The Product Security and Telecommunications Infrastructure (PSTI) Act 2022 and the Security Requirements for Relevant Connectable Products Regulations 2023 are setting new standards for IoT device security in the UK. These regulations mandate manufacturers to secure hardware, software, and APIs against breaches, prohibit default passwords, ensure secure storage of API keys, and implement vulnerability management processes. Learn how these laws impact IoT manufacturers and the steps needed for compliance.

Many consumers are big fans of smart appliances and toys for their ease of use and integration into their smart home setups. However, whenever you can remotely access your smart device, there is always a chance that someone else can too if the manufacturer has not implemented proper security measures. One such incident has caused a wave of media coverage recently - a connected/smart laundry system created by CSC ServiceWorks could be tricked into giving free laundry cycles.

CVE-2024-3400 targets Palo Alto GlobalProtect, allowing attackers to write arbitrary files and execute system commands. Upgrade PAN-OS immediately and learn best practices for preventing future exploits.

As we observe Data Privacy Week, a time dedicated to highlighting the critical importance of data protection, the cybersecurity world is confronted with a monumental event: the “Mother of All Breaches,” a massive data breach compromising 26 billion records.

Discover the shift from traditional data breaches to the rise of scraped data breaches in our latest blog. Understand the nuances of data scraping, its challenges, and the sophisticated tactics used by attackers. Learn about the importance of early detection, proactive measures, and GDPR implications.

Delve into 'Holiday Hacks: Unraveling API Exploits Fueling Digital Fraud' to master ecommerce API security this holiday season. Discover practical tips for detecting and preventing common API vulnerabilities that lead to digital fraud, using tools like OWASP Juice Shop and Burp Suite. This blog guides you through safeguarding your online platform against sophisticated cyber threats during the busiest shopping period.

In the last few weeks, the security community has been shaken by a series of exploits targeting MOVEit, a popular file transfer software. These incidents have exposed critical vulnerabilities, allowing threat actors to compromise sensitive data and exploit organizations ranging from the BBS to several arms of the US Government.

Explore the major findings from the 2023 Verizon Data Breach Investigations Report in our latest blog post. We delve into the rise of social engineering attacks, the human element in breaches, the most affected sectors, and the significance of web application attacks in today's cybersecurity landscape.

In 2019, I hacked 30 bank mobile apps and APIs in coordination with domestic and international financial services and FinTech companies. In 2020-2021, I hacked 30 mobile health (mHealth) apps and FHIR APIs in coordination with healthcare providers, giving me access to thousands of patient records via their APIs due to broken authentication and authorization vulnerabilities. This year, in coordination with federal and state law enforcement agencies, I was able to take remote control of law enforcement vehicles through the automaker’s APIs.

Even the largest companies in the world are susceptible to API vulnerabilities. How modern security defenses fail — and how to fix them.

The majority of organizations rely heavily on third-party web applications connected through APIs to generate revenue and serve customers. In many cases, these web applications contain security vulnerabilities.

Better security rules increase false positives — which causes more complacency. Better tools for creating the context for more sophisticated rules and automated workflows can help.

Lacking the power of AI and machine learning, common security technologies miss API attacks by not seeing the broader business context. Here’s what happened at Shopify.

Most security defenses would have missed the Uber API authorization vulnerability. Here’s why.