Forwarded from vulners
Navigating Uncertainty in Vulnerability Management🛡
Since mid-February 2024, the National Vulnerability Database (NVD) has been delayed in updating CPE data for new vulnerabilities, resulting in a backlog of over 10,000 CVEs 📉.
The value of the NVD has been underestimated with no simple replacements. Our article details the complexities of this issue.
Data inconsistency from CVE Numbering Authorities (CNAs) complicates matters further. Despite Vulners' efforts to create handlers for each CNA, manual oversight and expert analysis are crucial for reliable assessments. Closing the long tail of vulnerabilities still demands significant human resources.
Read more about strategies to address these challenges in our full article: Navigating Uncertainty
Since mid-February 2024, the National Vulnerability Database (NVD) has been delayed in updating CPE data for new vulnerabilities, resulting in a backlog of over 10,000 CVEs 📉.
The value of the NVD has been underestimated with no simple replacements. Our article details the complexities of this issue.
Data inconsistency from CVE Numbering Authorities (CNAs) complicates matters further. Despite Vulners' efforts to create handlers for each CNA, manual oversight and expert analysis are crucial for reliable assessments. Closing the long tail of vulnerabilities still demands significant human resources.
Read more about strategies to address these challenges in our full article: Navigating Uncertainty
Forwarded from Пост Лукацкого
Почувствовал себя ИБ-журналистом... ✍️ Сделал внутренний обзор 169 анонсов, озвученных 640 ИБ-вендорами на RSA Conference 2024. Непростая, скажу вам, работа, продраться сквозь маркетинговый булшит вендоров 🤠 и понять, что же реально было представлено компаниями. Нередко, ничего, которое скрывается за красивыми словами про искусственный интеллект, ускорение и углубление, автоматизацию и усиление... Но я это сделал 💪
Выкладывать этот внутренний документ я не буду, а вот его открытую часть с обзором ключевых трендов, я описал, а коллеги🤝 из Anti-malware его опубликовали. Так что велкам 🤓
Выкладывать этот внутренний документ я не буду, а вот его открытую часть с обзором ключевых трендов, я описал, а коллеги
Please open Telegram to view this post
VIEW IN TELEGRAM
👎3👍1
Описание новых функций безопасности в Windows 11.
https://www.microsoft.com/en-us/security/blog/2024/05/20/new-windows-11-features-strengthen-security-to-address-evolving-cyberthreat-landscape
https://www.microsoft.com/en-us/security/blog/2024/05/20/new-windows-11-features-strengthen-security-to-address-evolving-cyberthreat-landscape
Microsoft News
New Windows 11 features strengthen security to address evolving cyberthreat landscape
Read about the new class of Windows computers, alongside important new features and updates that make Windows 11 more secure.
https://vulncheck.com/blog/nvd-backlog-exploitation
"Key Findings
93.4% of new vulnerabilities have not been analyzed by the National Vulnerability Database (NVD) since February 12, 2024.
50.8% of VulnCheck Known Exploited Vulnerabilities have not been analyzed by the National Vulnerability Database (NVD) since February 12, 2024.(Source: VulnCheck KEV).
55.9% of Weaponized Vulnerabilities have not been analyzed by the National Vulnerability Database (NVD) since February 12, 2024.
82% of CVEs with a Proof-of-Concept Exploit have not been analyzed by the National Vulnerability Database (NVD) since February 12, 2024."
"Key Findings
93.4% of new vulnerabilities have not been analyzed by the National Vulnerability Database (NVD) since February 12, 2024.
50.8% of VulnCheck Known Exploited Vulnerabilities have not been analyzed by the National Vulnerability Database (NVD) since February 12, 2024.(Source: VulnCheck KEV).
55.9% of Weaponized Vulnerabilities have not been analyzed by the National Vulnerability Database (NVD) since February 12, 2024.
82% of CVEs with a Proof-of-Concept Exploit have not been analyzed by the National Vulnerability Database (NVD) since February 12, 2024."
VulnCheck
VulnCheck - Outpace Adversaries
Vulnerability intelligence that predicts avenues of attack with speed and accuracy.
https://openssf.org/blog/2024/05/20/enhancing-open-source-security-introducing-siren-by-openssf/
"Introducing Siren, a threat intelligence sharing list hosted by Open Source Security Foundation (OpenSSF), a groundbreaking initiative aimed at fortifying the defenses of open source projects worldwide."
"Introducing Siren, a threat intelligence sharing list hosted by Open Source Security Foundation (OpenSSF), a groundbreaking initiative aimed at fortifying the defenses of open source projects worldwide."
https://groups.google.com/a/chromium.org/g/blink-dev/c/R6VOVMt81y8
"Google engineers have proposed a new IETF standard named TLS Trust Expressions that introduces a new TLS extension/mechanism to servers to deploy multiple certificates and transparently select between them. This enables a multi-certificate deployment model, for a more agile and flexible PKI that can better meet security requirements."
"Google engineers have proposed a new IETF standard named TLS Trust Expressions that introduces a new TLS extension/mechanism to servers to deploy multiple certificates and transparently select between them. This enables a multi-certificate deployment model, for a more agile and flexible PKI that can better meet security requirements."
Использование LLM в будущих кибер атаках от голландского ФСТЭК.
https://www.ncsc.nl/binaries/ncsc/documenten/publicaties/2024/mei/21/index/TNO+2024+M10296+-+Technology+exploration+-+The+future+of+cyber+attacks+with+Large+Language+Models.pdf
https://www.ncsc.nl/binaries/ncsc/documenten/publicaties/2024/mei/21/index/TNO+2024+M10296+-+Technology+exploration+-+The+future+of+cyber+attacks+with+Large+Language+Models.pdf