Palo Alto Networks fixed several flaws in its PAN-OS operating system, including 3 issues that can trigger a DoS condition on its firewalls

Palo Alto Networks fixed multiple DoS bugs in its firewalls

In the closing of the recent trading day, Palo Alto Networks (PANW) stood at $281.04, denoting a +0.68% change from the preceding trading day.

Palo Alto Networks (PANW) Rises As Market Takes a Dip: Key Facts

Palo Alto Networks is the next-generation security company maintaining trust in the digital age by helping tens of thousands of organizations worldwide prevent cyber breaches

Palo Alto Networks

Breaches and cyber attacks dominate headlines today. Hardly a week goes by without news of another massive data leak or ransomware attack bringing a company to its knees. In fact, studies show that the of organizations have experienced cyberattacks. As threats proliferate, organizations invest heavily in security tools and staff. large majority The average enterprise uses a ridiculous and technologies. More tools mean more alerts and more alerts lead to alert fatigue. Unsurprisingly, a found that too many tools decrease effectiveness, hindering cybersecurity efforts. Exhausted security teams struggle to separate signal from noise, leading to missed threats and breaches. 45 different security solutions survey This rising tide of alerts threatens to drown security teams. A found that security analysts can’t deal with 67% of the daily alerts they receive. Most alerts are false positives and not worth the time. study by Vectra AI New cybersecurity vendors like Kivera are pioneering preventative approaches to cloud security. Rather than just detecting threats, before they happen to reduce the number of alerts in the first place. This prevents issues upfront rather than reacting after the fact. Kivera stops misconfigurations The Root Cause of Most Cloud Breaches The root cause behind most cloud breaches is misconfigured resources and permissions. Research suggests will result from customer misconfigurations by 2025. Cloud environments are incredibly complex, with thousands of services and configuration options. Just one mistake can leave an opening for attackers to exploit. 99% of cloud security failures All those misconfigured cloud resources trigger floods of policy violation alerts. But detecting problems after they occur is too late. The damage is already done. Attackers move quickly to take advantage of any slip-up. By the time an alert is triggered, sensitive data may have already been stolen. That's why forward-thinking organizations are shifting to preventative security controls. The traditional reactive model of detect-alert-respond is simply unsustainable. Prevention stops mistakes and policy violations before they ever happen. The Limitations of Detection-Focused Tools Cloud-native security tools on the market today focus heavily on detection and response. These tools are valuable layers of defense but come with inherent limitations: Cloud security posture management (CSPM) solutions from vendors such as Wiz and Orca continuously monitor cloud configurations and permissions. They identify resources that violate security policies or best practices. But again, problems are only detected after misconfigurations occur. The latest evolution in cloud security is cloud-native application protection platforms (CNAPP). Companies like Sysdig and Palo Alto Networks provide CNAPPs that combine security tools such as CSPM and CWPP with code scanning for cloud security. While these platforms embed security in code and templates, they face limitations in infrastructure-as-code scanning, restricted to specific programming languages. Kivera overcomes this by operating at the API level, offering a more universal and adaptable security solution.\ However, CNAPPs still rely heavily on threat detection and response. They aim to identify anomalies in cloud applications and resources. However, gaps that allow the attacks in the first place are not directly addressed. The Preventative Security Model The limitations of these detection-focused tools highlight the need for a preventative approach to cloud security. The ideal security model employs a mix of preventative and detective controls, commonly referred to as the “layered security model.” Preventative controls stop policy violations and misconfigurations before they happen. Rather than reacting to events, preventative controls proactively enforce security requirements within systems. Prevention provides a first line of defense to maintain a strong security posture. Detective controls then provide a second line of defense to identify threats that make it past the preventative line. Detective controls are still vital for monitoring, investigation, and incident response. Historically, implementing detective controls in a preventive manner has been challenging, but new tools provide an effective solution to enforce these common detective controls preventively, enhancing overall security posture. Why We Need Preventative Cloud Security This is where preventative approaches to cloud security become essential. Adopting such methods involves deploying inline security measures between users and the cloud. As deployment requests are made, these security systems analyze them against configured security policies. Any requests that violate these policies are immediately blocked, ensuring that only compliant resources are created. This approach emphasizes prevention over detection, eliminating the flood of policy violation alerts by avoiding misconfigurations in the first place. Security teams can then concentrate on real incidents rather than addressing misconfiguration. Vendors like are at the forefront in this area of cloud security. Kivera's solution allows customers to define flexible guardrails and policies tailored to their organization's needs. It then enforces these policies in real-time as users interact with the cloud, preventing misconfigurations at their source and avoiding reactionary measures after the fact. Kivera Best practices for implementing a prevent-first strategy include phasing in prevention by starting with the highest-risk misconfiguration threats and then incrementally expanding policies. Prevention should also be combined with detection tools for layered defenses to catch novel threats while tuning alerting to focus only on critical issues not prevented outright. Processes and training must align with prevention, emphasizing configuring policies over correcting violations. And any violations that still occur should be regularly reviewed to identify and address gaps in coverage. The Future of Cloud Security Today's cloud-first world demands a new approach to security. The volume and pace of threats have rendered traditional reactive models ineffective. Organizations need to prevent threats upfront before damage occurs. The future of security is prevention combined with detection. Organizations still need layered defenses to catch evolving threats. But prevention must come first to establish a robust security posture.

The Missing Piece in Cybersecurity: Tools that Go Beyond Issue Detection

What Is CloudMapper? CloudMapper serves as an indispensable tool for anyone navigating the complexities of Amazon Web Services (AWS). This open-source utility provides a detailed analysis of an AWS account's architecture and security posture, making it ideal for security analysts, developers, and system architects seeking to gain insights into their cloud resources. Originally developed to graphically represent network architecture within AWS, CloudMapper has grown in functionality, now offering resources inventory, security assessment of IAM policies, visualization of public and private resources, and much more. The genesis of CloudMapper was rooted in the need to simplify security audits and risk assessments within expanding cloud infrastructures. As a comprehensive response to these challenges, it evolved to assess security configurations and identify potential vulnerabilities across AWS regions. Its ability to map out AWS landscapes with precision has made it a favorite among organizations for maintaining robust security measures and ensuring the integrity of its cloud infrastructure. In an ecosystem where comprehensive cloud-native application protection platforms (CNAPP), cloud security posture management (CSPM), and cloud workload protection platforms (CWPP) are increasingly common, CloudMapper offers a no-cost alternative that might be just enough to bridge the gap for many users. While these full-featured platforms provide extensive capabilities, they often come with a hefty price tag and complexity that not all organizations require. For teams that need a straightforward, focused approach to cloud environment analysis and security, CloudMapper stands as a capable and cost-effective tool, delivering essential features that are more than sufficient for maintaining a strong security posture and optimized resource use in AWS. Why CloudMapper (You Get What You Pay For, Or Do You?) CloudMapper enters the cloud management arena as a compelling alternative to paid tools with its robust set of features that offer detailed visibility into AWS environments. For organizations wary of the substantial investment required for premium cloud analysis services, CloudMapper presents an opportunity to perform in-depth reviews of account status, resource inventories, and security configurations without the associated costs. This open-source tool is particularly valuable for small to medium-sized enterprises or startups that require comprehensive cloud oversight but must adhere to strict budgetary constraints. It might be possible to augment, or in some limited situations, replace paid solutions like those from Ermetic (now ), , , , and others. Tenable Aqua Lacework Palo Alto Networks The utility of CloudMapper extends beyond cost-saving; it's an essential instrument for a variety of use cases. It can be instrumental for security engineers conducting audits or companies looking to optimize their cloud resource utilization. For instance, during migration phases, CloudMapper can identify over-provisioned resources, helping to trim excess and avoid unnecessary expenses. Security teams can utilize CloudMapper's detailed IAM and security group analysis to enhance their security posture, ensuring that only necessary permissions are granted and that potential vulnerabilities are addressed. Whether it’s for strategic planning, compliance adherence, or security hardening, CloudMapper provides the insights needed to navigate AWS's cloud complexities with precision and confidence. Key Features of CloudMapper CloudMapper is equipped with a suite of functionalities tailored to the diverse needs of cloud infrastructure management. Its primary use cases include generating detailed resource inventories across multiple AWS regions, enabling a granular view of service usage and deployments. This feature is particularly helpful for cost management and identifying redundant resources. CloudMapper also specializes in visualizing complex network topologies, giving users the ability to see interconnections between services and assess their security exposure. For security audits, the tool meticulously examines IAM configurations, highlighting both active and inactive resources, and it scrutinizes public assets like EC2 instances and RDS databases to pinpoint potential security gaps. A lesser-known but highly valuable feature of CloudMapper is its ability to simulate network traffic to test the impact of route table and security group changes before they are implemented. This predictive capability allows engineers to proactively assess the potential consequences of network updates, thereby preventing disruptions and security breaches. This preemptive analysis tool can serve as a safeguard against inadvertent misconfigurations that could lead to costly downtime or security incidents, proving CloudMapper’s utility not just in analysis and visualization, but also in proactive infrastructure management. Wrap It Up CloudMapper stands out as an essential toolkit for any team working with AWS, offering a powerful yet cost-effective solution for cloud environment analysis. Its ability to provide deep insights and visualizations empowers users to manage and secure their AWS resources with unprecedented clarity. As we've explored its various use cases and the unique features it brings to the table, it's clear that CloudMapper is more than just a tool—it's a strategic asset for cloud management. But is it to provide all the insight and depth required to confidently secure a cloud environment? enough Stay tuned for Part 2 of our exploration into CloudMapper, where we'll dive into a hands-on, step-by-step setup guide. Whether you're new to AWS or looking to enhance your current infrastructure, our upcoming guide will equip you with the knowledge to deploy CloudMapper efficiently, unlocking its full potential to streamline your cloud operations. Don't miss this practical walkthrough to elevate your AWS experience with CloudMapper's dynamic capabilities.

Navigating AWS Landscapes: A Deep Dive Into CloudMapper Capabilities

Where to start with the rapid growth of the tech industry? Many have debated that the roof of the technology sector has been reached in the last few years. With the visible continued development and growth, investors can all see that the technology revolution is only starting. The leading companies in the tech industry aim to evolve by updating different sectors of the industry. While AI is the focal talk point at the moment, other leaders in green energy and the Internet of Things are taking great leaps to improve and excel within their realm. Many starting investors stated that they have missed the opportunity to gain financially from the rapid growth. This, however, is not true. The leading companies within the industry have announced that the growing sector of technology is only at the starting phase. The Growth and Development in the Last Year There have been doubts about the industry and whether or not they will grow as much as they have over the years. The massive layoffs that many companies have seen created doubts among specialists in the technology sector. The layoffs have been, according to a specialist, due to the pandemic. Covid caused a lot of companies to have expenses such as extra working computers, wifi routers, and other office necessities that were sent to all staff working from home. With light at the end of the tunnel, tech companies have realized that they have the opportunity to grow the industry at a rapid pace, which will create the same job opportunities that once were available within the industry. With the use of and many other online platforms, tech companies can grow sectors within the industry by improving their online usage. virtual events There has been a massive dollar investment from outside sources into technology development. And according to the , the occupation within the technology sector will grow another 15% by 2021. U.S. Bureau of Labor Statistics The key factor to consider is that this sector consists of more than just AI or the social media platforms we use daily. The Four Leading Tech Companies There are a few industry leaders that small investors can focus on. These companies are leading the technology revolutions and working to create a stronger and better future for all. These four giants are not all solely honed in on AI but focus on cybersecurity, cloud development, green energy, and the Internet of Things. Microsoft (MSFT: NASDAQ) is well known for its resilience and 40 years of running. Microsoft revenue has been up by 12%, reporting an increase of $51.9 billion. The company focuses on more than just building computers. 70% of organizations use their cloud service provider. Microsoft Microsoft takes pride in its ability to increase and enhance the use of digital technology. The organization offers multiple software solutions. These solutions are targeted to businesses to improve the way companies enhance their companies. Brookfield Renewable Corp. (BEPC: NYSE) is a company that strives to produce green energy that will change the way the world thinks. The organization makes use of hydroelectric, wind, and solar power plans to produce clean energy. Brookfield Renewable Brookfield Renewable Corp is actively functioning on five continents. The team takes pride in its ability to generate and produce approximately 25 400 megawatts. The compy aims to develop stations that will increase their production to 110 000 megawatts of renewable energy. It is safe to say that the organization is not yet where they want to be; this, however, is a great sight for investors. The business is bound to grow as the technology sector enhances its capacity. Nvidia Corporation (NVDA: NASDAQ) is well-known in the computer industry. The company developed and created the very first graphics card named GPU. The organization is growing at a rapid pace. This allows the business to diversify its expertise, such as video games and the use of AI to create self-driving cars. Nvidia The company is moving forward by focusing on the potential that technology offers to not only businesses but to the individual that enjoy technology at home. The company had many failures in the past but showed its resilience by increasing not only its profit value but its stock value as well. Palo Alto Networks Inc (PANW) is a cybersecurity provider which enables enterprises, service providers, and government entities to have a secure platform. The platform will keep all data, applications, networks, and devices linked to it safe from cybercrime. Palto As technology grows, the opportunity for crime and theft grows. The organization aims to reduce cybercrime and ensure that all data is safe with them. With the technology revolutions on the rise and all industry leaders taking charge, this organization is prioritizing safety. This will allow all consumers to enjoy the developments at a safe pace. The company is not stopping anytime soon and is looking into multiple avenues to improve and grow its business. Final Thoughts The technology industry can be seen as one of the most saturated markets in the U.S. This should not prevent investors from investing in technology. The industry is growing at a rapid pace, and the leading companies are taking charge. The technology revolution is on us, and we can either shy away from the opportunities or indulge in the future that can be developed by technology. Industry leaders are proving that the best way forward is to indulge in the possibilities that technology brings to the table.

Where to Start with the Rapid Growth of the Tech Industry?

Evolved Cloud Phishing Techniques Explained and Lessons Learned From Recent Dropbox & Uber Hack Cloud Computing gives phishers a new playground to harvest and grow their business. But not only that, the impacts are much broader and more dangerous. No organization, small or big, is invulnerable to phishing attacks. Therefore, it’s critical to learn how you might be targeted and what you can do to prevent it. SaaS-based phishing is already familiar. For example, over , from stolen credentials to malicious URLs. Also, according to a report from , researchers have seen a massive increase in this abuse, with the data collected by the firm showing an enormous expansion of 1,100% from June 2021 to June 2022. 90% of all data breaches are due to phishing Palo Alto Networks Unit 42 With more advancements in technology, not only can defenders leverage more sophisticated tools and techniques to detect and block phishing emails, links, and messages, but attackers are also improving on their side of the cat-and-mouse game. While most social engineering attacks are delivered by email, increased social engineering delivered via other communication platforms in 2022. one-third of IT professionals reported : These include attacks delivered via Video conferencing platforms (44%), Workforce messaging platforms (40%), Cloud-based file-sharing platforms (40%), and SMS (36%). Moreover, phishing on social media is increasingly common, and in Q1 2022, . According to report, employees at 74% of organizations have been sent fraudulent text messages (smishing), and the same percentage have been targeted on social media. LinkedIn users were targeted in 52% of all phishing attacks globally Proofpoint’s 2022 State of the Phish A Hard-to-Detect New Phishing Technique — SaaS-to-SaaS All these could happen without the attacker touching the victim’s on-prem computers/ network. Since it all happened SaaS-to-SaaS, all the existing security measures, such as Anti-Spam gateway, sandboxing, and URL filtering, will not inspect. Thus, no alert will be generated. Furthermore, with the rise of cloud office productivity and multi-user collaboration technologies, it is now possible for an attacker to of these reputable domains while remaining undetected. host and share malicious documents, files, and even malware on the cloud infrastructure Since , we saw the trend of using this “multi-stages” SaaS-to-SaaS phishing attack. the Check Point Research findings in 2020 The first stage of a phishing attack is This document can be downloaded; however, it is essential to note that to facilitate use, these cloud services open the PDF for viewing, allowing it to load in the web browser without restriction or warning. frequently a fake invoice or secure document PDF hosted on cloud services. It is hard to detect because it didn’t necessarily hit the protection deployed. As we saw on the news, as AWS Cloud Phishing attempts in , if phishing detection is implemented in the entrance and exit of emails, it will never see it happening. August All actions occurred in the Cloud (or multiple clouds); when the detection/ scanning took place, all things seemed legit and encrypted. Most likely, the phishing email will hit the victims’ machine, and all the magic will happen in the browser. Multi-stage Cloud Phishing Early this year, that prey upon those who don’t use multifactor authentication. Microsoft warned of new phishing leveraging Azure ADs This attack is thriving now but not before because attackers take advantage of via the capability of device registration using newly stolen credentials, and cloud authentication is accessible anytime, anywhere. the concept of BYOD (Bring-Your-Own-Device) Nothing out of the ordinary, it is a novel attack technique that combines traditional phishing with second-phase or even third-phase actions. The first stage steals an employee’s email like regular phishing attacks. Yet, instead of attacking the victim, the a new Office 365 account on a rogue device in the victim’s name. Once established on the new computer, the victim’s user account (and or this case, its Azure Ad) is used to send (disguised as the victim) within the company or to customers using the legitimate email account. second stage establishes internal phishing attacks If they want to gain more control or find a better “host,” they These multi-stage attacks appear legitimate and can even deploy malware on the company’s OneDrive or SharePoint systems. can find it via the first victim and then compromise the second account by internal phishing. ChatGPT (or Other AI) According to , phishing accounts for nearly 90% of malware attacks. But ChatGPT could make the whole situation even worse. Such intelligent 🧠 AI Chatbot can be . So the victim may not even know they are interacting with an AI. HP Wolf Security research a way to gather information through a human-like friendly chat https://research.checkpoint.com/2022/opwnai-ai-that-can-save-the-day-or-hack-it-away/?embedable=true demonstrating . Multiple scripts can be generated quickly, with variations. Complex attack processes can also be automated, using the LLMs APIs to generate other malicious artifacts. Check Point Research recently published an interesting article how AI models could create a full infection flow, from spear-phishing to reverse shell Another risk is more prominent. AI technology like ChatGPT will enable attackers to . For example, say generic phishing attacks send out millions of spam in the form of emails, SMS (in the case of smashing), and social media posts. But these are easy to spot, resulting in low yield. blend the volume of massive phishing with a targeted attack (or spear-phishing) With the addition of an AI Chatbot, millions of spear phishing messages could be generated in seconds. Thus, the attackers can have the best of both worlds. Therefore in 2023, we will probably see . It would be a tremendous challenge for security teams. some large-scale phishing that sends millions of unique messages generated within minutes Other Novel Phishing Techniques QRishing Attackers are now trying to deliver which makes them difficult to detect for most email security solutions. QRishing combines the words: “QR Codes” + “Phishing.” This indicates the attack is in the form of a QR code. It can potentially direct victims into connecting to an unsecured WiFi network while someone can easily capture what you are typing. malware links via QR codes embedded in emails, Some adversaries even stick malicious QR codes in restaurants or other public locations. Since the pandemic limits physical contact, QR codes are a popular tool for threat actors. We use it to access menus, check in for vaccines, and get public information. In addition, social engineering tactic is inserting fake QR codes into a phishing text (SMishing + QRishing) or social media platform. Upon scanning the malicious code, users are redirected to phishing sites, where the victim may be prompted to log in and steal their credentials. SMishing That means it is one kind of phishing sent across your mobile network in the form of text messages. Although the name uses SMS, this attack can happen on other messenger platforms, such as Facebook Messenger or WhatsApp. Common Smishing attempts to focus on everyday necessities. Missed deliveries, late payments, bank notifications, fines, and urgent notices are examples of smishing attacks. SMishing combines the words “phishing” and “SMS.” With so many people staying at home and so many daily online purchases, we’re awash in cardboard. It’s very challenging to keep track of everything coming into the house. Combining well-known delivery services with is the best recipe for a successful Smishing. fake “delivery fee” notifications Crown Jewel = Developer Accounts Why are threat actors trying to compromise developer accounts? And what can go wrong if they are stolen? Depending on the developer’s position, attackers gain access to nearly everything: SSH keys, API keys, Source Code, Production infrastructure, Access to CI/CD pipelines and, i.e., the works. Assuming a compromise with the “best scenario,” a junior engineer’s account might be stolen. At the very least, this engineer has “commit” access to the source code. On the other hand, suppose the organization does not follow the best practices of software engineering, such as code reviews and restricting who can commit to the main branch. In that case, the attacker can modify the organization’s source code to alter and infect the final product. In the worst-case scenario, which is also the most likely, the attacker will gain access to a senior developer with more permissions. This account could manually bypass some code checks, which will also have access to valuable resources (source code, SSH keys, secrets, credentials, API keys, CI/CD pipelines, and more). This scenario, where this kind of account is compromised, would be devastating for an organization. Developer accounts usually come with GitHub or other code repository access. Dropbox & Uber In September, Later, we discovered that the hack was related to Uber disclosed that hackers had stolen the personal information of about 57 million customers and drivers . obtained by a “ ” a hard-coded credential remote social engineering attack. In November, due to a phishing attack against its developers. They were lured into by a phishing email into a fake website, What makes these incidents scary is that this wasn’t just a random user from a business function; it was developers with privileged access to many Dropbox and Uber data. Dropbox had a security incident filling in their Github credentials despite multifactor authentication (MFA) in place. MFA Fatigue Both cases from these two giant tech companies implemented multifactor authentication. Still, hackers find a way to bypass or work around this measure that can prevent most credential theft. In the case of Uber, the hacker (allegedly a 17-year-old) was creative and came up with a low-tech but very effective method — The attacker attempts to log in repeatedly, sending a flood of push requests to users asking the victim to confirm a sign-in. Once the victim stopped clicking “no” on their phone, followed by an “authorized login,” thus, MFA failed. an “ ” MFA-fatigue attack. For the Dropbox case, which is much simpler. The phishing email purported to . Then the realistic-looking phishing site tricked the developer into typing the credential and the one-time password. Thus, MFA also failed. originate from the code integration and delivery platform, CircleCI Code Repo and More As we saw in these incidents, With the proper permissions, attackers can obtain intellectual property, source codes, and other sensitive data. GitHub and other platforms in the continuous integration/ continuous deployment (CI/ CD) pipeline space are the new “crown jewels” for many companies. But it doesn’t stop there, as GitHub often integrates with other platforms, which lets the allowed “users” go even further. In addition, developers’ accounts are usually granted access to the deepest level, as maintaining and developing the core application may be part of their job responsibility. That makes the developer account a crown jewel for attackers. How to Improve Your Phishing Defenses According to , the average organization receives dozens of phishing emails per day, with financial losses compounding as losses from malware and ransomware attacks drive up the average cost of landed phishing attacks year over year. Facing all the threats highlighted requires extra effort, and while you can’t eliminate the risk of phishing attacks, you can learn from observed trends and incidents to better manage them. industry statistics For example, here are the recommendations from : the recent Zscaler report Understand the risks to inform policy and technology decisions better Leverage automated tools and actionable intel to reduce phishing incidents Implement zero-trust architectures to limit the blast radius of successful attacks Deliver timely training to build security awareness and promote user reporting Simulate phishing attacks to identify gaps in your program Apart from the five basic mitigations of phishing attacks, we can do more. Therefore, I will end this article with tips you can bring along. , having a greater extent of cyber-resilience would be an excellent way to begin. Knowing that phishers will eventually find a way to get to you Tips #1: Multi-layered phishing defenses approach Typical email security against phishing often relies exclusively on a single guard point, such as email gateways and endpoint/ mobile agents. Everything passing through that gate would depend on users being able to spot phishing messages. Not to mention attackers are now sharpening their weapons with multi-stage phishing. Conversely, Moreover, there would be multiple chances to detect and catch a phishing email. a layered defense approach could improve cyber-resilience without disrupting business productivity. Reach — Prevent the email from reaching the user’s inbox. This can be achieved by introducing anti-phishing security software such as spam filters. In addition, anti-spoofing controls should be implemented, such as; DMARC, DKIM, and SPF records. Identify — Most data breaches are initiated through a phishing email due to human error. Therefore, staff should have regular training in identifying the latest potential phishing emails. This will enable them to follow the company process when an incident does occur, which should include reporting the incident to the relevant team. Protect — Protections should be in place for when incidents do occur. These protections include but are not limited to; enforcing multifactor authentication (MFA), password managers, regular IT health checks, and endpoint defenses. Response — Staff should be able to report phishing incidents to the relevant team. A dedicated security logging and the alarming system should be in place, as well as an Incident Response Plan. Even though some attacks get through, this approach will help with incident response and minimize the impact. Tips #2: Just-in-time (JIT) Access Approach Privilege access entails a significant danger, claims . The risk posed by users with standing privileges persists even with PAM tools, and it is considerable. They suggest just-in-time (JIT) solutions be used by identity and access management (IAM) leaders to finally achieve a posture of no standing privileges. Gartner also provided a solution to counter it — The Just-in-Time approach. For example, when developers use these credentials to set up or modify production resources, granting them the appropriate permissions is crucial, with only the capabilities required to complete specified tasks. Gartner The JIT approach, which deals with information security, only gives users access to privileged resources while working. This reduces the attack surface and eliminates the risk brought on by persistently held-over privileges. Tips #3: Review Mailbox Forwarding Threat actors use compromised accounts not only to steal internal data but also, for example: Read users’ emails, Distribute malware, Spamming, Learn about the user and to further launch second-stage phishing, and Forwarding emails to external recipients. Attackers may set up email rules to conceal their malicious activities from the user to hide incoming emails in the compromised user mailbox. They may also create rules in the compromised user mailbox to delete emails, move them to a less visible folder, such as an RSS folder, or forward emails to an external account. Emails can be manually or automatically forwarded using forwarding rules. Automatic forwarding can be accomplished in various ways, including While manual forwarding requires users to take direct action, they may need to be aware of all auto-forwarded emails. Inbox Rules, Exchange Transport Rules (ETR), and SMTP Forwarding. It would be wise to schedule a review of all email forwarding rules to external addresses and check that it is not an unusual IP address and corresponds to the user’s usual activities. Final Words as long as the human factor is in the formula. As a result, the best we can do for the long term is It would be a much more granular design of the multi-layered defense approach. The reality is that no one can stop phishing entirely to adopt Zero Trust Architecture for email security. A Zero Trust approach to email can assist organizations in defending against email impersonation attacks by — ensuring that emails entering the corporate environment or landing in end users’ inboxes are from legitimate individuals, brands, and domains. focusing on Authentication (Verifying User/ Device Trust) https://hackernoon.com/introduction-to-the-zero-trust-security-architecture-a-concept-not-a-product?embedable=true A privileged position exists for software developers in every technical organization. They are the lynch-pin in any modern company because of their upstream access to the products distributed to clients and their access to production systems and infrastructure. The security organization would fail if developers weren’t protected, leading to catastrophe. If you, unfortunately, fall for a phishing attack, please do the followings: Contact the IT department and let them know the situation Reset password for related applications Please don’t use a repeated password. Instead, reset the account with the same password as the applications above. Monitor the account with care for 30 days Finally, NIST developed a method to help the security team to see why users click on the phishing email: https://www.nist.gov/news-events/news/2020/09/phish-scale-nist-developed-method-helps-it-staff-see-why-users-click?embedable=true Thank you for reading. May InfoSec be with you🖖.

Cloud Phishing: New Tricks and the Crown Jewel

Phishing en la nube: nuevos trucos y la joya de la corona

Cloud Phishing : de nouvelles astuces et le joyau de la couronne

क्लाउड फ़िशिंग: न्यू ट्रिक्स एंड द क्राउन ज्वेल

クラウド フィッシング: 新しい手口と王冠の宝石

Phishing na nuvem: novos truques e a joia da coroa

Lừa đảo trên đám mây: Thủ thuật mới và viên ngọc quý

云网络钓鱼：新技巧和皇冠上的明珠

Achieving high-availability cloud architecture requires more than one cloud. From an architecture perspective, there are only three options for mission-critical systems: multi-cloud, hybrid cloud, or hybrid multi-cloud. Using a single cloud is really a single point of failure. To achieve high availability, redundancy is required everywhere to do away with the single points of failure. Three scenarios that bring a single cloud down While there are many things that result in losing access to the cloud, let me give you three major examples. First, the cloud can go down. News from the past 12 months is full of headlines on major . In many cases, these outages affect more than one availability zone or region. Network architects design a network across two providers, never one. It is what we have done for decades and there is no reason to change it now. cloud outages A second reason clouds fail is related to a component called the control plane that is in the orchestration part of the cloud. The control plane makes everything work. If a misconfiguration, bug, or hacking event takes the control plane down, the cloud goes down, which means all of its customers go down. Hacking is the third major factor that can lead to cloud failure. A massive (DDoS) attack has the potential to take down the entire cloud. TechRepublic reports that were at an all-time high in the first three months of 2022, nearly five times higher than they were for the same period in 2021. When an attack is successful, we will suffer if we are not using a multi-cloud or hybrid-cloud strategy. distributed denial of service DDoS attacks The foundation of reliable multi-cloud architecture For a cloud to be considered reliable, it must provide “ ” availability. This means the cloud will be available 99.999 percent of the time or provide less than 5 minutes and 15 seconds of downtime per year, but things happen which can make this impossible. For example, in 2021 AWS, Google, and Azure all had major outages and did not provide 99.999 percent availability.  When these clouds went down, so did the cloud providers' customers. five nines There is a simple fix for this problem: don't put all your eggs in one basket. Use multiple clouds so that when one cloud fails, the customer is still up and running. My favorite architecture for organizations with mission-critical needs involves at least one cloud provider and a data center running an OpenStack or Nutanix private cloud. For even greater availability needs, the solution is a hybrid cloud connected to at least two public clouds. This establishes a hybrid-cloud and a multi-cloud. To ensure high availability, redundancy must also be involved in connecting the organization to the cloud. High availability at the customer site requires that there be two routers connecting to each cloud provider, with each router being a high-availability router with multiple control modules and power supplies. The power supplies should be plugged into different circuits with different UPS systems and different generators for backup power. This provides redundancy in the brains of the routers and in the power supply. Establishing a high-availability security architecture Extremely robust cloud security architecture is not for everyone, primarily because it can be expensive and complex. But it is essential for those who have absolute mission-critical security requirements that need absolute high availability. From a strategy perspective, we want to make sure that we are using common security services across both clouds. This allows for a single security policy that we can deploy on everything. When we know that all of our security devices are the same brand from the same manufacturer, we know that we won’t have a problem with vendor interoperability. In addition, if we have bugs, we will have an easier time addressing them. We are also going to use industry standards for our security rather than relying on the security that comes from the cloud provider. While cloud providers have good security products, security is not their specialty. Cisco, Palo Alto Networks, Fortinet, and CheckPoint have been making security appliances for decades. For many of these organizations, security is all they do. When we go with an organization that only does security, we will get more robust features than what the cloud provider offers. When designing the security architecture, we acknowledge that a lot of what we are dealing with are web apps, which need to be protected from DDoS. The best thing that we can do to really make our web application scale and give us some protection is to use a (CDN). For the most part, CDNs only forward legitimate requests to the servers, so they're going to block all the illegitimate requests. We can use a CDN and their DDoS protection, whether it is Cloudflare’s DDoS protection or Shield on AWS, or Azure’s DDoS protection. content delivery network Next, we need firewalls. We want to use enterprise-grade, next-generation firewalls like a Cisco or Palo Alto firewall so we can have the same feature sets and functionality across the clouds and data center. However, doing that poses a problem. You can't knock on the door at AWS, go to a rack, and screw in your high availability firewalls. So, achieving enterprise-grade, robust security appliances, no matter what cloud we are on, requires having high-performance firewalls and security appliances residing on a virtual machine. This leads to another problem: virtual machines are not high-availability devices. This means we will need to load balance between them. We will set up two enterprise firewalls on two virtual machines and use a load balancer between them to increase performance and availability. Finally, we will need something to stop the bad actors who get through the firewall. Typically this will be an intrusion detection and intrusion prevention system. Because we are using a next-generation firewall, intrusion detection and prevention are built in. If someone breaches our firewall, hopefully, our next-generation firewall creates a new rule, resets a TCP connection, and can stop the attack. Moving from moderate to extreme cloud security At this point, we’ve established a good foundation for a high-security cloud, but we need to think of security like it’s an onion that always has more layers to peel back. There are a host of other components we can add to move from moderate to extreme security. For example, we can add access control lists to protect our subnets. Whether it is an AWS network access control list or an access control list on a router, we can use that to boost security. With most cloud providers, we also have the ability to protect our virtual machine with a security group, which is basically another firewall. We can also take security on the servers to the next level. We definitely need to put anti-malware protection on our servers and patch them against known vulnerabilities, but that's not enough. We also need to disable the unnecessary services. We want to harden our systems and lock them down, and we want to provide encryption for data at rest. AES 256-bit encryption is the best thing for this. With AWS, this requires that we enable the key management system. On Azure, it's automatic. Taking steps to limit unauthorized access Identity access management determines and keeps track of who a user is and what they are allowed to do. However, the creation of users and management of users, especially at scale, can be complicated. To address this efficiently, most organizations are getting something like Microsoft Active Directory, AWS AD Connector, or Azure AD. A strong identity and access management protocol will keep bad actors out while limiting and keeping track of what authorized users can do. This can keep those with system access from deploying things that do not meet security standards. Unauthorized access can also be achieved when an employee falls victim to a or a phishing email. For this reason, we really need to train the employees of the organization. Any effective cloud multi-cloud security architecture strategy will involve training employees on security awareness. social engineering scheme Responding to attacks Attacks happen, and the better your ability to monitor them and respond to them, the faster you can mitigate and remediate the attack. I believe the best approach to this is event-driven security, in which a particular type of attack triggers a particular type of response. For example, when someone makes an object public that is not supposed to be public, we can have a log notification that results in some type of code function that remediates it for us. With AWS, when Cloud Monitoring sees something that we don't like, it kicks off a Lambda function that remediates it. When we add monitoring and auto-remediation to our robust security architecture, we enter into the next generation of security in which the damage caused by breaches is self-healing. While the scenarios that can lead to a cloud failure are many and varied, they can all be anticipated and addressed by implementing a dependable multi-cloud architecture with robust security. Remember that a single cloud is a single point of failure, and a single point of failure does not provide the high availability that modern business requires.

Security Infrastructure and the Multi-Cloud

(This article is a collection of best practices and tips regarding securing containerized environments. And there is a previously published article about the K8S hardening.) https://hackernoon.com/how-to-harden-k8s-based-on-the-recent-updated-nsas-kubernetes-hardening-guide And Understanding How Containers Present Unique Security Challenges We all know that running cloud-based containers includes the flexibility of spinning applications up and down for users — or what we call “ ” and better integration with DevOps. They also provide cost-saving infrastructure compared with monolithic applications running on servers or virtual machines. WORA (write once, run everywhere) Different companies, big or small, are looking into how to run their business applications with this technology. As a result, the adoption of containerized applications is at an all-time high. According to the survey from the : Cloud Native Computing Foundation (CNCF) Kubernetes adoption among the ever-expanding cloud-native community is approaching 100%, meaning those investing in cloud-native are strongly bought in and excited for the future. The Container’s Threat Landscape When we look into the 243,469 K8S clusters are Kubernetes clusters also exposed port 10250, used by the kubelet as a default setting. As a result, recent data revealed by Shodan, publicly exposed. Furthermore, these attackers could scan the internet and find those clusters with minimum effort. Once the cluster is found, attackers could use the kubelet API as an entry point in targeting Kubernetes clusters to More impactful actions are possible, such as lateral movement to other internal resources, privilege escalation, and finally, jumping into the jewel💎 — the confidential data. mine for cryptocurrency. With more and more data in containers, so does the interest in cyberattacks targeting such applications. According to VMware’s “ 2022”, State of Kubernetes survey 97% of organizations have concerns about Kubernetes security. Redhat also provides similar data with their “ ”, saying that in their Kubernetes and container environments during the last 12 months. 2022 state of Kubernetes security report 94% of the respondents have experienced a security incident Akamai’s security researcher Larry Cashdollar launched an by setting up a standalone Docker as honeypot Dock to see how frequent and what kind of attacks would be recorded. The result is scary. He specifically configured the honeypot simply to look like a vulnerable cloud instance. exciting but alarming experiment In only 24 hours, the honeypot was leveraged by FOUR different cybercriminal campaigns! Containers and Kubernetes attacks are common, and organizations have difficulties protecting themselves. Meanwhile, the businesses are transforming, and even though there are security concerns, they are putting more and more data into them. 3 Main Security Concerns in Containers Although different, a container can still be compromised in many ways, just like traditional infrastructure. Therefore, I will highlight the most common container risk factor here. 1# Misconfiguration Based on the prediction of from their analysis, by 2025, 99% of cloud security failures will be the mistakes of customers. As you can imagine, containers are often deployed in very dynamic environments. Therefore, any misconfiguration, no matter access, networking, or other related settings, can lead to a stealthy security hole for users but not to cybercriminals. Gartner which are far less secure than customized, hardened settings. Attackers can find a problem in the default settings faster than understanding a new one. Smaller companies are generally using default configurations than large organizations. Basic misconfiguration accepts the default settings in the production environment, Such small mistakes can lead to expensive problems. When we look back into Sep 2021, published by the is the first known windows container malware and heavily obfuscated malware targeting K8S. According to the same research team, the primary purpose of Siloscape is to open a backdoor from poorly configured K8S clusters. As a result, the malware can further run malicious containers. Palo Alto Networks, Siloscape malware 2# Vulnerable Container Images Container images are static files with executable code that can be used to create a new container on a computing platform. Images are available via open-source repositories that are widely accessible online for easy download and deployment. What if someone uploads the pre-installed malware into images and plants it into the public repository? When someone deployed those images, the malware would be running on day-0 without any action from the attackers. It’s a specific type of supply chain attack. In 2020, a bug was found ( ) in the Containerd runtime software for complete container lifecycle management. By the time they obtain the token, they can disguise themselves as the author and take hostage of a cloud project. CVE-2020–15157 Adversaries could exploit it by creating specially-crafted container images to steal the host’s token, which they were pulled into a project. Another example of how attackers leverage malicious container images is illustrated by Team Nautilus, a threat research team from . They found Aqua Security five container images on Docker Hub used for mining cryptocurrency and as part of a supply chain attack specifically targeting cloud-native environments. 3# Zero-Day Vulnerabilities (+ Known CVEs) Perhaps zero-day vulnerabilities are a big problem for all software — and containers are no exception. Although cloud providers invest heavily in securing their platforms, it’s unavoidable that zero-day vulnerability can exist and put customers at risk. The most alarming example of this category is ,” found by Palo Alto Networks. Similar to Siloscape, Azurescpe is the first known vulnerability that could allow a user of a public cloud service to “escape” the environment (Microsoft Azure). “Azurescape This container escape is just an example of what known or zero-day vulnerabilities can impact a container environment. One public-facing hole could lead to a chain of exploits. When combined with a few misconfigurations, it would become a container takeover or even infiltrate other customers’ instances. about cloud-native and security usage found that report also stressed that some respondents stated they are prepared to take these risks to move faster and release applications quicker. A report in February by Sysdig 75% of containers contain high severity vulnerabilities. However, the Best Practices for Container Security Containerized environments can introduce distinctive challenges for visibility and application of security controls, but following a layered-security approach can significantly reduce the attack surface. The traditional approach of having a list of ‘bad’ things to look for won’t work in a container-based environment. Given the scalability and agility of these environments, organizations must be able to analyze the operational data in real-time and look for abnormal behaviors in runtime. 0# Continuous Improvement The first thing for container security is implementing security practices in the CI/CD pipeline and the entire build, store and deploy process of container images that include: Static Application Security Testing (SAST); Securely storing the container images, Vulnerability scanning for container images and; Enforce image content trust. Defense-in-Depth (DiD) in Containers The container security best practices don’t just include the delivered applications and then securing the container’s image itself, but the entire stack for building, distributing and executing the container. A layered approach should be followed. For starters, this includes: Cloud platform configuration The computing host (physical or virtual) The Operating System K8S cluster The container runtime Namespace The application code Each layer would have its own security controls. For example, keeping the cluster infrastructure up to date is always important. But for the purpose of this guide, I would skip the part that is outside the K8S cluster. 1# Role-Based Access Control (RBAC) RBAC is the frontline of defense in Kubernetes. It lets the user control who can access the API and their permissions. Official Kubernetes document provides detailed descriptions for . Although RBAC is enabled by default, simply having RBAC enabled is not sufficient. Authorization policies should be handled carefully and properly applied. Role-based Access Control (RBAC) Tips: Always use RBAC with the least privilege principle. As a baseline, we need to make sure That means using the RBAC policy to limit users and groups to only the actions and tasks they need. Also, confirm that the Kubernetes service and other user accounts have minimal privileges granted. not to give cluster-wide permissions and not give anyone cluster-admin privileges unless necessary. 2# Benchmarking and Remediation As stated above, Thus, to spot those misconfigurations, we need something to compare with. The Center for Internet Security (CIS) is the de-facto standard among various sources of best practices, benchmarks, and hardening guides, misconfiguration is the primary source of container-related attacks. the is the de-facto standard. Center for Internet Security (CIS) https://www.cisecurity.org/benchmark/kubernetes Whether it is a physical server where the Linux is installed as a platform for containers, a virtual machine provisioned on a cloud service provider, or an on-prem box, it may contain insecure out-of-the-box settings that no one knows. After all, we cannot assume that a cluster provisioned by a cloud provider is perfectly secured. Apart from K8S benchmarking, which is the most complex for cybersecurity professionals to review, CIS also provides similar checking for physical servers, especially Linux. and one specifically for Debian, Centos, Red Hat, and many other distributions. CIS has a benchmark for Distribution Independent Linux https://www.cisecurity.org/benchmark/distribution_independent_linux/ 3# Cloud Security Posture Management Benchmarking can be extended to cloud provider accounts, too. Developers may not have access to those settings, but it is equally crucial for the overall security of a containerized environment. It is different from the other settings as this part belongs to the management plane. A separate security control defined by Gartner for this area is called Initially, CSPM supported you in discovering and visualizing the IaaS and PaaS asset inventory. But it may be extended to help you save time and minimize risk across your entire cloud/container security stack. According to , CSPM should include the capabilities of: . “Cloud Security Posture Management” (CSPM) Gartner Continuous visualization of configurations Assets discovery, classification, and risk assessment Standard misconfiguration remediation and logging Compliance reports with security frameworks (e.g., PCI DSS, HIPAA, SOC 2…) 4# IaC Scanning IaC stands for Infrastructure-as-code, which refers to the technology and processes used to manage and provision infrastructure using code. Although IaC is not directly related to containers, it usually comes with DevOps. IaC simplifies DevOps processes such as peer reviews, version control, automation, and CI/CD delivery. IaC comprises resource declarations, input and output variables, configurations, and parameters. IaC is usually JSON, YAML, or HCL based, and a single file can contain all resources and configurations required to spin up a whole infrastructure, including: compute, storage, networking, identity access management, security, and more. Apart from its operational efficiencies, IaC can be employed to automate security processes and integrate them with DevOps as part of the transition to DevSecOps. However, IaC is a two-way sword. By provisioning cloud resources across environments with a unified, standard language, developers and operations can better readily remain on the same page and work together to secure cloud-native applications. However, it also creates hidden traps inside the code without review. IaC scanning software can parse standard cloud-native format templates. Then, they can set controls based on security best practices, providing developers or administrators with the knowledge of where they should apply further hardening to improve the security of the declared IaC environments. These tools can separate security problems such as: a Docker image initiated to run as the root user, a Kubernetes manifest that requests a node’s privileged access to the file system, or an Ansible/ Terraform script that configures an open access S3 bucket. As a result, adding security checks to IaC can isolate security vulnerabilities into a dedicated build and release pipeline. Likewise, IaC security simplifies workflows by embedding them into developer workflows to support cloud insight in both build and runtime. Final Words Although cloud-native technologies and containers are still a novice, the core security challenge remains; Organizations must consider how to accelerate development while retaining robust security controls, no matter it is a monolithic application or a containerized environment. These two objectives are still competing for equal attention in the container space. Although having containers in the picture fostered scalability and agility, they also increased the overall complexity. Securing containers needs a comprehensive approach. First, we must ensure that we address all teams’ needs within your organization. Next, make sure we can automate the procedure to fit the DevSecOps processes and that we also can meet deadlines and launch applications fast while protecting all of them. Security can no longer be an enforcer at the last minute with demands to change your workflow. Instead, it needs to build trusted security controls and automated processes from the start to address security concerns and make it easier to bridge the gap between each team. Thank you for reading. May InfoSec be with you🖖.

Incomplete Guide for Securing Containerized Environment

As the world becomes increasingly digital, nearly every company is looking for to code—no matter the industry. The phenomenon has been great news for software engineers and programmers who can now command high salaries for their hot, in-demand talent. software engineers Perhaps it is no surprise that software engineers in the San Francisco Bay Area, home to Silicon Valley and its many tech giants, can command an even higher premium with their pay packages. According to the more than 5 million verified professionals on the professional social network Blind, these are the top 17 best-paying cities for software engineers in the San Francisco Bay Area. Blind considered the annual base pay and the total compensation package, including the annual salary and any stock-based compensation or bonuses a company might offer. 1. Los Gatos, California n: $500,449 Average Total Compensatio : $475,000 Median Total Compensation : $470,015 Average Salary : $451,000 Median Salary Los Gatos is the best-paying city for software engineers in the U.S., according to Blind. The small town is home to Netflix, which prefers to hire more senior or experienced professionals and pays accordingly. The video-streaming giant typically pays large salaries and gives few employees stock-based compensation. 2. Menlo Park, California : $328,423 Average Total Compensation : $297,000 Median Total Compensation : $167,004 Average Salary : $165,000 Median Salary Menlo Park might be home to only 34,000 people, but its population can swell in size with tech workers during the workweek. Menlo Park is home to the headquarters of Meta, the owner of Facebook and one of the highest-paying technology companies. Google and Roblox were also founded in the city. 3. Cupertino, California n: $279,391 Average Total Compensatio : $255,850 Median Total Compensation : $165,753 Average Salary : $165,000 Median Salary Cupertino is home to Apple and its futuristic Apple Park corporate campus. Software engineers at Apple have enjoyed large paychecks recently, as the iPhone maker briefly topped a jaw-dropping $3 trillion market cap early in 2022. 4. San Bruno, California : $278,368 Average Total Compensation : $225,900 Median Total Compensation : $161,269 Average Salary : $149,500 Median Salary YouTube moved its headquarters to San Bruno in 2007 and has become the city’s largest employer. The Google-owned video streaming service employs more than 2,000 professionals. 5. Mountain View, California : $275,181 Average Total Compensation : $242,000 Median Total Compensation : $160,790 Average Salary : $156,000 Median Salary Mountain View is synonymous with Silicon Valley. Long before startups were birthed in San Francisco Bay Area garages, the city was home to silicon semiconductor producers, which gave the region its name. Of course, the city is now well-known as the headquarters of Google, but other tech companies with prominent presences include 23andMe, Intuit, Mozilla and Synopsys. 6. Oakland, California : $266,869 Average Total Compensation : $197,750 Median Total Compensation : $192,240 Average Salary : $168,750 Median Salary Oakland has become a hub for many financial-technology companies. Credit Karma moved its headquarters from San Francisco to downtown Oakland in 2020. Block and Marqeta also have major offices in “The Town.” 7. San Francisco, California : $265,050 Average Total Compensation : $225,000 Median Total Compensation : $165,042 Average Salary : $160,200 Median Salary San Francisco might be the crown jewel of the technology industry, as the home of too many tech startups and companies to count. The city by the bay is home to Airbnb, DoorDash, Lyft, Twitter, Uber and more, but its top employer is . The cloud giant employs more than 9,000 employees, and its headquarters has made a permanent contribution to the downtown skyline. Salesforce 8. Sunnyvale, California : $260,048 Average Total Compensation : $238,000 Median Total Compensation : $160,499 Average Salary : $160,000 Median Salary Sunnyvale maintains its Silicon Valley roots as home to the chip-maker AMD and advanced technology and networking companies, including Juniper Networks, Microsoft-owned LinkedIn and NetApp. 9. Palo Alto, California : $234,739 Average Total Compensation : $200,000 Median Total Compensation : $157,488 Average Salary : $154,000 Median Salary The tony city of Palo Alto is one of the major cities of Silicon Valley. Cloudera and VMware are some of the largest technology companies based in the city. 10. San Mateo, California : $234,066 Average Total Compensation : $187,875 Median Total Compensation : $158,629 Average Salary : $155,500 Median Salary Companies that call San Mateo home include Coupa, Roblox and Snowflake. Before being acquired by Zendesk, Momentive, which was founded as SurveyMonkey, was headquartered in the city. 11. Pleasanton, California : $225,058 Average Total Compensation : $202,000 Median Total Compensation : $150,887 Average Salary : $150,000 Median Salary Pleasanton is home to many business parks, but the suburb’s top employer is the HR-technology giant Workday. 12. Foster City, California : $220,293 Average Total Compensation : $190,000 Median Total Compensation : $158,319 Average Salary : $148,500 Median Salary Foster City is the headquarters site of the biopharmaceutical giant Gilead Sciences and the enterprise software company Zuora, among other companies. 13. Fremont, California : $218,913 Average Total Compensation : $180,000 Median Total Compensation : $144,638 Average Salary : $142,500 Median Salary Notable companies with headquarters in Fremont include Corsair, Synnex and more, although the city’s No. 1 employer is Tesla. 14. Santa Clara, California : $214,168 Average Total Compensation : $197,000 Median Total Compensation : $153,885 Average Salary : $150,000 Median Salary AMD, Intel, NVIDIA and Palo Alto Networks are some of the most well-known tech companies headquartered in Santa Clara. 15. San Jose, California n: $210,801 Average Total Compensatio : $183,000 Median Total Compensation : $153,390 Average Salary : $145,000 Median Salary The largest city by population in the San Francisco Bay Area, San Jose is home to Adobe, Cisco, eBay, PayPal, Zoom and more. 16. Redwood City, California : $207,955 Average Total Compensation : $190,000 Median Total Compensation : $156,248 Average Salary : $151,000 Median Salary Redwood City is the headquarters location for several global technology companies, such as Box, Carbon, Electronic Arts and Informatica. 17. Milpitas, California : $188,146 Average Total Compensation : $165,750 Median Total Compensation : $154,073 Average Salary : $138,000 Median Salary Some of the top employers in Milpitas are tech employers, including Cisco, FireEye, SanDisk and more. Methodology Blind analyzed the base salaries and total compensation of software engineers in the San Francisco Bay Area on its platform. Cities were ranked by the average total compensation, including annual base salary and, if applicable, stock-based compensation and cash bonuses. All data is self-reported by verified professionals on the professional social network Blind. Also published on Teamblind's blog

17 Highest-Paying Cities in the San Francisco Bay Area for Software Engineers

Las 17 ciudades que mejor pagan en el área de la bahía de San Francisco para ingenieros de software

17 villes les mieux rémunérées de la région de la baie de San Francisco pour les ingénieurs logiciels

सॉफ्टवेयर इंजीनियरों के लिए सैन फ्रांसिस्को खाड़ी क्षेत्र में 17 उच्चतम-भुगतान वाले शहर

ソフトウェア エンジニアにとって、サンフランシスコ ベイエリアで最も給料の高い 17 の都市

17 cidades mais bem pagas na área da baía de São Francisco para engenheiros de software

17 thành phố trả lương cao nhất trong khu vực vịnh San Francisco cho các kỹ sư phần mềm

旧金山湾区软件工程师薪酬最高的 17 个城市

Social engineering techniques are being extensively applied by all sorts of malignant entities operating on the cryptocurrency market. One of the most common and increasingly applied types of attacks relying on social engineering is phishing. Considering the recent received by KuCoin Group from users regarding attempts made by some websites to use the KuCoin trademark to conduct phishing attacks with the intent to steal the sign-in credentials of KuCoin users, we are releasing a guide aimed at informing about the potential dangers of such actions and the ways of preventing them. reports Threat can come from anywhere Phishing entails the attacker sending a specifically tailored, inherently fraudulent message to the victim in an attempt to trick them into revealing some personal or sensitive information, such as passwords, private keys, or other details. Once the information is obtained, the attacker can use it to launch an attack using malicious software onto the victim’s computer system and deploy any kind of ransomware. Phishing is becoming a considerable threat, as it is the simplest type of attack to deploy and has the highest chance of success, given the overall low level of cybersecurity knowledge and awareness among most internet users. A recent report released by Chainalysis states that the NFT market showed performance in excess of $44.2 billion at the end of 2021, but another by Palo Alto Networks revealed that over 90,000 of the NFTs on the market were fake, or were subject to phishing attacks. Such attacks were also used to over $1.7 million worth of NFTs from the OpenSea marketplace on February 19, 2022. report steal How To Safeguard Accounts Against Phishing Attacks The ways of protecting an account from phishing attacks start from prevention, which has always been the most effective means of protection. KuCoin urges its users to resort to both preventive and protective measures to avoid becoming the victim of phishing. Know The Source The abundance of spam and letters being sent to email accounts raises the issue of their authenticity and safety. We advise users to always check the source of the email or websites they visit before opening them and avoid fake ads in search engines. The only official website of the KuCoin exchange is , which has a Site Security Certificate next to it in the address bar in the form of a lock. www.kucoin.com Even the slightest deviation in the address details, URL, its lettering or spelling can signify that the website is a phishing source. The contents of a legitimate email sent by KuCoin will never contain requests from passwords or other information of a sensitive or personal nature. The same can be said of websites, which users should always check before visiting. Effective firewalls and anti-virus packages often come with website scanning tools that prevent users from visiting known or reported phishing sources. Check the correctness of the website name and the URL link In case users receive an email from KuCoin informing them about device/IP changes that were not requested, there is a high chance that the account has been compromised and the only way to proceed is to contact the official support service. Never Click Attachments sent in emails must be approached with extreme caution and avoided, if possible. Phishing emails rely on the immediate deployment of malware that is released once the victim opens an attachment. The same applies to websites and other sources of content that can encourage users to click on various buttons, file folders, or urge them to download “proprietary” software. We strongly recommend our users double-check a button or a link before clicking it. Always check the link before clicking on it Always use the KuCoin official website to sign in and trade. Make sure to add the KuCoin official website to your browser’s bookmarks to reduce your chances of encountering phishing sites. Keep Protection Up To Date Though antivirus software cannot stop or prevent phishing attacks, it will protect users from malware. Though the attackers are constantly developing new types of malware and ransomware, the databases of reputable antivirus software companies are being updated in real-time once a new type of threat is identified. Setting the updates of such antivirus and protection software to automatic mode is an added layer of security that ensures the availability of real-time connection to malware databases. Use Several Layers of Protection Email addresses are extremely vulnerable to attack, as are their access credentials. Should an attacker gain access to a password, the email address and all associated login details will be compromised, potentially giving the attacker access to funding repositories. Users are urged to use two-factor authentication, or multi-factor authentication via such tools as Google Authenticator. Strong passwords are merely one step in the protection process, which must be backed by physical availability to the device containing backup or second-layer verification that the hackers cannot access. Using a password manager software package is a good means of keeping track of complex passwords. KuCoin also recommends its users to set up a safety phrase under the Security Setting for preventing access to phishing websites. Another factor is autofill for passwords, which will never be inserted on a phishing website automatically. Back Up Data All-access details must be backed up by physical copies. Users are advised never to keep any digital copies of access credentials written down in any draft emails or text files, especially entitled “passwords”, “private keys”, or in any other fashion that can attract the attention of a potential attacker. Should a mobile device, email account, or computer be compromised via a phishing attack, the hackers will immediately gain access to all the data stored within, placing all other user accounts at risk. External hard drives that are not connected to the internet, copybooks, or cloud storage drives are the most secure means of data backup. Steps To Undertake In Case a Phishing Attack Is Suspected If you encounter any unverifiable information, you can find __ __through the official KuCoin APP for verification. If users suspect that they are being subjected to a phishing attack, the first step is to properly analyze the information under suspicion, in case of emergency, users could freeze their account by themselves first. Any email containing questions of a personal nature about account availability on specific websites or platforms, about password details, or with requests to open attachments is very likely a phishing scam letter. the official customer service However, if users accidentally or unknowingly answer such an email or open an attachment, the first thing to do is clear your browser’s cookies, and reset your KuCoin sign-in password, google authentication and trading password if you have clicked suspicious links. And check  whether there are pending orders, withdrawals, API creation, trusted devices, etc. if those are not operated by yourself , please delete them immediately . Next, contact all banks and other potentially affected account organizations and ask them to initiate an access code change procedure. The infected device must be immediately disconnected from the internet or switched off. KuCoin users are urged to immediately contact all managers and support staff of potentially affected accounts and request them to assist with credential change procedures, providing appropriate identification. The infected device must be scanned for malware and, in some cases, formatted. Summary Phishing attacks are a threat to all users of online space. There is no way of eliminating the threat, as the hackers are developing an ever-growing arsenal of instruments and preventing them from deploying such malware is both digitally and physically impossible. Considering the very real threat of phishing, KuCoin advises its users to remain vigilant and apply a series of proper protective measures to safeguard their accounts. If the users believe that they have encountered a page designed to look like another page in an attempt to steal their personal information, please click here to phishing. report

PALO ALTO NETWORKS

paloaltonetworks.com

-- employees

Since n.d.

COMPANY RANKING

PALO ALTO NETWORKS

EVERGREEN INDEX #8014

Representing this company? Click here to claim and customize this page!

Palo Alto Networks WIKI

Apply to get your Tech Company News Page live on HackerNoon.com today!

PALO ALTO NETWORKS

paloaltonetworks.com

-- employees

Since n.d.

COMPANY RANKING

PALO ALTO NETWORKS

EVERGREEN INDEX #8014

RELATED COMPANIESRANK

STORIES ABOUT PALO ALTO NETWORKS

Representing this company? Click here to claim and customize this page!

Palo Alto Networks WIKI

Apply to get your Tech Company News Page live on HackerNoon.com today!