Categoria: News
-
Industrialização do cibercrime: como o crime-as-a-service ameaça os negócios
A industrialização do cibercrime: como gangues digitais viraram “empresas” e o que isso muda para os negócios À medida que as ameaças digitais se tornam mais sofisticadas e baratas de operar, o cibercrime deixou de ser um trabalho de “hackers solitários” para se transformar em uma verdadeira indústria global. Quadrilhas atuam hoje como empresas estruturadas,…
-
Sensitive data protection in cloud with encryption, tokenization and data masking
To protect sensitive data in cloud for Brazilian companies, combine strong encryption, carefully managed keys, tokenization for identifiers, and data masking for non‑prod and analytics. Align controls with LGPD, segment access by role, log every access, and regularly test performance, incident response, and key‑recovery procedures in your cloud environments. Primary protection goals for sensitive cloud…
-
Cloud identity and access management: common Iam mistakes and how to avoid
To fix frequent IAM mistakes in cloud without breaking production, start with read-only checks: list identities, roles and policies, compare them with least-privilege expectations, and search for overbroad permissions. Then phase changes: first test in non‑prod, then apply narrowly scoped updates and enable stricter monitoring and conditional access. Critical IAM pitfalls to recognize Overprivileged users,…
-
Invasão à lexisnexis: vazamento massivo de dados na Aws expõe governo
Divisão da LexisNexis confirma invasão e vazamento massivo de dados na AWS Um conjunto de 2,04 GB de dados supostamente extraídos da infraestrutura em nuvem da LexisNexis Legal & Professional, braço de informações jurídicas do grupo RELX, foi publicado na dark web por um usuário que afirma ter violado sistemas da companhia. O autor do…
-
Best practices for network segmentation and microsegmentation in cloud environments
Cloud network segmentation and microsegmentation reduce blast radius, limit lateral movement and align access to business roles instead of IP ranges. Start by classifying workloads, defining zones and trust levels, then enforce identity- and label-based policies using cloud-native controls plus selective host-based agents, validating continuously with telemetry, testing and change governance. Core principles for cloud…
-
Zero-day in cloud providers: how to track, assess impact and mitigate fast
To handle zero‑day incidents in cloud providers, monitor official advisories and your security telemetry, quickly map exposed assets, and apply layered mitigations without breaking production. Focus first on read‑only verification, blast‑radius analysis, and short‑term controls (network, identity, WAF), then move to patching, architecture hardening, and continuous cloud security monitoring. Immediate detection signals for provider zero‑days…
-
Pwa malicioso do falso google security rouba códigos Otp e sequestra navegador
PWA malicioso rouba códigos e transforma seu navegador em arma dos atacantes Uma nova campanha de phishing está explorando um formato ainda pouco compreendido por muitos usuários: aplicativos web progressivos (PWA). Sob a aparência de uma checagem legítima de segurança do Google, criminosos estão distribuindo um PWA capaz de roubar códigos de autenticação de uso…
-
Falhas críticas no claude code permitem Rce e roubo de chaves de Api
Falhas críticas no Claude Code permitem execução remota de código e roubo de chaves de API, revelam pesquisadores da Check Point Software Vulnerabilidades recentemente descobertas no Claude Code, ferramenta de desenvolvimento assistido por IA da Anthropic, expuseram empresas a riscos significativos de execução remota de código (RCE) e roubo de chaves de API. O ponto…
-
Monitoring and incident response in cloud-native workloads: tools and best practices
To monitor and respond to incidents in cloud-native workloads safely, centralize metrics, logs, and traces, define SLO-based alerts, and automate standard responses with clear runbooks. Use Kubernetes-native tooling plus an observability platform, start with low-risk namespaces, and continuously tune alert thresholds based on real traffic and incident reviews. Essential Monitoring Principles for Cloud‑Native Workloads Instrument…
-
Least privilege in Aws, azure and Gcp: how to implement cloud access policies
To implement least privilege on AWS, Azure and GCP in practice, define role-based access aligned to business duties, start with managed roles, then iteratively shrink permissions using logs. Automate IAM through Infrastructure as Code, enforce approvals, monitor risky privileges continuously, and use just-in-time elevation plus auditable break‑glass for emergencies. Core Principles for Implementing Least Privilege…