and mistakes by individuals. And monitoring tools alone cannot provide proactive and automatically applied guardrails. Companies appear to have been lulled into a false sense of security. The reality is that proper security processes, protocols and best practices must be built into cloud workloads up front to prevent missteps from happening in the first place. Not somewhat or sometimes – fully and all the time,” Kukowski concluded.

    The CloudBolt Software report is based on a global survey of 350 IT leaders primarily VP+ from enterprises with 5,000 or more employees, executed by the Gartner-owned Pulse research platform.

    Resource : https://www.helpnetsecurity.com/2022/12/22/dealing-with-cloud-security-shortfalls/?web_view=true

    13Jul, 2021
    9 Best Skills to Learn for the Future

    1. Artificial intelligence 

    You don’t need to work in the artificial intelligence (AI) field to expect to encounter AI in your workplace. 

    Software like hyperautomation and business intelligence, both examples of process automation  enhanced by artificial intelligence, regularly rank among some of the top business technology trends  lists. These technologies are being employed across digitally transformed companies, which now account for approximately 70% of businesses. 

    These technologies are transforming the way businesses function, enhancing the need for employees with artificial intelligence experience across industries. 

    Developing artificial intelligence skills isn’t something that happens overnight, but is sure to be valuable in any company. The first step to understanding artificial intelligence is to learn how it’s developed. This is key to learning how to manipulate and inform artificial intelligence. Once you have the development skills necessary, you’ll have the ability to interact with and learn AI skills. 

    2. Coding 

    Coding has quickly become one of the most sought after skills people can learn. Computing languages serve a variety of purposes and can be applied to almost any job. At this point, coding has become so dominant across industries that experts argue that coding might soon be a basic life skill. 

    Learning to code is one skill that could take some time. The specific computing language you want to become literate in will determine how long it takes you to learn to code. 

    If you want to learn to code, start by looking at different types of computer languages and consider how relevant they would be to your career. 

    Often, people begin with the easiest languages to learn like HTML or JavaScript. After learning the basic languages, you can move on to more popular and widely used languages like Python. 

     3. Cloud computing 

    Cloud computing is a safe way to store and manage company data that also enables remote access to company platforms. 

    The technology has become one of the best ways to leverage and store data securely, making it popular across several companies. 

    If you develop cloud computing skills, you offer the ability to advise your employer on how to best manage their cloud. From remote data storage to multi-cloud computing, understanding the different aspects of the cloud and its possible uses will make you valuable to any company. 

    Understanding the cloud is valuable for managing company-wide data, but on a smaller scope, it is essential for effectively distributing and managing individual projects. 

    Developing cloud computing alongside valuable project management skills can help you secure your career in organizing and managing company processes. 

    4. Blockchain 

    You don’t have to work in finance for blockchain to be relevant to your workplace. Blockchain is characterized as a solution in search of problems, making it a desirable skill for employees to have. 

    Blockchain is driving deep changes to the architecture of corporations. If you understand how blockchain works, you will be in the mindset to find potential problems within your company before they develop into real problems. 

    If you already understand cryptocurrency and trading, you likely have blockchain skills in place. Consider reading different blockchain blogs that further explain how the technology works and can be applied in your company. 

    Knowing more about the way it changes and develops daily will help you advance and apply your blockchain skills. 

    To get familiar with blockchain in real life, start by getting a bitcoin address and a crypto wallet. 

    5. UX design 

    The internet continues to grow as the main source for consumers to find information and products. While it’s important for companies to host a website so that consumers can find them and their products, it doesn’t matter unless they can keep consumers on their site. 

    User experience (UX) design is essential to keeping users on a website. Bad UX design can lead to high bounce rates, which costs companies money. Companies have shifted their focus to UX design in order to stay competitive in the future. 

    Having UX design skills shows employers that you are invested in ensuring users have a good experience. Companies value this skill and mindset, as it proves to be applicable across the board. 

    You can start by taking courses that teach you about design and how to use essential design tools. To fully sharpen your UX skills, you’ll have to do research on the users you are targeting, so that you understand what they want. 

    6. Critical thinking 

    Companies look for critical thinking skills in their employees because critical thinking indicates the ability to solve both vague and complex problems. 

    Management can’t always direct your workflow, which means when you run into problems, it’s likely you’ll need to take on the task yourself. 

    Strong critical thinking skills enable you to find a solution to almost any problem that arises in your daily work. Companies want to know that their workers can handle problems independently, which is why they desire workers with strong critical thinking skills. 

    Critical thinking is a skill that takes self-discipline to further develop. Try thinking “outside of the box” and regularly approach problems from different perspectives. Doing so will help you practice thinking critically about problems and situations. 

    7. Emotional intelligence 

    Emotional intelligence has been described in several ways, but to most, it explains a person’s ability to recognize their own emotions and the emotions of others. 

    A person with strong emotional intelligence understands how to process and regulate their own feelings while being in tune with coworkers’ feelings. 

    Companies look for emotional intelligence in workers because it signifies strong interpersonal skills. Employees that have strong emotional intelligence will be able to communicate, debate, and disagree without the situation getting out of control. 

    This is important in every company that wants to host an honest, collaborative working environment. 

    Emotional intelligence isn’t a skill that can be developed overnight. This soft skill takes time and plenty of attention to your surroundings. Luckily, there are online courses that help you develop your awareness of coworkers’ body language. 

    Taking the steps to better read and understand the situations you’re in, will help enhance your emotional intelligence. 

     8. Communication 

    Communication skills are important for employees at any level within a company to have. 

    Effective communication is essential to company-wide success. Companies where leaders possess strong communication skills are reportedly making a 47% higher return, compared to competitors with poor communication. 

    Companies desire employees with effective communication skills, including verbal and written, to increase revenue return rates. 

    You can develop your communication skills by learning how to effectively speak to groups and individuals through online and in-person soft skill development courses. 

    9. Leadership 

    Possessing strong leadership skills means that you know how to effectively motivate and direct others, setting up your entire team for success. Companies look for leadership skills in employees to promote a successful team and organization. 

    Research has shown that it’s more beneficial for companies to promote internally, rather than hiring externally. This means that when it comes to leadership opportunities, companies are more likely to promote their employees to those positions. 

    If you want to secure a career within your company, it’s important to always be developing leadership and  team development skills to keep you moving up the ladder. 

    Source: https://www.goskills.com/Soft-Skills/Resources/Best-skills-to-learn-for-the-future