This report offers insight into authentication. It discusses some key problems with various standard authentication processes and highlights ways that authentication can be improved.

This report offers insight into the changes occurring in the financial services industry as relates to the revised Payment Services Directive (PSD2).

As account opening continues to transition from physical to digital channels, financial institutions, issuers, lenders, and other organizations must optimize the digital experience of applicants in order to compete. At the same time, fraud is on the rise as criminals have become more successful than ever, thanks to some of the same digital channel benefits enjoyed by consumers: convenience, speed, and ease of use. To achieve the necessary balance between preventing fraud and providing a delightful experience for consumers, an approach to identity proofing that accounts for the channel, product, customer, and threat environment is absolutely critical. But regardless of the approach, inconspicuous solutions — like those based on applicant behavior — have a distinct role to play in how institutions manage the risk of application fraud.

This is a handy guide that provides information useful for understanding online fraud.

This whitepaper is intended to help firms understand how security automation can accelerate analyst response time to incoming phishing alerts and minimize the impact of these malicious attacks on their environment.

In this report we analyze real-world end-user vulnerability assessment (VA) behavior using a machine learning (ML) algorithm to identify four distinct strategies, or “styles.” These are based on five VA key performance indicators (KPIs) which correlate to VA maturity characteristics. This study specifically focuses on key performance indicators associated with the Discover and Assess stages of the five-phase Cyber Exposure Lifecycle. During the first phase – Discover – assets are identified and mapped for visibility across any computing environment. The second phase – Assess – involves understanding the state of all assets, including vulnerabilities, misconfigurations, and other health indicators. While these are only two phases of a longer process, together they decisively determine the scope and pace of subsequent phases, such as prioritization and remediation. The actual behavior of each individual enterprise in the data set, in reality, exhibits a mixture of all VA Styles. For the purposes of this work, enterprises are assigned to the specific style group with which they most closely align. We provide the global distribution of VA Styles, as well as a distribution across major industry verticals.

This unique report offers insight into the world of hackers. It seeks to stand apart from other annuals and quarterlies by presenting information other reports are not discussing.

From the report, “Before we begin the 2018 Black Report in earnest, it’s important to understand who our respondents are. Last year, we focused on people who referred to themselves as hackers or professional penetration testers. This year, we broadened our survey to include incident responders. These guys deal first-hand with hackers and the aftermath of data breaches. And as you’ll see, their perspective provided a tremendously valuable contribution to the results of the survey.” Read on to find out more.

From the report, “To understand current levels of exposure and resiliency, Rapid7 Labs measured 4532 of the 2017 Fortune 500 List3 for: • Overall attack surface (the number of exposed servers/devices); • Presence of dangerous or insecure services; • Phishing defense posture; • Evidence of system compromise; • Weak public service and metadata configurations; and • Joint third-party website dependency risks.” Read on to find out more.

In 2016, Rapid7 Labs launched the National Exposure Index in order to get a measurable, quantitative answer to a fairly fundamental question: What is the nature of internet exposure—services that either do not offer modern cryptographic protection, or are otherwise unsuitable to offer on the increasingly hostile internet—and where, physically, are these exposed services located? Now in our third year, we continue this ongoing investigation into the risk of passive eavesdropping and active attack on the internet, and offer insight into the continuing changes involving these exposed services. We’ve also added a third dimension for exposure, “amplification potential,” in the wake of the disastrous memcached exposure uncovered in 2018.

From the report, “This quarter’s report covers three main areas of concern for the modern IT defender: • First, credential theft, reuse, and subsequent suspicious logins are—today— the most commonly reported significant incident we’re seeing across both small (<1,000 endpoints) and large organizations (≥1,000 endpoints). • Second, the DDoS landscape just got a lot more interesting with the debut of a new technique using misconfigured—and plentiful—memcached servers. • Finally, we take a look at the increasing levels of SMB and Cisco SMI attacker probes and attacks, where the former continues to define the “new normal” level of background malicious behavior around Windows networking, and the latter begins to bring shape to this relatively new attack vector targeting core router infrastructure.” Read on to find out more.

At Splunk, we’re working on shaping the future. Our experts are embracing new developments, focusing on the future of artificial intelligence (AI) and machine learning (ML), IT operations, security and IoT. Pulling together insights from our thousands of customers and our dedicated research teams, our experts have assembled a shortlist of the top predictions for 2019.

At Splunk, our experts don’t read palms, but they do look into the future. The future of artificial intelligence (AI) and machine learning (ML), IT operations, security, and IoT. Join us once again as we connect with our renowned experts to capture their predictions for the next big thing in their fields.

From the report, “Demisto recently sponsored an independent, third-party survey conducted with security professionals around the world working for companies ranging from less than 500 employees to greater than 20,000 employees. More than 200 responses were analyzed. The purpose of the survey was to discover challenges faced by incident response teams and how they are addressing them (or not) currently. This is the first industry study to span and cover all aspects of incident response, including SOC location, training issues, tools utilization, and what metrics are being tracked.” Read on to find out more.

From the report, “For the State of the Federal IT Landscape report, OneLogin commissioned CITE Research to conduct an online, in-depth survey of 150 federal IT professionals in the United States. The goal of the survey was to understand: The current federal IT landscape, Security concerns and challenges facing federal agencies, IT plans with regard to the cloud, Technologies in use or being considered to address concerns. This survey was conducted in late October of 2018.” Read on to find out more.

From the report, “What does 2018 hold in store for the defenders? Unfortunately, more of the same security drama, according to Cybereason’s researchers and analysts. Specifically, they identified the following as some of the bigger security trends in the new year: 01. Supply Chain Attacks Increase & Remain Underreported 02. Destructive Attacks Do Not Let Up 03. The Line Blurs Between APT Actors & Cybercriminals 04. Fileless Malware Attacks Become Ubiquitous” Read on to find out more.

“The people, not just tools, are the key to enterprise cyber security. It’s time to devise an actionable plan to make sure every member of your organization is cyber-ready. In this guide, we will present a basic framework for optimizing the types, frequency and costs of security simulation training for the entire enterprise.”

This helpful guide provides insight into the settings you should maintain on all of the major social networks. Read on to learn more.

As more people become connected on social platforms, cyber criminals find themselves with more numerous and accessible potential targets than ever before. Over a 4 month period in 2015, the ZeroFOX Research Team built a machine learning classifier and identified thousands scams targeting major financial institutions and their customers across Instagram. The results of the study shine a light on a growing problem with serious impacts on financial institutions’ bottom lines.

This report offers the following highlights - Case study of a Fortune 50 organization breached via social media, Deep dive into each layer of the new attack chain, A detailed look at impersonation accounts and hijacked accounts, a new staple in the attack lifecycle, Tactics, techniques, and procedures (TTPs) used by the modern attacker on social media, Recommendations and best practices for updating your security posture.

Fraudulent accounts run rampant on social media. But what are they up to, what cyber attacks are they launching? ZeroFOX Research investigates 40,000 fake accounts to find out.