CyberHappenings logo
☰
🏠 Home 📂 Browse ℹ️ About

Track cybersecurity events as they unfold. Sourced timelines, daily updates. Fast, privacy‑respecting. No ads, no tracking.

Security-by-default strategies for attack surface reduction

First reported
Last updated
📰 1 unique sources, 1 articles

Summary

Hide ▲

Security experts emphasize implementing security-by-default strategies to reduce attack surfaces. These strategies involve configuring systems to block risks from the outset, including enforcing multi-factor authentication (MFA), application whitelisting, and controlling network and application behaviors. The goal is to prevent attacks before they occur, rather than detecting and responding to them after the fact. These measures help mitigate risks associated with outdated protocols, unauthorized software, and unsecured remote access. The approach is particularly relevant in the current threat landscape, where cyberattacks are increasingly profit-driven and sophisticated. By adopting a security-by-default mindset, organizations can significantly reduce their vulnerability to attacks and enhance their overall security posture.

Timeline

  1. 14.08.2025 12:30 📰 1 articles · ⏱ 1mo ago

    Security-by-default strategies emphasized for attack surface reduction

    Security experts highlight the importance of implementing security-by-default strategies to reduce attack surfaces. These strategies involve configuring systems to block risks from the outset, including enforcing multi-factor authentication (MFA), application whitelisting, and controlling network and application behaviors. The goal is to prevent attacks before they occur, rather than detecting and responding to them after the fact. These measures help mitigate risks associated with outdated protocols, unauthorized software, and unsecured remote access.

    Show sources
    Open in new tab

Information Snippets

  • Multi-factor authentication (MFA) should be required on all remote accounts to prevent unauthorized access, even if passwords are compromised.

    First reported: 14.08.2025 12:30
    📰 1 source, 1 article
    Show sources

  • Application whitelisting or allowlisting blocks everything by default, only allowing known, approved software to run, effectively stopping ransomware and other malicious applications.

    First reported: 14.08.2025 12:30
    📰 1 source, 1 article
    Show sources

  • Disabling Office macros, using password-protected screensavers, and turning off outdated protocols like SMBv1 can close major security gaps on Windows and other platforms.

    First reported: 14.08.2025 12:30
    📰 1 source, 1 article
    Show sources

  • Removing local admin rights and controlling application behaviors can prevent users from installing malicious software or altering security settings.

    First reported: 14.08.2025 12:30
    📰 1 source, 1 article
    Show sources

  • Blocking unused ports, limiting outbound traffic, and securing VPNs can help prevent attacks like SolarWinds and other unauthorized access.

    First reported: 14.08.2025 12:30
    📰 1 source, 1 article
    Show sources

  • Blocking USB drives by default and limiting file access can prevent the spread of malware and unauthorized file activities.

    First reported: 14.08.2025 12:30
    📰 1 source, 1 article
    Show sources

  • Regular patching and automated threat detection are essential for ongoing vigilance and preventing attacks that exploit known vulnerabilities.

    First reported: 14.08.2025 12:30
    📰 1 source, 1 article
    Show sources

Similar Happenings

UNC6040 and UNC6395 Target Salesforce Platforms in Data Theft Campaigns

The FBI has issued an alert about two cybercriminal groups, UNC6040 and UNC6395, targeting Salesforce platforms for data theft and extortion. UNC6395 exploited compromised OAuth tokens for the Salesloft Drift application, while UNC6040 used vishing campaigns and modified Salesforce tools to breach Salesforce instances. Both groups have been active since at least October 2024, impacting multiple organizations. UNC6040 has been linked to extortion activities, with Google attributing these to a separate cluster, UNC6240, which has claimed to be the ShinyHunters group. The ShinyHunters group, along with Scattered Spider and LAPSUS$, recently announced they are going dark, but experts warn that the threat persists. UNC6040 impersonated corporate IT support personnel to gain access to Salesforce environments and used modified versions of Salesforce's Data Loader to exfiltrate data. Salesforce re-enabled integrations with Salesloft technologies, except for the Drift app, which remains disabled.

Open in new tab

Fourth Spyware Campaign Targeting French Apple Users in 2025

Apple has notified French users of a fourth spyware campaign in 2025. The Computer Emergency Response Team of France (CERT-FR) confirmed the alerts on September 3, 2025. The campaign targets individuals based on their status or function, including journalists, lawyers, activists, politicians, and senior officials. The alerts are part of a series of notifications sent throughout the year, with previous alerts on March 5, April 29, and June 25. These alerts indicate that at least one device linked to the users' iCloud accounts may have been compromised in highly-targeted attacks. The campaign follows a previous incident involving a security flaw in WhatsApp (CVE-2025-55177) and an Apple iOS bug (CVE-2025-43300), which were used in zero-click attacks. Apple has been sending these notifications since November 2021. Apple introduced Memory Integrity Enforcement (MIE) in the latest iPhone models to combat memory corruption vulnerabilities.

Open in new tab

Akira Ransomware Group Exploits SonicWall SSL VPN Flaws

The Akira ransomware group has been actively exploiting SonicWall SSL VPN flaws and misconfigurations to gain initial access to networks. This campaign has seen increased activity since late July 2025, targeting SonicWall devices to facilitate ransomware operations. The group leverages a combination of security vulnerabilities, including a year-old flaw (CVE-2024-40766) and misconfigured LDAP settings, to bypass access controls and infiltrate networks. Organizations are advised to rotate passwords, remove unused accounts, enable multi-factor authentication, and restrict access to the Virtual Office Portal to mitigate risks. The Australian Cyber Security Centre (ACSC) has acknowledged Akira's targeting of SonicWall SSL VPNs and issued alerts about the increased exploitation of CVE-2024-40766.

Open in new tab

Increased browser targeting by threat actors

Threat actors are increasingly targeting web browsers as a primary attack vector. This shift is driven by the browser's central role in accessing sensitive data and cloud applications, making it an attractive target for credential theft and session hijacking. High-profile incidents, such as the Snowflake breach, underscore the need for enhanced browser security measures. The browser's role in accessing sensitive data and cloud applications makes it a prime target for attackers. The Snowflake breach, which exploited stolen credentials, highlights the risks associated with browser-based attacks. Experts emphasize the need for stronger browser security to mitigate these threats. Browser-based attacks include phishing for credentials and sessions, malicious copy & paste (ClickFix), malicious OAuth integrations, malicious browser extensions, malicious file delivery, and exploiting stolen credentials and MFA gaps. These attacks exploit the browser's role in accessing business applications and data, making it crucial for security teams to focus on browser security.

Open in new tab

Microsoft September 2025 Patch Tuesday fixes 81 vulnerabilities, including two zero-days

Microsoft released updates for 80 vulnerabilities on September 2025 Patch Tuesday. None of these vulnerabilities were zero-days. The updates address eight critical flaws, including five remote code execution vulnerabilities, one information disclosure, and two elevation of privilege vulnerabilities. The vulnerabilities span various categories: 38 elevation of privilege, 2 security feature bypass, 22 remote code execution, 14 information disclosure, 3 denial of service, and 1 spoofing. One zero-day vulnerability was fixed in Windows SMB Server. The updates also include hardening features for SMB Server to mitigate relay attacks, with recommendations for administrators to enable auditing. The patch includes 38 elevation of privilege vulnerabilities, the highest number among all categories. CVE-2025-54918 is an EoP vulnerability in Windows NT LAN Manager (NTLM) marked as critical. CVE-2025-54111 and CVE-2025-54913 are EoP flaws in Windows UI XAML, allowing privilege escalation via phished credentials or malicious Microsoft Store apps. CVE-2025-55232 is an RCE vulnerability in the Microsoft High Performance Compute (HPC) Pack with a CVSS score of 9.8. CVE-2025-54916 is an RCE vulnerability in Windows NTFS that can be triggered by authenticated users. Microsoft's patch update includes recommendations for preparing for the end-of-life of Windows 10 and mandatory multifactor authentication (MFA) for Azure in October 2025.

Open in new tab