December 11, 2024 at 08:46AM Snowflake will require all customers to enable multifactor authentication (MFA) by November 2025, following a three-phase policy change. After incidents of attacks on customers, this measure aims to enhance security, with guides available for migration. Failure to comply will result in access being blocked after specified deadlines. ### Meeting Takeaways: … Read more
November 26, 2024 at 02:38PM Amazon Web Services updated Amazon Cognito, enhancing identity and access management capabilities for developers. Key features now include passwordless login options, a streamlined developer console, and tiered pricing (Lite, Essentials, Plus) based on user needs. Enhanced security features are available in the higher tiers, excluding AWS GovCloud regions. ### Meeting … Read more
November 5, 2024 at 06:49AM IBM Security Verify Access has 32 vulnerabilities that attackers could exploit, potentially compromising the entire authentication infrastructure. This alarming discovery was disclosed by a researcher and highlights significant security risks. The findings were reported by SecurityWeek. **Meeting Takeaways:** 1. **Security Vulnerability Report**: Researchers identified 32 vulnerabilities in IBM Security Verify … Read more
November 4, 2024 at 04:07PM Okta has resolved an authentication bypass vulnerability affecting long usernames and complex domain names, which could have enabled unauthorized access under specific conditions. Discovered on October 30, it remained undetected for three months. Customers are urged to check logs for unusual activity and implement multifactor authentication for added security. **Meeting … Read more
October 28, 2024 at 12:06PM A security update for watchOS 11.1, available for Apple Watch Series 6 and later, addresses multiple vulnerabilities including authentication issues, memory corruption, and sensitive data exposure. Improvements include enhanced checks, memory management, and input validation to prevent unauthorized access and system crashes. Release date is October 28, 2024. ### Meeting … Read more
October 22, 2024 at 10:30AM A recently patched vulnerability in Styra’s Open Policy Agent (CVE-2024-8260) could have allowed attackers to leak NTLM credentials, enabling authentication relay or password cracking. Proper input validation issues and specific prerequisites were identified. This highlights the ongoing risks associated with NTLM, prompting Microsoft to plan its retirement in Windows 11. … Read more
October 21, 2024 at 05:23PM Nearly half of organizations have long-lived credentials in cloud services, increasing risks of data breaches. Datadog’s 2024 report indicates many credentials are outdated or unused, often leaking in source code. To enhance security, experts recommend avoiding long-lived credentials and adopting short-lived ones along with modern authentication methods. ### Meeting Takeaways: … Read more
September 19, 2024 at 01:36AM GitLab released patches to address a critical flaw in both Community and Enterprise Editions, rooted in the ruby-saml library, allowing an authentication bypass. The vulnerability affects single sign-on security, prompting the update of dependencies and urging self-managed installations to enable two-factor authentication as a mitigation. Threat indicators suggest active exploitation … Read more
September 18, 2024 at 06:47AM Microsoft Azure Private 5G Core (AP5GC) has two critical vulnerabilities. The first (CVE-2024-20685) can lead to potential service outages, while the second (ZDI-CAN-23960) can disrupt network operations. These exploits underscore systemic weaknesses, particularly the lack of mandatory authentication procedures between base stations and packet-cores, posing potential denial-of-service threats. From the … Read more
September 12, 2024 at 09:36AM Bad actors target Internet-exposed Selenium Grid instances for illicit cryptocurrency mining and proxyjacking. The lack of authentication makes these instances vulnerable. Threat actors exploit this to carry out malicious actions, including deploying crypto miners and proxyware solutions EarnFM and IPRoyal Pawn. Organizations are urged to configure authentication to prevent abuse. … Read more