On May 4th, 2022, F5 announced their internal discovery of a remote code execution (RCE) vulnerability, CVE-2022-1388, that affects all firmware versions of their BIG-IP product.
Read more about Big Problem with BIG-IP: Vulnerability Alert | CVE-2022-1388 in F5 BIG-IPCyCognito Blog
Your source for exposure management research, product news, and security insights.
Search the Blog
NIST assigned Spring4Shell a score of 9.8, most likely out of concern of a similar blast radius to Log4Shell, which was trivial to exploit and very common.
Read more about One month in: CyCognito looks at Spring4Shell
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the recently disclosed remote code execution (RCE) vulnerability affecting the Spring Framework, to its Known Exploited Vulnerabilities Catalog based on evidence of active exploitation.
Read more about Detecting and Validating Spring4Shell Vulnerability: CVE-2022-22965
Over the years, pen tests have increasingly become a mandated component of regulatory and compliance standards. The Payment Card Industry Data Security Standard (PCI DSS) requiring pentests be performed in card data environments (CDEs) grew this need for compliance-based pen testing.
Read more about How to Get the Most out of Pen Tests
Despite the best efforts of automation and AI, we will always need people to prevent hackers from stealing data and wreaking havoc on computer networks essential for most businesses today. In essence, a domino effect over the last two years of Covid-19 has led to the “Great Resignation” and the “Great Retirement.”
Read more about The Great Resignation Isn’t Going Away. Here’s How to Retain Your Cybersecurity Employees.
Exploit Intelligence offers an end-to-end solution that prioritizes which risks to remediate immediately, before they are exploited, by proactively discovering external assets, testing vulnerabilities, and providing expert threat- plus risk-based insight.
Read more about Empowering Security Operations To Know Which Risks to Remediate FirstEquipping defenders with exploit intelligence is a way CyCognito helps defenders learn the offensive security side of things.
Read more about Exploit Intelligence: It’s Not Just for Offensive Security Pros Anymore
Effective immediately, the CyCognito platform is able to help identify and mitigate the gaps used by Russian state-sponsored threat actors.
Read more about Identifying and Mitigating Potential Russian Cyber Attacks – Proactive Measures in the CyCognito Platform
Imagine a cybersecurity team that is working hard with the usual tools and best practices. All seems on course for protecting the enterprise attack surface.
Read more about Principles of Attack Surface Protection: Discover EverythingBusiness risks lurk in many places. For cybersecurity, the worst risks are often the ones you never saw coming. A Real World Example To illustrate, consider this real example: A manufacturing conglomerate has an engineer build a Javascript connector for remote access to a mainframe but inadvertently exposes it to the internet. How do you discover this risk and its potential damage? A penetration test will not help unless you happen to be testing that particular machine among hundreds or thousands of servers. A vulnerability scan also will not help, as the risk will be invisible because it is not…
Read more about Principles of Attack Surface Protection: Assess All Assets to Detect All Risks