Is this you? As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.
Claim your profile
Articles by Pravin Madhani
Juniper Networks Archives
By Wajahat Raja,Michael Vizard,Pravin Madhani, CEO and Co-Founder,Mark Rasch In response to pressing security concerns, Juniper Networks has swiftly deployed out-of-band updates aimed at mitigating two high-severity vulnerabilities. These vulnerabilities, identified as CVE-2024-21619 and CVE-2024-21620, pose significant risks to SRX Series ...
cloud workload protection Archives
Pravin Madhani, CEO and Co-Founder | | Application Security, cloud workload protection, Juniper, Juniper Networks, NIST, rasp, runtime application self-protection, runtime security, SP800-53, Uncategorized
GUEST ESSAY: The many benefits of infusing application security during software ‘runtime’ | The Last Watchdog
By Pravin Madhani Vulnerabilities in web applications are the leading cause of high-profile breaches. Related: Log4J’s big lesson Log4j, a widely publicized zero day vulnerability, was first identified in late 2021, yet security teams are still racing to patch and protect their enterprise apps and services. This notorious incident highlights the security risks associated with open-source software, and the challenges of protecting web applications against zero day attacks.
Security Expert Re: Critical RCE WordPress Flaw May Affect 500K+ Sites
WordPress powers as much as a third of all websites on the Internet, including some of the most highly trafficked sites and a large percentage of eCommerce sites, so why aren’t they better equipped to protect against attack? In particular, RCE is one of the most dangerous flaws, because it gives the attacker the ability to run almost any code on the hacked site. Traditional application security tools like Web Application Firewalls (WAFs) have a tough time with RCE attacks because they rely .....
More than 40 billion records exposed in 2021
More than 40 billion records exposed in 2021 Security Brief Asia is reporting on new research showing more than 40 billion records were exposed by data breaches in 2021.
A Quick Look at the New OWASP Top 10 for 2021
Back in September of 2021 we wrote that the OWASP working group had a draft of latest Top 10 Web Application Security Risks, their first update since the 2017 revision. The working group finalized their list and published a final version a month later in October of 2021. With the list out for a few months now, let's take a quick look at what's changed with the new OWASP Top 10.
Vulnerabilities Up Almost 10% in 2021
Back on December 8, 2021, we reported that the number of recorded vulnerabilities in the NIST National Vulnerability Database (NVD), hit a record high number of vulnerabilities recorded in a single year for the fifth year in a row. Now that 2021 has ended, we can see the final tally of vulnerabilities recorded for 2021. The year ended with a total of 20,061 vulnerabilities recorded, 9.3% over the prior year and the most ever recorded of any year since the database began.
93% of Tested Networks Vulnerable to Breach
A recent article in Dark Reading is reporting that nearly every organization can be infiltrated by cyber attackers, based on data from dozens of penetration tests and security assessments. The article is reporting that the vast majority of businesses can be compromised within a month by a motivated attacker using common techniques, such as compromising credential, exploiting known vulnerabilities in software and Web applications, or taking advantage of configuration flaws.
Fifth Record Year in a Row for Vulnerabilities
The US-CERT Vulnerability Database keeps track of new vulnerabilities in production code as they are discovered and assigns each unique vulnerability with a "CVE" number. For the last four years, 2017 through 2020, we've had a record number of vulnerabilities recorded in the vulnerability database.
Cyber Security Predictions for 2022
As we approach the end of 2021, all of us at K2 Cyber Security want to wish you and your families the best holiday season and new year, especially after the almost two years of living with the COVID-19 pandemic. This last year was especially challenging as we finally developed a vaccine and thought things were getting back to normal, only to have repeated lockdowns and restrictions on travel.
Shadow Code is a Major Risk for Web Applications
A new report written by Osterman Research notes that most websites use third-party libraries to simplify common functions, but these same libraries often have application security risks. Organizations also typically lack visibility into third party code, making it difficult to determine if websites and web applications have been compromised.
Attacks On Retail Websites Up Heading Into Holiday Season
A new article in Help Net Security is reporting that attacks on retail industry websites from Q4 2020 through the first half of 2021 were notably higher than all other industries, and were characterized by more sporadic peaks in attacks. With attacks up on retail sites, and the continued global supply chain crisis, shoppers are sure to have a tougher time finding the presents they are looking for this holiday season.
The Security Implications of Application Proliferation
The proliferation of applications in the wake of COVID and more employees than ever working from home should not be a surprise to anyone. The worry though, is whether organizations have taken security for those newly released applications seriously enough. Security professionals face growing challenges as their organizations increase both the number of applications deployed and the pace at which these applications change.
Historic scientific notation bug foils WAF defenses
A new article in the Daily Swig discloses that security researchers have discovered that a historic vulnerability affecting both MySQL and MariaDB databases caused serious flaws for security technologies, specifically the Web Application Firewall (WAF) from AWS. WAF failures aren't new, and we recently wrote about a hacker claiming WAFs don't work.
On Track for Fifth Record Year in a Row for Vulnerabilities
Last year, K2 Cyber Security reported that the US-CERT Vulnerability Database hit a record number of vulnerabilities recorded for the fourth year in a row on December 15, 2020. As of last Thursday, October 14, 2021, the database is on track to hit a fifth record year of recorded vulnerabilities. The US-CERT Vulnerability Database keeps track of new vulnerabilities in production code as they are discovered and assigns each unique vulnerability with a "CVE" number.
Security Expert Re: New NIST Application Security Requirements - One Year Later
Thursday, September 23 is the one year anniversary of NIST SP800-53 Revision 5 , recognized by NIST as an historic update to its security and privacy controls. It also set a new standard for application security by adding RASP (Runtime Application Self-Protection) and IAST (Interactive Application Security Testing) as requirements to the NIST security framework. One year later, what’s different? Here are three trends we see with our customers: 1. Web-based applications are still under attack, .....
Why Do Developers Continue to Write Vulnerable Code?
It's been 18 years since OWASP first published their list of Top 10 Web Application Security Risks in 2003. It wouldn't be unreasonable to think it would have been possible to solve web application security problems in that time frame. Yet, attacks continue to happen, and successfully target vulnerabilities in web applications. It would be easy to blame the success of these continued cyber attacks directly on the software developers who write the code.
Application Security Books For Your Bookshelf
Security practitioners are under the constant need to keep up to date and continue their learning, just to keep up with the ever changing tactics of cyber criminals. It's one of the reasons, to keep an eye out for useful books to enhance and broaden our knowledge base. A recent article covered useful application security books available on Amazon.
Juniper and K2 Expand Partnership for Cloud Workload Protection
Organizations have seen a dramatic shift towards digital transformation in recent years, driven in part by the COVID-19 pandemic and the work from home phenomenon. Part of that transformation included a shift to an increased use of applications in and across the cloud. Applications store, process and exchange sensitive data belonging to the organization, making application security mission critical.
75% of Companies Spend as Much Time on False Positives as on Real Security Events
A new ESG report found that nearly half of all cybersecurity alerts are false positives, and 75% of companies spend an equal amount of time, or more, on them than on actual attacks. In addition the report found that 46% of all application downtime being caused by false positives. The report also asked organizations about their move to cloud and use of API-based applications, which have been making security more complicated than it was in the era of on-premise computing.
Major Insurance Companies in Europe Discover That Their Applications Have Security Issues
A new article in TechTimes is highlighting the results of a study on the web application security for Insurers in Europe. The study found that the web applications of major insurance companies in Europe contain security weaknesses. The study looked at the web applications of Europe's top 10 insurance providers, and every company examined had some degree of security vulnerability.
New Executive Order on Improving the Nation's Cybersecurity
In case you missed it, the President of the United States of America, Joe Biden, issued a new executive order in May of 2021, aimed at improving the nation's cyber security. With increase in threats and almost daily stories of new companies being the subject of ransomware and data breaches, perhaps it's no surprise that the U.S. Federal government is taking a serious look at the state of the security in federal organizations.
4 Ways CISOs Can Strengthen Their Security Resilience
A new article in Dark Reading discusses the "4 Ways CISOs Can Strengthen Their Security Resilience." The article caught my attention because one of the 4 areas was to "Secure Workloads and Kubernetes Environments." I was surprised by the inclusion of this requirement not because it isn't important, but because I assumed it would be just considered a given requirement in every organization today.
If Your Cloud Security Is Static, You May Miss Indicators Of Attack
Forbes Magazine recently ran an article titled "If Your Cloud Security Is Static, You May Miss Indicators of Attack." The premise of the article, that organizations are using outdated tools to address a growing and quickly changing part of their application infrastructure, namely the cloud. While I highly agree with the premise, and many of the points brought up by the author, I also found the author missed an extremely important tool in the arsenal to continuously assess security in the cloud.
2021 Verizon Data Breach Investigations Report Is Out
The Verizon Data Breach Investigations report is probably one of the most widely read reports in cyber security. Verizon released their 2021 edition of the report on May 13, 2021. Since K2 Cyber Security focuses on application security, we thought we'd take a look at this latest report with a lens on web application and application workload security.
Show More
loading
Actions
Is this you?
As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.Get in touch with Pravin
Contact Pravin, search articles and posts on X, monitor coverage, and track replies from one place.
Learn more about Muck Rack