Duo's Security Blog

OCTOBER 6, 2023

.” – Richard Hall, Senior Director IT Infrastructure and Operations, Financial Force Phase 3: Enabling access to apps Enable access to applications with VPN-less access (e.g., ZTNA) – regardless of location or protocol.

Authentication 144

Authentication Risk Social Engineering InfoSec 144

Security Boulevard

FEBRUARY 27, 2023

and 3rd party vendors (VPN to cloud provider, service provider, etc.). If supermarkets can apply this type of thinking and control, how does this align with infosec & cybersecurity? This is why we have so many different usernames and passwords for all sorts of businesses and services. Download it on Github.

InfoSec 52

InfoSec Cybersecurity Risk Technology 52

Digital Shadows

OCTOBER 23, 2024

Figure 3: Scattered Spider attack timeline Social Engineering: Fool Me Once, Fool Me Twice To gain initial access to the target network, the threat actor called the organization’s IT help desk and persuaded staff to reset the CFO’s account password. This isn’t the first time we’ve seen Scattered Spider target password managers.

Social Engineering 122

Social Engineering Engineering Accountability Backups 122

Duo's Security Blog

APRIL 5, 2021

In this talk, Brad will discuss how Cisco’s Zero Trust rollout was not only a logistical challenge with 100,000 global users and a complex mix of cloud and on-premises applications, but also a huge shift in how the company itself thought about networks, perimeters, and security (including reducing its own VPN usage).

CISO 97

CISO InfoSec Financial Services Marketing 97

Cisco Security

AUGUST 26, 2021

We constantly see new threats, and threat vectors, come and go; which puts a tremendous strain on the InfoSec teams that have to protect organizations and businesses from these threats. CyberArk reduces VPN risk with MFA enforcement on any VPN client that supports RADIUS; including Cisco Secure Firewall. Read more here.

Technology 145

Technology Firewall VPN Authentication 145

Pen Test Partners

JULY 1, 2024

There has been a lot of talk on various infosec news feeds about the RegreSSHion vulnerability. Numerous limiting factors may be applied and should be considered such as Access Control Lists (ACL) or Virtual Private Networks (VPN). The flaw results from importer input validation in OpenSSH’s handling of SSH connections.

InfoSec 83

InfoSec Authentication VPN Firewall 83

Security Boulevard

MARCH 29, 2023

TAP abuse helps us with that issue in two ways: We can add a temporary password to a victim user without invalidating their existing password, ensuring that the user won’t notice a password change. This means that we can use this password directly, without needing a second factor like an application code or SMS.

Authentication 64

Authentication VPN Passwords Social Engineering 64

Digital Shadows

OCTOBER 23, 2024

Figure 3: Scattered Spider attack timeline Social Engineering: Fool Me Once, Fool Me Twice To gain initial access to the target network, the threat actor called the organization’s IT help desk and persuaded staff to reset the CFO’s account password. This isn’t the first time we’ve seen Scattered Spider target password managers.

Social Engineering 52

Social Engineering Engineering Accountability Backups 52

Errata Security

MAY 19, 2020

They are already involved in securing the server side, the work-at-home desktop, the VPN, and all the other network essentials. If there's one thing that the entire cybersecurity industry is agreed about (other than hating the term cybersecurity, preferring "infosec" instead) is that you need this vulnerability disclosure program.

Engineering 41

Engineering VPN Encryption Marketing 41

ForAllSecure

MARCH 1, 2022

Vamosi: Within InfoSec there's an informal use of AppSec as well. And I use a VPN that doesn't log my websites. Don't use familiar passwords seriously. If you want nothing to connect back to you choose an entirely new set of passwords. You need a VPN. You want a VPN that doesn't log transactions.

Hacking 52

Hacking Mobile Cryptocurrency VPN 52