Is this you? As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.
Claim your profile
Articles by Timothy Chiu
CSF MicroRNAs Reveal Impairment of Angiogenesis and Autophagy in Parkinson Disease
Abstract Background and Objectives We assessed longitudinal changes in CSF microRNAs (miRNAs) in patients with moderately severe Parkinson disease. Methods We used next-generation whole-genome miRNA sequencing to determine CSF miRNA expression in 75 patients with Parkinson disease after single random ascending doses of nilotinib and longitudinal miRNA expression after daily nilotinib, 150 and 300 mg, vs placebo for 1 year.
More Data Stolen in January 2021 than in all of 2017
ComputerWeekly reported back in May that more data records were stolen in January 2021 than in all 12 months of 2017. 878.17 million records were stolen in January, reflecting the continued increase in cyber attacks and putting 2021 to be on track to be a record year for data breaches. ComputerWeekly's data comes from a new report published by Imperva. The report concluded that data breaches are accelerating and growing in size.
New Report Finds 67% of Applications in the Utility Sector Have Serious Vulnerabilities
SiliconAngle reported on a new study from Whitehat Security that found 67% of applications in the utility sector have serious vulnerabilities. The report found that the "Window of Exposure," a key metric indicative of breach exposure for applications, has increased from 55% to 67% in the utility sector since the start of the year. The figure makes applications in the utility sector the second most vulnerable to attacks behind public administration applications.
Collaboration is key to a secure web application architecture
TechTarget recently ran an interview with "Web Application Security" author Andrew Hoffman, who explained the importance of a secure web application architecture and how to achieve it through collaboration between software and security engineers. Emphasizing collaboration between software and security is more important than ever with the increasing attacks on web applications, fueled in part by the increased attack surface available with more applications moving to the cloud.
Security Boulevard
A recent Ponemon study found that 71% of IT professionals prefer to use best-of-breed security solutions rather than get all of their security tools from a single vendor. This finding is especially important in the light of recent security architectures, especially SASE and Zero Trust. Here at K2, we agree with this finding, especially with the increasing attacks, especially those increasing in scope and complexity.
Security Boulevard
Having a framework for security helps organizations identify what is missing and what is needed for their existing security architecture. A recent article in Dark Reading covered some of the cyber security frameworks that are available and how to make the decision in choosing one to use in your organization.
Security Boulevard
An ESG report on Modern Applicaton Development Security released in August of 2020 found that 60 percent of organizations had experienced an attack on an OWASP Top 10 vulnerability in the prior 12 months. The increase in attacks happened at the same time that organizations were increasing their investments in application security programs. The dichotomy between these two findings supports the need for most organizations to improve their application security stance.
Memphis-based First Horizon Bank Discloses Data Breach, Customers Lose Close to $1 Million
BACKGROUND: First Horizon Bank in Memphis, Tenn., has disclosed that a number of online customer bank accounts were targeted by a data security breach. The $87.5 billion-asset company said that an unauthorized party obtained login credentials from an unknown source and exploited a vulnerability in third-party security software to gain access to less than 200 accounts, obtaining “less than $1 million” from some of the accounts. Experts Comments
Security Boulevard
A new report, the Hiscox Cyber Readiness Report 2021, surveyed over 6,000 companies in the U.S. and Europe and found that the number of businesses targeted by cyber criminals in the past year increased from 38 percent to 43 percent, with 28 percent of those targeted, experiencing five or more attacks. A consequence of the increased attacks has been the financial impact to the organizations, with 17 percent saying the financial hit materially threatened the company’s future.
Security Boulevard
The new 2021 report and study, the Open Source Security and Risk Analysis from Synopsys examined audit data from 1,500 + commercial codebases to examine how organizations are using open source code. The past year with the COVID pandemic saw a significant increase from last year’s report, with the number of open source vulnerabilities in codebases increasing from 75% to 84%.
Data Security Expert Comment On Geico Admits Fraudsters Stole Customers’ Driver’s License Numbers For Months
TechCrunch has reported that Geico, the second-largest auto insurer in the U.S., has fixed a security bug that let fraudsters steal customers’ driver’s license numbers from its website.
Security Boulevard
High profile data breaches seem to be in the news at an almost daily rate. As we have seen from the findings of the last Verizon Data Breach Incident Report, a significant number of these data breaches result from exploiting vulnerabilities and misconfigurations in web applications. The historically high prevalence of vulnerabilities in code is not a new topic, and neither is misconfiguration.
Security Boulevard
Cymatic released new survey results from C-suite and VP-level executives in IT and cybersecurity detailing the state of web application security. The survey included some troubling results, including the finding that 75 percent of IT leaders lacked confidence in their web application security. Surprising given that 34% of respondents used over 10 products to protect their web applications.
Security Boulevard
With the movement to increase security testing during development, also known as “Shift Left”, Dynamic Application Security Testing (DAST) is one of the tools used by organizations to improve their detection rate of vulnerabilities in custom web applications and application workloads. The goal of DAST is to reduce the amount of vulnerabilities that make it to production.
Security Boulevard
Security magazine recently reported on WhiteHat Security’s AppSec Stats Flash Volume 3, the latest installment of the company’s monthly report and podcast reflecting on the current state of application security and the wider cyber threat landscape. One of the key findings was that over 40% of applications are actively leaking information and are at risk of exposing sensitive data.
Experts Insight On CISA Advisory Regarding Attackers Targeting SAP
Cybersecurity experts commented below on recent CISA’s advisory regarding bad actors targeting critical SAP apps. Experts Comments
Security Boulevard
ZDNet recently wrote about some new statistics from the annual Cyber Security Breaches Survey from the Department for Digital, Culture, Media and Sport (DCMS). The report shows how businesses approach cybersecurity and the impact of attacks. While most of the figures and statistics are pretty much what you’d expect during the pandemic (increased attacks, etc), there was one statistic that was quite surprising.
Security Boulevard
According to a report published by the Cloud Security Alliance, the average enterprise has 464 custom applications deployed today. Even the smallest size organizations, those with 1 to 1000 employees had an average of 22 custom applications. It is obvious, enterprises of all sizes are increasing their development of custom applications to help them interact with their customers, employees and partners.
Security Boulevard
A recent article in Forbes discussed prioritizing the risks of the cloud, and specifically called out four areas of risk that need to be addressed by organizations moving to the cloud. The article recognized risks come from: Applications Workloads Network Platforms The last two, network and platform security are well understood, and have been widely used in on-premises deployments as well as cloud deployments. Most security deployments and spend are around security for network and platforms.
Security Experts On Popular MangaDex Site Shuts Down Due To Cyberattack
Manga scanlation giant MangaDex has been temporarily shut down after suffering a cyberattack and having its source code stolen. MangaDex is one of the largest manga scanlation (scanned translations) sites where visitors can read manga comics online for free. According to SimilarWeb, MangaDex is the 179th most frequently visited site on the web, with over 76 million visitors per month. Experts Comments
Security Boulevard
Six months ago, NIST (National Institute of Standards and Technology) released a new version of their security and privacy framework, which had its last update seven years ago. The new document was released as NIST SP800-53 Revision 5. If you missed this update, you’re not alone, as many organizations we have talked to were unaware of this update.
Security Boulevard
Screenshot of K2’s Detection of Apache Druid Zero Day Exploit In today’s world of increasing zero day attacks and the increasing success of zero day attacks, the ability to detect and protect applications and workloads from zero day attacks is more important than ever. Many security vendors claim they are able to detect zero day attacks and protect your applications from those attacks.
Security Boulevard
Applications More Vulnerable A recent Ponemon Institute report on application security found that 71% of large enterprise-scale organizations felt their applications have become more vulnerable. Respondents to the survey indicated the organizations they work for are struggling with monitoring, detecting and preventing attacks.
Security Boulevard
IBM’s 2020 report on the Cost of a Data Breach found that on average it takes 280 days to fix a vulnerability in production once a breach is discovered. If you’ve got an application in production you may be wondering how you can protect the application once a vulnerability is identified, and before that vulnerability is fixed. If you’re like most organizations you probably can’t bring down the application, as it would mean lost revenue, productivity or other negative hit.
Security Boulevard
If you’re new to Application Security, you may be confused by the different terminology and where exactly Application Security fits relative to all the different phases of application development and during runtime of applications. The term is broadly used in both the software development lifecycle as well as by security teams managing applications running in production. In this article we will cover where application security fits in both development and in production.
Security Boulevard
The start of February 2021 brought with it a number of announcements from APM (Application Performance Monitoring) vendors, all relating to RASP (Runtime Application Self-Protection). Three vendors in the APM (referred to by some as the Observability Platform market), made announcements about either adding RASP or enhancing their RASP offerings as part of their APM offering.
Security Boulevard
Web Application Firewalls (WAFs) are a traditional application security tool used by many organizations in their arsenal against the cyber attacks inflicted on a continual basis on their infrastructure. When they were introduced, they were seen as the remedy to the cyber attacks facing typical organizations with a web presence. Unfortunately, cyber criminals have evolved, and while WAFs have tried to evolve as well, it seems they are losing the battle.
Security Boulevard
If you’re just starting out as an application developer or you’re a seasoned developer looking for a good review guide, there’s a new book from Wiley titled “Alice and Bob Learn Application Security” to assist with learning about the fundamentals of application security. Application security is more important than ever with more vulnerabilities than ever being released to production in application code, the increasing number of attacks on web applications, including zero day attacks.
Security Boulevard
TechBeacon recently published an article on the Three Application Security Fundamentals Every Developer Should Know. The article bases its recommendations for developers on research that came out of a recent USENIX Security conference for developers and application security specialists. While I recommend you read the TechBeacon article for the entire commentary, here’s the a short synopsis of the 3 fundamentals. The three fundamentals that the article covers in more details, include: 1.
Security Boulevard
CSO Online ran an article last August covering some important application security statistics from a study run by the Enterprise Security Group (ESG).
Security Boulevard
If you are a developer of web applications and looking for a guide to help you get started with security best practices, you are in luck. Back in October of 2020, Security Intelligence ran an article titled Web Application Security Best Practices: A Developer’s Guide. The article starts with a discussion about the impact of cyber criminals and data breaches on applications today, as the reason behind the importance behind having best practices in developing web applications securely.
Security Boulevard
If you are like many in our online connected world, you get some of your news from Twitter, both personally and professionally. For those that are security professionals, that have been looking to enhance your twitter feed with additional application security news, TechBeacon has a new list of the Top 50 Application Security Pros to Follow on Twitter.
Security Boulevard
In recent blog posts from K2, we’ve highlighted the need for additional application security for healthcare and financial verticals with the increased attacks on those organizations. In a recent article in Supply Chain Brain, security for another vertical was covered, retailers and their specific need for increased security.
Security Boulevard
A new report highlighted in Security Boulevard, is showing a 51 percent increase in attacks on web applications hosted by healthcare providers during December 2020, the timing of which coincides with the initial distribution of COVID-19 vaccines. Like banks and financial institutions, healthcare providers require a higher level of security because of the sensitive data they need to protect, and by the same token are more highly targeted by cyber criminals.
Security Boulevard
When talking about application security, financial institutions are typically at the top of the list that have the biggest concern around the security of their web applications. So should be no surprise to see a recent article in Finextra, talking about banks increasing their focus on application security.
Security Boulevard
If you’re looking for a direction to head with your application security efforts, TechBeacon recently ran an article on five key application security trends for 2021. We know that 2020 had a number of significant events around application security, including the move of applications to the cloud, the expansion of remote workers using cloud accessed applications, and an increase in the number of vulnerabilities reported in code.
Security Boulevard
It should be no surprise that taken as a whole, organizations are failing at application security. Whether it’s the findings of the Verizon Data Breach Incident Report or the latest studies from Forrester’s The State of Application Security, we know that applications are making it to production with more vulnerabilities than ever, and attacks on web applications have doubled in the most recent year.
Security Boulevard
Application Security Security Bloggers Network Vulnerabilities If you’re looking for more information on the latest update to the NIST (National Institute of Standards and Technologies) Security and Privacy Framework outlined in SP800-53, there’s a new article just published in the Cutter Business Technology Journal detailing the changes, the timing and an explanation of the new technologies (RASP and IAST) added to the framework.
Security Boulevard
Application Security Security Bloggers Network Vulnerabilities A Ponemon study released in 2019 showed that satisfaction with WAFs (Web Application Firewalls) is at 40 percent, and effectiveness of WAFs rated at only 43 percent. Those figures may seem low, but they reflect the growing disillusionment with WAF security that was recently discussed in a Dark Reading article.
Security Boulevard
Application Security Security Bloggers Network Vulnerabilities The final numbers for reported vulnerabilities in 2020 are published. We covered the news when the number of vulnerabilities recorded hit a record for the fourth year in a row. The US-CERT Vulnerability Database keeps track of new vulnerabilities in production code as they are discovered and assigns each unique vulnerability with a “CVE” number.
Security Boulevard
What is Web Application Security and Why is it Important? If you're new to web application security and you're looking for a primer to get yourself educated, there's a recent article published by the EC Council that covers the basics of what ... RDP Attacks on the Rise During COVID-19 Pandemic Enterprises forced to pivot to remote work environments in the wake of the COVID-19 pandemic may have exposed themselves to the potential for remote desktop protocol (RDP) attacks.
Application Security
WhatsApp/Facebook Data Sharing: Pants On Fire? WhatsApp is forcing users to agree to a new pile of data-sharing legalese. But that’s exactly what it promised not to do ... Prepare for more sophisticated security threats in 2021 As computing becomes more distributed to achieve greater optimization and efficiency, the threats posed by cyberattackers are destined to become increasingly more sophisticated. Here are some steps organizations should take in 2021 ...
Security Boulevard
Application Security Security Bloggers Network Vulnerabilities If you’re new to web application security and you’re looking for a primer to get yourself educated, there’s a recent article published by the EC Council that covers the basics of what web applications are, why web application security is important.
Security Boulevard
Application Security Security Bloggers Network Vulnerabilities Back in June of 2020 we wrote about Forrester’s new 2020 State of Application Security report. Back then we focused on the finding that application vulnerabilities were the weakest link in application security.
Security Boulevard
Application Security Security Bloggers Network Vulnerabilities Analytics Insight ran a recent article on the “Ten ways to ensure web application security,” a good reminder that there are many steps an organization can take to ensure security for their web applications in the face of larger numbers of attacks and increasingly sophisticated attacks.
Security Boulevard
Application Security Security Bloggers Network Vulnerabilities As we approach the new year, many of us are hoping for a new normal in 2021, at least something not so crazy as 2020 has been. Traditionally the new year has also meant a time of reflection, and a time to make resolutions for the new year. Here at K2, we’d like to help you with your new year’s resolutions, specifically those that revolve around web application security.
Security Boulevard
Application Security Security Bloggers Network Vulnerabilities The US-CERT Vulnerability Database keeps track of new vulnerabilities in production code as they are discovered and assigns each unique vulnerability with a “CVE” number. For the last three years, 2017 through 2019, we’ve had a record number of vulnerabilities recorded in the vulnerability database.
Security Boulevard
Application Security Security Bloggers Network Vulnerabilities During the 2020 COVID-19 pandemic, we’ve seen organizations increase their use of the cloud, partly to accommodate the increase in employees working from home, and partly as the increase they had already been planning on in their move to the cloud.
Show More
loading
Actions
Is this you?
As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.Get in touch with Timothy
Contact Timothy, search articles and posts on X, monitor coverage, and track replies from one place.
Learn more about Muck Rack