Web browsers are massive, in many ways becoming a new operating system we use to access data, watch videos, and manage professional services. Following that, browser extensions have quietly become one of the most overlooked risks in enterprise security. And as the recent revelations about the campaign make clear, attackers increasingly understand that the easiest way into an organization might be through the small, trusted extensions that users install without a second thought.

This article breaks down what happened, why it matters, and why organizations subject to security frameworks need to treat browser extensions as a first-class part of their threat models.

Read More

The continual news of state-sponsored hackers attacking U.S. infrastructure has led the general public to better understand that digital security is a critical part of our overall national security. Digital systems aren’t isolated to high-tech companies–instead, cybersecurity touches on almost every aspect of our lives, particularly energy and utility management.

The U.S. government was already ahead of this curve and, starting in the 1990s, began implementing government regulations (in partnership with private companies) to protect the country’s electrical infrastructure. This led to the North America Electric Reliability Corporation Critical Infrastructure Protection (NERC CIP) requirements. 

Read More

If you’re plugged into the world of cybersecurity, then you’ve most likely come across breathless reports of new “zero-day” vulnerabilities hitting the wild. And, on the surface, these sound terrible… but do you understand what that means?

A zero-day exploit is a significant, but not world-ending, security flaw affecting systems without anyone having noticed them yet. Rather than a cause for worry, these issues call us to remain ever-vigilant against potential security issues and our responses to them. 

Read More