Okta investigating reports of data breach by Lapsus$ ransomware cybercriminal group (updated)
Identity and authentication services firm Okta is investigating reports that the firm has been breached by the Lapsus$ ransomware cybercriminal group.
Identity & Access Management
FIPS 201-3: Personal Identity Verification (PIV) of Federal Employees and Contractors
The U.S. Secretary of Commerce has approved the publication of FIPS 201-3, the National Institute of Standards and Technology (NIST) latest revision of “Personal Identity Verification (PIV) of Federal Employees and Contractors.”
NSA and CISA release guidance on securing remote access VPNs
The National Security Agency (NSA) and the Cybersecurity and Infrastructure Security Agency (CISA) have released a joint Cybersecurity Information Sheet selecting and securing remote access VPNs.
NIST SP 800-204B: Attribute-based Access Control for Microservices-based Applications using a Service Mesh
The National Institute of Standards and Technology (NIST) has issued the NIST SP 800-204B Attribute-based Access Control for Microservices-based Applications using a Service Mesh.
Critical ForgeRock Access Management vulnerability (CVE-2021-35464) exploited
A Critical ForgeRock Access Management (AM) vulnerability (CVE-2021-35464) has been exploited in the wild. The issue affects ForgeRock’s OpenAM, open-source AM solution.
Hacker remotely accesses Florida water treatment plant, bumps chemical level to “dangerous levels”
A hacker remotely accessed a Florida city water treatment plant and attempted to increase the chemical level to “dangerous levels” before the cyberattack was thwarted.
NIST SP 800-210: General Access Control Guidance for Cloud Systems
The National Institute of Standards and Technology (NIST) has issued the NIST SP 800-210 General Access Control Guidance for Cloud Systems.
Cisco says telnet vulnerability affects IOS XE software (CVE-2020-10188)
Cisco has released a High severity security advisory for a telnet vulnerability that affects Cisco IOS XE software.
Microsoft releases Zero Trust guidance for Azure AD
Microsoft has released new Zero Trust guidance for Azure Active Directory (Azure AD). The guidance is part of a broader “Zero Trust Security Strategy” to help organizations provide more secure access to corporate resources.
Alert: Threat actors continue to exploit patched Pulse Secure VPN devices
Organizations that are running Pulse Security VPN devices may still be at risk of being exploited, even if previously patched, according to a new Department of Homeland Security (DHS) advisory. The risk is elevated if an actor previously exploited CVE-2019-11510 and stole AD credentials from the victim organization.