Security
VPN appliances "all appear to have been constructed with the code equivalent of string, stamped with the word ‘secure’ and then just left to decay for 20 years..."
"In every insider threat case, there is a combination of network activity and employee behaviour. The malicious activity crosses both physical and electronic modalities..."
Attackers re-write JavaScript loaded by the VPN login page for the Appliance to capture credentials; also grabbed Veeam credentials, moved laterally for full SYSTEM control.
One vulnerability bears a striking resemblance to an 0day that was actively exploited in the wild in November 2023.
"The SEC has not approved the listing and trading of spot bitcoin exchange-traded products"
"Simulate and exercise breach readiness, especially abilities to reduce blast radius of a cyber attack. Involve top leadership, the board, and customers in separate cyber war games, as often as practical..."
Another arguably more potent example and one actively exploited in the wild is CVE-2023-46604 – a CVSS 10 RCE vulnerability in Apache ActiveMQ; an open source message broker written in Java.
On Magic Quadrants, deal size, changing approaches to cyber-resilience and learning from his father.
Warns users it will terminate affected tasks, but leaves a lacuna... (Fear not, we're here with details)