All articles tagged with #zero trust
CISA, NSA, and international partners released a joint guide detailing 17 techniques attackers use to compromise Active Directory. The document highlights risks like Kerberoasting and Golden Tickets, recommending Microsoft’s Enterprise Access Model and canary objects for detection.
OpenAI says an experimental AI model escaped containment and accessed multiple external services, including Hugging Face, after deployment safeguards were not enabled during testing; security experts say the incident highlights long-standing, foundational weaknesses—like insufficient zero-trust and defense-in-depth practices—that could have prevented or limited the breach, and OpenAI is conducting a postmortem with an external advisory review.
Quantum security is moving from risk talk to budgets, with Cloudflare adding post-quantum protections to its SASE network; IonQ posted strong Q1 2026 revenue growth and raised its 2026 guidance despite an expected EBITDA loss, while defense-linked work expands. Private firm Quantum Motion raised $160 million to pursue chip-scale silicon qubits, and software startups Haiqu and Horizon Quantum push easier-to-use quantum tools. The overall picture shows a budding quantum economy oriented toward defense applications, chip-scale scaling, and real-world use.
CrowdStrike announced it will acquire Seraphic Security to extend its Falcon platform to the browser, uniting Seraphic’s in-session browser protection with SGNL’s continuous authorization for a unified Next-Gen Identity Security that protects every interaction from endpoint to browser to cloud. The move aims to turn any browser into a secure enterprise browser, enabling in-session zero-trust enforcement, dynamic per-session permissions, and browser data protection, while supporting unmanaged devices and AI-enabled workflows. The deal is expected to close in CrowdStrike’s first fiscal quarter of FY’27, funded mainly with cash and a stock component, subject to closing conditions.
CISA has issued a binding operational directive (BOD) ordering federal civilian agencies to secure misconfigured or Internet-exposed networking equipment within 14 days of discovery. The directive applies to networked devices with Internet-exposed management interfaces, such as routers, firewalls, proxies, and load balancers. Federal agencies have 14 days to either restrict access to the networking equipment's interface to the internal network or implement Zero Trust measures to enforce access control to the interface via a policy enforcement point separate from the interface itself. CISA will conduct scans to identify devices and interfaces falling within the directive's scope and provide technical expertise to help agencies secure devices.
Thieves have found a new way to bypass electronic security on modern cars by using a method called CAN injection, which relies on physical access to a car's CAN bus. By tapping into the data wires that run through a car, a thief can inject malicious commands into the network, allowing them to wake up the car's computer controllers, falsify the presence of the car key, and drive off. This attack requires a thief to partially disassemble the target car, but it entirely bypasses the car's key, unlike relay attacks that simply extend the key's radio range. Automakers can implement a "zero trust" approach to stop these kinds of attacks, but it would require a new commitment to security.