This report examines trends in vulnerabilities, exploits and threats in order to better align your security strategy with the current threat landscape. Incorporating such intelligence to vulnerability management programs begins to put vulnerabilities in risk–based context and helps to focus remediation on vulnerabilities most likely to be used in an attack. This is an update to a report published in January 2018 to reflect mid–year trends. All statistics for 2018 reflect data from the first half of the year — January 1, 2018 through June 30, 2018.

In 2016, Rapid7 Labs launched the National Exposure Index in order to get a measurable, quantitative answer to a fairly fundamental question: What is the nature of internet exposure—services that either do not offer modern cryptographic protection, or are otherwise unsuitable to offer on the increasingly hostile internet—and where, physically, are these exposed services located? Now in our third year, we continue this ongoing investigation into the risk of passive eavesdropping and active attack on the internet, and offer insight into the continuing changes involving these exposed services. We’ve also added a third dimension for exposure, “amplification potential,” in the wake of the disastrous memcached exposure uncovered in 2018.

In this whitepaper, they look at three categories of approaches taken by malware to evade sandboxes and explore techniques associated with each approach.

From the report, “Over the past few year’s attackers have exploited this opportunity, and as documented in our Anatomy of an Attack (AOA) report, have compromised a wide variety of manufacturing control systems. This report documents five case studies which show how cyber attackers could gain access to manufacturing and utility facilities. We also detail the progression of the attacks which in some cases disabled operations for an extended period. In one of our case studies, losses were catastrophic with the impacted entity suffering losses of over 800,000 euro per day. This report will explain how the attacks happen, and once established, how the attackers can extend these command and control points to breach the institution’s records, blackmail and extort funds, or worse, disable ongoing operations of the facility over an extended period.” Read on to find out more.

This report takes an inside look at the Cyber Security challenge for healthcare today and more specifically looks at the medical device security challenge.

This report offers a variety of case studies that highlight the challenges in the Healthcare Network.

From the report, “For security teams, the sheer depth and breadth of what they need to defend may seem daunting, but thinking about the Internet from an attacker’s perspective —a collection of digital assets that are discoverable by hackers as they research their next campaigns— can put the massive scope of their organization’s attack surface into perspective. In this report, we’ll highlight five areas that we feel help to better frame the challenges faced in keeping the Internet a safe environment, all of which underline a need to broaden awareness of the potential risks involved to foster a more informed approach to cyber defense.”

This report offers deep insight into the threat actor known as Oilrig.

The DataVisor Fraud Index Report Q2 2018 is based on attacks that were detected by the DataVisor UML Engine from April through June 2018 with additional recent attack trend data. This report provides unprecedented insights into the evolving attack trends and characteristics of fraud attacks across a number of industries including social platform, e-commerce, financial services, and mobile gaming.

The 2018 edition of Webroot’s annual Threat Report shares a glimpse into their discoveries and analysis of threat activity throughout 2017, to equip you with the knowledge you need to overcome modern cybercrime.

From the report, “For the past six years, Puppet has produced the annual State of DevOps Report1 and collected more than 27,000 responses from technical professionals around the world, making it the longest-running and most comprehensive study on the topic of DevOps today. One of the most common requests we’ve gotten over the years is for segmentation of the data by region, industry and company size. In this special report, we’ve segmented the 2017 State of DevOps survey data to dive deeper into trends and patterns we’re seeing in each of these segments.”

From the report, “This year we designed our DevOps survey to reveal what successful organizations actually do as they progress on their DevOps journeys. We discovered that they experience five distinct stages of DevOps evolution, which we have shared in full detail in our 2018 State of DevOps Report. This CIO guide digests our research into a report that’s just for you. We want to help you quickly understand what successful organizations do at each stage of DevOps evolution; which practices must be established at each stage (we call these the defining practices); and how you can best support your team throughout its DevOps journey to assure continuing progress and success.”

This guide is designed to help enterprises endpoint security solutions.

This paper provides a helpful checklist for NIST adoption.

With hundreds of thousands of implementations across the globe, Enterprise Resource Planning (ERP) applications are supporting the most critical business processes for the biggest organizations in the world. This report is the result of joint research performed by Digital Shadows and Onapsis, aimed to provide insights into how the threat landscape has been evolving over time for ERP applications. We have concentrated our efforts on the two most widely-adopted solutions across the large enterprise segment, SAP and Oracle E-Business Suite, focusing on the risks and threats organizations should care about.

Long gone are the simple days of malware threats only being associated with the computers on our desks or at our business offices. Today, we’ve all become accustomed to malware infiltrating our homes and pockets across a variety of platforms, be that our telephones, tablets, smart TV or even ‘connected’ devices such as our fridges. Whilst malware can be tailored for different platforms and differ in their abilities or functionality, the overall taxonomy remains very much the same. Back in the ‘halcyon’ days many malware authors released their wares for fun, ‘lulz’ in modern parlance, today most are criminally motivated and driven by financial gain, ideology, revenge and nation state doctrine. The objective of these attacks, and the compromised devices or networks, are typically similar and result in the threat actor gaining access, leading to the theft of confidential and personal information, or disrupting the operations and functionality.

This paper offers insight into QR code usage and user interest and suggests that organizations should take time to consider and familiarize themselves with the potential security ramifications.

“Almost immediately following the WannaCry cyberattack, the NotPetya malware affected countries and organisations around the globe that had strikingly similar repercussions and lessons to take away. This attack exemplified the chronic failings organisations and nation-states continue to have despite the blatant and ongoing threats cyberspace poses. With cyber threats remaining a critical issue for organisations, there is still a great deal organisations need to do to mitigate these for future resilience.”

This report offers insight into the Cyber security landscape of The People’s Republic of Korea.

This report is the first in a bi-annual series that examines risks and attacks in the cloud native computing ecosystem. The next report will be released in the first half of 2019.

In this report, they provide an overview of current vulnerability disclosure trends and insights into real-world vulnerability demographics in enterprise environments. they analyze vulnerability prevalence in the wild, based on the number of affected enterprises, to highlight vulnerabilities that security practitioners are dealing with in practice - not just in theory.