Comprehensive software reviews to make better IT decisions
Hacker Compromises Data of 106 Million Capital One Customers
Tech worker Paige A. Thompson has been charged with computer fraud for compromising the data of 106 million Capital One customers.
Thompson took advantage of a firewall misconfiguration to access data stored in a Capital One cloud server.
The cloud provider was confirmed as Amazon Web Services. Thompson was also revealed to be a former Amazon Web Services employee.
Source: SoftwareReviews Amazon Web Services Scorecard, accessed August 14, 2019
In their statement, Capital One said that “this type of vulnerability is not specific to the cloud.” What this means is that the data breach had nothing to do with security vulnerabilities of Amazon Web Services itself. The problem instead lay with a misconfigured firewall internal to Capital One.
Indeed, the relevant takeaway from this story is probably not to do with the security of Amazon Web Services. It is instead to do with why Capital One’s own Cloud Custodian – an open source governance, security, and compliance engine for cloud services – overlooked this firewall misconfiguration.
As always, clients should ensure that data stored anywhere (either in the cloud or otherwise) is protected by secure firewalls. Info-Tech’s security blueprints offer effective strategies to ensure clients can appropriately select and implement firewalls, alongside specific information on cloud security.
Source: Info-Tech Research Group Ensure Cloud Security in IaaS, PaaS, and SaaS Environments
Want to Know More?
Information security leaders fully understand the importance of having a security incident and event management (SIEM) solution, but teams need to overcome three main challenges before considering purchasing a SIEM solution.
Chronicle, Alphabet’s enterprise security company, expands its North American partner base with Herjavec Group, its first Canadian partner. Herjavec Group is the first service provider in Canada to be certified in, and provide access to, Chronicle’s security intelligence products.
Qualys VMDR and Ivanti have announced a new partnership dedicated to improving the detection and patching of vulnerabilities. Announced July 30, the Qualys and Ivanti Partnership have already gone live as an integrated component of the VMDR solution.
IBM is changing the terms of its ubiquitous Passport Advantage agreement to remove entitled discounts on over 5,000 on-premises software products, resulting in an immediate price increase for IBM Software & Support (S&S) across its vast customer landscape.
RiskSense announced on July 13 its new version of the cloud-delivered RiskSense risk management platform. The main draw of the program is its holistic risk calculation across CVEs and CWEs.
Thinking about choosing a new software vendor but don't know where to start? Narrow down your shortlist by focusing on software that has received an Info-Tech Research Group award. New data from SoftwareReviews shows that organizations reported higher satisfaction when they switched to software that had received an Info-Tech award.
Cyberthreats are omnipresent for any enterprise. Monitoring ingress and egress points while still conducting business is a balance security professionals attempt to strike. Couple this with the continued security issues around remote work during the pandemic, and security teams have their hands full.
On May 26, Kenna Security released its new Prioritization to Prediction Benchmark Survey. This free tool provides organizations with the ability to compare their vulnerability management programs to industry averages Kenna Security has compiled over the years.
COVID-19 has changed a great deal about how businesses operate. From a security perspective, however, COVID-19 caught many businesses off guard. The shift from working in the office to working from home has made it difficult for security measures to keep pace. Specifically, how are businesses meant to maintain the same secure networks when their employees are no longer working in the office? Outside of the security of the IT departments, IT and security have a tough time ensuring that patching and vulnerability management remain at the forefront of a business’s priorities.