Il y a une masse de points de vue mais politiquement c’est vague. Écologie, anti faciste, commun culturel mais basé sur quoi il n’y aura pas de transformation sociale sans collectif. Pour moi tout est politique et les tribulations d’une bande d’intellos bobos ca manque de pep, c’est un entre soi qui m’emmerde un peu. Reunir des artistes (je suis peintre )oui mais ne pas s’isoler des milieux populaires qui sont les proies idéales du FN. J’ai lu vos commentaires des uns et des autres mais je ne vois pas de dynamisme pour secouer ces sociétés ultra capitalistes et fascistes. No pasaran. Vous ne parlez pas du genocide en cours sous nos yeux. Dommage

AI has been transformational for the workplace, saving time on repetitive tasks and freeing skilled staff to focus on higher-value work. It has become so embedded in organisations that ISACA’s research recently found that 82% of European companies expressly permit the use of AI at work.

However, there is a difference between using AI and governing AI use safely. Only 42% of organisations have a formal AI policy in place, and one in five (20%) don’t know who would be accountable if an AI system caused harm.

To further complicate things, it turns out that Microsoft Copilot now sits inside 80% of organisations using AI at work, well ahead of ChatGPT (56%), Gemini (37%), and Claude (21%). That means the majority of companies using AI are depending on just one vendor as an executive assistant, IT support, and sounding board.

In practice, this means that most of the business world is leaning on a single AI provider, with little planning for what happens if that provider is compromised or experiences an outage.

We use AI professionally and personally so much that, for many organisations, it is easy for compliance to become an afterthought. A tool people rely on daily doesn’t feel like a security risk – even when it is.

Leadership needs to challenge this by asking: what happens if this tool goes down, and what happens if it’s compromised? Some analysts expect over 200 high-signal disruption days across AI platforms this year and the negative impact that this will have on organisations’ productivity is considerable. Once staff begin to rely on AI-generated first drafts and summaries, reverting to manual work isn’t impossible, but it isn’t frictionless.

An over-reliance on AI – particularly on individual AI tools – can create a false sense of security, and the AI governance gap only gets worse when things go wrong. Three-fifths (59%) of companies do not know how quickly their organisation could halt an AI system in the event of a security incident, and only a fifth (21%) said they could do so within half an hour.

When a tool people rely on every day goes down, staff don’t stop working – they improvise. More than a quarter (26%) of organisations use no risk framework for AI at all, so when something does go wrong, there’s often no process to fall back on. That often means turning to whatever other AI tool is at hand, personal accounts, unapproved apps, and work-arounds that nobody has checked, at exactly the moment when careful handling of data matters most. This is why the fallback plan must exist before it’s needed, rather than being invented on the fly. The outage isn’t really the risk – how people cope during the aftermath is.

EU regulators have recognised and begun to address the AI governance gap, formally naming major cloud and AI providers, including Microsoft, as critical services to finance under the Digital Operational Resilience Act (DORA). Other sectors should expect similar action in line with NIS2 and the UK Cyber Security and Resilience Bill as the concentration risk argument spreads beyond finance.

What can businesses actually do about the AI governance gap? Firstly, they should review their AI use and record which important day-to-day work depends on a single AI tool. Where possible, they should try to diversify their provider use in order to mitigate the knock on effect of an outage.

This should be done as early as possible, as swapping AI providers isn’t like switching a light-touch SaaS tool. Foundation model capability sits with a small number of providers, so diversifying means retraining workflows and testing outputs.

Businesses should then look at their continuity plan and consider what the next steps are should their AI tools suffer an outage. Every organisation using AI should have a designated team that is responsible for managing an AI outage. But assigning ownership alone isn’t enough. Organisations also need a structured, maturity-based approach that embeds governance, accountability and resilience into day-to-day AI operations. Frameworks such as CMMI AIM provide a practical way to assess current capabilities, identify gaps and improve governance over time. That is not a decision that should be made mid-crisis, but before anything happens.

A backup option is also essential for operations that can’t afford to be put on hold until the AI is operational. Staff should be made aware of this contingency plan so that if their usual AI tool is unavailable, they don’t reach for something less secure out of habit.

This kind of business foresight is what will prevent your most useful tool becoming your biggest cybersecurity oversight.

None of this is to say that businesses should not use AI – rather that AI should be treated like any other critical part of the business, with a plan for when things don’t go smoothly. A designated owner and a tested fallback plan won’t stop the next outage, but it will decide whether it’s a minor disruption or a major one.

The post The 80% Problem: Why AI resilience is more important than ever appeared first on IT Security Guru.

Jimmy White, Chief Technology Officer, AI Security, F5

The first domino has well and truly fallen. The advent of high-powered AI models that can rapidly find software vulnerabilities that have lain hidden – in some cases, for decades – effectively makes static code analysis the first significant problem to be solved by AI.

The first-, second-, and even third-order effects of models such as Anthropic’s Claude Mythos Preview and ChatGPT 5.4-Cyber by OpenAI are the hottest topic in enterprises globally, for good reason. By pairing powerful AI with huge volumes of code data and existing vulnerability databases, these models know what good and bad code looks like, and can cycle through code at machine speed to find bugs and security issues.

Put simply, there has never been anything better than these AI models at detecting vulnerabilities in source code; they are highly capable tools that outperform all current best-in-class solutions. Their ability equates to a human coder that knows every existing disclosed software flaw, can read as fast as a computer, has perfect memory, and has 100% recall in milliseconds.

The potential and limitations of frontier models

There are already countless examples of the models finding real-world software vulnerabilities that have lain dormant for long periods but never known. There are also likely to be flaws that are unknown to their host company but are being abused by threat actors behind the scenes – a known tactic of attackers who want to keep their best weapons under wraps.

Most recently, there are eye-opening incidences of test models chaining together attacks or breaking their boundaries, such as the OpenAI models that accessed Hugging Face from a sandbox environment. Anthropic is investigating three incidents where Claude test models accessed the internet and breached the systems of outside organisations.

What does it all mean for already-stretched IT security teams and the industry as a whole? First, the utopian scenario: organisations with access to these models can rapidly find all the vulnerabilities in their existing code base and go about fixing them, reaching a better security posture. At the same time, all their new code can go through the models, so there is no ‘bad’ new code, no new security vulnerabilities.

Enterprises can also apply the models at all the entry points for potentially harmful code into their organisation. Any open source tools can be checked before usage; in M&A scenarios, acquirers can insist on the code base of potential acquisitions going through the AI models; companies can evaluate the source code of vendors that want their business; and so on.

However, the utopian thesis quickly breaks, for two reasons. One is that the AI models are performing static code analysis. Yes, that’s a very big, important thing, but it’s not everything; there are still many flaws that AI can’t find because it can’t understand the patterns in runtime or race conditions.

Secondly, and maybe more importantly, because AI makes coding easier, enterprises around the world will undoubtedly be generating exponentially more new code. Google says that 75% of its new code is AI generated; at Anthropic and other AI-native companies, the proportion is as high as 90%. So, the speed that new code – and new vulnerabilities – are being created will at least match the speed these powerful models can find those vulnerabilities.

Static code analysis is just the opening act

For now, access to frontier AI models is limited, allowing participating organisations to find and fix bugs before they can be exploited in anger. But the frontier model companies have been frank that these models present unprecedented attack capability, as demonstrated in the Hugging Face incident, making them dangerous in the hands of a bad actor.

This is a familiar pattern in AI: each time the technology catches up from a cyber defence perspective, it offers similar advancements from an offensive perspective. As an industry, we are in an established cycle of ‘leap ahead, catch up’, a game of leapfrog between defenders and attackers as both sides advance their capabilities.

For the AI model makers, there is another aspect to the story. Source coding itself looked set to be the first market to be ‘cracked’ by AI, but it remains imperfect and still requires human input and oversight. In static code analysis, the frontier model companies have found a market they can dominate, defying the naysayers who question the enormous investment in AI and the technology itself.

Anthropic was first to this particular market, but OpenAI and other frontier model companies were quickly out of the blocks. Open-source models will similarly reach the bar for effective code vulnerability scanning, sooner rather than later.

Other markets will follow too. Anthropic’s collaboration with Canva, the design software company, and the launch of Claude Design signal is another example of a market that will be disrupted by the application of powerful AI to existing practices.

The AI giants are becoming surgeons, not general practitioners

In the Western world, there are now five titans in the AI arena: Anthropic, OpenAI, Google, Meta and xAI. They are going toe-to-toe with regular improvements in their models, opening up the prospect of a new class of specialised AI models for specific tasks that have practical – and financial – value.

Each time one of these players picks a new thing to focus on, it is a signal to where there’s market value. Sometimes they will choose the same market, but sometimes they will go for unique ones, maybe niche to their business area.

What those markets are will partly be decided by the model companies’ access to relevant datasets. Because of the popularity of its models with coders, for instance, Anthropic had access to an enviable source code dataset for training Mythos Preview.

Meta and xAI have access to vast social and communication data, though the nature of their data is very different. On top of that, search, email and mapping services hold near-infinite amounts of data on how people communicate and where they go.

This is all ripe for disruption by AI, with profound downstream effects. For example, enterprises may be discouraged from choosing a single AI provider as various model makers offer increasingly differentiated capabilities.

Buyers will benefit from competitive tension, but the cost and complexity of maintaining and securing multiple AI models will rise. Enterprises will have multiple subscriptions with multiple providers for different use cases.

AI disruption has only just begun

The static code analysis breakthrough did not happen by accident. The frontier model companies have pointed their currently most powerful models at a 20-year-old problem where they have the training data – and the models perform very well.

They will point the models at hundreds of other 20-year-old problems and do equally well. For the foreseeable future, we can expect massive disruption. This is the first domino to fall; there will be another, and another, and another.

The post The first domino of AI disruption: How frontier models are revolutionising software security appeared first on IT Security Guru.

It only works when I’m Rwanda.

Noteworthy stories that might have slipped under the radar: government AI platform deal sparks outrage, North Korean IT worker breaches federal agency, DEF CON attendee blamed for Delta flight disruption.

The post In Other News: Rapid7 Layoffs, Hacking a Boeing 737, Refrigeration System Vulnerabilities appeared first on SecurityWeek.

Over 95% of the affected companies were exposed before the malicious LiteLLM packages were published.

The post Trivy, Not LiteLLM Behind the 2,500 Org Compromise appeared first on SecurityWeek.

It can be daunting to determine who’s responsible for showing ads on the websites we visit, or who’s harvesting data from the mobile apps we use every day. That information is already semi-public, but it is not easily parsed and traditionally much of it has remained walled away in the hands of large advertising platforms. Not anymore: A powerful and free new service called DecryptAds scrapes and correlates this adtech data and makes it simple to quickly learn a great deal about the entities that are tracking you.

A Decryptads summary of the advertising partnerships declared by espn.com.

The newly launched decryptads.com says it is constantly scraping the files that websites and apps make publicly available to disclose the companies that are permitted to run ads or collect user data. These files include:

–ads.txt: all of the adtech companies and data brokers that may run ads or harvest data from the site;
–app-ads.txt: entities that can harvest data from or display ads on mobile and smart TV apps;
–buyers.json/sellers.json: the entities buying, selling or reselling ad inventory for a given site or app.

Zach Edwards is chief research officer for DecryptAds and a threat researcher at the security company Infoblox. Edwards said he and two other founders decided the service was needed because the adtech data in these files is generally only useful when it can be cross-referenced to build a more complete picture of the advertising ecosystem for each website or app.

“It’s an adtech tool but we’re trying to approach adtech from a security perspective,” Edwards said. “It’s really built for a lot of privacy and security use cases that have been dramatically underserved.”

Those use cases, he said, include tracking down the source of malicious ads that try to foist malware on targeted users, identifying ad networks located in adversarial nations, and detecting the fast growing swarms of AI-generated slop websites and apps. And as decryptads.com demonstrates, these potential security and privacy threats are near impossible to detect just by viewing a single apps.txt or app-ads.txt file.

“Supply-chain integrity issues rarely live in a single file,” the site explains. “They show up as broken cross-references between ads.txt, app-ads.txt, and sellers.json files; as cloned declaration sets across unrelated domains; as seller removals that only make sense when viewed across exchanges; and even as supply paths in bid logs that never actually appear in any given publisher’s authorized-seller list.”

A search in DecryptAds for the hugely popular sports network espn.com reveals 143 ad partners and 19 registered data broker domains are listed within its ads.txt and app-ads.txt files. That data broker information is gradually becoming available because four states — California, Oregon, Texas and Vermont — have recently passed laws requiring data brokers to register if they buy or sell data on consumers from those states. DecryptAds reports that almost half of those data brokers are collecting geolocation data from espn.com visitors who aren’t blocking ads, while another three disclose that they collect device fingerprints and sensitive personal information.

A visual representation of the complex ad supply chain declared by espn.com. Image: decryptads.com.

HIGH-RISK AD PARTNERS

DecryptAds also makes it easy to learn the beneficiaries and national origins of the advertising firms lurking in apps and websites, displaying a conspicuous warning when adtech partners of an app or website are based in “geo-risk” areas like China and Russia, or in countries with strong financial and political ties to both — such as Cyprus and the United Arab Emirates (UAE).

According to DecryptAds, espn.com works with four different advertising entities that are based in either Russia, China or the UAE, including the adtech firm Between Digital, which lists a New York address. However, the dossier on Between Digital flags them as a Russian firm, showing that their publisher offers (PDF) are processed through Alfa Bank, Russia’s largest private commercial bank and one of several financial institutions placed under U.S. sanctions in 2022 after Russia invaded Ukraine. KrebsOnSecurity sought comment from both Between Digital and the company’s founder, and will update this story in the event that either replies.

A search for several top U.S. military news websites — including armytimes.com, airforcetimes.com, defensenews.com, navytimes.com, marinecorpstimes.com and federaltimes.com — shows they all allow Between Digital to serve ads and track users, as well as two entities in the UAE and another in the ownership secrecy haven of Panama. DecryptAds reports that Between Digital is collecting ad data on approximately 55,000 partner websites.

The “Geo Risk” section of decryptads.com.

Pivoting on Between Digital’s app-ads.txt file reveals hundreds of domains featuring simple web-based games that are frequently interrupted by ads. Edwards said Between Digital’s own declarations show the company is listed as both a publisher and a reseller on approximately two-thirds of their portfolio.

“It means they are basically playing both sides of the bidding equation, which creates opportunities to direct client spend at your owned and operated properties or client infrastructure, essentially creating opportunities for conflicts of interest,” Edwards told KrebsOnSecurity. “The problem we have right now is that for years we’ve had almost no one policing these ads.txt and app-ads.txt files.”

The Opera Web browser remains quite popular, and probably many users are unaware that since 2016 it has been majority owned and controlled by the Chinese company Kunlun Tech (the operational headquarters of Opera remain in Oslo, Norway).

Opera.com’s profile at DecryptAds identifies 27 registered data brokers collecting information, including 15 adtech partners in the UAE, six in China, three in Cyprus, two in Russia and one each in Hong Kong and Ukraine. DecryptAds makes clear, however, that these companies represent just seven percent of the adtech partners specified in Opera.com’s ads.txt and app-ads.txt files.

LEGAL DOSSIERS

One feature of DecryptAds that sent this author down multiple hours-long research rabbit holes is its Legal Dossier lookup, which takes several minutes for each search but eventually churns out oodles of useful information about who owns a particular domain or app, when it was registered, and any aliases or relationships it may have to adtech companies and other websites or apps.

For example, last month KrebsOnSecurity wrote about researchers from Bitsight who found that an extremely popular line of TV streaming sticks called H96 quietly rent out each user’s Internet connection to strangers. Bitsight also discovered that when these devices aren’t being used to stream pirated video content, they are spoofing themselves as mobile phones clicking ads on AI-generated slop websites.

Bitsight concluded that the same Chinese company that made several of the malicious apps common to all of these H96 streaming sticks — the Fengwo Group — also also ran the network of ads and AI slop websites being clicked on by tens of thousands of these devices that are pretending to be mobile phones.

Examples of ad landing pages linked to the Fengwo Group. These sites were designed to show ads only to H96 devices that were spoofing their device type as mobile phones. Image: Bitsight.

A DecryptAds legal dossier on the (now dormant) Fengwo Group domain name for the AI slop website pictured on the left in the screenshot above (medicalbeautyhub dot com) shows it shares a seller ID (1674071) with a gaming website — giacoloredstones[.]com — which features yet another seller ID (103488000).

Pivoting on that latter seller ID reveals hundreds of active websites within Russia’s Yandex ad system featuring extremely low-quality games or simple utilities that pepper visitors with ads.

QUIET REMOVALS

Edwards said that when advertising networks suspect a given advertiser is engaged in unauthentic clicks or displaying malicious ads, very often those networks will quietly remove the offender from their list of approved partners without letting anyone else know about their suspicions.

This practice, he said, makes it easier for dodgy adtech firms to avoid accountability and continue victimizing others. To address that visibility gap, DecryptAds features a quiet removals feed that records and correlates all of the sellers.json removals across ad exchanges for the same seller domain or name.

A screenshot of the Quiet Removals Feed at decryptads.com.

“The way the adtech industry works, someone will write a report about ad fraud and only share it with their own clients and they won’t make it public,” Edwards said. “The ban is just removing them from the sellers.json file, but they told nobody. One day it was there, the next it was gone. So if you’re trying to navigate who is suspicious, that’s usually tough to do because there are a lot of adtech companies removing things all at once.”

MALVERTISING AND AI SLOP

Malvertising, the term given to the practice of inserting malicious ads that foist malware or redirect visitors to phishing pages, remains an all-too-frequent occurrence in the modern adtech industry. But Edwards said these malicious ads are far more commonly found now on newly generated AI slop websites than on high traffic destinations that typically employ a variety of technologies and third party tools to quickly flag bad ads.

“None of these slop AI content farms are paying for that kind of protection,” he said. “They’re just signing up the lowest quality partners, and it essentially becomes a greased rail to target the users of those sites with malicious ads. Most malvertising attacks don’t happen on espn.com or huffpost.com, but rather [on] some lower quality content farm and someone just went there because it came up in a search.”

Edwards said the AI slop websites are populated with machine-generated blog posts and images, and cover a wide array of themes from home improvement and decorating to food recipes, hunting, cars and consumer technology. He said organizations that get hit with malicious ads are often at a loss for what to do next, unaware that in most cases the answer is one of the entities listed inside the website’s ads.txt or app-ads.txt file.

“A lot of serious organizations are starting to understand that if we’re not breaking down this ad data, we’re not going to know who’s targeting government people with zero-click payloads on an almost daily basis,” he said.

Edwards maintains that truly getting a handle on the malvertising and AI slop problems will require more data-sharing by the major ad networks. Specifically, he says those platforms do not broadly share what’s known as the “supply chain object” or SCO, structured data attached to each advertising bid request that lets buyers see every seller, reseller and intermediary involved in passing an ad impression from the publisher to the final buyer.

“That SCO tells you who sold it or resold it, and who was the final entity that bought the impression that served that malware payload,” Edwards explained. “You may see the malicious zero-click redirection, but without the supply chain object — which is only served server side — you won’t know who targeted your people with malware and won’t have a way to try and prevent it properly. But if we can encourage the adtech industry to expose that SCO, it will get easier to find the culprit behind any one bad ad.”

DecryptAds also offers an application programming interface (API) that allows researchers to automate queries and integrate the site’s functionality into popular AI platforms.

WHAT CAN YOU DO?

The only sane reaction to the examples described above is to block all online ads outright. This approach is broadly endorsed by security experts because it also makes it more difficult for adtech firms and data brokers to build detailed profiles on you and track your movements around the web and in the real world.

However, much depends on how you normally prefer to browse the Internet, and how much trust you place in third party browser plugins and extensions. For those primarily surfing via a regular desktop or laptop Web browser, uBlock Origin Lite is an excellent free and well-maintained open source option. uBlock Origin also should work with mobile browsers like Firefox, but apparently only on Android-based devices.

Adblock Plus is a decent option for iPhone and iPad users. For power users, Adblock and uBlock Origin both support custom blocking rules from easylist.to, which publishes a frequently updated list that removes most advertisements from webpages.

The well established browser extension NoScript blocks all non-approved Javascript code, and it generally does a fine job blocking most ads from loading. However, script blockers like NoScript may not be suitable for average users who don’t enjoy constantly having to referee which scripts should be allowed to load so that each site displays properly.

More technically inclined/adventuresome readers should strongly consider a hardware approach to blocking ads at the local network level, because that is easily the cheapest, most secure and scalable way to do it. A tiny, low-cost and broadly available computer known as a Raspberry Pi can be turned into a powerful ad blocker for all devices on a local network when fitted with a microSD memory card and a free program called Pi-hole. Once you’ve set it up properly and changed your router’s network settings to use the Pi-hole’s DNS sinkhole and DHCP servers, it should prevent ads from displaying on any devices connected to that network.

Bear in mind that ad blockers often do little to block ads and/or tracking that occurs from within mobile apps that users have chosen to install on their devices. Many websites now push users to install a mobile app, supposedly in order to more fully access and enjoy the site’s services and content. But in my experience, they’re not doing this because the user experience is somehow way better on the app (as LinkedIn tries to convince us non-app users several times a week via email). On the contrary, I find most mobile apps to be horribly designed, annoying, and/or completely unnecessary, and when given the option I will almost always choose to interact with a website or service directly in a Web browser.

No, the cold truth is that big web destinations tend to get pushy with their apps because they make it easier for these companies to keep you on their platforms longer and to collect (and in many cases resell) far more precise data about who, what and where their users are. Also, companies pushing customers the hardest to install mobile apps always seem to liberally opt everyone in to having their data used to train large language models these days. So be cautious about the apps you install on your mobile devices (including any smart TVs!), and poke around their listings at DecryptAds if you want to learn more about their privacy practices and any relationships they may have to adtech firms.

Keeper Security has urged schools, colleges and universities to strengthen their cyber defences ahead of the new academic year, warning that AI-powered phishing and a growing number of unmanaged machine identities are widening the education sector’s attack surface.

The identity security and privileged access management (PAM) provider said the annual rush to provision accounts, issue credentials and connect new devices creates a particularly attractive window for cybercriminals.

At the start of an academic year, IT teams can be responsible for onboarding thousands of students, faculty and staff while simultaneously enrolling devices and integrating third-party applications. Keeper warned that this combination can increase the likelihood of misconfigurations, stale credentials and excessive access going unnoticed.

Education institutions are already frequent targets for ransomware, credential theft and data breaches, in part because of the valuable information they hold, ranging from student and financial records to academic research.

Keeper said the threat is being compounded by relatively low levels of security awareness. Its research found that just 14% of schools mandate security awareness training, while almost one in five students and parents reported reusing passwords across personal and school accounts.

Artificial intelligence is adding another layer to the problem. AI-generated phishing messages can imitate communications from IT helpdesks, student funding departments and senior university figures with greater accuracy, potentially removing many of the spelling, grammar and formatting mistakes traditionally associated with phishing campaigns.

Deepfake technology also gives attackers the ability to impersonate trusted individuals through voice and video.

According to Keeper research, 52% of education leaders identify deepfake impersonation as a major concern, but only 26% are confident in their ability to recognise AI-enabled threats. The company also found that 41% of institutions reported being targeted by AI-generated phishing attempts or misinformation campaigns.

Beyond attacks targeting students and staff, Keeper highlighted what it describes as a less visible threat to education environments: non-human identities (NHIs).

These identities include service accounts used to synchronise student information and learning management systems, API keys connecting third-party EdTech applications, machine certificates authenticating connected equipment and cloud identities supporting automated workloads.

Increasingly, the category also includes AI agents and bots used for functions such as admissions, IT helpdesks and grading.

Keeper warned that credentials associated with these systems can be overlooked by conventional identity management practices. Service account passwords may remain unchanged for long periods, while API tokens belonging to applications that are no longer used can potentially remain active.

Cloud workloads can similarly accumulate permissions beyond those required for their function, while expired or incorrectly configured certificates can create additional security gaps.

Darren Guccione, CEO and co-founder of Keeper Security, said the education sector needed to broaden its approach to identity security.

“The conversation about education cybersecurity has historically focused on human accounts: students, teachers and administrators,” said Guccione. “But the real blind spot is the vast ecosystem of machine identities that power modern EdTech. Back-to-school is the right moment for education IT teams to take stock of every identity on their network, human and non-human alike.”

Keeper is recommending that education IT teams use the period before students return to review both human and machine access to their environments.

Among its recommendations is enforcing multi-factor authentication (MFA) across student, faculty and staff accounts, alongside deploying enterprise password management to reduce weak, reused and shared credentials.

Institutions should also audit privileged access and remove permissions associated with former employees, expired service accounts and applications that are no longer required, the company said.

For non-human identities, Keeper recommends creating an inventory covering service accounts, API keys, machine certificates, cloud identities and AI agents. Credential rotation policies should then be established, particularly for third-party EdTech integrations and AI systems introduced for the coming academic year.

The company also advised institutions to update phishing awareness programmes to account for increasingly convincing AI-generated communications.

Keeper said its zero-trust and zero-knowledge security platform can be used to discover, govern and rotate credentials belonging to both human and non-human identities. Its KeeperPAM platform additionally provides privileged access controls, session recording and audit capabilities.

As education environments become increasingly dependent on cloud services, connected equipment, third-party applications and AI, Keeper argues that knowing which identities have access (and whether they still require it) is becoming as important as protecting the students and staff behind traditional user accounts.

The post Keeper Security Issues Cyber Guidance for Education IT Teams appeared first on IT Security Guru.

Google Cloud outlines its roadmap to full post-quantum cryptography readiness, with key milestones targeted for 2027 and 2028.

The post Google Cloud Sets Out Post-Quantum Roadmap With 2029 Readiness Goal appeared first on SecurityWeek.

The hackers published the allegedly stolen information, including names, addresses, email addresses, and phone numbers.

The post 1.6 Million Likely Impacted by RingCentral Data Breach appeared first on SecurityWeek.

It was late March when Joe Teirab, the second-in-command at Minnesota’s U.S. attorney’s office, received an urgent email from Washington.

The federal government was scrambling to find criminal cases to back up President Donald Trump’s claims that illegal voting by noncitizens was tipping the scales in American elections. Agents from Homeland Security Investigations, a massive federal law enforcement agency, had been dispatched to work leads across the country, including hundreds in Minnesota.

Teirab was already under pressure. In an earlier missive, Nick Davis, a high-ranking Justice Department appointee helping to lead the election fraud crusade, had reminded him the cases were so high priority that Teirab and his staff couldn’t decline to move forward on them without express approval from agency higher-ups. On March 24, Davis demanded a status report — within hours.

Teirab, a former Marine and a Harvard Law graduate who’d run unsuccessfully for Congress as a Republican, responded with a blunt reality check.

“Bottom line up front,” he replied in an email reviewed by ProPublica. After subpoenaing records on about 130 people, only one had been referred for prosecution, his staff had told him. Agents had deluged local election offices with calls and demands for voting histories, demonstrating “a complete lack of understanding” of illegal voting investigations.

“The HSI task force has been disjointed and disorganized,” Teirab wrote. The entire process, he said, had been “dysfunctional.”

Since Trump regained the White House, his administration has launched a series of unprecedented initiatives to find and prosecute voting by noncitizens, which he’s long claimed, without evidence, is rampant.

He’s stepped up this push in recent weeks, saying in a nationally televised speech that the American election system was “so vulnerable that no one can possibly defend it.” To support that assertion, the Department of Homeland Security, HSI’s parent agency, released documents asserting it had found more than 250,000 noncitizens on voter rolls in just four states, all led by Democrats. The documents included no explanation of how that number was calculated.

It’s well known the administration has tasked HSI — a force established to combat drug cartels, terrorism and other cross-border criminal enterprises — with leading the campaign to find election fraud cases in the United States.

But an investigation by ProPublica reveals for the first time how the Trump administration came to harness HSI’s personnel, technology and sweeping legal authority in service of its election agenda — and how meager the results have been, despite the prodigious resources sunk into the effort.

According to interviews and internal emails reviewed by ProPublica, career staffers at the Justice Department warned that transferring voter rolls to HSI to enable it to search for noncitizen voters could violate federal privacy laws. Similarly, longtime HSI insiders cautioned that using the agency’s databases and tools to search these lists would yield mismatches and wildly inflated results.

The administration plowed forward anyway.

HSI’s involvement in the hunt for election fraud traces at least to summer 2025, when agency supervisors embraced a proposal from a midlevel agent who’d publicly echoed Trump’s claims about elections. He argued the agency’s powerful databases and tools could find noncitizens even on the voter lists that states make publicly available, from which the most confidential information has been redacted. Under Trump, the Justice Department had collected many public voter rolls as part of a controversial effort to compel states to turn over the unredacted versions.

Those searches went forward, ProPublica’s reporting shows, helping to generate tens of thousands of leads regarding illegal voting across the country. But when HSI agents were sent to investigate them, the results were similar to what Teirab reported from Minnesota.

Between January 2025 and May 2026, a ProPublica analysis of Justice Department data shows, fewer than 150 alleged noncitizen voters were referred for prosecution. Even fewer — 41 — were charged with voting illegally or other election-related crimes. (More than 150 million people voted in the most recent presidential election.)

In response to questions from ProPublica, administration officials insisted the effort spearheaded by HSI was producing meaningful results.

“President Trump is committed to ensuring that Americans have full confidence in the administration of elections, and that includes totally accurate and up-to-date voter rolls free of errors and unlawfully registered non-citizen voters,” Abigail Jackson, a White House spokesperson, said in response to ProPublica’s request for comment. “Noncitizens voting is a crime. Anyone breaking the law will be held accountable.”

A DHS spokesperson didn’t answer questions about why so few prosecutions have resulted from HSI’s work. The agency wouldn’t specify what tools or techniques HSI had used, but confirmed it had cross-referenced “publicly available data” from state voter rolls with information on “known illegal aliens” in its systems. “It’s not rocket science,” the spokesperson wrote of this initiative in a response to ProPublica’s questions. “It’s an easy step to secure our elections.”

Teirab and the U.S. attorney’s office in Minnesota declined to comment.

There’s an array of reasons why Trump’s campaign to document claims of widespread voter fraud hasn’t succeeded. Most obviously, it’s exceedingly rare, as countless studies and state audits have found. Noncitizens often get on voter rolls by accident or when government officials make errors. Last month, New Jersey disclosed that a mistake involving its Motor Vehicle Commission caused 6,600 noncitizens to be registered (fewer than 400 voted).

The administration’s critics say its hunt for noncitizen voters aligns with Trump’s attempts to seek more federal control over elections while stoking doubt and fear about the voting process. Since taking back the Oval Office, Trump has tried to impose new restrictions on voter registration, mail-in ballots and voting machines, though judges have shut down most of these efforts.

Former officials at DHS and the Justice Department called the move to involve HSI a further escalation and questioned the propriety of aiming the agency’s muscle and technology at individual cases of illegal voting.

“It’s one thing if you’re going after Pablo Escobar,” said Steve Bunnell, a former DHS general counsel and senior intelligence adviser who handled voting fraud prosecutions during more than a decade at the Justice Department. “It’s another thing if you’re going after some cleaning lady who’s been working in the United States for 20 years and taking care of her 80-year-old mother and taking her little kids to church.”

“The Swiss Army Knife of Federal Law Enforcement”

Trump’s enlistment of HSI in his election fight is no accident. Cobbled together in the aftermath of 9/11, the agency has 7,100 armed, highly trained agents and another 800 criminal analysts, as well as access to troves of confidential data about hundreds of millions of Americans.

Though part of Immigration and Customs Enforcement, the agency has historically stayed out of immigration cases. During the first Trump administration, leaders of 19 HSI regional offices — virtually its entire top field hierarchy — signed a letter calling for HSI to become a standalone agency, arguing that ICE’s deportation work dissuaded people from cooperating with its investigations. But when Trump returned to the White House, it swiftly became clear that the agency would play a central role in investigations related to the president’s twin obsessions, illegal immigration and noncitizen voting.

Trump picked his field general for repurposing HSI even before taking the oath of office. In December 2024, he named Anthony Salisbury, a 50-year-old career agent who’d run the agency’s Miami office, as a deputy homeland security adviser, reporting to White House policy chief Stephen Miller. He was also given a dual appointment as head of HSI.

Salisbury was colorful: A mixed martial arts enthusiast, he once appeared at the agency’s headquarters with his face bruised and eye blackened from a recent bout. He’d sometimes entertain colleagues by pulling out a bridge that covers his missing front teeth.

To agency veterans, however, he was forever linked to a 2011 operation he’d overseen in Mexico in which one agent was killed and another wounded in a highway ambush by a drug cartel. An agency review submitted to Trump in April 2020 concluded that errors by HSI supervisors, including Salisbury, contributed to the outcome; it urged the administration to consider disciplinary action. None was taken against Salisbury, however.

Salisbury did not respond to requests for comment from ProPublica. A White House official called him “a critical member of the Trump administration” who was “cleared” in every review of the Mexico incident and was subsequently “promoted six times under multiple administrations.”

Once elevated to his new posts, Salisbury took charge of carrying out the second Trump administration’s agenda for HSI, personally issuing staffing directives, reassignments and promotions, current and former agency officials told ProPublica. (A number of them spoke on condition of anonymity out of fear of retribution.) 

Starting in early 2025, Salisbury oversaw the unprecedented reassignment of more than 6,000 agents to immigration enforcement, diverting most of the agency from its normal duties. He then also pointed HSI at noncitizen voting, presiding over multiple meetings with officials at DOJ and Homeland Security focused on election fraud, according to emails reviewed by ProPublica and agency supervisors who worked with him.

“Stephen Miller has an HSI deputy for a reason,” said Eric Balliet, a high-level HSI manager who retired in 2024 after 23 years with the agency. (Like many HSI veterans, Balliet has remained in close contact with former colleagues.) “Salisbury is going to salute and execute, and he is going to make sure that from the HSI side, they fall in line, and there’s going to be no resistance or pushback. HSI has been turned into the Swiss Army knife of federal law enforcement.”

In early July 2025, Frank Quiñones, an HSI special agent who’d worked under Salisbury in Florida, approached leaders at the HSI Innovation Lab with an idea for using the agency’s technology to find noncitizen voters on state voter rolls, sources at the agency told ProPublica. Quiñones had been transferred to Washington to oversee a unit that had previously handled cases involving the theft of government benefits but that had been enlisted into voting investigations.

The lab, housed in an unmarked office in a D.C. suburb, had access to the government’s most sensitive databases, from suspicious activity reports to arrest records. Staffed by a combination of HSI experts and outside consultants, it developed software tools to comb the data for information that could help agents pursue criminal suspects.

Quiñones was a true believer in Trump’s claims about election fraud: In multiple Facebook posts and reposts, ProPublica found, he promoted claims that the 2020 presidential vote had been stolen. At a meeting with the Innovation Lab’s overseers, according to sources who worked in the lab, he pitched using the lab’s technology to identify illegal voters — even though the agency lacked voter rolls that included identifiers such as partial Social Security numbers. (Quiñones did not respond to ProPublica requests for comment.)

For proof of concept, Quiñones proposed using a February 2021 public voter list he’d obtained for New Jersey and running it through HSI’s databases. The lab staff viewed his idea as “a little insane,” one recalled — both unreliable and improper. Since the public rolls don’t include voters’ unique identifiers, people at the lab also knew linking them to HSI’s data would produce mismatches — what the staffer called an “ungodly” number of false positives. The lab team also worried about violating longstanding safeguards limiting use of private citizen data. They “didn’t want to touch this,” the staffer added. Quiñones defended his idea, repeatedly declaring: “The president wants this!”

Tom Hodge, an HSI data analyst at the meeting, proposed running the voter information through the Athena Toolbox, an analytical platform developed by the Sandia National Laboratories that had access to all of HSI’s databases. (Hodge did not respond to ProPublica requests for comment. Sandia referred ProPublica’s questions to the facilities’ parent agencies, including the Department of Energy, which did not respond to our requests.)

Hodge and the Sandia team spent the next six weeks on the project, reporting they’d found large numbers of noncitizens on Quiñones’ 2021 New Jersey list. According to one former HSI official, they said they’d found “5,000 high-confidence illegal voters” in just a single New Jersey county. (Officials at the New Jersey secretary of state’s office, which oversees the state’s voter rolls, declined to comment on the claim. Beth Thompson, head of a group for local New Jersey election officials, called the number impossibly high, even accounting for the mistake disclosed by the state.)

The apparent breakthrough couldn’t have come at a better time.

The Trump administration’s other efforts to identify noncitizens on state voter rolls were running into a variety of roadblocks.

The administration had hoped to persuade states to check their voters’ citizenship status using a system called the Systematic Alien Verification for Entitlements, or SAVE, but many didn’t. Most states also refused the Justice Department’s demands to turn over their unredacted voter rolls, including partial Social Security numbers, which thwarted the agency’s plan to run them through SAVE. Courts have stymied the DOJ’s attempts to sue for the records, citing the Constitution, which gives primary control over elections to the states.

In an Aug. 21 email to a half dozen administration officials, Quiñones touted the solution he’d brought to the HSI Innovation Lab: using HSI’s platform to search voter rolls. The results, Quiñones noted, could fuel both criminal and immigration investigations.

By the end of the month, those in top election-related roles at DHS and the Justice Department were actively promoting what they dubbed the “HSI Tool” as a preferred alternative to SAVE, according to people familiar with the matter. Among them was Heather Honey, the prominent election denier appointed as a senior counselor at DHS, who is helping lead the government’s efforts to identify noncitizens on voter rolls. (Honey did not respond to ProPublica’s requests for comment. In an email responding to questions to her, DHS said Honey’s “expertise in election administration” was “invaluable to the Department’s efforts to protect critical infrastructure.”)

The White House, too, got behind the idea. In a November email, J. Brian Sikma, special assistant to the president, excitedly noted that the New Jersey trial cross-checking voter rolls with DHS data appeared to have identified a “very significant number” of “potential non-citizens.” (Sikma didn’t respond to a request for comment.)

The DOJ, Sikma reported, had already obtained public voter rolls for many other states. He included a list of them, adding: “It is of paramount importance that these also be reviewed expeditiously.”

Running “Roughshod” Over Privacy

As the push to use HSI’s tech to search voter information gained momentum, a new problem emerged.

Career attorneys at the Justice Department, including specialists on privacy law, raised concerns that transferring voter rolls wholesale from the agency to DHS might not be legal, according to internal emails reviewed by ProPublica and interviews with several former officials.

The voter rolls the DOJ had collected contained sensitive information on millions of Americans. Even the public versions, which political parties and candidates routinely obtain to target ads and messages, included voters’ addresses, birth dates and party affiliations. For the 16 states that have agreed to share their unredacted voter lists, the DOJ had citizens’ partial Social Security numbers or driver’s license information, too.

Federal laws, particularly the Privacy Act, dictate what data government agencies can collect, what it can be used for, how it can be shared, and how it must be protected. Agencies have to disclose their plans in advance, gathering public comment. A person’s information can’t be released or shared without their consent, subject to limited exceptions.

From the outset, the Trump administration’s effort to combine data across federal agencies has repeatedly drawn criticism from courts and whistleblowers for failing to adhere to restrictions meant to keep data private and secure. In June, for example, a judge prohibited the government from using SAVE for mass searches, ruling the administration had violated federal privacy laws by giving DHS access to Social Security data to enhance the tool. The administration has appealed that ruling.

In July 2025, as word got around that the DOJ might hand over voter data to DHS, a half dozen career attorneys who had been reassigned into the voting section voiced their unease to supervisors, according to two former DOJ lawyers. Their concerns were disregarded, prompting most to resign.

Instead, the DOJ’s office of legal counsel pushed forward with plans to share the public voter rolls, claiming a Privacy Act exception allowed HSI to receive such data without public notice as long as it was for law enforcement purposes. DHS just needed to submit a letter officially requesting the data for those purposes, an attorney in the legal counsel’s office explained, according to internal emails.

But this exception was meant to be used to get information on individual criminal suspects, not to gain mass access to data on people suspected of no wrongdoing, according to Nikhel Sus, chief counsel for Citizens for Responsibility and Ethics in Washington, which has sued the Trump administration on behalf of voter and pro-privacy groups, filing the case that eventually limited SAVE’s use.

Peter Winn, a 29-year Justice Department veteran who had served as the agency’s acting privacy chief for nearly a decade, drafted a letter to set out the data-sharing agreement between the DOJ and DHS, according to internal documents reviewed by ProPublica.

In a Feb. 12 email to two top DOJ officials, he said he’d rewritten an initial draft memo to “make the information sharing arrangement far easier to defend, if and when it is challenged in court.”

Rather than simply handing over the voter rolls, Winn proposed having DHS request “pertinent and relevant” information about specific people from the DOJ, then having technical staff at Justice and Homeland Security “coordinate” to fulfill the requests.

“Having slept on it,” Winn wrote, “I ended up deciding that our initial idea of sending a huge amount of raw unprocessed voter registration data to DHS, involved taking far too much unnecessary legal risk, given that 99% of the data would implicate the privacy and civil liberties of United States Citizens, and would risk adding to the false narrative in the establishment press of DOJ and DHS being unconcerned with the privacy and civil liberties of Americans.”

Winn attached his proposed letter, to be signed by Todd Lyons, then the acting director of ICE.

Winn’s suggested restrictions were quickly abandoned, however. A second draft of the letter, dated March 4, contained altered language providing that the voter information would be “transferred” to HSI, with one exception: Voters’ party affiliation would be redacted, if possible, it said.

The final letter, signed by Lyons and sent to the DOJ just two days later, abandoned even that limitation. Just three paragraphs long, it permitted HSI to use the voter rolls to pursue any “appropriate investigation of potential violations of federal election law.”

In response to questions from ProPublica, Winn said “I can’t really comment on internal drafts of correspondence.”

A Justice Department spokesperson defended the government’s actions, saying “no one should oppose intergovernmental data sharing and coordination that enable swift investigations and prosecution of illegal alien voting.” DHS echoed the DOJ’s view, calling such information sharing “essential to protecting America’s election process by keeping noncitizens off voter rolls” and “an easy step to secure our elections.”

Sus said that by pooling voters’ sensitive personal identifiers, along with their party and voting histories, the administration has “run roughshod” over privacy laws and is creating a “1984-style database” that could be used to surveil political participation.

CREW filed a lawsuit in April on behalf of the nonprofit advocacy group Common Cause that argues it’s illegal for the administration to use the law enforcement exception to justify mass sharing of voter information.

Balliet, the former HSI agent, expressed similar concerns, saying that handing over voter rolls to run through DHS’ systems amounted to “a mass data-collection effort by the government against its own citizens in a non-criminal setting.” On a practical level, he added, the data sharing increased the risk of breaches that can open law-abiding citizens up to identity theft.

“As a citizen, I want the government to take seriously the protection of my private data,” he said. “If it falls into the wrong hands, it’s not the government that suffers. It’s me.”

Collapsing Claims

By January 2026, scores of HSI agents were fanning out across the country to investigate thousands of leads about illegal voting.

About 25,000 of them involved people SAVE had identified as potential noncitizens on state voter rolls. Another 15,000 were given to HSI’s cross-border financial crimes unit, which was told to prioritize them over money laundering and fraud cases, a former high-level HSI official said. Quiñones’ unit led a separate effort to find additional cases by reviewing whether people who’d recently become citizens had voted before they were naturalized, then lied about it in naturalization interviews.

Still more leads came from running public voter rolls through the HSI lab’s databases, though it’s not clear how many. Agency sources told ProPublica that the rolls of New Jersey and Pennsylvania were searched using the Athena Toolbox. When DHS announced it had found more than 250,000 noncitizens on the registered voter lists of four Democrat-led states, it said that included “as many as” 35,152 in New Jersey and 14,576 in Pennsylvania. Both states have asked DHS to provide the source of the numbers.

Once federal investigators started digging into these cases, however, they often fell apart.

Through May, prosecutors had charged fewer than four dozen people with crimes related to noncitizen voting, ProPublica’s analysis of DOJ data and federal court filings shows, getting convictions or guilty pleas in 14 cases.

The largest cluster of cases was brought in the Southern District of Florida, headed by Jason Reding Quiñones (no relation to the HSI agent), a staunch Trump ally who has led investigations of the president’s political opponents. Voters have been sentenced in eight of the office’s cases; seven others are pending.

Prosecutors have initiated a total of seven noncitizen voting cases as of May in the four states where DHS claimed to have found more than a quarter million noncitizens on the rolls. Collectively, these states have more than 40 million registered voters.

Overall, the paltry numbers reflect the realities HSI investigators confronted on the ground as they tried to convert leads into cases, a ProPublica review of records obtained by voting-advocacy groups Campaign Legal Center and Democracy Forward shows.

Emails between agents and local election officials in Texas and Ohio indicate much of the federal information on purported noncitizens was inaccurate, the consequence of flawed data matching. When agents demanded voting histories and registration forms, they often discovered people weren’t registered in the counties where HSI thought they were. When voters register, they must attest that they are U.S. citizens; agents found some, however, who’d been put on voter rolls in error after disclosing they weren’t citizens. Many had never voted.

Most HSI agents, steeped in pursuing complex international crimes, had no experience in pursuing voting fraud. In his email to Nick Davis at the Justice Department, Teirab, the top deputy in Minnesota’s U.S. attorney’s office, described the chaos that ensued when the state and at least six counties got subpoenas for voters’ records. The demands “presented a host of issues,” Teirab wrote to Davis. (Davis did not respond to a request for comment.)

“An unknown number of agents are constantly arriving in Minnesota without any knowledge of the investigation, the issues already discussed and decided, and the processes they need to follow,” Teirab complained. “Instead of getting up to speed and learning, they have demanded many calls and subpoenas, most of which demonstrate a complete lack of understanding of the investigation.”

In Stearns County in central Minnesota, HSI agents subpoenaed voting histories on 13 people, county officials told ProPublica. Only six turned out to live there.

Minnesota Secretary of State Steve Simon, a Democrat, said the effort revealed federal investigators’ ignorance about “the nuance of elections administration.” The rate of purposeful election crime is “microscopic,” he said. “The very human errors that can happen are not some sort of plot or scheme to dirty up the voting rolls, but are just everyday human beings making mistakes, not intending at all to violate any law.”

As of May, only one illegal voting case has been referred for prosecution in Minnesota. The state has more than 3.8 million registered voters.

Even Republican-led states like Ohio, which has shared its unredacted voter rolls with the DOJ and run them through the SAVE system, have struggled to meet Trump administration demands to deliver cases.

In October, the Ohio secretary of state referred more than 1,000 voters identified as possible noncitizens to the federal government, claiming 167 had voted at least once since 2018. At least nine HSI agents in Cincinnati and Cleveland began to investigate, emails obtained by Campaign Legal Center and shared with ProPublica show.

The agents bombarded local election officials with requests for voting histories and other records, some dating back decades. “Sorry again for piecemealing these to you,” one agent wrote to an official in Butler County, outside Cincinnati, after making five separate requests over two weeks. Mohamed Al-Hamdani, a Democratic member of Montgomery County’s Board of Elections, which received similar inquiries, said they amounted to “witch hunts” that ate up staff time.

In February, Davis sent an email pressing Ohio’s two U.S. attorneys’ offices for an “election integrity” update, asking: “How close are we to complaints/indictments, how many subjects, what issues you’ve run into, how many referrals have been closed and why, how helpful HSI has been.”

As of May, just two voting cases had been referred for prosecution in Ohio and no one had been charged, federal data shows. The state has nearly 8 million voters.

In the past, it was uncommon for federal prosecutors to pursue charges against noncitizen voters who didn’t understand that it was against the law for them to vote. Without evidence of a coordinated effort or plot, it didn’t make sense to put resources into such prosecutions, a former DOJ official who oversaw election cases said.

Now, however, U.S. attorneys’ offices are taking a different approach, pursuing prosecutions that could result in prison terms or deportation.

In May 2025, federal prosecutors in Florida filed illegal voting charges against a mother and daughter, both Ukrainian citizens, who’d registered after becoming permanent U.S. residents, then voted in the 2024 presidential election. They’ve pleaded not guilty, with the mother saying in an interview with investigators that she thought having a green card meant she could vote. They and their attorneys didn’t respond to requests for comment from ProPublica. The prosecutor handling the case for the Southern District of Florida also didn’t respond to questions. The mother and daughter are scheduled to go to trial in September.

“Far-Reaching Consequences”

Experts on both elections and national security warn there may be profound longer-term costs to unleashing the federal government’s investigative and prosecutorial might to try to prove the president’s claims about noncitizen voting.

Current and former HSI agents say critical investigations — including task forces aimed at drug rings, human trafficking and money laundering — have languished as the agency has pivoted to take on noncitizen voting and immigration enforcement.

In February 2026, according to court files and emails reviewed by ProPublica, an HSI agent in Ohio who’d been leading a multistate child sex abuse investigation was abruptly assigned to pursue dozens of leads on suspected noncitizen voters, work that took months. It wasn’t until May that he made an arrest in the other case. Prosecutors have filed child exploitation and pornography charges against the man, 38, in connection with acts involving at least five 14-year-old girls.

Cases like this “don’t just stop,” said Balliet, the 23-year HSI veteran. “When you pull people off them for an extended period of time, those criminal networks will adapt, and people get killed and kidnapped.”

Federal data hints at a broader slowdown in what had been HSI’s most urgent work. According to an annual government report, the number of wiretaps obtained by DHS — often to investigate drug trafficking — plummeted to 23 in 2025, from 133 the previous year. In the report, DHS attributed the decline to several factors, including “changes in administration enforcement and prosecutorial priorities.”

“It’s never been a better time to be involved in transnational organized crime,” said John Tobon, a high-ranking HSI official who retired in early 2025.

In its statement, DHS denied HSI has neglected its core mission, saying the agency has increased its efforts to combat criminal cartels, gangs and drug traffickers in response to multiple Trump executive orders.

Though HSI’s voting-related investigations have yielded only a small number of prosecutions, voter advocacy groups worry the Trump administration will use them to justify more extreme interventions.

Its latest tactics include threatening to withhold funds from states it says are refusing to check their voter rolls for noncitizens and saying it will prosecute state election officials who “knowingly” fail to remove noncitizens. Trump has also continued to press Congress to enact the SAVE America Act, which would require people to provide proof of citizenship when registering to vote, a measure advocates have criticized as a barrier to voting. Democrats are preparing for the prospect of federal troops being sent to the polls to intimidate voters.

“Those concerns are playing out in real time, with far-reaching consequences,” said Dax Goldstein, a director at the States United Democracy Center, a nonprofit group that works to build confidence in elections. “When federal agencies are misused and weaponized, people lose trust in government itself.”

The post Inside Trump’s Failed Hunt for Noncitizen Voters appeared first on ProPublica.

President Trump has signed a national security presidential memorandum allowing federal law enforcement agencies to partner with private technology companies to execute offensive cyber operations against foreign criminal groups and international adversaries. Under the directive, vetted private sector tech firms will be permitted to work under direct federal supervision to propose, coordinate, and execute targeted cyber actions.

The move marks a significant shift in US cyber policy, formalising a role for private industry in offensive operations that have traditionally been the preserve of government agencies.

“A coalition of the willing”

Commenting on the announcement, Kyle Hanslovan, CEO and co-founder of Huntress, said, “Considering the rapidly accelerated sophistication of organised cybercrime and nation-state actors, close public and private collaboration is no longer an option. When you add the reality of AI-powered autonomous threats, the only viable solution is a stronger coalition of the willing, which we are eager to support.

One key pillar to the success of this programme will be the appropriate use of hyperscalers for their breadth of intelligence data and die-hard security research labs like Huntress for their agility and operational depth to truly disrupt adversaries. Another key pillar will be the deconfliction process to ensure private industry doesn’t interfere with the value of long term persistent access operations which often lead to public arrests and geo-political negotiations.

All-in-all, I’m proud to see the US Government push the boundaries when it comes to denying, degrading, and disrupting these measurable threats to democracy. If done correctly, I believe it will ultimately slow the illegal transfer of wealth and knowledge from Western civilization.”

Concerns over collateral damage and delay

Not all reaction has been unreserved. Ben Bernstein, cybersecurity advisor at Huntress, added, “I’m all for expanding public-private cooperation because the government clearly can’t fight transnational cybercrime on its own, but I have concerns about how this actually plays out in the wild. When you look at the operational reality of green-lighting private offensive ops, you hit two massive roadblocks: collateral damage and bureaucratic lag.

Threat actors don’t launch attacks from labeled servers in Moscow; they route traffic through compromised, innocent infrastructure, like a vulnerable router at an Ohio dental office or a hospital network. That makes it practically impossible to “strike back” without taking out innocent bystanders. Plus, adversary infrastructure is incredibly ephemeral, often burning down in a matter of hours. By the time a vetted firm submits a target, sits through the DOJ and DHS deconfliction reviews, and finally gets a green light, they’ll be shooting at ghosts. Expecting government bureaucracy to move at the speed of modern ransomware operators is wildly optimistic.”

A signal to adversaries

Tim Mackey, head of software supply chain risk strategy at Black Duck, struck a more cautionary tone, concluding, “Ignoring the reality that it’s difficult to identify the source of cybercriminal activity, endorsing private companies to conduct offensive cyberactivity is far more likely to increase criminal, and potentially nation-state, activity than deter it. Without careful governance and control, individuals with access to sophisticated surveillance technologies could easily abuse that access and engage in surveillance efforts for personal gain. Unfortunately, one message this memo does send to adversaries is – the US government needs private companies and their capabilities to defend against cyberattacks.”

The memorandum is likely to prompt further debate within the security community over how offensive cyber operations conducted by private firms should be governed, vetted, and deconflicted from ongoing law enforcement and intelligence operations.

The post Trump Signs Memorandum Allowing Private Firms to Launch Offensive Cyber Operations Against Foreign Threat Actors appeared first on IT Security Guru.

The root cause of the incident is believed to be a compromised AWS access key that was exposed in publicly available JavaScript build artifacts.

The post Over 1,000 Charities Hit by Beacon CRM Data Breach appeared first on SecurityWeek.

When the Justice Department indicted the Southern Poverty Law Center in April on controversial fraud charges, the storied civil rights organization faced a major threat to its lifeblood — the flow of donor dollars.

Not because it was convicted or because the Internal Revenue Service revoked its tax-exempt status. Not even because individual donors stopped writing checks.

Instead, three Wall-Street-affiliated grantmaking giants each made a decision, one they refused to fully explain, to prevent donors from using their platforms to give to the embattled nonprofit.

Vanguard Charitable, Fidelity Charitable and Charles Schwab’s DAFgiving360 sponsor donor-advised funds, offering account holders immediate tax deductions on contributions they can later recommend be granted to charities.

Once niche, donor-advised fund sponsors controlled more than $327 billion in assets as of 2024, over 10 times their footprint two decades ago. They are the conduit for about a quarter of all individual giving in the U.S.

After the three sponsors cut off the SPLC, ProPublica investigated how the new gatekeepers of American philanthropy make these opaque, high-stakes decisions.

In examining the treatment of dozens of nonprofits, we uncovered troubling inconsistencies in how some DAF sponsors applied their policies and found that donors and affected charities are routinely left in the dark about how decisions are made.

The three sponsors are nonprofits spun off from major brokerages. Their accounts, used largely by high-income earners, charge administrative fees while sponsors retain legal control over the charitable assets. (ProPublica has received donations through each of the groups.) Donors “advise” the sponsors on where to send grants, but sponsors can deny requests for any reason.

They say decisions stem from policy triggers. Vanguard Charitable pauses payments when an organization faces formal charges, while Fidelity Charitable and DAFgiving360 say they “may” or “might” stop donations if organizations come under investigation by government or law enforcement agencies.

Deone Powell, a former general counsel for Vanguard Charitable who now advises nonprofits, said that DAF sponsors don’t view these moves as moral policing, but instead as ways of protecting their own brands. “All of these really speak to reputational risks for the sponsoring organizations,” he said.

They weigh these choices carefully, given the possible ripple effects, he said. “A single decision often establishes a precedent that’s going to affect thousands of other future recommendations.”

But ProPublica found that Fidelity and DAFgiving360 appeared to apply their policies unevenly. Even though they froze donations to the SPLC, they allowed numerous other groups to keep receiving money amid government investigations. The cases included hospitals, universities, charter schools and even a white nationalist organization.

The sponsors say their decisions are viewpoint neutral, and ProPublica found no evidence to the contrary. Removed groups spanned the political spectrum. But most of the ones that spoke to ProPublica shared one common experience: silence from the sponsors.

Months after being deemed ineligible for donations, the SPLC still doesn’t know why the action was taken or whether there is a path to reinstatement, according to a source familiar with the matter. The legal pressure, however, continues: A former employee was indicted this week on charges related to the case.

Experts say this is particularly problematic under the Trump administration, which has a track record of making politically charged accusations that don’t hold up in court.

“I don’t think Fidelity, Vanguard and Schwab are acting in bad faith,” said Joe Goldman, the president of Democracy Fund, a foundation supporting democratic principles. “They’re applying old rules to new circumstances without recognizing that the circumstances have changed.”

President Donald Trump has put nonprofits under an intense spotlight, alleging that many of them “undermine the security, prosperity, and safety of the American people” and directing federal agencies to align funding decisions with administration priorities.

Members of Congress, mainly Republicans, have initiated over 135 investigations into nonprofits since 2025, often claiming that charities were operating with foreign influence, engaging in supporting terrorism, or promoting diversity, equity and inclusion.

In letters sent to the IRS, Republican lawmakers accused several organizations that support pro-Palestine efforts of funding terrorism and asked for them to be investigated.

One of the charities has not been charged in court, and another was the subject of a state investigation. Neither has had its IRS status revoked, but they no longer appear on a Fidelity Charitable donation portal that allows users to select charities to donate to, ProPublica found. Fidelity wouldn’t say whether the letters played a role.

“This is potentially a way that a hostile legislator could harm tax-exempt organizations without having to prove anything,” said Samuel Brunson, a Loyola University Chicago School of Law professor who researches nonprofits. “Even if these letters are completely legitimate, you can take that same set of tools and use them illegitimately.”

The consequences can be significant. The SPLC, for instance, has received $20 million through Fidelity Charitable, Vanguard Charitable and DAFgiving360 in the past three years, with roughly 7% of its 2025 contributions coming from the three sponsors that cut it off.

“When investment firms block donor-advised funds to nonprofits based on allegations and speculation, it not only impedes critical charitable work; it also sets a dangerous precedent that stifles the rights of donors and chills the rights of the organizations they seek to support,” said an SPLC spokesperson in a statement to ProPublica.

The fund sponsors have not responded to similar concerns voiced by 16 state attorneys general, who wrote that their actions could enable weak or politically motivated investigations to “suppress, chill, or dismantle organizations” that are doing vital work.

Their own donors are also reaching out.

Dawn Piccolo, a retired Fidelity Investments senior vice president who has kept a DAF account since the 1990s, is a fervent supporter of donor-advised funds. She wrote to Fidelity Charitable reminding the sponsor that it had allowed another charity under similar fire to keep receiving gifts. “The SPLC has not been found guilty of anything,” she wrote. “Preemptively restricting donations under these circumstances sets a troubling precedent.”

All three fund sponsors declined to be interviewed for this story or answer detailed questions, including on their process for identifying nonprofits facing allegations and deciding which ones to ban. Fidelity Charitable said it does not comment on decisions involving individual charities and declined to give a statement.

DAFgiving360 said in a statement that it “communicates directly with donors when a grant recommendation is impacted by an eligibility determination” and will provide information on other alternatives when appropriate. The sponsor said that it does “not take charity eligibility decisions lightly.”

In a separate statement, Vanguard Charitable noted its “procedural pause” is “not a value judgment; it is the application of objective criteria and reflects Vanguard Charitable’s responsibility, as the legal owner and steward of the charitable assets, to review and approve the grants made in its name.” A spokesperson said it denies fewer than half a percent of donors’ donation recommendations annually and that “independent oversight is central to the value of donor-advised fund structure.”

Unexplained Inconsistencies

ProPublica reviewed donor-advised fund sponsors’ policies and giving records alongside government actions taken against charities to understand when and how sponsors intervene.

The review identified cases in which Fidelity Charitable and DAFgiving360 diverged from their treatment of the SPLC and kept giving to charities facing the kinds of government investigations their guidelines identify as grounds for halting donations.

Then-Washington Attorney General Bob Ferguson sued Providence Health and Services in February 2022, alleging that the nonprofit Catholic healthcare system illegally billed and aggressively collected payments from low-income patients without determining if they were qualified for charity care.

The case was extensively covered in the regional media, and Ferguson’s own news release emphasized that Providence’s conduct continued despite an investigation by his office.

Even so, Fidelity Charitable and DAFgiving360 allowed Providence to keep getting donations, ProPublica found.

Providence ultimately agreed to pay $150 million in refunds and debt relief for unlawful charges, the largest resolution of its kind in the country, according to Ferguson’s office. Providence did not admit to any wrongdoing.

Fidelity Charitable and DAFgiving360 also kept sending donations to Grand Canyon University as it faced a lawsuit and a $38 million fine following federal investigations that found it deceptively advertised the cost and course requirements of its doctoral programs and made illegal calls to consumers. The university denied the allegations, calling them “unsubstantiated.”

The Department of Education rescinded the fine in May 2025, and the Federal Trade Commission dismissed its remaining case months later after losing multiple court motions. But records show the Christian university drew donations from both fund sponsors throughout the two-year dispute.

Idea Public Schools, Texas’ largest charter school network, was investigated from 2021 to 2024 by the state’s chief charter school regulator amid allegations of lavish spending on private jets and parachute payments to leaders.

Fidelity Charitable kept the dollars flowing throughout.

The charter network was ultimately placed in a conservatorship by the state and forced to pay back $28.7 million to the U.S. Department of Education. The network acknowledged that it did not properly ensure that funds were administered lawfully in a statement released at the time.

Then there’s VDARE Foundation, which ran an influential far-right, white nationalist website. In 2022, New York Attorney General Letitia James began investigating the organization for misuse of millions in charitable assets. As VDARE faced subpoenas, it solicited donations asking supporters to “help us fight back.” Clear evidence on its homepage that it was under investigation didn’t stop DAFgiving360 (formerly Schwab Charitable) from continuing to give.

James sued the organization in 2025. Its leaders are fighting the charges, and the case remains open. VDARE, whose website is now inactive, is no longer listed as an option for current DAFgiving360 customers. The sponsor would not say when the charity was removed, but said in a statement that it conducts a “thorough assessment” to determine eligibility and that it “applies its policies consistently across all charitable organizations, regardless of their political viewpoint or orientation.”

The fund sponsors’ discretion to keep money moving to embattled groups becomes evident when considering the Trump administration’s actions against major universities.

Dozens of colleges became the subjects of formal government investigations involving their handling of campus protests and alleged antisemitism tied to the crisis in Palestine and Israel and over allegations of diversity, equity and inclusion. At least 20 of the universities are still listed as options for donation recommendations on Fidelity Charitable’s and DAFgiving360’s websites. ProPublica asked each school if it was still receiving funds from the DAFs. Most did not respond. One said that it has not seen a decline in donations from the sponsors.

Rather than making ad-hoc decisions about which organizations to keep giving to, some legal experts told ProPublica that fund sponsors should follow the direction of the IRS, which has the authority to investigate and rescind tax-exempt status through an audit, while also providing avenues for organizations that come under scrutiny to appeal decisions they don’t agree with.

“The wisest choice is probably to rely on the IRS list,” said Lloyd Mayer, a professor at the University of Notre Dame Law School who researches nonprofits. Cutting off organizations deemed eligible by the IRS, Mayer said, runs the risk of looking inconsistent or partisan.

“An investigation by who? An indictment at what level? Is it only federal government indictments? Is it also state indictments? What about the local county prosecutor? Of the thousands of counties in the United States, if any one of them brings an indictment, you’re gonna stop? Where do you start drawing the lines?”

Answerable to Few

ProPublica used an internal Fidelity Charitable tool to identify 22 nonprofit organizations that Fidelity had given to in the past but no longer lists as options to donors. ProPublica limited its analysis to nonprofits that have raised $1 million or more annually.

The charities represent a cross section of ideologies and missions — left- and right-leaning, foreign and domestic, media, religious, humanitarian.

The list includes The Epoch Times, the conservative media outlet whose chief financial officer pleaded guilty in July to federal money-laundering charges, as well as pro-Israel nonprofits that support the country’s defense forces. It also includes the Alliance for Global Justice, a progressive, Arizona-based organization scrutinized for its financial ties to a Palestinian group that the American and Canadian governments designated a terrorist organization in 2024.

The Epoch Times released a short statement following the plea agreement, noting that it was not named in the lawsuit. The Alliance for Global Justice has called the allegations against it “false and unsubstantiated.” Both groups are currently eligible to receive tax-deductible donations, according to the IRS.

Fidelity refused to confirm it had deemed these charities ineligible. A source familiar with the sponsor said donors can manually enter a charity’s tax information to ask the fund to make a contribution to an unlisted charity. But ProPublica reviewed requests from two donors who tried the manual workaround. Both were turned down.

ProPublica attempted to ask representatives of all 22 charities if they understood why they did not appear on Fidelity’s rolls of more than 1 million potential grant recipients. Seven responded.

One of the only groups that said it had gotten a clear answer about its removal was the United Aid and Logistics Foundation.

“Our activities include providing aid to those defending the safety and human rights of Ukraine’s men, women and children, which Fidelity does not consider to be humanitarian,” said Sytske de Boer, a director of the volunteer group. “We understand it is their prerogative, however we disagree with their interpretation and hope they reconsider.”

Four organizations told ProPublica they’d been left with no or unclear answers from Fidelity Charitable. Among them is Nonviolence International, a group founded by a Palestinian activist that supports nonviolent campaigns worldwide.

“Substantial funds have been paused by Fidelity DAF that were earmarked for our projects,” co-director Michael Beer said in a statement. “If funding is not resumed, nonviolence training, education, and intervention programs for marginalized communities will be slashed.”

Donors have also been met with silence.

Piccolo, the retired Fidelity senior vice president, said that the decision to cut off the SPLC seemed at odds with the careful decision-making she’d come to expect from the fund sponsor. “This action feels out of band for me,” she said in an interview. “The case appears weak and politically motivated.”

For over 25 years, the SPLC has tracked the activity and influence of extremist groups across the country. Its “Hate Map” lists over 1,200 groups with connections to white nationalism, the neo-Nazi movement, antigovernmentalism and a plethora of other ideologies that it says are rooted in hate.

The tool has been widely cited by journalists and academics for years, and, up until last year, the FBI utilized SPLC research to assist in law enforcement efforts. The map has drawn scrutiny under the Trump administration, whose supporters are among some of the right-leaning groups the organization has labeled extremists.

In a letter addressed to top White House aide Stephen Miller last year, several of those groups called the map a “smear tactic” and called upon the Trump administration to remove references to the SPLC’s work from the federal government.

Attorneys for the SPLC, in court papers, pointed out how language from the letter wound up in an incident report opened by the FBI one month later justifying an investigation.

The Justice Department’s ultimate accusation was unorthodox. Prosecutors alleged that the SPLC’s longtime practice of paying confidential “field sources” to monitor extremist groups like the Ku Klux Klan constituted a fraudulent diversion of donor funds.

The SPLC pleaded not guilty to 11 counts of wire fraud, giving false statements to a federally insured bank and conspiracy to commit money laundering. Former federal prosecutors called the indictment “stretched” and “not valid,” and whistleblower reports to Democratic lawmakers said that the prosecution was rushed despite weak evidence.

The Justice Department did not respond to a request for comment. Earlier this week, it arrested Heidi Beirich, a former SPLC employee, on charges connected to the case. Prosecutors allege that she facilitated secret payments to informants inside extremist groups. Beirich’s attorney said that she is innocent and the case is “without merit.”

“I can understand that if overwhelming evidence were to emerge publicly in the course of proceedings, a temporary pause might be warranted,” Piccolo wrote to Fidelity Charitable. “But that is not where things stand.”

While company representatives sent rote responses and promised to pass along her inquiries, Piccolo told ProPublica that she has yet to receive a thorough explanation of their actions. She has stopped funding her Fidelity Charitable account and plans to move her existing balance to a different sponsor.

After the fund sponsors moved to cut off the SPLC, 16 state attorneys general, all Democrats, registered their objections in a letter.

“As attorneys general, many of us are the chief regulators of nonprofits, charities, and charitable trusts in our states, and serve as representatives of the public and donor intent,” they wrote. “This decision raises serious concerns that you are allowing the DOJ’s selective political targeting of a charity to impact your donor-advised giving decisions.”

They said their concerns were amplified by the sponsors’ refusal to disclose other charities whose donations they’d paused.

They have not received a response.

Powell, the former Vanguard Charitable attorney, said the sponsors are unlikely to be moved by public blowback.

“I don’t see this as being earth-shattering enough where it’s going to drive any immediate change,” he said. “These are sponsoring organizations that are aligned with financial institutions, which are traditionally adverse to risk. Once policies are in place, it takes a lot to change something.”

But in the future, he expects large account holders will want more from the fund sponsors than just moving their money between organizations.

“I think that any change is going to be driven by donors who are asking questions about how their philanthropy is defending democracy.”

The post Wall Street’s Nonprofits Use Selective, Opaque Logic to Defund Charities appeared first on ProPublica.

Huntress will be heading to International Cyber Expo 2026, where visitors can meet the team on Stand K94 and discover how the company is helping organisations tackle increasingly complex cyber threats with fewer resources.

One of the biggest challenges Huntress is seeing is the growing attack surface. Security teams are expected to protect endpoints, identities, cloud environments and other systems, often while dealing with limited time, resources and expertise.

At the same time, attackers are no longer operating in silos. Attacks increasingly move across different parts of an organisation’s environment, leaving security teams managing multiple tools and an overwhelming number of alerts.

At International Cyber Expo, Huntress will showcase its more unified, managed approach to security. The Huntress platform combines greater visibility across the attack surface with AI technologies and human security analysts to help partners and customers detect and respond to threats.

Tackling the rise of AI-powered attacks

AI-powered cybercrime will also be a major focus for Huntress at the show.

Generative AI is making it easier for attackers to create convincing phishing emails, develop malicious code and scale their operations. Tasks that previously required significant cybersecurity expertise can now be carried out with the help of readily available AI tools.

Huntress believes AI will also play an important role in helping defenders respond. Its approach uses AI to help analysts correlate security signals, summarise investigations and work faster, while retaining human judgement and context when making critical security decisions.

Visitors can also speak with Huntress about practical ways to strengthen their security posture. These include implementing multi-factor authentication, improving security awareness training and reducing vulnerabilities across the external network perimeter.

And when preventive controls fail, Huntress stresses the importance of having a mechanism to detect and respond to attacks quickly, including access to a 24/7 SOC that can support containment and remediation.

Listen to Huntress Senior Sales Engineer Alex Hitchen discuss the biggest cybersecurity challenges facing organisations today and what Huntress will be showcasing at International Cyber Expo 2026:

You can still register for FREE to attend International Cyber Expo HERE.

The post Meet Huntress at International Cyber Expo 2026 appeared first on IT Security Guru.

La gestione della sicurezza dei privilegi tra endpoint e cloud è cambiata radicalmente. Capire questa evoluzione è fondamentale per proteggere la propria azienda.

Per vent'anni ci siamo concentrati sulla gestione degli accessi privilegiati (PAM) a livello di endpoint, ma oggi lo scenario è del tutto diverso. Infatti le infrastrutture si sono spostate su AWS, Azure e Google Cloud. I dati più preziosi risiedono in applicazioni SaaS e un numero crescente di account di servizio e agenti AI detiene permessi costanti. Nessun vault tradizionale può controllare questa nuova realtà.

I cybercriminali lo sanno bene: non cercano più di "entrare con la forza", ma semplicemente si "autenticano" usando credenziali valide. In questo modo, ereditano ogni singolo privilegio che quell'identità ha accumulato nel tempo.

Questa checklist in cinque fasi ti aiuterà a scoprire dove si nascondono i privilegi inutilizzati nella tua infrastruttura e a eliminarli una volta per tutte, così da proteggere la tua azienda al meglio.

L'evoluzione della minaccia per la sicurezza dei privilegi da endpoint a cloud

Il modello di minaccia legato alla sicurezza dei privilegi tra endpoint e cloud non è scomparso, ma è stato affiancato da un rischio molto più vasto e insidioso. I privilegi si sono spostati e non risiedono più solo all'interno del perimetro aziendale. Infatti oggi sono sparsi ovunque.

Pensa alle autorizzazioni IaaS, ai ruoli di amministratore SaaS, agli account non umani e alle identità AI. Tutti questi elementi possiedono spesso un accesso permanente e non gestito. Non si tratta di un rischio astratto. Report di settore, come quello di IBM sul costo delle violazioni dei dati, mostrano che il costo medio di un data breach ha raggiunto cifre record.

Le aziende con più privilegi permanenti sono quelle che pagano il prezzo più alto.

La soluzione in 5 fasi: una nostra checklist pratica

Il problema di fondo è quasi sempre lo stesso: un'autorizzazione concessa per una necessità specifica che non viene più rivista, revocata o limitata nel tempo. L'accesso permanente non fallisce in modo evidente; semplicemente attende che un malintenzionato lo scopra.

Per colmare questa lacuna, è necessario un approccio strutturato. Le cinque fasi seguenti funzionano in sequenza per costruire una difesa solida e moderna.

Fase 1: consolidare la sicurezza dei privilegi da endpoint a cloud

Prima di guardare al cloud, è essenziale assicurarsi che le fondamenta siano solide. Le nuove sfide non rendono obsolete le vecchie. È quindi cruciale confermare che i controlli di base siano attivi e funzionanti. Questo significa aver implementato il vaulting delle credenziali, rimosso i diritti di amministratore locale e attivato la registrazione delle sessioni.

Se il punto di partenza è vulnerabile, qualsiasi strategia cloud sarà inefficace.

Fase 2: mappare la reale posizione dei privilegi

Non puoi proteggere ciò che non vedi. Questa fase si concentra sulla scoperta ed è qui che la maggior parte delle aziende individua le proprie lacune. Devi ottenere una visibilità completa su dove risiedono realmente i privilegi:

• Autorizzazioni nelle piattaforme IaaS (AWS, Azure, GCP)
• Ruoli di amministratore e permessi critici nelle applicazioni SaaS
• Account di servizio, pipeline CI/CD e altre identità non umane
• Agenti AI con accesso a dati e sistemi

Solo una mappatura completa ti darà la consapevolezza necessaria per agire in modo mirato.

Fase 3: eliminare l'accesso permanente (standing access)

La scoperta si trasforma in riduzione del rischio solo quando i privilegi inutilizzati iniziano a scomparire. Questo è il cuore della moderna sicurezza dei privilegi.

L'obiettivo è semplice: rimuovere ogni accesso che non sia strettamente necessario in un preciso momento. Si tratta di "dimensionare correttamente" i permessi (right-sizing), revocando le autorizzazioni dormienti che rappresentano una superficie di attacco.

Fase 4: rendere operativo l'accesso just-in-time (JIT)

Una volta eliminato il superfluo, è il momento di applicare al cloud la lezione imparata dagli endpoint. Invece di gestire meglio i privilegi permanenti, perché non eliminarli del tutto?

Il modello Just-in-Time (JIT) si basa proprio su questo: concedere l'accesso solo quando è necessario e per il tempo indispensabile. Questo approccio, noto come Zero Standing Privileges (ZSP), dipende da un workflow efficiente per non rallentare le operazioni.

Fase 5: dimostrare i risultati

Un programma di sicurezza è efficace solo se puoi misurarlo. Al termine del percorso, devi essere in grado di rispondere a tre semplici domande:

1. Puoi vedere ogni richiesta di accesso privilegiato?
2. Puoi dimostrare che ogni concessione è stata limitata nel tempo?
3. Hai una traccia di audit completa e immutabile per ogni sessione?

Una risposta onesta a queste domande ti dirà a che punto sei veramente nel tuo percorso di messa in sicurezza.

Perché la tua azienda dovrebbe mettere in sicurezza i privilegi tra endpoint e cloud?

La maggior parte delle organizzazioni supera bene la Fase 1, ma si blocca nella Fase 2. La buona notizia è che, una volta ottenuta la visibilità, convertire gli accessi permanenti in un modello JIT è in gran parte un esercizio di automazione. I privilegi hanno lasciato l'endpoint per sempre; è ora che anche le discipline di sicurezza facciano lo stesso.

Che tu operi nel settore finanziario, sanitario o tecnologico, il principio non cambia. Garantire l'accesso temporaneo ai sistemi critici, revocandolo automaticamente, non è più un'opzione, ma una necessità strategica per proteggere il tuo business nell'era del cloud.

L'articolo La checklist per la sicurezza dei privilegi da endpoint a cloud proviene da sicurezza.net.

Hackers stole the customers’ shipping information, including names, addresses, email addresses, and phone numbers.

The post 14,000 Trezor Customers Impacted by Data Breach at ShipMonk appeared first on SecurityWeek.

The security defect is described as an SQL injection that could allow attackers to achieve remote code execution.

The post Hackers Exploiting Unpatched GeoServer Zero-Day appeared first on SecurityWeek.

The Rust-based macOS infostealer harvests users’ passwords, keychain information, Chromium-based browser data, and Safari cookies.

The post AmnesiaStealer macOS Malware Steals Data, Controls Browser Sessions appeared first on SecurityWeek.