CVE-2022-1388 is a critical CVE (CVSS 9.8) in F5 Networks’ BIG-IP solution management interface. This CVE will allow threat actors to bypass F5’s iControl REST authentication to gain remote code execution. This is not the first significant vulnerability we have seen with the BIG-IP platform. In 2021, security practitioners worldwide observed attacks against the iControl REST API as well. This was tracked as CVE-2021-22986. The vulnerability is what security researchers call a

Phishing attacks remain the number one technique used in cyberattacks. Some of the most common phishing attacks leveraged attachments to facilitate the initial infection chain. We disproportionally see Microsoft Office documents and PDF files used to embed the malicious code as far as the attachments themselves go. When we say Microsoft Office documents, we refer to files created by the Microsoft Office suite such as Microsoft Word, Excel, PowerPoint, etc. Historically we wou

A critical vulnerability CVE-2022-22965 (Spring4Shell or SpringShell) was found on March 29, 2022, in an open-source Java framework while testing named Spring. This vulnerability allows the attacker to execute arbitrary code on a web server. Spring is a widely used framework, so this vulnerability can be highly lethal. The data binding feature of Spring Framework was used to bind data in an HTTP request to some of the objects being used in an application. The vulnerability ex

As we look across the landscape, we see that cyberattacks continue to succeed in all business sectors. In the cases we have observed, the cyberattack leveraged weak security controls and, as a result, could have been prevented by organizations adopting security best practices. A new study shows that ransomware, phishing, social engineering, denial of service (DoS) attacks, and the business fallout of a data breach rank as the top concerns of global organizations. The recently

Despite the depth of implemented protection measures, cyber incidents are bound to happen at some time. An incident analysis process comprises carefully structured and orchestrated operations to determine the incident's root cause and prevent it from reoccurring in the future. Incident analysis is critical to responding and recovering from an adverse cyber event. The following are recommended incident analysis phases: Detection and observation IT security teams use various t