Vulnerability Management Archives - RedSeal

Tag Archive for: Vulnerability Management

7 Things to Know About Hybrid Exposure Management

/by

Enterprise environments are no longer contained within a single data center or cloud provider. They span on-premises networks, public and private clouds, remote locations, operational technology, Internet of Things devices, and third-party infrastructure. This complexity has changed what security teams need from an exposure management platform. 

Traditional vulnerability management tools can identify weaknesses, but they often cannot explain whether an attacker can reach them, how exposures connect across the environment, or which issues create the greatest business risk. 

Hybrid exposure management addresses this gap by helping organizations understand their entire environment as a connected system. It combines asset discovery, network modeling, attack path analysis, risk prioritization, compliance monitoring, and remediation workflows to reduce exposure before it becomes an incident. 

Here are seven capabilities enterprise cybersecurity leaders should evaluate when selecting a hybrid exposure management platform. 

  1. Hybrid Exposure Management Goes Beyond Vulnerability Scanning

A hybrid exposure management platform helps organizations identify, understand, prioritize, and reduce cybersecurity risk across interconnected environments. 

Unlike traditional vulnerability management, exposure management does not evaluate vulnerabilities in isolation. It examines how assets, network configurations, identities, security controls, and business context interact. 

This distinction matters because a high-severity vulnerability does not always represent the greatest risk. 

A vulnerability may be difficult to exploit because it is isolated behind multiple security controls. At the same time, a lower-severity issue may provide a direct path to a critical system. 

An effective exposure management platform should help answer questions such as: 

  • Can an attacker reach this asset?
  • Which systems could be affected if it were compromised?
  • What security controls stand between an attacker and a critical resource?
  • Which exposures create the largest potential impact?
  • What remediation would reduce the most risk?

By answering these questions, exposure management helps teams move from finding vulnerabilities to reducing meaningful risk. 

  1. Complete Asset Discovery Is the Foundation

Organizations cannot protect assets they do not know exist. 

Asset discovery is therefore one of the most important capabilities within an exposure management platform. However, discovery must extend beyond managed laptops, servers, and cloud workloads. 

Enterprise environments frequently include: 

  • On-premises infrastructure
  • Public and private cloud resources
  • Remote offices and branch locations
  • Virtual machines and containers
  • Internet of Things devices
  • Operational technology systems
  • Network and security devices
  • Unmanaged or unknown assets

IoT and OT security present a particular challenge because many devices cannot support traditional endpoint agents. Some are difficult to patch, run outdated operating systems, or support essential business and industrial processes that cannot easily be interrupted. 

An exposure management platform designed for hybrid environments should use hybrid environment modeling to discover assets, map their connections, and provide visibility without depending entirely on agents. It should identify known and unknown assets, understand how they communicate, and show where they are located within the broader environment. 

Complete asset discovery creates the foundation for every other exposure management capability. Without an accurate understanding of the environment, risk assessments and remediation decisions will remain incomplete. 

  1. Architecture-Aware Visibility Is Essential

A list of assets does not show how an environment actually functions. 

Enterprise cybersecurity leaders need architecture-aware visibility that explains the relationships between networks, assets, cloud environments, identities, routes, access controls, and security policies. 

This is especially important for hybrid infrastructure security, where risk can move across multiple technology domains. 

For example, an attacker might: 

  1. Compromise an internet-facing system. 
  2. Move through a misconfigured network segment. 
  3. Use an identity relationship to access another environment. 
  4. Reach a critical application or operational system. 

Each individual security tool may see part of this activity. An exposure management platform should connect those individual findings into a unified model. 

RedSeal creates a digital model of the hybrid environment by collecting and analyzing information from existing network, cloud, security, vulnerability, and identity technologies. This allows security teams to understand how the environment is configured and how an attacker could move through it. 

By modeling the environment as a connected system, organizations gain more than visibility. They gain context. 

  1. Attack Path Analysis Should Show How Risk Spreads

Attack path analysis helps security teams understand how an adversary could move from an initial point of access to a high-value asset. 

Instead of presenting vulnerabilities as an isolated list, an exposure management platform should identify the combinations of exposures, routes, configurations, identities, and access policies that create viable attack paths. 

This allows teams to answer a more valuable question: 

What could an attacker actually reach? 

Effective attack path analysis should show: 

  • Potential entry points 
  • Reachable assets and network segments 
  • Paths to critical systems 
  • Security controls along each path 
  • Opportunities for lateral movement 
  • Choke points where remediation could interrupt multiple paths 

This context is particularly valuable in hybrid, IoT, and OT environments. Security teams may not be able to patch every vulnerable device immediately. In some cases, patching may not be possible at all. 

Attack path reduction gives organizations additional ways to lower risk. Teams may be able to change network access, strengthen segmentation, adjust a security control, isolate an asset, or remove unnecessary connectivity. 

The goal is not simply to count vulnerabilities. It is to reduce the number of ways an attacker can reach important systems. 

  1. Risk Prioritization Must Include Business Impact

Security teams regularly face thousands or even millions of findings. Treating every vulnerability as equally urgent creates noise, slows remediation, and makes it harder to focus on the risks most likely to affect the business. 

A mature exposure management platform should combine technical severity with environmental and business context. 

That context may include: 

  • Asset criticality 
  • External exposure 
  • Network reachability 
  • Attack path position 
  • Existing security controls 
  • Exploitability 
  • Identity relationships 
  • Potential downstream impact 
  • Regulatory importance 
  • Business ownership 

This approach improves threat reduction by helping teams focus on exposures that are both exploitable and consequential. 

RedSeal’s Risk Radius™ risk prioritization helps organizations understand the potential impact of compromise by evaluating what an attacker could reach from a particular asset. Instead of prioritizing solely based on a vulnerability score, teams can consider the broader radius of risk surrounding the exposure. 

For example, a vulnerable system connected to several critical applications may deserve attention before a higher-scoring vulnerability on an isolated device. 

The best exposure management platforms help security leaders explain not only what needs to be fixed, but why it matters. 

  1. Continuous Compliance Requires Continuous Validation

Compliance cannot be treated as a once-a-year assessment. 

Hybrid environments change constantly. Cloud resources are added, network rules are updated, devices connect and disconnect, and configuration changes can unintentionally introduce new exposure. 

Continuous compliance helps organizations identify policy violations and control gaps as the environment changes. 

An exposure management platform should continuously assess the environment against internal policies, industry frameworks, and regulatory requirements. It should also help teams understand whether security controls are functioning as intended. 

Key capabilities may include: 

  • Automated policy assessments 
  • Configuration validation 
  • Network segmentation checks 
  • Continuous control monitoring 
  • Evidence collection 
  • Compliance reporting 
  • Identification of policy violations 
  • Prioritized remediation guidance 

Continuous compliance is especially important for organizations operating in highly regulated industries or managing critical infrastructure. 

Rather than relying on point-in-time evidence, cybersecurity teams can maintain an ongoing understanding of their security posture and identify potential compliance issues before an audit. 

  1. Exposure Management Should Support Action, Not Just Analysis

Visibility and prioritization provide limited value if security teams cannot turn findings into action. 

An exposure management platform should connect analysis to remediation workflows. This means providing security, network, cloud, IT, and operational teams with clear information about what needs to change and why. 

Effective workflow capabilities should help organizations: 

  • Assign remediation to the appropriate owner 
  • Provide technical and business context 
  • Track remediation progress 
  • Validate whether a change reduced risk 
  • Integrate with existing ticketing and security tools 
  • Automate repeatable response processes 
  • Measure changes in exposure over time 

Exposure management should also help teams validate remediation before and after changes are made. 

Before a change, teams should be able to understand its potential impact. After remediation, the platform should confirm that the exposure or attack path has actually been reduced. 

This closes the gap between identifying risk and proving that risk has been addressed. 

What Should You Look for in an Exposure Management Platform? 

Enterprise cybersecurity leaders should evaluate whether a platform can provide the following capabilities across their complete environment: 

  1. Comprehensive asset discovery 
  2. Agentless visibility for hybrid, IoT, and OT environments 
  3. Architecture-aware environment modeling 
  4. Attack path and lateral movement analysis 
  5. Business-contextual risk prioritization 
  6. Continuous compliance monitoring 
  7. Integrated remediation and validation workflows 

The platform should also work with the organization’s existing technology investments. Exposure management should unify information from network, cloud, vulnerability, identity, endpoint, and security tools rather than create another disconnected source of alerts. 

How Does RedSeal Support Hybrid Exposure Management? 

RedSeal helps organizations understand and reduce exposure across complex hybrid environments. 

The RedSeal exposure management platform creates an agentless digital model of the environment using information from existing network, cloud, security, vulnerability, and identity technologies. 

This allows cybersecurity teams to: 

  • Discover assets across hybrid, IoT, and OT environments 
  • Understand network architecture and connectivity 
  • Identify attack paths and lateral movement opportunities 
  • Prioritize risk using environmental and business context 
  • Evaluate the potential impact of compromise with Risk Radius™ 
  • Continuously monitor compliance and security controls 
  • Mobilize remediation through integrated workflows 
  • Validate whether security changes meaningfully reduced exposure 

Instead of evaluating vulnerabilities as isolated findings, RedSeal helps organizations understand how risk moves through the environment and where action will have the greatest impact. 

Reduce Exposure Across Your Hybrid Environment 

The modern enterprise attack surface is too complex to manage through disconnected tools and vulnerability lists alone. 

Organizations need an exposure management platform that can model the complete environment, reveal how risk is connected, prioritize the exposures that create the greatest potential impact, and help teams take action. 

RedSeal gives cybersecurity leaders the visibility and context needed to understand their hybrid environment better than an adversary and reduce exposure before it becomes an incident. 

Explore the RedSeal exposure management platform to see how your organization can uncover attack paths, prioritize meaningful risk, and strengthen security across hybrid IT, OT, and IoT environments. 

CISA Just Described Your Monday Morning Problem — And We Already Built the Answer

/by

Yesterday, CISA Acting Director Nick Andersen stood up at a Washington, D.C. event and said something that should stop every vulnerability management team in their tracks:

“We’re really asking people to take more of a focus on risk associated with each vulnerability. Is it with an asset that is internet-exposed? Does it align to a KEV entry? Is it automatable in its exploitation? Really, we need to be able to highlight that some patches just aren’t as important as others.”

A binding operational directive for federal agencies is dropping today that formalizes exactly this thinking — a fundamental shift away from blanket, score-based patching toward targeted, context-driven risk prioritization.

Here’s what caught my attention: Andersen just described the exact problem we built our CISA KEV workflow to solve. Not in theory. In production. In customer environments today.

Let me show you what that looks like.

The problem CISA is finally naming

Picture Monday morning. Your vulnerability scanner just ran. You have 100 vulnerabilities — all CVSS score of 10. The worst possible rating. They’re all tied for first place.

Your team has a process for this. Some methodology to rack and stack and prioritize. Fair enough.

But here’s the math: if it takes an hour to properly evaluate each vulnerability — and that’s a reasonable estimate — you’ll know which one to start with in about two and a half weeks.

That’s before you factor in CISA’s Known Exploited Vulnerabilities database.

The KEV catalog is CISA’s list of CVEs being actively exploited in the wild right now. Not theoretical. Not scored by committee. Actively weaponized by adversaries targeting organizations like yours.

But the KEV database doesn’t update on any regular cadence. It might update three times this week. It might not update at all. That means your team has to either subscribe to email alerts, maintain a custom polling script, or check it manually every day. And even when you have the KEV list, you still have to cross-reference it against every vulnerability in your environment — manually.

Two and a half weeks of triage, plus a daily manual intelligence operation layered on top of it.

This is the problem Andersen is directing federal agencies to solve. And it isn’t just a federal problem.

What the new CISA directive actually requires

The binding operational directive formalizes a three-factor risk lens for vulnerability prioritization:

  1. Internet exposure— Is the vulnerable asset reachable from outside your network?
  2. KEV alignment— Does this vulnerability appear in the CISA Known Exploited Vulnerabilities catalog?
  3. Exploitability— Can this vulnerability be automated in its exploitation?

The directive moves federal agencies away from “a patch is released, apply this patch as quickly as you can” toward a model where context determines urgency. Not every CVSS-10 is equally dangerous. The one that matters is the one that’s internet-exposed, KEV-listed, and sitting unpatched in your environment right now.

That’s a precise, three-part question. The answer should be immediate — not the result of two weeks of analyst effort.

We already built this

At RedSeal, we’ve been operationalizing exactly this logic for our customers.

Here’s what it looks like in practice.

A RedSeal workflow — no code required, schedulable at any interval — automatically pulls the current CISA KEV list, compares it against every vulnerability in your RedSeal environment model, and builds a dynamic scope inside the RedSeal UI called CISA. It runs in under 20 seconds. It runs as often as you tell it to. It requires zero analyst hours.

When a security team opens RedSeal on Monday morning, that scope is already there. Already current. Already filtered to the vulnerabilities in their environment that CISA has flagged as actively exploited.

In one recent demonstration environment, that scope contained 50 assets carrying known exploited vulnerabilities. That’s still a week of work to evaluate — until you apply the internet exposure filter

Filter to assets exposed to the outside world: the list goes from 50 to 1.

One asset. One action. That’s your Monday morning priority list.

And RedSeal doesn’t stop there. For that single exposed asset, RedSeal shows you:

  • The blast radius — in this case, one untrusted network connection providing a path to 92 critical internal assets
  • The exact network path from the untrusted external network to the vulnerable asset — traced hop by hop, like a visual traceroute through your actual security controls
  • The specific firewall with the specific rule allowing that access — highlighted automatically
  • The exact line in the configuration file your network team needs to change to close the exposure

In the example above: line 347 on a Palo Alto firewall. Change that rule. Exposure mitigated. You didn’t need to wait for a patch. You closed the door.

That’s not just KEV alignment — that’s all three factors in Andersen’s framework addressed simultaneously. Internet exposure: confirmed. KEV alignment: confirmed. Actionable remediation: here’s the firewall, here’s the rule, here is the line.

Why this matters beyond federal agencies

Andersen was explicit that this directive targets federal civilian executive branch agencies — but he was equally clear that the underlying logic applies broadly. CISA strongly urges all organizations to prioritize KEV remediation as part of their vulnerability management practice.

That guidance lands differently when you consider what’s driving it: AI-enhanced threats are shortening the timeline from vulnerability disclosure to weaponized exploit. The window your team has to act is narrowing. The cost of prioritizing the wrong vulnerability — spending two weeks evaluating 100 CVSS-10s while the one internet-exposed KEV sits unpatched — is rising.

The organizations that will respond fastest to this directive, and to the threat environment driving it, are the ones that have already automated the intelligence layer. Not just the scanning. Not just the scoring. The continuous, real-time correlation of what’s in your environment, what CISA says is being exploited, and what’s actually reachable from the outside world.

That’s what RedSeal does. Not as a future roadmap item. Today.

63% of organizations lack the network visibility to answer Andersen’s question

There’s a data point that contextualizes why this directive is necessary: 63% of companies say they lack the network visibility necessary to achieve a strong security posture.

If you don’t know what’s internet-exposed in your environment, you cannot answer the first question in Andersen’s framework. If you’re not continuously monitoring the KEV catalog and cross-referencing it against your vulnerability data, you cannot answer the second. And if you don’t have a network model that shows you the actual path from the external network to the vulnerable asset, you can’t act on the answer even when you have it.

Visibility isn’t a nice-to-have in this new framework. It’s the prerequisite for everything else.

What to do right now

Whether you’re a federal agency subject to the new directive or a critical infrastructure operator taking Andersen’s guidance seriously, here are three immediate steps:

Step 1 — Know what’s internet-exposed. Build or verify a continuously updated model of your hybrid environment that can answer, at any moment, which assets are reachable from outside your network. Not a six-month-old Visio diagram. A living, current model.

Step 2 — Automate your KEV correlation. Stop manually checking the CISA KEV catalog. Build a workflow that pulls the catalog automatically, cross-references it against your vulnerability data, and surfaces matches without analyst intervention. If you’re a RedSeal customer, this workflow is available to you today.

Step 3 — Know your path to remediation before the call comes. For any KEV-listed vulnerability on an internet-exposed asset, you should be able to answer: what is the specific network path enabling that exposure, and what is the specific control change that closes it? That answer should take minutes, not days.

The bottom line

CISA’s Acting Director just codified in a binding directive what the most operationally mature security teams have known for years: CVSS scores don’t tell you what matters. Internet exposure plus active exploitation plus network context tells you what matters.

RedSeal was built to answer exactly that question — continuously, automatically, and with the specific evidence your network team needs to act.

When the directive drops today, your team shouldn’t be scrambling to figure out how to comply. They should already be there.

To see the CISA KEV workflow and the internet exposure filter in action, contact your RedSeal representative or visit www.redseal.net.

 

Exposure Management in 2025: Meeting the Moment

/by

In 2025, the cyber threat landscape reached a new level of urgency. With hybrid infrastructure now the norm, operational complexity has skyrocketed, and attackers are moving faster, with AI-enhanced tools and relentless automation. Security teams face a harsh truth: vulnerability management isn’t enough. It’s not just about what’s vulnerable, it’s about what’s exposed.

Exposure management is the new frontline, and many organizations are still figuring out what that means in practice. At RedSeal, we’ve worked closely with some of the most targeted sectors, finance, healthcare, energy, and government, to answer that question. And while the answer varies across organizations, a few key needs are consistent: Clarity about what’s in the environment, context to know what truly matters, and confidence to take the right action, quickly.

Let’s explore how RedSeal has evolved to meet those needs, what we’re seeing in the field, and how exposure management is shaping up for 2026.

From Visibility to Actionable Insights

Most exposure starts with a lack of visibility. Security teams are tasked with protecting environments that span legacy systems, multiple clouds, OT/IoT networks, and remote access infrastructure. RedSeal helps map this complexity without agents or manual updates, so customers can continuously understand how everything connects and where risk can move.

But customers need more than just a map.

The real challenge is turning visibility into action. That’s why our platform now prioritizes vulnerabilities based on how they could be exploited, not just that they exist. We factor in:

  • Reachability across the network
  • Known exploit paths
  • Business impact of affected assets

Our scoring is explainable, so teams can see exactly why something is a priority, no black boxes, no guesswork.

Helping Teams Do More With Less

Staffing shortages are still a reality for most organizations. RedSeal customers tell us they need solutions that scale, not just in coverage, but in usability. We’ve focused heavily on workflow integration and automation, enabling teams to move from insight to action without jumping across tools. Including: Automating ticket generation for prioritized issues, validating segmentation and access policies continuously and integrating with orchestration tools to streamline remediation.

One customer in healthcare reduced audit prep time by 80% through continuous policy validation. Another, in manufacturing, cut response time for OT-to-IT threats by more than half. These aren’t theoretical wins, they’re operational gains that reduce real-world risk.

A Platform Built for Hybrid Complexity

Whether protecting cloud workloads, industrial control systems, or sprawling campus networks, customers need a unified approach. RedSeal’s strength lies in bringing these worlds together, modeling access across them, revealing hidden exposure paths, and helping customers enforce consistent policies.

And as organizations blend traditional IT with OT, RedSeal’s ability to simulate access and validate segmentation across both domains has become critical, especially in regulated industries like finance, healthcare, and government.

Where We’re Headed in 2026

Looking ahead, exposure management will demand more automation, more integration, and more explainability. The volume and speed of threats won’t slow down. But with the right platform, customers can keep ahead of it, not by chasing alerts, but by understanding what’s at risk and acting with confidence.

RedSeal is continuing to invest in:

  • Environment modeling
  • Automated remediation
  • Deeper integrations with compliance and response tools
  • More transparency in how risk decisions are made

Ultimately, our goal is to help teams secure environments they can’t afford to misunderstand. In 2026, that means giving them more clarity, more control, and more time back in their day. We’ve come a long way together, but there’s still so much left to do. For a quick peek into our platform, check out our latest video here.

Contact RedSeal today to learn how RedSeal can support your exposure management journey.

Drowning in Vulnerabilities? Here’s How to Finally Know What to Fix First

/by

Security teams are drowning in vulnerabilities. Thousands of new Common Vulnerabilities and Exposures (CVEs) emerge every month, and the number of assets in hybrid environments continues to grow. The challenge isn’t finding exposures; it’s knowing which ones actually matter. With limited staff and constant pressure to reduce risk, the critical question becomes: Which risks do we tackle first, and why? 

Moving Beyond a List of Vulnerabilities 

Traditional tools surface endless lists of issues without context. A vulnerability on a low-value asset is treated the same as one on a mission-critical system. This leaves teams guessing, executives frustrated, and remediation delayed. 

That’s why RedSeal built Risk Radius™, to move beyond raw vulnerability counts and bring explainable, business-aligned context to risk decisions. Risk Analysis in the RedSeal platform changes the conversation. Instead of showing only what’s vulnerable, it explains why an asset is risky, how the score was calculated, and what the potential impact would be if compromised. 

Introducing Risk Radius™ 

At the center of this analysis is Risk Radius™, RedSeal’s proprietary algorithm that makes risk explainable. Rather than delivering another opaque score, Risk Radius turns complex exposure data into a clear, defensible story of risks showing what’s exposed, why it matters, and what to fix first. 

It combines the likelihood of compromise with potential business impact to highlight the assets that matter most. 

With Risk Radius, customers can see: 

  • Why an asset is considered high risk 
  • How its score was calculated 
  • What the potential blast radius would be if it were compromised 

Unlike black-box scoring models, teams gain transparent insights they can confidently share with executives, auditors, and insurers, transforming vulnerability management from guesswork into an explainable, business-aligned process. 

How We Arrive at Risk Scores 

Not every risk is created equally. A forgotten file server and a domain controller may both have vulnerabilities, but only one could disrupt business continuity if breached. 

Risk Radius calculates Risk Scores by considering multiple parameters: 

  • Criticality to the business
    Is the asset tied to operations, compliance, customer data, or safety? For example, domain controllers, Enterprise Resource Planning (ERP) platforms, and Operational Technology (OT) controllers often represent high business impact. 
  • Connectivity and exposure
    How reachable is the asset from potential attack entry points? Highly connected systems that bridge Information Technology (IT), OT, cloud, or remote environments naturally increase risk. 
  • Potential blast radius
    If compromised, how much farther could a threat actor move? Could they pivot into critical systems or exfiltrate sensitive data? 
  • Ease of compromise
    How hard would it be for an attacker to take control if they gained access? Are controls in place to slow them down? 
  • Business context and classification
    Has the organization designated it as holding sensitive data, intellectual property, or workloads tied to regulatory frameworks? Assets tied to Payment Card Industry Data Security Standard (PCI), Health Insurance Portability and Accountability Act (HIPAA), or internal “crown jewels” designations carry higher risk weight. 

By combining these factors, Risk Radius delivers a Risk Score that reflects both technical exposure and business importance. This ensures that the vulnerabilities surfaced at the top of the list are the ones most likely to reduce risk if fixed. 

Why This Matters 

  • For Security Teams: Prioritize efforts with confidence and focus limited resources where they matter most. 
  • For Executives: Gain clarity into the true business impact of vulnerabilities and support smarter decision-making. 
  • For Auditors and Insurers: Provide transparent, defensible evidence of how risks are scored and managed. 

A Clear Path to Risk Reduction 

Risk Radius transforms vulnerability management from a guessing game into an explainable process. By showing why an asset is risky and how much it matters, RedSeal empowers organizations to cut through noise, align security and business priorities, and reduce exposure faster. 

See your risk the way your business does. Request a demo and experience how RedSeal helps you prioritize what truly matters. 

CTEM

The Future of Exposure Management: From Vulnerability Counts to Business Context

/by

In cybersecurity, volume has become the enemy of clarity. Enterprises today face thousands—sometimes millions—of potential vulnerabilities across hybrid infrastructures. And while scanning and patching remain foundational practices, it’s clear that traditional vulnerability management doesn’t scale to today’s threat landscape. 

That’s where exposure management comes in. It’s not about checking off CVEs from a list. It’s about understanding which exposures, whether unpatched systems, misconfigured access, or forgotten assets, actually matter, based on context, reachability, and business impact. 

Why Exposure Management Needs to Evolve 

The modern attack surface is sprawling and dynamic. Cloud environments, third-party services, legacy infrastructure, and unmanaged assets introduce exposures that are difficult to track with legacy tools and periodic assessments. What’s needed is a shift from reactive scanning to continuous, risk-informed exposure reduction. 

A recent blog by the SANS Institute describes this shift as a necessary evolution: “Organizations must stop treating vulnerabilities as one-dimensional. The real risk lies in how threats can exploit those weaknesses through accessible paths to high-value assets.” (SANS) 

From Vulnerability Lists to Risk-Based Prioritization 

The next generation of exposure management tools must look beyond severity scores. A CVSS 9.8 vulnerability on an isolated, non-critical system is not as urgent as a CVSS 6.5 on a device directly reachable from the internet with lateral movement paths into sensitive areas. 

This is why reachability modeling, asset classification, and network context matter. As Carnegie Mellon’s CERT Division has noted, “Risk is not just about the presence of a flaw, it’s about the ability to exploit it within the operational environment.” (SEI CERT) 

The Role of Continuous Monitoring and Simulation 

One major trend in the future of exposure management is the move toward continuous visibility and simulation. Rather than waiting for quarterly scans or annual audits, organizations are embracing persistent exposure assessment as a daily discipline. 

Continuous Threat Exposure Management (CTEM), a model described by Gartner and supported by NIST guidelines, emphasizes a five-phase approach: scoping, discovery, prioritization, validation, and mobilization. CTEM is not a product. It’s a programmatic shift that aligns cyber risk visibility with business priorities. (NIST SP 800-137) 

Reducing Exposure Without Disrupting Operations 

Let’s be realistic: not everything can be patched. Legacy systems often run critical workloads and can’t tolerate downtime. Exposure management helps security teams navigate that reality by identifying alternative controls, like segmentation, policy updates, or virtual patching, based on which assets are actually exposed. 

As the Center for Internet Security (CIS) explains in their Controls v8, organizations must “continuously manage asset exposures and reduce attack paths, not just catalog vulnerabilities.” (CIS Controls v8) 

Final Thoughts 

The future of exposure management is about clarity over chaos. It’s about knowing what matters, what’s reachable, and what could impact the business, not chasing every alert with equal urgency. By combining continuous monitoring, contextual visibility, and strategic prioritization, exposure management becomes not just a security process but a business enabler. With the right strategy and RedSeal’s ability to support a continuous threat exposurement management (CTEM) process at every step, organizations make smarter, data-driven security decisions before attackers strike. Contact us today to learn more.

Cyber News Roundup for June 13, 2025

/by

Hacking the Hackers: When Bad Guys Let Their Guard Down

A string of operational security failures by threat actors has unexpectedly empowered defenders in what’s being dubbed “Hacking the Hackers.” According to Dark Reading’s analysis, live leaks of memory footprints and internal communications—often resulting from poor cleanup or disgruntled insiders—have provided defenders with direct visibility into the playbooks of malware and ransomware groups like DanaBot, Black Basta, and Conti . These lapses let researchers reconstruct attack sequences, tooling choices, and command-and-control (C2) infrastructures with clarity rarely afforded. Notably, this trend emphasizes that sometimes cyber defenders gain an upper hand not through flawless attacks, but thanks to threat actors’ own mistakes. This shift enables more proactive defense measures, including early detection signatures and threat hunting routines built on adversary-specific artifacts. The analysis highlights how vigilant defenders are increasingly “hacking the hackers” by exploiting adversaries’ carelessness to enhance organizational resilience.

(Dark Reading)

GitLab patches multiple vulnerabilities in its DevSecOps platform

GitLab has issued urgent security updates to patch multiple vulnerabilities in its DevSecOps platform. The flaws include account takeover risks and the ability for attackers to inject malicious jobs into CI/CD pipelines. The fixes are included in GitLab versions 18.0.2, 17.11.4, and 17.10.8. Critical issues addressed include HTML injection (CVE-2025-4278), missing authorization (CVE-2025-5121), cross-site scripting (CVE-2025-2254), and a denial-of-service flaw (CVE-2025-0673). GitLab.com is already patched, and users of self-managed instances are urged to upgrade immediately.

(Bleeping Computer)

Researchers unveil a covert method for exfiltrating data using smartwatches

Researchers in Israel have unveiled “SmartAttack,” a covert method for exfiltrating data from air-gapped systems using smartwatches. The attack involves malware on a secure, isolated computer emitting ultrasonic signals via built-in speakers. These inaudible tones, modulated to carry data, are picked up by a smartwatch microphone worn nearby. The watch then transmits the data via Wi-Fi, Bluetooth, or cellular networks. Though challenging and theoretical, the attack shows how insider threats can bypass physical isolation. Experts recommend banning smartwatches and disabling speakers in sensitive areas to mitigate risk.

(TechCrunch)

Erie Insurance has confirmed a cyberattack as the root cause of recent operational disruptions, raising concerns about potential data exposure

The Pennsylvania-based insurer acknowledged that a June 2024 cybersecurity incident was responsible for delays and interruptions to its customer services. Although the company has not disclosed the exact nature of the attack, it confirmed the involvement of an unauthorized third party and is actively working with forensic experts to investigate the scope of the breach. Erie has also involved law enforcement and taken steps to restore normal operations. At this time, it’s unclear whether customer or employee data was compromised, but the company promises to notify affected individuals should any data exposure be confirmed. This incident highlights the growing risk that cyberattacks pose to financial services organizations, which are often prime targets for threat actors seeking sensitive personal information.

(BleepingComputer)

Google Cloud and Cloudflare outages reported

Google Cloud and Cloudflare suffered outages yesterday, affecting services such as Google Home/Nest, SnapChat, Discord, Shopify and Spotify, as well as creating access authentication failures and Cloudflare Zero Trust WARP connectivity issues. Downdetector received tens of thousands of reports, with impacted users experiencing Cloudflare and Google Cloud server connection, website, and hosting problems. The issue started around 1:15 p.m. ET and was being resolved through the afternoon.

(The Verge)

 

Journalists are confirmed targets of Paragon’s Graphite spyware

A forensic investigation by Citizen Lab has confirmed that Paragon’s Graphite spyware was used in zero-click attacks targeting iPhones of at least two journalists in Europe. The attacks exploited a then-unknown vulnerability with a CVE number (CVE-2025-43200) in iOS 18.2.1, which allowed malicious photos or videos shared via iCloud Links to compromise devices. Apple notified the victims on April 29, identifying the spyware as “advanced.” The Graphite platform is believed to be part of Paragon’s mercenary spyware operations. The flaw has since been patched by Apple.

(BleepingComputer)

Librarian Ghouls’ Cyberattackers Strike at Night

A stealthy threat group known as “Librarian Ghouls” has been quietly targeting Russian organizations in a prolonged cyberespionage campaign.
According to Kaspersky researchers, the group has operated since at least December 2024 and focuses on stealing sensitive data while minimizing its digital footprint. Librarian Ghouls employs “living-off-the-land” techniques, using legitimate administrative tools like 4t Tray Minimizer and Mipko employee monitoring software to blend into normal system activity and avoid detection. They launch their attacks during off-hours—primarily at night and on weekends—reducing the likelihood of triggering alarms. The attackers also leverage PowerShell scripts and custom info-stealers to extract data, particularly targeting email communications. This campaign exemplifies the increasing sophistication of threat actors who avoid traditional malware in favor of covert, tool-based persistence.

(Darkreading)

AI-powered “ghost students” enrolling in online college courses to steal government funds

Financial aid fraud is on the rise, fueled by identity theft and AI-powered “ghost students” enrolling in online college courses to steal government funds. Criminals use stolen personal data to apply for grants and loans, often enrolling in community colleges where low tuition means more aid goes directly to students. In 2024 alone, California colleges reported 1.2 million fake applications, leading to over 223,000 suspected fraudulent enrollments and at least $11.1 million in unrecoverable aid. Victims often learn about the fraud only after seeing credit score drops or loan notifications. Clearing their names can take years. To combat the trend, the U.S. Education Department now requires ID verification for new aid applicants. However, federal staffing cuts may undermine efforts to detect and prevent these increasingly sophisticated scams.

(SecurityWeek)

Mozilla  patches two critical FireFox security flaws

Mozilla has released Firefox 139.0.4 to patch two critical security flaws that could crash the browser or allow hackers to run malicious code. The first, CVE-2025-49709, involves memory corruption in Firefox’s canvas rendering system. If triggered by specially crafted web content, it could let attackers exploit memory issues and compromise browser stability. The second flaw, CVE-2025-49710, is an integer overflow in Firefox’s JavaScript engine, specifically in the OrderedHashTable structure. This could lead to heap buffer overflows and similar risks when handling JavaScript-heavy websites. Both vulnerabilities are rated high severity with CVSS scores over 8. Mozilla urges users and enterprise admins to update to version 139.0.4 immediately via the built-in updater or Mozilla’s website to protect against potential exploitation.

(Cyber Security News)

Zero-click data leak flaw in Copilot

Researchers at Aim Labs documented a flaw in Microsoft 365 Copilot dubbed EchoLeak, part of an emerging class of “LLM Scope Violation” vulnerabilities. By sending an email with a hidden prompt injection in an otherwise banal business email, the researchers could get around Microsoft’s cross-prompt injection attack classifier protections. When a user later asks about the email, the Retrieval-Augmented Generation, or RAG engine, pulls in the malicious injection, inserting internal data into a crafted markdown image and sending it to a third-party server. Aim Labs reported the issue to Microsoft back in January, which subsequently issued a server-side fix in May.

(Fortune, Bleeping Computer)

Friendly skies…or friendly spies? 

It turns out the major U.S. airlines—yes, the ones that can’t find your luggage—have been quietly selling your domestic flight data to Customs and Border Protection (CBP). An investigative report from 404 Media reveals that through a data broker the airlines own called ARC, airlines shared names, itineraries, and payment info, all while telling CBP not to mention them by name. This cloak-and-dagger data deal, documented through FOIA requests, supports tracking “persons of interest” without pesky things like warrants. The program, known as the Travel Intelligence Program, updates daily and holds over a billion records. Civil liberties advocates are, unsurprisingly, unimpressed. One called it a digital-age revival of the “collect it all” mentality. Meanwhile, Congress is starting to ask airlines why their loyalty programs apparently come with complimentary government surveillance.

Turn out, when it comes to data collection…the sky’s the limit.

(404 Media)

Five zero-day vulnerabilities in Salesforce Industry Cloud are uncovered

Security researchers at AppOmni uncovered five zero-day vulnerabilities and 15 serious misconfigurations in Salesforce Industry Cloud, potentially impacting tens of thousands of organizations. Salesforce Industry Cloud offers low-code tools tailored for sectors like healthcare, finance, and government, but its ease of use can lead to risky default settings. Three of the five flaws were fixed by Salesforce directly, while two require customer action. The remaining issues stem from common misconfiguration traps, often caused by non-technical users unknowingly applying insecure access settings. These missteps could lead to major data breaches, including exposure of sensitive health or financial data. AppOmni’s scans show these risks are widespread among Industry Cloud users, raising serious concerns about security in low-code enterprise platforms designed for speed and simplicity.

(SecurityWeek)

PoC Code escalates Roundcube Vuln threat

A critical Roundcube webmail flaw with a CVSS score of 9.9 is now a major threat after proof-of-concept code was publicly released. The 10-year-old bug lets authenticated attackers execute remote code via a malicious URL exploiting PHP’s object handling. Over 85,000 unpatched servers are exposed globally. Login credentials are required to exploit it, but attackers can pair it with older credential-theft bugs for full compromise. A patch is available , but researchers warn organizations to update immediately and monitor for malicious activity.

(Dark Reading)

SentinelOne rebuffed a China-linked “PurpleHaze” APT targeting its internal infrastructure

SentinelOne revealed that it was the target of a thwarted cyberattack in October 2024 by a group linked to Chinese nation-state actors, specifically associated with APT15 (also known as Ke3chang or Vixen Panda). The threat actor, referred to as “UNC5174” or “PurpleHaze,” was also found to have compromised over 70 global organizations spanning the defense, telecommunications, and IT sectors. The attackers used legitimate software tools and the ShadowPad malware framework to quietly infiltrate systems and conduct espionage. SentinelOne worked with international security partners to identify and warn affected victims, stressing the importance of proactive threat hunting and detection capabilities. The attack underscores the growing boldness of state-sponsored groups and the strategic value they place on targeting cybersecurity firms themselves.

(Cybersecurity Dive) 

Chinese hackers target U.S. smartphones 

A recent cyberattack targeting smartphones of U.S. officials and professionals in politics, tech, and journalism has raised alarms among cybersecurity experts. Investigators at iVerify linked the unusual crashes to a zero-click hack, likely by Chinese hackers, that allowed access to phones without user interaction. Victims had ties to fields of interest to China’s government.

Experts say smartphones, often less protected than other systems, are becoming key targets for espionage. Devices belonging to Donald Trump’s campaign and top aides were also reportedly targeted. Lawmakers fear Chinese state-owned firms could exploit their tech presence in global networks. The U.S. is responding with new initiatives like a “cyber trust mark” for secure connected devices. Still, officials warn that even the most secure device is vulnerable if users ignore basic precautions. Cyber lapses, like misconfigured apps or unsecured connections, remain a serious national security risk.

(Associated Press) 

United Natural Foods hit by cyberattack

The company confirmed it discovered a cyberattack on June 5, 2025, according to an 8-K filing with the US SEC. United Natural Foods is North America’s largest publicly traded wholesale food distributor, with 53 distribution centers. The company proactively took some systems offline due to the attack, disrupting customer orders. At the same time, anecdotal posts on social media mention some worker shifts cancelled as well. No ransomware group took credit for the attack, and the company has not released further details about any data loss or what systems the attacker accessed.

(Bleeping Computer)

Russian companies hit with LockBit

You don’t tug on Superman’s cape, you don’t spit into the wind, you don’t pull the mask off of old Lone Ranger, and you don’t have your ransomware affiliates attack Russia. Those used to be the rules. However, the Russian cybersecurity firm Positive Technologies identified a financially motivated group called DarkGaboon that was doing just that: deploying LockBit 3.0 ransomware. Unlike typical LockBit affiliates, DarkGaboon seems to operate entirely independently, using Russian-language phishing emails with malicious attachments claiming to have legitimate financial documents. Researchers say the group has appeared to operate since at least 2023, but its use of open-source tools in other parts of its attack chain made attribution difficult.

(The Record)

FBI keeps Leatherman in its back pocket

FBI Director Kash Patel named agency veteran Brett Leatherman as assistant director and head of the Cyber Division. During his 22-year career, Leatherman served as section chief for cyber investigations and deputy assistant director for the last three years and has been the FBI’s public face for communications on major cyber incidents going back to the Colonial Pipeline attack. He takes over for Bryan Vorndran, who left the FBI to work as Microsoft’s deputy CISO. Given the number of personnel shakeups across government cybersecurity posts since January, this is a notable bit of continuity.

(Cyberscoop)

Cloudflare creates OAuth library with Claude

Last week, Cloudflare published the open-sourced OAuth 2.1 library, which was written almost entirely by Anthropic’s Claude LLM. Notably, the company also published comprehensive documentation of the process, including a full prompt history. Due to the sensitive nature of the library, this wasn’t an exercise in vibe coding, with human review in all parts of the process. Software developer Max Mitchell reviewed the process, finding the LLM excelled when given a substantial code block to work off of, with clear context and explanation of what needed to be changed. In all instances, the LLM excelled at generating documentation. However, the code needed human intervention for styling and other housekeeping tasks. Mitchell suggested looking at this the same as collaborating with a human developer, expect a back and forth rather than one-off prompting success. Cloudflare tech lead Kenton Varda, who oversaw the project, came into it with a healthy dose of skepticism, but ended up saying, “I was trying to validate my skepticism. I ended up proving myself wrong.”

(Maxe Mitchell, Neil Madden, GitHub)

SecOps teams must combat AI “hallucinations” to improve threat detection accuracy  Dark Reading warns that while generative AI accelerates incident detection and response, model hallucinations can generate false positives, mislead analysts, or gap investigations. Organizations are advised to implement robust model evaluation, training for AI oversight, and processes to cross-check alerts and avoid operational inefficiencies.

(Dark Reading)

ESET uncovers Iranian hackers targeting Kurdish and Iraqi government officials

Iran-linked hackers, identified as BladedFeline, have been conducting a years-long cyberespionage campaign targeting Kurdish and Iraqi government officials, according to ESET. Believed to be a subgroup of Iran’s OilRig (APT34), BladedFeline has operated since at least 2017, initially breaching the Kurdistan Regional Government (KRG) and later expanding to Iraq’s central government and even a telecom provider in Uzbekistan. The group uses custom malware like Shahmaran, Whisper, and PrimeCache to spy on systems, exfiltrate data, and maintain remote access. Entry points likely include exploited server vulnerabilities and webshells. Researchers say the campaign likely supports Iran’s geopolitical goals by monitoring the KRG’s Western ties and countering U.S. influence in Iraq. OilRig has a history of targeting critical sectors and using compromised networks for supply chain attacks.

(The Record)

Hitachi Energy, Acronis and Cisco patch critical vulnerabilities

Hitachi Energy has patched two critical vulnerabilities (CVE-2020-35198 and CVE-2020-28895) in its Relion 670, 650 series, and SAM600-IO devices, which are widely used in power grid protection and control. The flaws could allow remote attackers to trigger memory corruption, risking grid stability. Hitachi Energy has released targeted updates and recommends users upgrade to secure revisions. No public exploitation has been reported, but mitigation steps are advised for older systems.

Acronis Cyber Protect users are urged to update immediately due to multiple critical vulnerabilities, including three with the highest CVSS score of 10.0. These flaws allow attackers to bypass authentication, access sensitive data, and escalate privileges. Updates have been available for a month. If updating isn’t possible right away, restrict network access and monitor systems for suspicious activity.

Cisco has patched 12 vulnerabilities across its products, including a critical flaw (CVE-2025-20286, CVSS 9.9) in cloud deployments of Identity Services Engine (ISE). This bug affects AWS, Azure, and Oracle Cloud ISE instances where shared credentials are improperly generated, allowing attackers to access sensitive data or modify configurations. No workarounds exist, and proof-of-concept (PoC) code is public. Cisco also addressed two high-severity SSH flaws in its IMC and Nexus Dashboard Fabric Controller (CVE-2025-20261 and CVE-2025-20163), which could allow unauthorized access or man-in-the-middle attacks. Additionally, nine medium-severity bugs were patched across various Cisco communication and management tools. Two have public PoC code, though no active exploitation is reported. Cisco strongly urges users to apply updates immediately.

(Beyond Machine, [1]  SecurityWeek)

Presidential cyber executive order signed

The President signed a new executive order aimed at refocusing U.S. cybersecurity policy by emphasizing secure software development, updated encryption, and internet routing security. The order revokes parts of Biden- and Obama-era directives, including digital identity initiatives, which it claims could increase fraud risks. It criticizes the previous administration for politicizing cybersecurity and shifts AI policy from potential censorship to identifying vulnerabilities. The order rolls back compliance mandates for software vendors, instead encouraging collaboration with industry partners. It also targets post-quantum cryptography and consumer device security.

(Cyberscoop)

OpenAI takes down ChatGPT accounts linked to state-backed hacking, disinformation  The owner of ChatGPT says threat actors from countries such as China, Russia, North Korea, Iran, and the Philippines are using the LLM product for three key areas of activity: social media comment generation; malware refinement and cyberattack assistance; and foreign employment scams. One example: using ChatGPT to publish comments on topics such as U.S. politics, on TikTok, X, Reddit, Facebook, and other social media platforms and then shifting to other accounts that would reply to the same comments. They have also been using it to assist with writing scripts for brute-forcing passwords, as well in conducting employment scams, including arranging for delivery of company laptops.

(The Record)

Cyber News Roundup for May 9, 2024

/by

Cuckoo malware, a paralyzed city of Wichita, and early cybersecurity preparations for the upcoming Olympics made headlines this week. RedSeal is here to keep you informed and equipped to fortify your cyber defenses in an ever-evolving digital landscape.

 

1. Cuckoo malware targets macOS systems

Cybersecurity researchers at Kandji have identified a new malware called Cuckoo targeting Apple macOS systems. It’s designed as a universal Mach-O binary, compatible with both Intel and ARM-based Macs, and found on websites offering music ripping and MP3 conversion tools. Cuckoo establishes persistence via a LaunchAgent and employs a locale check to avoid execution in Russia or Ukraine. It tricks users into providing system passwords through fake password prompts for escalated privileges and performs extensive data harvesting. This includes capturing hardware information, running processes, installed apps, screenshots, and sensitive data from iCloud Keychain, Apple Notes, web browsers, crypto wallets, and various applications like Discord and Steam. The associated malicious application bundles are signed with a valid developer ID. (Kandji)

 

2. Secretary of State Blinken is set to unveil a new international cybersecurity strategy at the RSA Conference in San Francisco

The Biden administration is set to introduce a new international cybersecurity strategy, marking the first U.S. global cyber strategy in over a decade, aimed at bolstering global cooperation against cyber threats. Secretary of State Antony Blinken will unveil the strategy at the RSA Conference in San Francisco. This strategic plan targets enhancing cybersecurity through four main pillars: establishing a secure digital ecosystem, promoting rights-respecting digital technology with allies, forming coalitions against cyberattacks, and boosting cybersecurity resilience among partner nations. A key element of this strategy is the allocation of $50 million to the newly formed Cyberspace and Digital Connectivity fund, aimed at supporting cybersecurity improvements in allied countries.

Additionally, the strategy emphasizes a proactive role in cyber diplomacy at the United Nations and seeks to develop global norms for emerging technologies like artificial intelligence (AI). The U.S. aims to foster international consensus on AI usage and cyber conduct. The strategy’s implementation is considered urgent, with efforts intensifying in the months leading up to the November presidential election, reflecting the need for consistent U.S. leadership in global cybersecurity irrespective of potential administration changes. (Politico)

 

3. Chinese-linked ArcaneDoor targets global network infrastructure

A new cyber espionage campaign named ArcaneDoor, potentially linked to Chinese actors, has targeted network devices from vendors like Cisco, starting in July 2023 with the first attack detected in January 2024, according Censys. The attacks involved custom malware, Line Runner and Line Dancer, and exploited patched vulnerabilities in Cisco Adaptive Security Appliances. The findings indicate the involvement of a China-based threat actor, given that key infrastructure used SSL certificates linked to Chinese networks and hosted services related to anti-censorship tools. (The Hacker News)

 

4. Largest city in Kansas paralyzed by ransomware attack

Another city government faces the implications of a ransomware attack. The city of Wichita, Kansas was forced to shut down portions of its network over the weekend after its IT systems were encrypted with ransomware. Bleeping Computer reports: payment systems for city water, court citations, and tickets are down. There is no additional information regarding whether any information was compromised or which ransomware group has claimed responsibility for the attack. (Bleeping Computer)

 

5. Microsoft warns Android developers to steer clear of the Dirty Stream

Microsoft has issued a warning to Android app users and developers about a new attack method called Dirty Stream, which exploits a path traversal vulnerability within Android’s content provider component, particularly the ‘FileProvider’ class. This vulnerability can lead to the takeover of apps and theft of sensitive data. Notably affected are popular apps like Xiaomi File Manager and WPS Office, which together boast over 1.5 billion installs. The vulnerability has been identified in applications totaling four billion installations and could potentially be present in other apps. Dirty Stream allows malicious apps to overwrite files in another app’s directory, facilitating arbitrary code execution and token theft. This can give attackers complete control over the app and access to user accounts. Microsoft has informed affected developers, who have patched their apps, and urges all developers to review their apps for this security flaw. Google has also published guidance for developers on handling this issue. (Security Week)

 

6. French cybersecurity teams prepare for “unprecedented” Olympic threat

Jérémy Couture, who is in charge of the cybersecurity hub for the event being held in Paris in July, says his goal is to have his team’s activities perceived as a “non-event” by successfully fending off attacks from nation state actors, hacktivists, thrill seekers, and everyone else. He adds that it’s not just the games themselves that need protecting, but also the infrastructure that supports them, such as transport networks and supply chains. Russia, which is banned from these games, is of particular focus, but, officials state, they are looking at everything. (Security Week)

 

7. Ascension health system disrupted by cyberattack

 US health system Ascension has sustained a cyberattack that disrupted some of its systems, the Record reports. The organization, which runs 140 hospitals across the country, stated, “Our care teams are trained for these kinds of disruptions and have initiated procedures to ensure patient care delivery continues to be safe and as minimally impacted as possible. There has been a disruption to clinical operations, and we continue to assess the impact and duration of the disruption.” The nonprofit is working with Mandiant to respond to the incident. (The Record)

 

8. Mobile medical provider DocGo discloses data breach

Mobile health service provider DocGo has disclosed a cyberattack that led to the theft of patient health information, BleepingComputer reports. The company stated in an SEC filing, “Promptly after detecting unauthorized activity, the Company took steps to contain and respond to the incident, including launching an investigation, with assistance from leading third-party cybersecurity experts, and notifying relevant law enforcement. As part of its investigation, the Company has determined that the threat actor accessed and acquired data, including certain protected health information, from a limited number of healthcare records within the Company’s U.S.-based ambulance transportation business, and that no other business lines have been involved.”(Bleepingcomputer)

 

9. MedStar Health sustains breach

Maryland-based healthcare organization MedStar Health sustained a data breach affecting more than 183,000 patients, the Record reports. A hacker gained access to the data through email accounts belonging to three MedStar employees. The threat actor was able to access “patients’ names, mailing addresses, dates of birth, date(s) of service, provider name(s), and/or health insurance information.”The company said in a breach notification, “Patients whose information may have been involved are encouraged to review statements they receive related to their healthcare. If they identify anything unusual related to the healthcare services or the charges for services, they should contact the healthcare entity or health insurer immediately.” (The Record, MedStar Health)

 

10. US indicts LockBit ransomware ringleader

On Tuesday, the U.S. Department of Justice (DoJ) charged the mastermind behind the notorious LockBit ransomware-as-a-service (RaaS) operation. The DoJ unmasked 31-year-old Russian National, Dimitry Yuryevich Khoroshev (also known as LockBitSupp, LockBit, and putinkrab) in a 26-count indictment that includes charges of fraud, extortion, and damaging protected computers. The charges carry a combined maximum penalty of 185 years in prison. Khoroshev is accused of designing LockBit, recruiting affiliates and maintaining LockBit’s infrastructure and leak site. Khoroshev allegedly received over $100 million in proceeds from the ransom payments. The US is offering a reward of up to $10 million for information leading to Khoroshev’s arrest. Sanctions were also announced on Tuesday by the United Kingdom and Australia. (SecurityWeek)

 

11. CISA is moving the needle on vulnerability remediation

CISA launched its Ransomware Vulnerability Warning Pilot in January 2023, and issued 1,754  warning notices to entities with vulnerable internet-accessible devices in its first year. The agency said that nearly half (for a total of 852) of these notifications resulted in organizations either patching, briefly taking systems offline to fix the issue, or otherwise mitigating exploitable flaws. The pilot program is set to launch as a fully automated warning system by the end of next year.

Another CISA-led initiative called Known Exploited Vulnerabilities (KEV), which the agency introduced in 2021, is also speeding up vuln remediation times. The KEV is designed to notify government agencies and enterprises of high-risk threats in the wild. Bitsight reported that critical KEVs are remediated 2.6 times faster than a non-KEV threats, while high-severity KEVs are fixed 1.8 times faster. Non-profits and NGOs are the slowest to remediate, while tech companies and insurance and financial firms are the fastest.(The Register and Dark Reading)

 

12. Lockbit takes credit for Wichita attack

The pernicious ransomware organization added the city of Wichita to its leak site, giving officials until May 15th to pay an unspecified ransom. We previously covered the city’s announcement of the attack over the weekend. In the wake of the attack, city officials say it can only accept cash or checks for all city services, although the city will not shut off water services as a result until regular payment methods come back online. This attack also comes on the heels of the US law enforcement agencies publicly naming the suspected leader of LockBit, Dmitry Khoroshev. (The Record)

 

Have questions? Reach out to RedSeal today to chat with one of our cybersecurity experts.

Tales from the Trenches: “Is that what you’re going to say to the auditor?”

/by

Today’s tale from the trench is brought to you by Brad Schwab, Senior Security Solutions Consultant.

 

In the high-stakes world of security operations, one question looms larger than most: Are you sure you’re scanning the entire network? It seems straightforward, but for any team dealing with a network of significant scale, answering this question can be a daunting task.

During a pivotal meeting with stakeholders of a large health organization, the focus was squarely on the performance and security of the network. As discussions turned to the scanning program, the head of security operations confidently outlined the procedures in place to ensure comprehensive scanning—scanning that covered the entire network. Wait, scanning that covered the entire network? This is when my skepticism crept in.

“How do you know you’re scanning the entire network?” I interjected, addressing the elephant in the room. The head of security operations deflected to the head of network operations, claiming his assurance. “[Head of network operations] said I could…” she asserted.

Turning to the head of network operations, I couldn’t resist a quip: “Is that what you’re going to say to the auditor? ‘He said I could’?” Though we shared a solid working relationship, I couldn’t let such a critical issue slide with mere assurance. And it was clear that the others in the room shared my same concerns.

With a blend of humor and seriousness, I delved into the complexities and uncertainties inherent in ensuring comprehensive network scanning. Questions rained down from the attendees, making it clear that a deeper exploration of their scanning protocols was necessary to instill confidence in the organization’s security measures. I began to outline critical considerations:

  • Does the scanner have a complete list of all IP space on the network that needs scanned?
  • Are there any overlapping subnets? If so, that overlapped portion of a subnet is not visible to the scanner, thus, creating a possible hiding place for a bad actor.
  • Is there a duplicate IP space in the network? This creates blind spots to any scanner.
  • And finally, the hard part of the answer, does the scanner have logical access to the entire network? Even if the scanner is trying to scan a network subnet, if the network architecture via Access Control Lists and Routing is blocking the access or not granting the access, the scan won’t be complete. On top of that, you will get no indication from the scanner that the scan didn’t work.

Beyond the logical access issue, no one had thought about the other issues. I then explained how RedSeal automatically looks for subnets that have no scan data, thus possibly not part of the IP list giving to the scanner. Also, overlapping subnets and colliding IP space is revealed as a RedSeal finding. Finally, I also explained how a RedSeal Access Query combined with our “show what is missing” feature can give you a list of everything that the scanner can’t reach because of network architecture.

I ended my explanation with “these features will give you comprehensive documentation of complete scanner coverage for your upcoming audit(s)…”

After less than a few days of work, we had provided a list to both network operations and security operations of additions and changes required by both teams to make their vulnerability program complete.

At RedSeal, we’re committed to helping you fortify your digital infrastructure, for good. We proactively help visualize your network, identify attack paths, prioritize risk, and help you stay in compliance to ensure your business and customers stay secure.

Reach out to RedSeal or schedule a demo today.

 

 

Tales from the Trenches: When Low-Risk is Actually High-Concern

/by

Since 2004, RedSeal has been instrumental in empowering our clients to comprehensively visualize and fortify their intricate networks. While our customers initially grasped the importance of understanding their network architecture, connections, and identifying potential risks, there’s often an enlightening “aha” moment when the true significance becomes unmistakable. These narratives, cherished within the confines of RedSeal, vividly exemplify the practical value of our platform beyond mere theory. In the words of our dedicated field team, who collaborates directly with our clients, this blog series aims to unveil the instances where the theoretical transforms into tangible reality. 

Today’s post is brought to you by Chris Morgan, Client Engagement Director 

 

In the realm of cybersecurity, where threats and vulnerabilities lurk aplenty, RedSeal stands as a beacon of innovation. Pioneers in network security analytics, RedSeal delivers actionable insights, enabling customers to close defensive gaps across their entire network. 

While reviewing a large medical provider’s network, we discovered several high- and medium-severity vulnerabilities within the network. However, it was the low-risk vulnerability we found to be of highest concern.  

Delving deeper into our investigation, we unearthed a situation of seismic proportions. Amidst the chaos of the COVID-19 era, the client’s IT team had inadvertently granted unrestricted access to a seemingly mundane printer. However, unbeknownst to them, and visible now only because of RedSeal, this printer served as direct access to more than 14,000 hosts within the client’s expansive network, opening access that could enable bad actors to directly invade much of the network. RedSeal’s comprehensive approach, merging risk and access, empowers genuine prioritization for clients. 

With a fresh eye toward restricting access, we worked with the medical provider to remediate the exposure immediately, tightening access controls for printers and implementing access logs, securing them for the future.  

At RedSeal, we’re committed to helping you fortify your digital infrastructure, for good. We proactively help visualize your network, identify attack paths, prioritize risk, and help you stay in compliance to ensure your business and customers stay secure. 

Reach out to RedSeal or schedule a demo today.

 

5 Critical Steps to Identifying and Remediating Exfiltration Paths

/by

Summary. Cybersecurity risks continue to rise, further increasing the severity of long-term impacts.  

The latest IBM Data Breach Report revealed 82% of breaches involved data stored in the cloud—public, private, or multiple environments, with attackers gaining access to multiple environments 39% of the time. In 2023, the average cost of a data breach reached an all-time high of USD 4.45 million, representing a 15.3% increase (from USD 3.86 million) in 2020.   

It is clear that in today’s interconnected and digital age, safeguarding sensitive information is of paramount importance for any organization. Data breaches not only cause significant financial loss but can also erode the trust of customers and stakeholders. One critical threat an organization faces is ‘data exfiltration’—the unauthorized transfer of data from within an organization to an external location. 

In this article, we’ll explore the concern exfiltration paths cause and important steps you can take to identify and mitigate them. 

Understanding Exfiltration Paths 

Exfiltration paths are like hidden backdoors that malicious actors use to smuggle out sensitive information. These paths can often exploit various vulnerabilities in an organization’s network, be it misconfigured devices, neglected access controls, or compromised endpoints.  

The consequences of overlooking these paths are substantial:  

  • Loss of sensitive data: This can include everything from proprietary business information to customer data.  
    • In March, 1.2% of ChatGPT subscribers’ payment-related and personal information were exposed during an outage. While the actual number of people exposed in the breach was “extremely low” according to OpenAI, the breach exposed a number of areas requiring immediate improvement to ensure safety of subscribers. 
  • Reputation damage: Data breaches can significantly harm an organization’s reputation, leading to a loss of trust. 
    • According to Forbes, nearly half of all organizations that suffer data breaches also suffer damage to their brand – the report identifies data loss as the “fourth most common threat to reputation.” 
  • Financial repercussions: This encompasses both direct losses and potential fines from regulatory bodies. 
    • IBM found the average cost of a data breach reached an all-time high in 2023 of $4.45 million, while the number is more than double in the U.S., averaging $9.44 million.  

Safeguarding Data, Reputation, and the Future   

Designed to provide a detailed and holistic view of an organization’s entire network—including all devices, access paths, and potential vulnerabilities, RedSeal’s platform has helped hundreds of organizations gain an understanding of potential exfiltration paths while identifying and sealing off pathways.  

By the time a breach is detected, the damage is often done. It is almost always less expensive to stop an attack before it starts than to remediate. With tools like RedSeal, organizations can transition from defensive to proactive security.  

5 Steps your organizations can take to identify exfiltration paths: 

  1. Comprehensive network modeling: RedSeal creates a detailed, up-to-date model of an organization’s entire network. By doing so, it highlights all potential data flow paths, including those that might be unintentionally left open or overlooked. 
  2. Visual representation of exfiltration paths: One of RedSeal’s standout features is its ability to visually represent every possible path out of a network, providing IT teams with a clear and intuitive view of how data might be siphoned out to better recognize and address vulnerabilities. 
  3. Highlighting vulnerable access points: Using its sophisticated analytics, RedSeal can pinpoint devices or access points within the network that are susceptible to breaches or have misconfigured settings, allowing for potential data exfiltration. 
  4. Prioritization based on risk: Not all vulnerabilities are equal. RedSeal’s platform ranks potential exfiltration paths based on risk, allowing prioritization of response and patching strategies. 
  5. Simulating attack paths: RedSeal can simulate potential attack vectors, allowing organizations to proactively understand and counteract the strategies that malicious actors might employ.

Understanding potential exfiltration paths is not just a cybersecurity best practice—it’s an organizational imperative. With threats growing in sophistication and number, tools like RedSeal are no longer optional but a necessity. By identifying and sealing off these potential exfiltration pathways, businesses can safeguard their data, reputation, and future. 

Get the latest news, invites to events, and threat alerts

CONTACT US
Distinguished Vendor badge 2025

NEW Gartner® Report, Emerging Tech: The Future of Exposure Management is Preemptive.Download Report.
Footer
Connect on LinkedIn