Security Leftovers
-
How Cloud-Native Zero-Trust Could Up its Game With Permissions
The cloud-native world could learn a thing or two from the simplicity of mobile application permissions.
-
SANS ☛ Are typos still relevant as an indicator of phishing, (Mon, Oct 16th)
-
Bruce Schneier ☛ Coin Flips Are Biased
Experimental result:
Many people have flipped coins but few have stopped to ponder the statistical and physical intricacies of the process. In a preregistered study we collected 350,757 coin flips to test the counterintuitive prediction from a physics model of human coin tossing developed by Persi Diaconis. The model asserts that when people flip an ordinary coin, it tends to land on the same side it started—Diaconis estimated the probability of a same-side outcome to be about 51%.
-
Silicon Angle ☛ Critical Atlassian Confluence flaw with vulnerability score of 10 draws federal warning
The U.S. Cybersecurity and Infrastructure Agency, the Federal Bureau of Investigation and the Multi-State Information Sharing and Analysis Center today released a Cybersecurity Advisory over a recently disclosed vulnerability in Atlassian Corp.’s Confluence Data Center and Server that opens the door to malicious cyber threat actors.
-
Security Week ☛ Microsoft Improving Windows Authentication, Disabling NTLM [Ed: Possibly to attack some other, existing protocols, as usual]
Microsoft is adding new features to the Kerberos protocol, to eliminate the use of NTLM for Windows authentication.
-
Security Week ☛ Academics Devise Cyber Intrusion Detection System for Unmanned Robots
Australian AI researchers teach an unmanned military robot’s operating system to identify MitM cyberattacks.
-
Security Week ☛ Equifax Fined $13.5 Million Over 2017 Data Breach
UK’s financial watchdog FCA imposes a £11 million (approximately $13.5 million) fine to Equifax over the 2017 data breach.
-
Security Week ☛ Milesight Industrial Router Vulnerability Possibly Exploited in Attacks
A vulnerability affecting Milesight industrial routers, tracked as CVE-2023-4326, may have been exploited in attacks.
-
Security Week ☛ EPA Withdraws Water Sector Cybersecurity Rules Due to Lawsuits
Environmental Protection Agency (EPA) withdraws recent water sector cybersecurity rules due to lawsuits by states and water associations.