News Feed

G2 Names INE 2025 Cybersecurity Training Leader

~ Reporter ~ Leave a comment

Cary, North Carolina, March 27th, 2025, CyberNewsWire

INE, a global leader in networking and cybersecurity training and certifications, is proud to announce it is the recipient of twelve badges in G2’s Spring 2025 Report, including Grid Leader for Cybersecurity Professional Development, Online Course Providers, and Technical Skills Development, which highlight INE’s superior performance relative to competitors. 

“INE solves the problem of accessible, hands-on security training with structured learning paths and real-world labs,” says SOC Analyst Sai Tharun K. “It helps bridge the gap between theory and practical skills. For me, it has been very valuable in refining my penetration testing, cloud security, and threat analysis skills.”

G2 calculates rankings using a proprietary algorithm sourced from verified reviews of actual product users and is a trusted review source for thousands of organizations around the world. Its recognition of INE’s strong performance in enterprise, small business, and global impact for technical training showcases the depth and breadth of INE’s online learning library. 

“We’re incredibly proud to once again be at the forefront of the training industry, recognized by G2 users in a time when cyber threats are escalating in both frequency and complexity,” said Dara Warn, CEO of INE. “This recognition reflects our commitment to providing training that not only keeps pace with but anticipates the dynamic intersection of cybersecurity with networking, cloud services, and broader IT disciplines. At INE, we believe deeply in equipping professionals and organizations with the robust, up-to-date skills necessary to navigate and secure today’s rapidly changing digital landscapes. A huge thank you to our dedicated team and learners, who are essential in our mission to transform cybersecurity training to meet the urgent demands of the current environment.”

INE’s G2 Spring 2025 Report highlights include:

  • Momentum Leader, Cybersecurity Professional Development
  • Momentum Leader, Online Course Providers
  • Momentum Leader, Technical Skills Development
  • Grid Leader, Cybersecurity Professional Development
  • Grid Leader, Online Course Providers
  • Grid Leader, Technical Skills Development
  • Regional Leader, Europe Online Course Providers
  • Regional Leader, Asia Online Course Providers
  • Regional Leader, Asia Pacific Online Course Providers
  • Grid Leader, Small-Business Technical Skills Development
  • Grid Leader, Small-Business Online Course Providers
  • High Performer, India Online Course Providers

“INE’s hands-on labs and real-world scenarios have helped me refine by skills,” said Leonard R.G., a Pentesting Consultant. “INE is solving the hiring issues most HR people have when they are hiring cybersecurity workers,” adds Batuhan A., a Cyber Security Researcher. 

In 2024, the prestigious SC Awards recognized INE Security, INE’s cybersecurity-specific training, as the Best IT Security-Related Training Program. This designation further underscores INE Security’s role as a frontrunner in cybersecurity training for businesses, providing the tools and knowledge essential for tackling today’s complex cyber threats.

INE Security was also presented with 4 awards from Global InfoSec Awards at RSAC 2024, including: 

  • Best Product – Cybersecurity Education for Enterprises
  • Most Innovative – Cybersecurity Education for SMBs
  • Publisher’s Choice – Cybersecurity Training
  • Cutting Edge – Cybersecurity Training Videos

Combined, these accolades highlight INE’s leadership in delivering innovative and effective networking and cybersecurity education across various market segments, including enterprises and small to medium-sized businesses.

About INE Security

INE Security is the premier provider of online networking and cybersecurity training and certification. Harnessing a powerful hands-on lab platform, cutting-edge technology, a global video distribution network, and world-class instructors, INE Security is the top training choice for Fortune 500 companies worldwide for cybersecurity training in business and for IT professionals looking to advance their careers. INE Security’s suite of learning paths offers an incomparable depth of expertise across cybersecurity and is committed to delivering advanced technical training while also lowering the barriers worldwide for those looking to enter and excel in an IT career.

Contact

Kathryn Brown
INE Security
kbrown@ine.com

The post G2 Names INE 2025 Cybersecurity Training Leader first appeared on Cybersecurity Insiders.

The post G2 Names INE 2025 Cybersecurity Training Leader appeared first on Cybersecurity Insiders.

from Cybersecurity Insiders https://ift.tt/7VtcaM0
via IFTTT

Firewall support for AWS Amplify hosted sites

~ Reporter ~ Leave a comment

Today, we’re announcing the general availability of the AWS WAF integration with AWS Amplify Hosting.

Web application owners are constantly working to protect their applications from a variety of threats. Previously, if you wanted to implement a robust security posture for your Amplify Hosted applications, you needed to create architectures using Amazon CloudFront distributions with AWS WAF protection, which required additional configuration steps, expertise, and management overhead.

With the general availability of AWS WAF in Amplify Hosting, you can now directly attach a web application firewall to your AWS Amplify apps through a one-click integration in the Amplify console or using infrastructure as code (IaC). This integration gives you access to the full range of AWS WAF capabilities including managed rules, which provide protection against common web exploits and vulnerabilities like SQL injection and cross-site scripting (XSS). You can also create your own custom rules based on your specific application needs.

This new capability helps you implement defense-in-depth security strategies for your web applications. You can take advantage of AWS WAF rate-based rules to protect against distributed denial of service (DDoS) attacks by limiting the rate of requests from IP addresses. Additionally, you can implement geo-blocking to restrict access to your applications from specific countries, which is particularly valuable if your service is designed for specific geographic regions.

Let’s see how it works
Setting up AWS WAF protection for your Amplify app is straightforward. From the Amplify console, navigate to your app settings, select the Firewall tab, and choose the predefined rules you want to apply to your configuration. AWS WAF integration in AWS Amplify Hosting

Amplify hosting simplifies configuring firewall rules. You can activate four categories of protection.

  • Amplify-recommended firewall protection – Protect against the most common vulnerabilities found in web applications, block IP addresses from potential threats based on Amazon internal threat intelligence, and protect against malicious actors discovering application vulnerabilities.
  • Restrict access to amplifyapp.com – Restrict access to the default Amplify generated amplifyapp.com domain. This is useful when you add a custom domain to prevent bots and search engines from crawling the domain.
  • Enable IP address protection – Restrict web traffic by allowing or blocking requests from specified IP address ranges.
  • Enable country protection – Restrict access based on specific countries.

Protections enabled through the Amplify console will create an underlying web access control list (ACL) in your AWS account. For fine-grained rulesets, you can use the AWS WAF console rule builder.

After a few minutes, the rules are associated to your app and AWS WAF blocks suspicious requests.

If you want to see AWS WAF in action, you can simulate an attack and monitor it using the AWS WAF request inspection capabilities. For example, you can send a request with an empty User-Agent value. It will trigger a blocking rule in AWS WAF.

Let’s first send a valid request to my app.

curl -v -H "User-Agent: MyUserAgent" https://main.d3sk5bt8rx6f9y.amplifyapp.com/
* Host main.d3sk5bt8rx6f9y.amplifyapp.com:443 was resolved.
...(redacted for brevity)...
> GET / HTTP/2
> Host: main.d3sk5bt8rx6f9y.amplifyapp.com
> Accept: */*
> User-Agent: MyUserAgent
> 
* Request completely sent off
< HTTP/2 200 
< content-type: text/html
< content-length: 0
< date: Mon, 10 Mar 2025 14:45:26 GMT

We can observe that the server returned an HTTP 200 (OK) message.

Then, send a request with no value associated to the User-Agent HTTP header.

 curl -v -H "User-Agent: " https://main.d3sk5bt8rx6f9y.amplifyapp.com/ 
* Host main.d3sk5bt8rx6f9y.amplifyapp.com:443 was resolved.
... (redacted for brevity) ...
> GET / HTTP/2
> Host: main.d3sk5bt8rx6f9y.amplifyapp.com
> Accept: */*
> 
* Request completely sent off
< HTTP/2 403 
< server: CloudFront
... (redacted for brevity) ...
<TITLE>ERROR: The request could not be satisfied</TITLE>
</HEAD><BODY>
<H1>403 ERROR</H1>
<H2>The request could not be satisfied.</H2>

We can observe that the server returned an HTTP 403 (Forbidden) message.

AWS WAF provide visibility into request patterns, helping you fine-tune your security settings over time. You can access logs through Amplify Hosting or the AWS WAF console to analyze traffic trends and refine security rules as needed.

AWS WAF integration in AWS Amplify Hosting - Dashboard

Availability and pricing
Firewall support is available in all AWS Regions in which Amplify Hosting operates. This integration falls under an AWS WAF global resource, similar to Amazon CloudFront. Web ACLs can be attached to multiple Amplify Hosting apps, but they must reside in the same Region.

The pricing for this integration follows the standard AWS WAF pricing model, You pay for the AWS WAF resources you use based on the number of web ACLs, rules, and requests. On top of that, AWS Amplify Hosting adds $15/month when you attach a web application firewall to your application. This is prorated by the hour.

This new capability brings enterprise-grade security features to all Amplify Hosting customers, from individual developers to large enterprises. You can now build, host, and protect your web applications within the same service, reducing the complexity of your architecture and streamlining your security management.

To learn more, visit the AWS WAF integration documentation for Amplify or try it directly in the Amplify console.

— seb

How is the News Blog doing? Take this 1 minute survey!

(This survey is hosted by an external company. AWS handles your information as described in the AWS Privacy Notice. AWS will own the data gathered via this survey and will not share the information collected with survey respondents.)

from AWS News Blog https://ift.tt/yQDZuAv
via IFTTT

Commerce limits 19 Chinese, Taiwanese companies from buying U.S. tech

~ Reporter ~ Leave a comment

The Commerce Department plans to finalize economic sanctions this week on nearly 20 Chinese and Taiwanese organizations, citing the need to limit their access to U.S. cloud, artificial intelligence and quantum computing technologies.

The sanctions, which will be detailed and published Friday in the Federal Register , would place additional license requirements on, and limit the availability of, license exceptions for exports, re-exports, and transfers of certain technologies to those entities.

Among the Trump administration’s stated goals for the sanctions are restricting the Chinese government from acquiring high-performance and exascale computing capabilities to build AI systems and quantum computers for military use.

“We will not allow adversaries to exploit American technology to bolster their own militaries and threaten American lives,” Commerce Secretary Howard Lutnick said in a statement. “We are committed to using every tool at the Department’s disposal to ensure our most advanced technologies stay out of the hands of those who seek to harm Americans.”

The newly added Chinese entities include the Beijing Academy of Artificial Intelligence and Beijing Innovation Wisdom Technology, for acquiring or attempting to acquire U.S. products for AI models, as well as advanced computing chips. Those efforts, the Commerce Department claims, are in support of the Chinese government’s larger military modernization goals.

Six Chinese and Taiwanese subsidiaries of Inspur Group, one of China’s largest cloud computing firms, were also placed on the sanctions list, citing their use of U.S. parts and components in the development of supercomputers for the Chinese military.

Four other Chinese firms — Henan Dingxin Information Industry, Nettrix Information Industry, Suma Technology and Suma-USI Electronics — were sanctioned for their alleged development of Chinese exascale supercomputers and providing manufacturing support for Sugan, a previously sanctioned Chinese entity.

The firms were all placed on the Bureau of Industry and Security’s export sanctions list for organizations engaged in “activities contrary to the national security or foreign policy interests” of the United States. The designation limits the ability of these companies to gain licenses to buy, import or otherwise legally acquire technologies from U.S. firms that may be used to power Beijing’s cloud, AI and quantum computing ambitions.

For certain entities, such as the Beijing Academy of Artificial Intelligence and Beijing Innovation Wisdom Technology, those license reviews will happen with a “policy of a presumption of denial.” For others, such as the firms working on exascale supercomputing, the reviews will be done under a “policy of denial.”

A separate Commerce action set to be finalized Friday places similar sanctions on an additional seven Chinese companies for their work developing quantum computing technologies. Those companies include Scikro (Hong Kong) Instruments, Scikro (Shanghai) Instrument, Anhui Kehua Sci-Tech Trading, Associated Optoelectronics, Chongqing Southwest Integrated Circuit Design, ORICAS Import and Export Corporation, and Physike Technology.

The sanctions are the latest example of bipartisan U.S. efforts to restrict or stop the flow of U.S. technologies and equipment — such as high-performance computing chips — that are foundational to a number of emerging technologies like AI and quantum computing. The Biden administration spent much of its last two years in office attempting to restrict the flow of semiconductors to China.

Previous attempts to restrict the supply of similar technologies to China have had mixed results. While conventional wisdom over the past year held that China was behind the U.S. in the global AI race, 2025 has seen multiple Chinese companies release large language models that are capable of performing as well as many of the top American-made models, in some cases with far more efficient computing and (allegedly) at a significantly cheaper cost.

China has also been steadily working to build up its own domestic industry for semiconductors and other key technologies, with the goal of weaning itself off dependence from U.S. firms.

“This is shocking to me, because I thought that the restrictions we placed on chips would keep them back,” former Google CEO Eric Schmidt said last November when discussing Chinese AI advancements over the past year and a half.

The post Commerce limits 19 Chinese, Taiwanese companies from buying U.S. tech appeared first on CyberScoop.

from CyberScoop https://ift.tt/YbehWAR
via IFTTT

String of defects in popular Kubernetes component puts 40% of cloud environments at risk

~ Reporter ~ Leave a comment

More than 40% of cloud environments are at risk of an account takeover due to a series of five recently discovered vulnerabilities — one regarded critical — in the Ingress Ngnix Controller for Kubernetes, according to security research published this week.

Upon discovering the string of vulnerabilities in one of most widely used ingress controllers for Kubernetes, Wiz researchers described the potential risk as an “IngressNightmare” in a blog post Monday. The most serious defect, an unauthenticated remote code execution vulnerability tracked as CVE-2025-1974, has a CVSS score of 9.8.

Security researchers told CyberScoop they aren’t aware of any active exploitation, but the risk for publicly exposed and unpatched Ingress Nginx controllers is extremely high. 

“The exploit chain is unauthenticated and a target is vulnerable in a default configuration,” Stephen Fewer, principal security researcher at Rapid7, said in an email. “With exploit code for CVE-2025-1974 starting to be published online, Kubernetes administrators should remediate publicly-exposed instances on an urgent basis.”

Ingress Nginx maintainers released patches for CVE-2025-1097, CVE-2025-1098, CVE-2025-1974, CVE-2025-24513 and CVE-2025-24514 on Monday. Wiz reported CVE-2025-1974 and CVE-2025-24514 to Kubernetes on Dec. 31, 2024. 

Attackers can exploit CVE-2025-1974 and achieve unauthenticated remote code execution by chaining it to one of three high-severity configuration injection vulnerabilities: CVE-2025-1097, CVE-2025-1098 or CVE-2025-24514.

Successful exploitation could allow attackers to access cluster-wide secrets, including passwords or tokens,  or completely take over a cluster, Fewer said. 

Researchers are especially concerned about the potential risk of exploitation because Ingress Nginx Controller is so widely used across Kubernetes environments. 

The open-source tool is deployed in more than 2 in 5 Kubernetes clusters, according to Tabitha Sable, co-chair of SIG Security and member of the Kubernetes Security Response Committee. 

“When combined with today’s other vulnerabilities, CVE-2025-1974 means that anything on the pod network has a good chance of taking over your Kubernetes cluster, with no credentials or administrative access required,” Sable said in a blog post Monday.

The pod network is typically accessible to all workloads in a virtual private cloud and anyone connected to the corporate network, Sable added. “This is a very serious situation.”

Wiz researchers said about 43% of cloud environments, spanning more than 6,500 Kubernetes clusters, including some used by Fortune 500 companies, were potentially at risk of exploitation Monday. Censys scans found about 5,000 publicly exposed and potentially vulnerable hosts Tuesday.

Several public proof-of-concept exploit scripts for the vulnerabilities have appeared online, Fewer said. 

“Due to the root cause of the vulnerabilities being logic-based issues, these vulnerabilities are both relatively simple to exploit, and exploitation is expected to be reliable,” Fewer said. 

“An attacker must first identify an accessible and vulnerable Ingress Nginx controller in a target Kubernetes cluster, along with the admission controller service belonging to that Ingress controller,” he added. “Once a viable target has been identified, the difficulty in exploiting the target will be low.”

The post String of defects in popular Kubernetes component puts 40% of cloud environments at risk appeared first on CyberScoop.

from CyberScoop https://ift.tt/7SK6iNf
via IFTTT

The Importance of Secure Data Management Tools in Higher Education (+ 6 Best-Value Tools for Universities)

~ Reporter ~ Leave a comment

As a cybersecurity professional, you must stay abreast of the latest resources that help users protect and work with information. Such offerings are critical for the higher-education industry, which stores data related to students’ academic achievements, health records, financial aid details and more.

How Do Data Management Tools Improve the Higher-Education Industry?

Data management tools bring together information from separate distributed databases, creating a single source of truth about everything happening on campus. Authorized users can retrieve information, run reports and keep the content in a single secure location. 

These purposeful data management tools allow administrators to set access parameters that only allow people to work with information related to their duties or roles — vital to ensure student and faculty records remain secure and protected from cyberattacks. As cybercrime continue to increase in the education sector — an alarming increase of 75% between 2020 and 2021 — the need for secure platforms across all aspects of university life is more prevalent than ever.

Some data management tools standardize the content, making it more user-friendly, accessible and reliable. These products keep all the relevant information in one place, streamlining cybersecurity efforts and saving people time by preventing them from needing to remember login details for several separate tools.

Who Offers the Best-Value Data Management Tools for Universities? 

Cybersecurity professionals may bear the responsibility of determining who offers cost-effective data management tools that still provide exceptional security, especially as they assist their employers in the higher-education industry with handling progressively larger amounts of data while following best practices to protect it. 

While going through this process, they should remember that value encompasses many aspects. Although a reasonable cost may indicate good value, so can excellent scalability because it allows users to continue using the same products over time, even as their needs grow. Similarly, people may establish that a particular option provides excellent value because it includes numerous automated features that save them time and increase. That said, there are some standout providers of data management tools that provide valuable products to clients in the higher-education industry that you should know about and consider. 

1. Watermark 

The professionals at Watermark have spent the last two decades developing data management solutions that give users more time to learn from higher-education information and spend less time gathering it. Watermark’s Educational Impact Suite is an integrated tool hub that shows users their data in context and helps them make informed, big-picture conclusions. It’s purpose-built for higher education, offering features and capabilities to 

Whether the information relates to student retention, faculty reviews or course evaluations, the company’s data management tools can handle all that content and more, helping users extract strategic insights that increase success for students and the entire institution. 

Capture information about the entire student learning journey and use rubric-based juried assessments to efficiently measure learners’ outcomes at scale. This data management tool is just as robust from the faculty side of things, allowing users to take and store educators’ information once and use it infinitely. 

When it’s time to examine trends from the latest batch of student evaluations, Watermark’s solutions make it easy to convert those takeaways into the next actionable steps. The LMS integrations increase response rates, and the deep insights let people track patterns over time. 

Since the company offers cloud-based tools, authorized users can access them from anywhere. That user-friendliness minimizes friction, helping people retrieve the information they want and need at any time. Cybersecurity professionals also appreciate how Watermark’s centralized system simplifies the data landscape, reducing the number of access points for malicious parties to exploit. Together, these aspects make this company a worthy possibility for those seeking the best-value data management platforms for their universities. 

2. Ellucian

Ellucian offers solutions that address how many higher-education institutions have massive amounts of data but cannot use it effectively. Most people would agree that a platform offers excellent value if it allows them to do things with their internal information that were otherwise extremely challenging or impossible. Ellucian’s data management and analytics solutions assist during every stage, whether users need to consolidate files or analyze trends to cause strategic impacts. 

An internal analysis can also examine an institution’s level of data maturity and how it compares to industry standards. The results may show users that they retain specific files for too long or otherwise need to consider changing their policies. The findings could also give cybersecurity professionals more leverage if they have been trying to convince organizational leaders to alter related internal practices but have yet to convince them it is time to act. 

The platform can also provide customized recommendations linked to your organizational structure and strategic aims. Additionally, the powerful analytics capabilities turn higher-education institutions into data-driven organizations that can make decisions based on options that account for all stakeholders, whether students, educators or administrators. 

Something that puts Ellucian among companies offering best-value data management tools is its flexible approach to pricing. These solutions work as modular offerings, so people can bundle them as a suite or choose individually priced components to create a platform that works with their budgets and other needs. 

3. Informatica

Informatica empowers higher-education institutions with a cloud-based data management platform that helps users see unified views of individual students’ information and how they have progressed through their learning journeys. The associated insights allow people to improve overall experiences and personalized aspects. Since the platform compiles the content into a single, reliable source, the centralization makes cybersecurity professionals’ jobs easier by reducing the size of the potential attack surface. 

This data management platform also helps users achieve and maintain regulatory compliance because its features maintain the security and privacy of sensitive student information while providing total visibility and transparency. There are also tools to automate privacy management workflows and requests, reducing the manual interventions that can cause people to make mistakes.

Since Informatica has capabilities that let people share data smoothly and safely, parties can collaborate more effectively across business entities. These solutions keep cybersecurity tight while reducing the friction that can result when people cannot quickly access the information needed to do their jobs. 

If you already use other educational systems, Informatica integrates smoothly with many of them, whether the products are learning management systems or enterprise resource planning tools. Since this data management platform can sync information across multiple systems, people can rest assured that it will enhance interoperability and maintain accuracy.

Additionally, the platform’s integrated tools emphasize data security and governance by enabling anonymization, consent management and other necessities that help institutions continue to operate securely in an increasingly digital world. 

4. Edify

Edify is a data management platform from EAB for the higher education industry.  This product provides powerful storage capabilities to match the large and growing quantities of information users often work with daily. Since this product offers a cloud-native and secure data lake and warehouse, it helps organizations prioritize scalability and privacy while maintaining easy access for authorized parties. These cybersecurity-centered characteristics assist people in upholding best practices while seamlessly retrieving the data needed for their jobs. 

Edify also comes with numerous data governance features, thanks to a transparent model built specifically for the higher-ed industry. Customizable data and metadata definitions are available out of the box to support better usability and organization. The platform’s recordkeeping features also track individual students across their whole learning experience, no matter how many times they advance to new levels or begin additional programs. 

The self-service analytics capabilities enhance organizational decision-making and unlock efficiencies. Built-in support for low-or-no-code data analysis and reporting enables people to get more done without additional training, while compatibility with numerous business intelligence tools lets users create valuable data visualizations to see information in the appropriate context. 

This is an enterprise-grade solution hosted on AWS. Securely storing data in the cloud enables more than 99.9% uptime, giving users the confidence needed to know Edify will support their productivity and let them get a handle on growing amounts of data.

5. Own

Own is a software-as-a-service data management tool made for the education industry. Since it is a Salesforce product, this offering has the brand recognition that can reassure people they are choosing a reputable option. This solution also has specific features that keep Salesforce data safe. Challenges related to data protection, compliance and continuity can result when educational institutions migrate to the cloud. However, Own enhances security capabilities, supporting cybersecurity professionals in meeting or exceeding organizational goals. 

For example, the platform has automated backup and recovery tools for Salesforce content, helping organizations resume normal operations after accidental or malicious data loss occurs. This data management solution also streamlines compliance with data regulations for higher-education institutions. It facilitates the secure archiving of sensitive data, ensuring users can meet security and governance requirements while retaining the information’s integrity. 

If an administrator plans to use data for testing and development purposes, Own has integrated masking capabilities that support innovation while upholding privacy. Additionally, customized data retention policies and in-depth reporting capabilities make audit preparations more straightforward. 

Own also allows users to fill development sandboxes with accurate data, minimizing delays related to rework or other challenges. The improved efficiency makes workers more productive, ensuring they spend more time on value-added tasks instead of grappling with data-management obstacles. 

6. Komprise

Poor management of a higher-education institution’s unstructured data can be a costly problem. However, Komprise offers purposeful tools that help users identify, manage and categorize the information possessed and used by these organizations. 

Since this platform offers storage-agnostic data management, people can index, search through and use information regardless of its location. Additionally, Komprise always references the target storage device and retains files in the native format, ensuring the information keeps its complete context for better usability. 

Komprise also gives people a global file index within minutes of deployment, showing a unified view of all an organization’s data across storage environments. Such information is valuable from a cybersecurity perspective because it reveals whether a higher-education institution may have sensitive information stored in a database with inadequate safeguards against breaches or attacks. That visibility could encourage people to make prompt and strategic decisions that improve cybersecurity preparedness for the long term.

Additionally, Komprise’s intelligent data management features let people create customized storage policies across a university, whether by department or user groups. The platform also shows access trends, facilitating better decision-making and ensuring people can quickly access information when needed. 

When it’s time to move data, the built-in migration tools make it simple. They shift the information without disrupting hot data, user experiences or applications. Because this feature supports transitions to more cost-effective cloud tools, people may determine that Komprise is the best-value data management tool for universities they’ve come across that aligns with their budgets. 

Choosing Data Management Tools to Increase Value in Higher Education

These feature-filled data management tools will help those working in higher education tap into numerous value streams, whether because they can work more productively, increase how data-driven insights shape student progress or save costs through better data visibility and compliance. 

Cybersecurity professionals should create a list of must-have features in their desired tools and then see how closely the above solutions align with those requirements. That goal-oriented process will support people as they data management platforms that enhance  their workflows and cause operational success.

The post The Importance of Secure Data Management Tools in Higher Education (+ 6 Best-Value Tools for Universities) first appeared on Cybersecurity Insiders.

The post The Importance of Secure Data Management Tools in Higher Education (+ 6 Best-Value Tools for Universities) appeared first on Cybersecurity Insiders.

from Cybersecurity Insiders https://ift.tt/dZhBT7P
via IFTTT

Quantum-Proofing Enterprise Security: The Clock is Ticking

~ Reporter ~ Leave a comment

Many experts believe that quantum computing will arrive in the next decade. The unparalleled processing capabilities of these computers hold promise for advances in material science, drug discovery, artificial intelligence, environmental science, and much more. While quantum computing opens up the potential for exciting breakthroughs across sectors, these computers also pose a significant threat to widely used cryptography currently securing billions of devices and more than 80% of communications over the global internet.

Cryptographic algorithms like RSA and ECC, which secure much of the world’s digital communication and data, are particularly vulnerable to quantum attacks. A cryptographically relevant quantum computer (CRQC) is powerful enough to crack these encryption algorithms, rendering these systems obsolete and putting the security, privacy, and availability of sensitive data at risk.

With commercially viable quantum computers on the horizon, it is critical for all organizations to take steps NOW to quantum-proof enterprise security by migrating to post-quantum cryptography (PQC). 

No time to waste

Gartner predicts that by 2029, advances in quantum computing will render applications, data and networks protected by asymmetric cryptography unsafe and by 2034, quantum computing technologies will be able to fully break this cryptography.

IT leaders understand they are staring down the barrel of quantum threats. According to a DigiCert report, these leaders expressed concern about the timeframes in which to prepare with 41% saying that their organizations have less than five years to get ready.

While CRQCs are not a reality right now, quantum threats are. 

Cybercriminals are executing “hack now, decrypt later” attacks to harvest sensitive communications and data, storing this information until they can decrypt it once quantum technology becomes accessible. 

This underscores the critical necessity for tech leaders to rapidly transition to quantum-safe cryptography to ensure the confidentiality and integrity of systems, applications, and business communication.

Stay ahead of quantum threats

Organizations must start integrating quantum-resistant algorithms into their technology stacks now. To prepare for a post-quantum world and create a quantum-resilient future for their organizations, IT leaders should take the following proactive steps in their migration to PQC:

•Audit cryptographic assets

Take inventory of existing encrypted assets to identify all systems and applications that rely on public key cryptography. A comprehensive cryptographic inventory should include communication channels, email systems, servers, databases, VPNs, and security tools.

•Develop a transition plan

Create a PQC transition plan that prioritizes the organization’s most critical assets. This plan should include timelines with clear deadlines and a list of resources required for the transition including human, financial, and technological. Some of the most vulnerable systems include communication networks or cloud servers that contain sensitive data such as customer information or proprietary data. These can prove valuable starting points when beginning a full transition. 

•Build crypto-agility 

As enterprises begin the migration to PQC, it is important to design systems with cryptographic flexibility to adapt to new standards as they emerge. Building crypto agility like this will ensure that enterprises are able to switch to updated cryptographic algorithms without major operational disruptions.

•Leverage NIST resources

To help enterprises protect against quantum threats, the U.S. Department of Commerce’s National Institute of Standards and Technology (NIST) released three PQC standards in August 2024. These standards provide a roadmap for securing a wide range of digital information including confidential business communication, e-commerce transactions, and more. NIST is encouraging IT administrators to start integrating these encryption standards into their systems immediately.

•Assess the supply chain

Organizations should contact their technology vendors to ask about their plans for transitioning to PQC. This discussion will help enterprises understand vendor quantum readiness and provide clarification on vendor plans and timelines for migrating to PQC.

•Make digital communication quantum-safe

With NetSfere’s mobile messaging platform, enterprises can ensure digital communication remains secure now and in the quantum era.

NetSfere’s industry leading post-quantum crypto-agile architecture sets a new standard for secure communications in the industry.

NetSfere is designed to meet future cryptographic challenges, in 2024 the company announced the integration of  NIST-recommended FIPS 203 ML-KEM with Kyber-1024 strength security.. This advanced post-quantum encryption ensures that NetSfere’s security remains resilient and robust, safeguarding enterprise data against the threats of today and the complex quantum threats of tomorrow.

Wrapping Up

It’s not a matter of if quantum threats will arrive, it is a matter of when. 

IT leaders must move PQC transition to the top of their priority lists to safeguard sensitive communication and data against quantum threats.

PwC noted that “by adopting quantum-resistant technologies, and fostering a culture of agility and preparedness, organizations can build the resilience necessary to safeguard their most essential assets. This isn’t just about a technological upgrade. It’s a strategic imperative for business survival.”

The clock is ticking. 

 

The post Quantum-Proofing Enterprise Security: The Clock is Ticking first appeared on Cybersecurity Insiders.

The post Quantum-Proofing Enterprise Security: The Clock is Ticking appeared first on Cybersecurity Insiders.

from Cybersecurity Insiders https://ift.tt/0Fj9pt3
via IFTTT

Detailed geographic information for all AWS Regions and Availability Zones is now available

~ Reporter ~ Leave a comment

Starting today, you can get more granular visibility of geographic location information for AWS Regions and AWS Availability Zones (AZs). This detailed information will help you choose the Regions and AZs that align with your regulatory, compliance, and operational requirements.

We continue to expand the AWS global infrastructure to meet your business requirements and now have 114 AZs across 36 Regions. We have announced plans to add 12 more AZs and four Regions in New Zealand, Kingdom of Saudi Arabia, Taiwan, and the AWS European Sovereign Cloud.

One of the things we’ve learned from our customers is the need to have more visibility into the specific location of infrastructure within an AWS Region. This is important for customers in highly regulated industries such as the financial industry or gaming, where there are specific requirements for the physical placement of infrastructure. For example, FanDuel, a leading sports gaming company based in the U.S., is scaling into new markets across the U.S. and Canada. They are taking advantage of the improved geographic transparency to make more informed decisions and ensure they’re meeting data residency requirements as they scale their business quickly.

Geographies for AWS Regions
To find the geographic information for your Region, you can visit the AWS Global Infrastructure Regions and Availability Zones page. Once you navigate to this page, you can choose any tab on the map and scroll to the bottom to review the geographic information for each Region. See the following image for an example showing the North America Regions. As would be expected, the infrastructure for the US West (Oregon) Region is located in the United States of America, and the Canada (Central) Region is located in Canada.

Geographies for Availability Zones
To find the specific geographic information for an AZ, you can visit the AWS Regions and Availability Zones page in AWS Documentation. Choose the Region you’re interested in and you’ll find a table showing you the geography for that Region. As you see in the following screenshot, the infrastructure of the AZ with AZ ID use1-az1 is located in Virginia, United States of America.

Geographies_AZs

Stay tuned
We will update these pages to reflect new geographic information as we continue to grow our AWS Global infrastructure footprint and add more AWS Regions and AZs.

Quick links
To learn more, visit the AWS Global Infrastructure Regions and Availability Zones page or AWS Regions and Availability Zones in AWS Documentation, and send feedback to AWS re:Post or through your usual AWS Support contacts.

– Prasad

How is the News Blog doing? Take this 1 minute survey!

(This survey is hosted by an external company. AWS handles your information as described in the AWS Privacy Notice. AWS will own the data gathered via this survey and will not share the information collected with survey respondents.)

from AWS News Blog https://ift.tt/jerxb2d
via IFTTT

AWS Weekly Roundup: Omdia recognition, Amazon Bedrock RAG evaluation, International Women’s Day events, and more (March 24, 2025)

~ Reporter ~ Leave a comment

As we celebrate International Women’s Day (IWD) this March, I had the privilege of attending the ‘Women in Tech’ User Group meetup in Shenzhen last weekend. I was inspired to see over 100 women in tech from different industries come together to discuss AI ethics from a female perspective. Together, we explored strategies such as reducing gender bias in AI systems and promoting diverse representation in model training data. In the AWS Cloud Lab, participants used Amazon Bedrock with large language models (LLMs) to generate rose bloom videos, which was the most popular part of this meetup.

These gatherings are crucial to our efforts to engage more women in AI technology exploration and development, and to help make sure that the generative AI era evolves without gender bias. The collaborative spirit and technical curiosity displayed throughout the event is further proof that diverse teams truly build inclusive and effective solutions.

Speaking of vibrant community engagement, I also had the honor of presenting at Kubernetes Community Day (KCD) Beijing 2025 this weekend. The enthusiasm Omdia Universe: Cloud Container Management & Services 2024-25 reportfor container technologies was remarkable, with nearly 300 developers gathering to share experiences and best practices. During my keynote introducing the DoEKS project from Amazon Web Services (AWS), I was struck by the depth of interest in managed Kubernetes services. The audience’s questions revealed how widely adopted services such as Amazon Elastic Kubernetes Service (Amazon EKS) and Amazon Elastic Container Service (Amazon ECS) have become among Chinese developers building mission-critical applications.This strong community interest aligns perfectly with findings from the Omdia Universe: Cloud Container Management & Services 2024–25 report. In this comprehensive evaluation of container management solutions hosted on public clouds, AWS was recognized as a Leader. The report specifically highlights that AWS offers “widest range of options for working with Kubernetes or its own container management service, across cloud, edge, and on-premises environments.” You can read the full report about AWS offerings to learn more about our comprehensive container portfolio and how we’re helping builders deploy scalable, reliable containerized applications.

Last Week’s launches

In addition to the inspiring community events, here are some AWS launches that caught my attention.

Amazon Q Business browser extension gets upgrades – The Amazon Q Business browser extension now features significant enhancements designed to streamline browser-based tasks. Users gain access to their company’s indexed knowledge alongside web content, direct PDF support within the browser, image file attachment capabilities, and controls to remove irrelevant attachments from conversation context. The expanded context window accommodates larger web pages and more detailed prompts, resulting in more helpful responses. For advanced needs, the extension offers seamless transition to the full Amazon Q Business web experience with access to Actions and Amazon Q Apps. Review the Enhancing web browsing with Amazon Q Business in the documentation for detailed setup instructions and feature descriptions to learn more about this announcement.

Amazon Bedrock RAG evaluation is now generally available – Offering comprehensive assessment of both Bedrock Knowledge Bases and custom Retrieval Augmented Generation (RAG) systems through LLM-as-a-judge methodology. The service evaluates retrieval quality and end-to-end generation with metrics for relevance, correctness, and hallucination detection, and the newly added support for custom RAG pipeline evaluations lets you bring your own input-output pairs and retrieved contexts directly into the evaluation job, along with new citation precision metrics and Amazon Bedrock Guardrails integration for more flexible RAG system optimization. To learn more, visit the Amazon Bedrock Evaluations page and What is Amazon Bedrock? in the documentation.

Amazon Nova expands Tool Choice options for Converse API – We’ve enhanced Amazon Nova with expanded Tool Choice capabilities for the Converse API, giving developers more flexibility in building sophisticated AI applications. This update allows models to determine when to use tools to fulfill user requests more effectively. Learn more in the announcement about expands Tool Choice options.

Amazon Bedrock Guardrails adds policy-based enforcement for responsible AI – Our builders can now enforce responsible AI policies at scale with Amazon Bedrock Guardrails’ new AWS Identity and Access Management (IAM) policy-based enforcement capabilities. This feature helps you to specify required guardrails through IAM policies using the bedrock:GuardrailIdentifiercondition key, so that all model inference calls comply with your organization’s AI safety standards. When your teams make Amazon Bedrock Invoke or Converse API calls, requests are automatically rejected if they don’t include the mandated guardrails, providing consistent protection against undesirable content, sensitive information exposure, and model hallucinations. Refer to the Set up permissions to use Guaidrails for content filtering in the technical documentation and the Amazon Bedrock Guardrails product page to learn more about the announcement about policy based enforcement for responsible AI.

Next generation of Amazon Connect released – We’ve launched the next generation of Amazon Connect, featuring AI-powered interactions designed to strengthen customer relationships and improve business outcomes. This major update brings enhanced agent experiences, smarter customer interactions, and deeper operational insights to contact centers of all sizes. Learn more from the new launch post in the AWS Contact Center Blog.

Amazon Redshift Serverless introduces Current and Trailing release tracks – Amazon Redshift Serverless now offers two release tracks to give users more control over their update cadence. The Current track delivers the most up-to-date certified release with the latest features and security updates, while the Trailing track remains on the previous certified release. This dual-track approach allows organizations to validate new releases on select workgroups before implementing them across production environments. Users can easily switch between tracks through the Amazon Redshift console, providing the flexibility to balance innovation with stability for mission-critical workloads. This capability is available in all AWS Regions where Amazon Redshift Serverless is offered. Refer to Tracks for Amazon Redshift provisioned cluster and serverless work groups to learn more about the Current and Trailing tracks in Amazon Redshift Serverless.

AWS WAF now supports URI fragment field matching – AWS WAF has expanded its capability to include URI fragment field matching, allowing security teams to create rules that inspect and match against the fragment portion of URLs. This enhancement enables more precise security controls for web applications that use URI fragments to identify specific sections within pages. Security professionals can now implement more targeted protections, such as restricting access to sensitive page elements, detecting suspicious navigation patterns, and enhancing bot mitigation by analyzing fragment usage patterns characteristic of automated attacks. This feature is available in all AWS Regions where AWS WAF is supported. For more information about URI field for matching, visit the AWS WAF Developer Guide.

For a full list of AWS announcements, be sure to keep an eye on the What’s New at AWS.

Other AWS news

Here are some other additional projects and blog posts that you might find interesting.

Build your generative AI skills at AWS Gen AI Lofts – AWS has established more than 10 global hubs offering training and networking for developers and startups in 2025, where you can gain practical, hands-on experience with the latest AI technologies. These revamped spaces feature dedicated zones where you can participate in workshops on prompt engineering, foundation model (FM) selection, and implementing AI in production environments. If you’re near San Francisco, New York, Tokyo, or other major tech hubs with AWS Gen AI Lofts, stop by to access these free resources and accelerate your generative AI development skills. Check out all of the AWS Gen AI Loft locations and events and to read 5 ways to build your AI skills on AWS Gen AI Loft to learn more.

AWS Lambda‘s architecture for billions of asynchronous invocations – A recent technical article reveals how AWS Lambda handles massive scale through sophisticated engineering approaches. The Lambda asynchronous invocation path employs multiple queuing strategies, consistent hashing for intelligent partitioning, and shuffle-sharding techniques to minimize noisy neighbor effects. The system relies on key observability metrics (AsyncEventReceived, AsyncEventAge, and AsyncEventDropped) to maintain optimal performance. These architectural decisions enable Lambda to process tens of trillions of monthly invocations across 1.5 million active customers while providing reliable scalability and performance isolation. For details read Handling billions of invocations – best practices from AWS Lambda in the AWS computing blog.

AWS is reducing prices by more than 11% for its high-memory U7i instances across all Regions and pricing models. The reduction applies to four instances: u7i-12tb.224xlarge, u7in-16tb.224xlarge, u7in-24tb.224xlarge, and u7in-32tb.224xlarge. The new On-Demand pricing, which covers shared, dedicated, and host tenancy options is retroactive, to March 1, 2025. For new Savings Plan purchases, pricing is effective immediately.

Create your AWS Builder ID and reserve your alias – Builder ID is a universal login credential that gives you access beyond the AWS Management Console to AWS tools and resources, including over 600 free training courses, community features, and developer tools such as Amazon Q Developer.

From community.aws
Here are some of my favorite posts from community.aws.

Model Context Protocol (MCP): why it matters – The recently introduced Model Context Protocol (MCP) creates a standardized way for AI applications to communicate with multiple FMs using consistent prompts and tools.

Build serverless GenAI Apps faster with Amazon Q Developer CLI agent – Discover how Amazon Q Developer CLI Agent revolutionizes cloud development by building a complete serverless generative AI application in minutes instead of days.

Automating code reviews with Amazon Q and GitHub actions – A new developer tutorial demonstrates how to integrate Amazon Q Developer with GitHub Actions to automatically analyze pull requests and provide AI-powered code feedback.

DeepSeek on AWS – A new technical guide demonstrates how to deploy DeepSeek’s powerful open-source AI models on AWS infrastructure. The tutorial provides step-by-step instructions for setting up these cutting-edge models using Amazon SageMaker, Amazon Elastic Compute Cloud (Amazon EC2) instances with GPUs, or through integration with Amazon Bedrock. The guide covers optimization techniques, sample applications, and best practices for balancing performance with cost efficiency.

Upcoming AWS events
Check your calendars and sign up for these upcoming AWS events.

Empowering Futures – Women Leading the Way in Tech and Non-Tech Careers – Whether you’re here to expand your professional circle, learn about the AWS Cloud or gain wisdom from inspiring speakers, this event has something for everyone. This is a public event open to everyone in the Seattle area—for free—on March 27, 2025.

AWS at KubeCon + CloudNativeCon London 2025 – Join us at KubeCon London on April 1 – April 4 , at Excel booth S300 for live product demonstrations that help you simplify Kubernetes operations, optimize costs and performance, harness the power of artificial learning and machine learning (AI/ML), and build scalable platform strategies.

That’s all for this week. Check back next Monday for another Weekly Roundup!

– Betty

This post is part of our Weekly Roundup series. Check back each week for a quick roundup of interesting news and announcements from AWS!

How is the News Blog doing? Take this 1 minute survey!

(This survey is hosted by an external company. AWS handles your information as described in the AWS Privacy Notice. AWS will own the data gathered via this survey and will not share the information collected with survey respondents.)

from AWS News Blog https://ift.tt/FDrHguL
via IFTTT

Oracle Cloud denies data breach claims of 6 million data files leak

~ Reporter ~ Leave a comment

Oracle Cloud, the tech giant that has recently found itself in the spotlight due to a series of allegations concerning a potential data leak of over 6 million files, has firmly rejected claims made by a hacker known as ‘rose87168’. In a statement released to the public, Oracle emphasized that it had conducted a thorough investigation into the matter and was issuing its response based on careful analysis and insights provided by its threat intelligence team.

The Alleged Data Breach

The controversy erupted last Thursday when the hacker using the pseudonym ‘rose87168’ claimed to have breached Oracle Cloud’s Federated Single Sign-On (SSO) Login Servers. The hacker even released a portion of the alleged stolen data, seemingly to demonstrate the authenticity of the breach. According to the hacker, the data contained sensitive information that could compromise the security of Oracle Cloud’s systems.

However, Oracle was quick to respond, and after scrutinizing the leaked data and running diagnostic checks through its automated intrusion detection systems, the company found no evidence to support the claims. In fact, after an in-depth investigation, it was confirmed that no breach had occurred and the so-called ‘leaked’ data was entirely fabricated.

Cybersecurity Challenges in the Digital Age

While the incident highlights a growing trend of cybercrime and misinformation, Oracle isn’t the only tech giant to face such claims. Over the years, many social media influencers, often masquerading as hackers, have used these kinds of allegations to generate buzz, attract followers, or push marketing agendas. These claims are frequently designed to create panic or controversy, without any real substance behind them. In the case of ‘rose87168’, the leaked files were found to be entirely unrelated to Oracle’s SSO credentials or any login information, further proving that the claims were baseless.

Oracle’s History with Cybersecurity and Attacks

Oracle’s reputation has, unfortunately, been marred by past cyberattack speculations. In recent years, the company has faced rumors of security vulnerabilities and even attacks targeting its WebLogic servers. Additionally, there have been accusations that its cloud services were being exploited for crypto-mining malware. Despite these allegations, Oracle has consistently worked to bolster its cybersecurity measures, particularly in its cloud and hybrid environments, which are updated regularly to keep pace with evolving threats.

The company has consistently demonstrated its commitment to protecting its infrastructure by applying the latest cybersecurity practices and leveraging its considerable resources. Similarly, other major companies like Amazon, Facebook, and Twitter face similar challenges in defending their consumer data from hackers. As these organizations operate across multiple sectors and regions, they are frequently targeted by cybercriminals.

The Importance of Ongoing Cybersecurity Vigilance

Although occasional cybersecurity incidents are nearly inevitable for large, multinational companies, it is critical for businesses like Oracle to address any potential weaknesses swiftly and decisively. A recurrence of such events, even if false or exaggerated, must be addressed promptly to maintain public trust and ensure that protective measures are always evolving to counteract the growing sophistication of cyber threats.

In conclusion, while this particular claim of a data breach involving Oracle Cloud has been proven false, the tech industry at large must remain vigilant against both genuine threats and deceptive attempts to exploit these fears for personal gain. As cybersecurity challenges continue to evolve, companies must be proactive and transparent in their efforts to safeguard their data and reassure customers that their systems remain secure.

The post Oracle Cloud denies data breach claims of 6 million data files leak first appeared on Cybersecurity Insiders.

The post Oracle Cloud denies data breach claims of 6 million data files leak appeared first on Cybersecurity Insiders.

from Cybersecurity Insiders https://ift.tt/4aX6ko5
via IFTTT